Weaknesses of type CWE-532

858 results

Exposição de Informações Sensíveis em Logs

Aplicações registram dados confidenciais (senhas, tokens, chaves de API, números de cartão) em arquivos de log que ficam acessíveis a usuários não autorizados ou são capturados em backups, análises e monitoramento. Esse registro desprotegido transforma logs em porta de entrada para comprometimento de credenciais e dados pessoais.

Example

Um sistema web que loga tentativas de autenticação incluindo username e senha em texto plano em /var/log/app.log, ou uma API que registra o token JWT completo em logs estruturados que acabam replicados em servidores de análise compartilhados com múltiplos times.

How to mitigate

Implemente um filtro de sanitização que mascara ou remove dados sensíveis antes de gravar em logs (senhas, tokens, PII). Restrinja acesso a arquivos de log apenas a usuários autorizados e implemente rotação de logs com criptografia de arquivos históricos. Revise periodicamente o que está sendo logado em produção.

CVE-2021-3032MEDIUMPAN-OS: Configuration secrets for log forwarding may be logged in system logsEPSS 0.2%CVE-2024-11923MEDIUMSensitive Information Disclosure in Fortra Application Hub Prior to version 1.3EPSS 0.2%CVE-2024-45091MEDIUMIBM UrbanCode Deploy information disclosureEPSS 0.2%CVE-2024-22276MEDIUMVMware Cloud Director Object Storage Extension contains an Insertion of Sensitive Information vulnerability. A malicious actor with adjaceEPSS 0.2%CVE-2022-27893MEDIUMThe Foundry Magritte plugin osisoft-pi-web-connector was found to be logging in a manner that captured authentication requests.EPSS 0.2%CVE-2024-49750MEDIUMSnowflake Connector for Python has sensitive data in logsEPSS 0.2%CVE-2025-46808MEDIUMSensitive information is leaked into NeuVector’s manager container logsEPSS 0.2%CVE-2024-54519MEDIUMThe issue was resolved by sanitizing logging. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2. An app may be able to read senEPSS 0.2%CVE-2025-24034LOWHimmelblau leaks credentials in the debug logEPSS 0.2%CVE-2024-41129MEDIUMThe ops library leaks secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI commandEPSS 0.2%CVE-2023-29002HIGHDebug mode leaks confidential data in CiliumEPSS 0.2%CVE-2025-24884MEDIUMkube-audit-rest's example logging configuration could disclose secret values in the audit logEPSS 0.2%CVE-2025-22246LOWCVE-2025-22246 – UAA Private Key ExposureEPSS 0.2%CVE-2024-22336MEDIUMIBM QRadar Suite information disclosureEPSS 0.2%CVE-2026-75485MEDIUMMust-gather: /tmp/kubeconfig retentionEPSS 0.2%CVE-2026-27315MEDIUMApache Cassandra: cqlsh history sensitive information leakEPSS 0.2%CVE-2026-81870LOWOpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logsEPSS 0.2%CVE-2026-81320MEDIUMHawtio-operator: hawtio-operator: tls private key written to operator log at debug levelEPSS 0.2%CVE-2024-34353MEDIUMmatrix-sdk-crypto contains a log exposure of private key of the server-side key backupEPSS 0.2%CVE-2025-7445MEDIUMKubernetes secrets-store-sync-controller discloses service account tokens in logsEPSS 0.2%