Weaknesses of type CWE-532

858 results

Exposição de Informações Sensíveis em Logs

Aplicações registram dados confidenciais (senhas, tokens, chaves de API, números de cartão) em arquivos de log que ficam acessíveis a usuários não autorizados ou são capturados em backups, análises e monitoramento. Esse registro desprotegido transforma logs em porta de entrada para comprometimento de credenciais e dados pessoais.

Example

Um sistema web que loga tentativas de autenticação incluindo username e senha em texto plano em /var/log/app.log, ou uma API que registra o token JWT completo em logs estruturados que acabam replicados em servidores de análise compartilhados com múltiplos times.

How to mitigate

Implemente um filtro de sanitização que mascara ou remove dados sensíveis antes de gravar em logs (senhas, tokens, PII). Restrinja acesso a arquivos de log apenas a usuários autorizados e implemente rotação de logs com criptografia de arquivos históricos. Revise periodicamente o que está sendo logado em produção.

CVE-2025-36050MEDIUMIBM QRadar SIEM information disclosureEPSS 0.2%CVE-2026-20165MEDIUMSensitive Information Disclosure in MongoClient logging channel in Splunk EnterpriseEPSS 0.2%CVE-2025-49009MEDIUMPara Inserts Sensitive Information into Log File for Facebook authenticationEPSS 0.2%CVE-2025-48955MEDIUMPara Server Logs Sensitive InformationEPSS 0.2%CVE-2023-6833MEDIUMInformation Exposure Vulnerability in Hitachi Ops Center AdministratorEPSS 0.2%CVE-2023-27502LOWInsertion of sensitive information into log file for some Intel(R) Local Manageability Service software before version 2316.5.1.2 may allow EPSS 0.2%CVE-2026-44969LOWdbt-mcp: Tool Arguments Including SQL Queries and Credentials Logged in Plaintext Without Redaction When File Logging Is EnabledEPSS 0.2%CVE-2024-0912HIGHCCURE passwords exposed to administratorsEPSS 0.2%CVE-2023-30430MEDIUMIBM Security Verify Access information disclosureEPSS 0.2%CVE-2024-40096LOWThe com.cascadialabs.who (aka Who - Caller ID, Spam Block) application 15.0 for Android places sensitive information in the system log.EPSS 0.2%CVE-2024-40679MEDIUMIBM Db2 information disclosureEPSS 0.2%CVE-2026-28868MEDIUMA logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, mEPSS 0.2%CVE-2023-25604MEDIUMAn insertion of sensitive information into log file vulnerability in Fortinet FortiGuest 1.0.0 allows a local attacker to access plaintext pEPSS 0.2%CVE-2026-0637MEDIUMSensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 ProductsEPSS 0.2%CVE-2025-2002MEDIUMCWE-532: Insertion of Sensitive Information into Log Files vulnerability exists that could cause the disclosure of FTP server credentials whEPSS 0.2%CVE-2026-44479MEDIUMVercel: Non-interactive mode includes CLI arguments in suggested command outputEPSS 0.2%CVE-2026-41004MEDIUMWhen enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. Spring Cloud Config 3.EPSS 0.2%CVE-2023-3335MEDIUMInformation Exposure Vulnerability in Hitachi Ops Center AdministratorEPSS 0.2%CVE-2025-23413MEDIUMBIG-IP Next Central Manager vulnerabilityEPSS 0.2%CVE-2026-55102MEDIUMhashi-vault-js: Vault token and secret values exposed in thrown errorsEPSS 0.2%