Falhas do tipo CWE-532

941 resultados

Informações sensíveis em arquivos de log

A aplicação registra dados confidenciais (senhas, tokens, PII, chaves criptográficas) em arquivos de log sem proteção adequada. Esses logs são frequentemente legíveis por outros usuários do sistema, backups desprotegidos ou ferramentas de análise, expondo segredos de negócio e credenciais de autenticação.

Exemplo

Uma API registra a requisição HTTP completa incluindo o header `Authorization: Bearer eyJhbGc...`, ou um serviço de login escreve a senha do usuário em log de debug antes de validá-la. Um atacante com acesso ao servidor (ou backups antigos) lê esses logs e obtém credenciais válidas.

Como mitigar

Nunca registre senhas, tokens, chaves, CPF ou dados de cartão. Use máscaras (ex: `token=***`) para valores sensíveis que precisam ser logados. Restrinja permissões de acesso aos arquivos de log e aplique rotação com limpeza segura de logs antigos. Implemente revisão de código e linters para detectar padrões suspeitos.

CVE-2026-28943HIGHA logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, mEPSS 0.4%CVE-2026-81705HIGHopenssl-encrypt before 1.4.9 Password Cleartext Leak via DebugEPSS 0.4%CVE-2026-28987HIGHA logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, mEPSS 0.4%CVE-2025-32054LOWIn JetBrains IntelliJ IDEA before 2024.3, 2024.2.4 source code could be logged in the idea.log fileEPSS 0.4%CVE-2025-66236HIGHApache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UIEPSS 0.4%CVE-2023-46255MEDIUM`SPICEDB_DATASTORE_CONN_URI` is leaked when URI cannot be parsedEPSS 0.4%CVE-2024-27156MEDIUMLeak of authentication sessions in secure logsEPSS 0.4%CVE-2024-27157MEDIUMLeak of authentication sessions in secure logsEPSS 0.4%CVE-2021-22533MEDIUMPossible Insertion of Sensitive Information into Log File VulnerabilityEPSS 0.4%CVE-2024-27097MEDIUMPotential log injection in reset user endpoint in ckanEPSS 0.4%CVE-2026-32218MEDIUMWindows Kernel Information Disclosure VulnerabilityEPSS 0.4%CVE-2023-52146MEDIUMWordPress 404 Solution Plugin <= 2.33.0 is vulnerable to Sensitive Data ExposureEPSS 0.4%CVE-2025-57813MEDIUMInsertion of Sensitive Information into Log File in github.com/traPtitech/traQEPSS 0.4%CVE-2026-87779HIGHApache Syncope: AES Secret Key disclosure via log outputEPSS 0.4%CVE-2020-37267HIGHRenovate 19.180.0 before 23.25.1 Token Leakage via LogsEPSS 0.4%CVE-2019-25766HIGHRenovate before 19.38.7 Credential Exposure via Go ModulesEPSS 0.4%CVE-2020-10750HIGHSensitive information written to a log file vulnerability was found in jaegertracing/jaeger before version 1.18.1 when the Kafka data store EPSS 0.4%CVE-2026-113799MEDIUMSlack Morphism verifier errors disclose valid HMACs in the logsEPSS 0.4%CVE-2026-120548MEDIUMYML for Yandex Market <= 5.10.0 - Unauthenticated Sensitive Information Exposure through Log File via 'y4ym_check_action' Parameter via admin-post.phpEPSS 0.4%CVE-2024-22440MEDIUMHPE Compute Scale-up Server 3200 Server, Disclosure of Sensitive InformationEPSS 0.4%