Fallos del tipo CWE-532

852 resultados

Informações sensíveis em arquivos de log

A aplicação registra dados sensíveis (senhas, tokens, chaves criptográficas, PII) em arquivos de log que acabam acessíveis a usuários não autorizados. Isso expõe credenciais e informações críticas sem necessidade, transformando o log em vetor de ataque.

Ejemplo

Um serviço de autenticação que escreve no log: 'Usuário admin logou com senha: senhaForte123!' ou uma API que registra tokens JWT completos em caso de erro. Se alguém tiver acesso ao arquivo de log (via LFI, backup exposto ou permissões fracas), captura as credenciais.

Cómo mitigar

Nunca registre dados sensíveis: máscare ou omita senhas, tokens e chaves. Se precisar logar para debug, use aliases/hashes e remova antes de produção. Restrinja acesso aos arquivos de log (permissões Unix, encriptação) e implemente rotação/limpeza automática de logs antigos.

CVE-2025-46432MEDIUMIn JetBrains TeamCity before 2025.03.1 base64-encoded credentials could be exposed in build logsEPSS 1.0%CVE-2021-22030—In versions of Greenplum database prior to 5.28.14 and 6.17.0, certain statements execution led to the storage of sensitive(credential) infoEPSS 1.0%CVE-2018-1072MEDIUMovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files. When engine-backup was run with one of tEPSS 1.0%CVE-2020-10712HIGHA flaw was found in OpenShift Container Platform version 4.1 and later. Sensitive information was found to be logged by the image registry oEPSS 1.0%CVE-2021-34800—Sensitive information could be loggedEPSS 1.0%CVE-2022-24875MEDIUMPotential Secrets being logged to disk in CVEProject/cve-servicesEPSS 1.0%CVE-2022-20768MEDIUMCisco TelePresence Collaboration Endpoint and RoomOS Software Information Disclosure VulnerabilityEPSS 1.0%CVE-2022-20807MEDIUMCisco Expressway Series and Cisco TelePresence Video Communication Server VulnerabilitiesEPSS 1.0%CVE-2024-29945HIGHSplunk Authentication Token Exposure in Debug Log in Splunk EnterpriseEPSS 0.9%CVE-2022-20806MEDIUMCisco Expressway Series and Cisco TelePresence Video Communication Server VulnerabilitiesEPSS 0.9%CVE-2020-5389CRITICALDell EMC OpenManage Integration for Microsoft System Center (OMIMSSC) for SCCM and SCVMM versions prior to 7.2.1 contain an information discEPSS 0.9%CVE-2022-20809MEDIUMCisco Expressway Series and Cisco TelePresence Video Communication Server VulnerabilitiesEPSS 0.9%CVE-2025-21319MEDIUMWindows Kernel Memory Information Disclosure VulnerabilityEPSS 0.9%CVE-2025-21320MEDIUMWindows Kernel Memory Information Disclosure VulnerabilityEPSS 0.9%CVE-2025-21321MEDIUMWindows Kernel Memory Information Disclosure VulnerabilityEPSS 0.9%CVE-2025-21316MEDIUMWindows Kernel Memory Information Disclosure VulnerabilityEPSS 0.9%CVE-2025-21318MEDIUMWindows Kernel Memory Information Disclosure VulnerabilityEPSS 0.9%CVE-2026-54236MEDIUMvLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic routerEPSS 0.9%CVE-2021-36544HIGHIncorrect Access Control issue discovered in tpcms 3.2 allows remote attackers to view sensitive information via path in application URL.EPSS 0.9%CVE-2021-27022—A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those sensitive parameters being loggEPSS 0.9%