Weaknesses of type CWE-532

858 results

Exposição de Informações Sensíveis em Logs

Aplicações registram dados confidenciais (senhas, tokens, chaves de API, números de cartão) em arquivos de log que ficam acessíveis a usuários não autorizados ou são capturados em backups, análises e monitoramento. Esse registro desprotegido transforma logs em porta de entrada para comprometimento de credenciais e dados pessoais.

Example

Um sistema web que loga tentativas de autenticação incluindo username e senha em texto plano em /var/log/app.log, ou uma API que registra o token JWT completo em logs estruturados que acabam replicados em servidores de análise compartilhados com múltiplos times.

How to mitigate

Implemente um filtro de sanitização que mascara ou remove dados sensíveis antes de gravar em logs (senhas, tokens, PII). Restrinja acesso a arquivos de log apenas a usuários autorizados e implemente rotação de logs com criptografia de arquivos históricos. Revise periodicamente o que está sendo logado em produção.

CVE-2026-82723LOWActor record with password digest stored in AshAuthentication audit log entriesEPSS 0.2%CVE-2022-27599MEDIUMQVR Pro ClientEPSS 0.2%CVE-2025-43485MEDIUMPoly Clariti Manager - Multiple Security VulnerabilitiesEPSS 0.2%CVE-2023-22572HIGH Dell PowerScale OneFS 9.1.0.x-9.4.0.x contain an insertion of sensitive information into log file vulnerability in change password api. A lEPSS 0.2%CVE-2024-8264MEDIUMSensitive information in agent log file when detailed logging is enabled with Robot Schedule Enterprise prior to version 3.05EPSS 0.2%CVE-2025-43517LOWA privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.7.3, macOS SonomEPSS 0.2%CVE-2023-40682MEDIUMIBM App Connect Enterprise information disclosureEPSS 0.2%CVE-2026-20668MEDIUMA logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.3 and iPadOS 26.3, mEPSS 0.2%CVE-2022-39876MEDIUMInsertion of Sensitive Information into Log in PushRegIdUpdateClient of SReminder prior to 8.2.01.13 allows attacker to access device IMEI.EPSS 0.2%CVE-2022-41553MEDIUMInformation Exposure Vulnerability in Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center AnalyzerEPSS 0.2%CVE-2025-53885MEDIUMDirectus doesn't redact sensitive user data when logging via event hooksEPSS 0.2%CVE-2022-35719MEDIUMIBM MQ Internet Pass-Thru 2.1, 9.2 LTS and 9.2 CD stores potentially sensitive information in trace files that could be read by a local userEPSS 0.2%CVE-2023-39447MEDIUMBIG-IP APM Guided Configuration vulnerabilityEPSS 0.2%CVE-2026-22798MEDIUMhermes's raw options logging may disclose secrets passed in via subcommand options argumentEPSS 0.2%CVE-2024-27849LOWA privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15. An app may be aEPSS 0.2%CVE-2025-1998MEDIUMIBM UrbanCode Deploy (UCD) / IBM DevOps Deploy information disclosureEPSS 0.2%CVE-2025-48374MEDIUMzot logs secretsEPSS 0.2%CVE-2019-25683MEDIUMFileZilla 3.40.0 Denial of Service via Local SearchEPSS 0.2%CVE-2026-28923HIGHA logging issue was addressed with improved data redaction. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26EPSS 0.2%CVE-2022-3191MEDIUMInformation Exposure Vulnerability in Hitachi Ops Center AnalyzerEPSS 0.2%