Fallos del tipo CWE-532

852 resultados

Informações sensíveis em arquivos de log

A aplicação registra dados sensíveis (senhas, tokens, chaves criptográficas, PII) em arquivos de log que acabam acessíveis a usuários não autorizados. Isso expõe credenciais e informações críticas sem necessidade, transformando o log em vetor de ataque.

Ejemplo

Um serviço de autenticação que escreve no log: 'Usuário admin logou com senha: senhaForte123!' ou uma API que registra tokens JWT completos em caso de erro. Se alguém tiver acesso ao arquivo de log (via LFI, backup exposto ou permissões fracas), captura as credenciais.

Cómo mitigar

Nunca registre dados sensíveis: máscare ou omita senhas, tokens e chaves. Se precisar logar para debug, use aliases/hashes e remova antes de produção. Restrinja acesso aos arquivos de log (permissões Unix, encriptação) e implemente rotação/limpeza automática de logs antigos.

CVE-2023-46672HIGHLogstash Insertion of Sensitive Information into Log FileEPSS 0.3%CVE-2024-28830LOWAutomation user secrets written to audit logEPSS 0.3%CVE-2019-0021HIGHJuniper ATP: secret CLI inputs are logged to /var/log/syslog in clear textEPSS 0.3%CVE-2025-13925MEDIUMMultiple vulnerabilities in IBM Aspera ConsoleEPSS 0.3%CVE-2021-3447—A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on maEPSS 0.3%CVE-2024-40596MEDIUMAn issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. The Special:Investigate feature can expose suppressed inforEPSS 0.3%CVE-2024-40598MEDIUMAn issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. The API can expose suppressed information for log events. (EPSS 0.3%CVE-2024-38460MEDIUMIn SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially exposed in cleartexEPSS 0.3%CVE-2025-62705MEDIUMOpenBao and Vault Leak []byte Fields in Audit LogsEPSS 0.3%CVE-2019-0004HIGHJuniper ATP: API and device keys are logged in a world-readable permissions fileEPSS 0.3%CVE-2026-23775HIGHDell PowerProtect Data Domain appliances with Data Domain Operating System (DD OS) of Feature Release versions 8.0 through 8.5, LTS2025 releEPSS 0.3%CVE-2026-20138MEDIUMSensitive Information Disclosure in "_internal" index in Splunk EnterpriseEPSS 0.3%CVE-2025-10486MEDIUMContent Writer <= 3.6.8 - Unauthenticated Information Exposure via Log FileEPSS 0.3%CVE-2026-20142MEDIUMSensitive Information Disclosure in "_internal" index in Splunk EnterpriseEPSS 0.3%CVE-2026-85171HIGHn8n before 1.123.73 Credential Exposure via Error LoggingEPSS 0.3%CVE-2024-11193MEDIUMAn information disclosure vulnerability exists in Yugabyte Anywhere, where the LDAP bind password is logged in plaintext within application EPSS 0.3%CVE-2019-3763HIGHThe RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain an information eEPSS 0.3%CVE-2026-49088MEDIUMInsertion of Sensitive Information into Log File in Kibana Leading to Information DisclosureEPSS 0.3%CVE-2026-41185MEDIUMServiceAccount token disclosure via Azure IPAM CNI plugin logsEPSS 0.3%CVE-2024-23210LOWThis issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.EPSS 0.3%