Fallos del tipo CWE-532

852 resultados

Informações sensíveis em arquivos de log

A aplicação registra dados sensíveis (senhas, tokens, chaves criptográficas, PII) em arquivos de log que acabam acessíveis a usuários não autorizados. Isso expõe credenciais e informações críticas sem necessidade, transformando o log em vetor de ataque.

Ejemplo

Um serviço de autenticação que escreve no log: 'Usuário admin logou com senha: senhaForte123!' ou uma API que registra tokens JWT completos em caso de erro. Se alguém tiver acesso ao arquivo de log (via LFI, backup exposto ou permissões fracas), captura as credenciais.

Cómo mitigar

Nunca registre dados sensíveis: máscare ou omita senhas, tokens e chaves. Se precisar logar para debug, use aliases/hashes e remova antes de produção. Restrinja acesso aos arquivos de log (permissões Unix, encriptação) e implemente rotação/limpeza automática de logs antigos.

CVE-2024-27097MEDIUMPotential log injection in reset user endpoint in ckanEPSS 0.4%CVE-2024-27156MEDIUMLeak of authentication sessions in secure logsEPSS 0.4%CVE-2024-27157MEDIUMLeak of authentication sessions in secure logsEPSS 0.4%CVE-2026-32218MEDIUMWindows Kernel Information Disclosure VulnerabilityEPSS 0.4%CVE-2023-52146MEDIUMWordPress 404 Solution Plugin <= 2.33.0 is vulnerable to Sensitive Data ExposureEPSS 0.4%CVE-2026-23493HIGHPimcore ENV Variables and Cookie Informations are exposed in http_error_logEPSS 0.4%CVE-2022-38133LOWIn JetBrains TeamCity before 2022.04.3 the private SSH key could be written to the server log in some casesEPSS 0.4%CVE-2025-32054LOWIn JetBrains IntelliJ IDEA before 2024.3, 2024.2.4 source code could be logged in the idea.log fileEPSS 0.4%CVE-2024-22440MEDIUMHPE Compute Scale-up Server 3200 Server, Disclosure of Sensitive InformationEPSS 0.4%CVE-2026-22098CRITICALSensitive information is written to logsEPSS 0.4%CVE-2020-10750HIGHSensitive information written to a log file vulnerability was found in jaegertracing/jaeger before version 1.18.1 when the Kafka data store EPSS 0.4%CVE-2025-27391MEDIUMApache ActiveMQ Artemis: Passwords leaking from broker properties in the debug logEPSS 0.4%CVE-2018-20105MEDIUMyast2-rmt exposes CA private key passhrase in log-fileEPSS 0.4%CVE-2019-14858HIGHA vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub paramEPSS 0.4%CVE-2022-20651MEDIUMCisco Adaptive Security Device Manager Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-32215MEDIUMWindows Kernel Information Disclosure VulnerabilityEPSS 0.4%CVE-2021-3791MEDIUMAn information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an unauthenticated atEPSS 0.4%CVE-2024-25095HIGHWordPress Easy Forms for Mailchimp plugin <= 6.9.0 - Sensitive Data Exposure via Log File vulnerabilityEPSS 0.4%CVE-2026-32217MEDIUMWindows Kernel Information Disclosure VulnerabilityEPSS 0.4%CVE-2020-10763—An information-disclosure flaw was found in the way Heketi before 10.1.0 logs sensitive information. This flaw allows an attacker with localEPSS 0.4%