Falhas do tipo CWE-532

858 resultados

Informações sensíveis em arquivos de log

A aplicação registra dados confidenciais (senhas, tokens, PII, chaves criptográficas) em arquivos de log sem proteção adequada. Esses logs são frequentemente legíveis por outros usuários do sistema, backups desprotegidos ou ferramentas de análise, expondo segredos de negócio e credenciais de autenticação.

Exemplo

Uma API registra a requisição HTTP completa incluindo o header `Authorization: Bearer eyJhbGc...`, ou um serviço de login escreve a senha do usuário em log de debug antes de validá-la. Um atacante com acesso ao servidor (ou backups antigos) lê esses logs e obtém credenciais válidas.

Como mitigar

Nunca registre senhas, tokens, chaves, CPF ou dados de cartão. Use máscaras (ex: `token=***`) para valores sensíveis que precisam ser logados. Restrinja permissões de acesso aos arquivos de log e aplique rotação com limpeza segura de logs antigos. Implemente revisão de código e linters para detectar padrões suspeitos.

CVE-2026-28923HIGHA logging issue was addressed with improved data redaction. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26EPSS 0.2%CVE-2026-47234MEDIUMAdmidio writes session IDs and auto-login cookie values to application logsEPSS 0.2%CVE-2026-9735MEDIUMKeyfile contents are in MongoDB Server logsEPSS 0.2%CVE-2023-22573HIGHDell PowerScale OneFS 9.0.0.x-9.4.0.x contain an insertion of sensitive information into log file vulnerability in cloudpool. A low privilegEPSS 0.2%CVE-2023-6814MEDIUMInformation Exposure Vulnerability in Cosminexus Component ContainerEPSS 0.2%CVE-2023-41253MEDIUMBIG-IP DNS TSIG Key vulnerabilityEPSS 0.2%CVE-2023-43485MEDIUMBIGIP and BIG-IQ TACACS+ audit log VulnerabilityEPSS 0.2%CVE-2023-45241MEDIUMSensitive information leak through log files. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows)EPSS 0.2%CVE-2025-1696MEDIUMExposure of Proxy Credentials in Docker Desktop LogsEPSS 0.2%CVE-2026-75057MEDIUMIn JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE logEPSS 0.2%CVE-2026-59302LOWPotential for logging sensitive data in Spring Cloud StreamEPSS 0.2%CVE-2024-2877MEDIUMVault Enterprise Leaks Sensitive HTTP Request Headers in the Audit Log When Deployed With a Performance Standby NodeEPSS 0.2%CVE-2025-8864MEDIUMShared Access Signature token is not masked in the backup configuration response and is also exposed in the yb_backup logsEPSS 0.2%CVE-2023-40694MEDIUMIBM Watson CP4D Data Stores information disclosureEPSS 0.2%CVE-2021-3034MEDIUMCortex XSOAR: Secrets for SAML single sign-on (SSO) integration may be logged in system logsEPSS 0.2%CVE-2025-36050MEDIUMIBM QRadar SIEM information disclosureEPSS 0.2%CVE-2025-23261MEDIUMNVIDIA Cumulus Linux and NVOS products contain a vulnerability, where hashed user passwords are not properly suppressed in log files, potentEPSS 0.2%CVE-2025-43508MEDIUMA logging issue was addressed with improved data redaction. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive EPSS 0.2%CVE-2026-93982MEDIUMOpenPanel MCP Authentication Token in Query Parameter Logged PlaintextEPSS 0.2%CVE-2025-6624LOWVersions of the package snyk before 1.1297.3 are vulnerable to Insertion of Sensitive Information into Log File through local Snyk CLI debugEPSS 0.2%