Falhas do tipo CWE-532

941 resultados

Informações sensíveis em arquivos de log

A aplicação registra dados confidenciais (senhas, tokens, PII, chaves criptográficas) em arquivos de log sem proteção adequada. Esses logs são frequentemente legíveis por outros usuários do sistema, backups desprotegidos ou ferramentas de análise, expondo segredos de negócio e credenciais de autenticação.

Exemplo

Uma API registra a requisição HTTP completa incluindo o header `Authorization: Bearer eyJhbGc...`, ou um serviço de login escreve a senha do usuário em log de debug antes de validá-la. Um atacante com acesso ao servidor (ou backups antigos) lê esses logs e obtém credenciais válidas.

Como mitigar

Nunca registre senhas, tokens, chaves, CPF ou dados de cartão. Use máscaras (ex: `token=***`) para valores sensíveis que precisam ser logados. Restrinja permissões de acesso aos arquivos de log e aplique rotação com limpeza segura de logs antigos. Implemente revisão de código e linters para detectar padrões suspeitos.

CVE-2026-119290HIGHZuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow runEPSS 0.5%CVE-2026-65311MEDIUMMissing authentication for logging-configuration endpointEPSS 0.5%CVE-2024-47913MEDIUMAn issue was discovered in the AbuseFilter extension for MediaWiki before 1.39.9, 1.40.x and 1.41.x before 1.41.3, and 1.42.x before 1.42.2.EPSS 0.5%CVE-2026-46514MEDIUMFrogman: Plaintext passwords and secrets persisted to audit logEPSS 0.5%CVE-2026-14528HIGHIBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive informationEPSS 0.5%CVE-2023-49921MEDIUMAn issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw cEPSS 0.4%CVE-2026-55785LOWfree5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKAEPSS 0.4%CVE-2024-30523MEDIUMWordPress Paid Memberships Pro – Mailchimp Add On plugin <= 2.3.4 - Sensitive Data Exposure vulnerabilityEPSS 0.4%CVE-2024-32686MEDIUMWordPress Backup Migration plugin <= 1.4.3 - Sensitive Data Exposure via Log vulnerabilityEPSS 0.4%CVE-2025-27391MEDIUMApache ActiveMQ Artemis: Passwords leaking from broker properties in the debug logEPSS 0.4%CVE-2024-22138MEDIUMWordPress Seraphinite Accelerator plugin <= 2.20.47 - Sensitive Data Exposure via Log File vulnerabilityEPSS 0.4%CVE-2024-37205MEDIUMWordPress affiliate-toolkit plugin <= 3.4.4 - Sensitive Data Exposure via Log File vulnerabilityEPSS 0.4%CVE-2024-22339MEDIUMIBM UrbanCode Deploy information disclosureEPSS 0.4%CVE-2024-25923MEDIUMWordPress Community by PeepSo plugin <= 6.2.7.0 - Sensitive Data Exposure via Log File vulnerabilityEPSS 0.4%CVE-2024-33922MEDIUMWordPress WP Media Cleaner plugin <= 6.7.2 - Sensitive Data Exposure via Log File vulnerabilityEPSS 0.4%CVE-2024-32513MEDIUMWordPress Product Feed PRO for WooCommerce plugin <= 13.3.1 - Sensitive Data Exposure vulnerabilityEPSS 0.4%CVE-2017-2592MEDIUMpython-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError classEPSS 0.4%CVE-2024-23760LOWCleartext Storage of Sensitive Information in Gambio 4.9.2.0 allows attackers to obtain sensitive information via error-handler.log.json andEPSS 0.4%CVE-2022-44587MEDIUMWordPress WP 2FA plugin <= 2.6.3 - Sensitive Data Exposure via Log File vulnerabilityEPSS 0.4%CVE-2024-36127HIGHapko Exposure of HTTP basic auth credentials in log outputEPSS 0.4%