Falhas do tipo CWE-532

941 resultados

Informações sensíveis em arquivos de log

A aplicação registra dados confidenciais (senhas, tokens, PII, chaves criptográficas) em arquivos de log sem proteção adequada. Esses logs são frequentemente legíveis por outros usuários do sistema, backups desprotegidos ou ferramentas de análise, expondo segredos de negócio e credenciais de autenticação.

Exemplo

Uma API registra a requisição HTTP completa incluindo o header `Authorization: Bearer eyJhbGc...`, ou um serviço de login escreve a senha do usuário em log de debug antes de validá-la. Um atacante com acesso ao servidor (ou backups antigos) lê esses logs e obtém credenciais válidas.

Como mitigar

Nunca registre senhas, tokens, chaves, CPF ou dados de cartão. Use máscaras (ex: `token=***`) para valores sensíveis que precisam ser logados. Restrinja permissões de acesso aos arquivos de log e aplique rotação com limpeza segura de logs antigos. Implemente revisão de código e linters para detectar padrões suspeitos.

CVE-2026-22098CRITICALSensitive information is written to logsEPSS 0.4%CVE-2026-78174CRITICALWatchGuard Dimension Session Hijack via Exposed Session Tokens in Diagnostic LogsEPSS 0.4%CVE-2026-73100CRITICALApache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errorsEPSS 0.4%CVE-2024-9453MEDIUMJenkins-image: sensitive data disclosure when using openshift jenkins imageEPSS 0.4%CVE-2026-123316MEDIUMIn JetBrains Junie CLI before 26.6.29 sensitive environment variables were exposed in session event logsEPSS 0.4%CVE-2026-23493HIGHPimcore ENV Variables and Cookie Informations are exposed in http_error_logEPSS 0.4%CVE-2018-20105MEDIUMyast2-rmt exposes CA private key passhrase in log-fileEPSS 0.4%CVE-2026-32982HIGHOpenClaw < 2026.3.13 - Telegram Bot Token Exposure in Media Fetch Error LogsEPSS 0.4%CVE-2019-14858HIGHA vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub paramEPSS 0.4%CVE-2022-20651MEDIUMCisco Adaptive Security Device Manager Information Disclosure VulnerabilityEPSS 0.4%CVE-2024-25095HIGHWordPress Easy Forms for Mailchimp plugin <= 6.9.0 - Sensitive Data Exposure via Log File vulnerabilityEPSS 0.4%CVE-2021-3791MEDIUMAn information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an unauthenticated atEPSS 0.4%CVE-2026-32215MEDIUMWindows Kernel Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-32217MEDIUMWindows Kernel Information Disclosure VulnerabilityEPSS 0.4%CVE-2020-10763—An information-disclosure flaw was found in the way Heketi before 10.1.0 logs sensitive information. This flaw allows an attacker with localEPSS 0.4%CVE-2025-27555MEDIUMApache Airflow: Connection Secrets not masked in UI when Connection are added via Airflow cliEPSS 0.4%CVE-2024-37270MEDIUMWordPress TrustedLogin Vendor plugin < 1.1.1 - Sensitive Data Exposure vulnerabilityEPSS 0.4%CVE-2024-40636MEDIUMBasic Auth Credential Leakage to Logs After Fetch Registry Error in Steeltoe.Discovery.Eureka with Peer AwarenessEPSS 0.4%CVE-2024-38321MEDIUMIBM Business Automation Workflow information disclosureEPSS 0.4%CVE-2026-86049HIGHJupyter Server: 5xx request logging leaks token-bearing Referer header valuesEPSS 0.4%