Weaknesses of type CWE-532

852 results

Exposição de Informações Sensíveis em Logs

Aplicações registram dados confidenciais (senhas, tokens, chaves de API, números de cartão) em arquivos de log que ficam acessíveis a usuários não autorizados ou são capturados em backups, análises e monitoramento. Esse registro desprotegido transforma logs em porta de entrada para comprometimento de credenciais e dados pessoais.

Example

Um sistema web que loga tentativas de autenticação incluindo username e senha em texto plano em /var/log/app.log, ou uma API que registra o token JWT completo em logs estruturados que acabam replicados em servidores de análise compartilhados com múltiplos times.

How to mitigate

Implemente um filtro de sanitização que mascara ou remove dados sensíveis antes de gravar em logs (senhas, tokens, PII). Restrinja acesso a arquivos de log apenas a usuários autorizados e implemente rotação de logs com criptografia de arquivos históricos. Revise periodicamente o que está sendo logado em produção.

CVE-2021-1226MEDIUMCisco Unified Communications Products Information Disclosure VulnerabilityEPSS 0.9%CVE-2017-9278LOWAvoid password disclosure via EBS event logging in the iManager Oracle driverEPSS 0.9%CVE-2026-25846MEDIUMIn JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logsEPSS 0.9%CVE-2023-50740MEDIUMApache Linkis DataSource: DataSource module Oracle SQL Database Password LoggedEPSS 0.9%CVE-2018-16856MEDIUMIn a default Red Hat Openstack Platform Director installation, openstack-octavia before versions openstack-octavia 2.0.2-5 and openstack-octEPSS 0.9%CVE-2021-37861MEDIUMMattermost 6.0.2 and earlier fails to sufficiently sanitize user's password in audit logs when user creation fails.EPSS 0.9%CVE-2025-21317MEDIUMWindows Kernel Memory Information Disclosure VulnerabilityEPSS 0.9%CVE-2025-21323MEDIUMWindows Kernel Memory Information Disclosure VulnerabilityEPSS 0.9%CVE-2022-38756MEDIUMCVE-2022-38756 vulnerability in GW Web prior to 18.4.2EPSS 0.8%CVE-2023-25163MEDIUMArgo CD leaks repository credentials in user-facing error messages and in logsEPSS 0.8%CVE-2024-31391MEDIUMApache Solr Operator: Solr-Operator liveness and readiness probes may leak basic auth credentialsEPSS 0.8%CVE-2017-7434LOWNetIQ Identity Manager JDBC driver could leak passwords in exception tracesEPSS 0.8%CVE-2022-3499MEDIUMAn authenticated attacker could utilize the identical agent and cluster node linking keys to potentially allow for a scenario where unauthorEPSS 0.8%CVE-2021-32767MEDIUMInformation Disclosure in User AuthenticationEPSS 0.8%CVE-2022-32254MEDIUMA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). A customized HTTP POST request could force the apEPSS 0.8%CVE-2022-23715—A flaw was discovered in ECE before 3.4.0 that might lead to the disclosure of sensitive information such as user passwords and ElasticsearcEPSS 0.8%CVE-2022-31119LOWPassword disclosure in log file in Nextcloud Mail AppEPSS 0.8%CVE-2023-24827MEDIUMCredential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set in syftEPSS 0.8%CVE-2018-19014—Drager Infinity Delta, Infinity Delta, all versions, Delta XL, all versions, Kappa, all version, and Infinity Explorer C700, all versions. LEPSS 0.8%CVE-2023-22362HIGHSUSHIRO App for Android outputs sensitive information to the log file, which may result in an attacker obtaining a credential information frEPSS 0.8%