CWE-532
AllowedInsertion of Sensitive Information into Log File
Abstraction: Base · Status: Incomplete
The product writes sensitive information to a log file.
1961 vulnerabilities reference this CWE, most recent first.
GHSA-P439-6QGJ-6PQG
Vulnerability from github – Published: 2026-10-06 18:31 – Updated: 2026-10-06 18:31Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
{
"affected": [],
"aliases": [
"CVE-2026-63689"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-06T16:17:08Z",
"severity": "MODERATE"
},
"details": "Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.",
"id": "GHSA-p439-6qgj-6pqg",
"modified": "2026-10-06T18:31:32Z",
"published": "2026-10-06T18:31:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63689"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000515771/dsa-2026-448-security-update-for-dell-container-storage-modules-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-P47J-XX8M-FJR9
Vulnerability from github – Published: 2022-05-24 17:35 – Updated: 2022-05-24 17:35IBM Business Automation Workflow 19.0.0.3 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 190991.
{
"affected": [],
"aliases": [
"CVE-2020-4900"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-30T16:15:00Z",
"severity": "MODERATE"
},
"details": "IBM Business Automation Workflow 19.0.0.3 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 190991.",
"id": "GHSA-p47j-xx8m-fjr9",
"modified": "2022-05-24T17:35:19Z",
"published": "2022-05-24T17:35:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-4900"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/190991"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6373004"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-P529-VRPR-9P36
Vulnerability from github – Published: 2026-05-05 09:31 – Updated: 2026-05-05 09:31An issue was discovered in the PaperCut Hive Ricoh embedded application. When the "Deep Logging" (diagnostic) mode is enabled, the application inadvertently records administrative credentials in plain text within the log files.
An attacker with administrative access to the PaperCut Hive management portal could remotely enable deep logging and subsequently retrieve sensitive device passwords from the logs after an authorized user authenticates at the device. This exposure allows for the lateral movement or unauthorized configuration of the physical print hardware.
{
"affected": [],
"aliases": [
"CVE-2026-7824"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-05T07:16:01Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in the PaperCut Hive Ricoh embedded application. When the \"Deep Logging\" (diagnostic) mode is enabled, the application inadvertently records administrative credentials in plain text within the log files.\n\n\n\nAn attacker with administrative access to the PaperCut Hive management portal could remotely enable deep logging and subsequently retrieve sensitive device passwords from the logs after an authorized user authenticates at the device. This exposure allows for the lateral movement or unauthorized configuration of the physical print hardware.",
"id": "GHSA-p529-vrpr-9p36",
"modified": "2026-05-05T09:31:55Z",
"published": "2026-05-05T09:31:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7824"
},
{
"type": "WEB",
"url": "https://www.papercut.com/kb/Main/papercut-ng-mf-and-papercut-hive-security-bulletin-may-2026"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-P5FP-56MJ-RXM3
Vulnerability from github – Published: 2024-09-25 18:31 – Updated: 2024-10-01 21:31An information exposure in Devolutions Remote Desktop Manager 2024.2.20.0 and earlier on Windows allows local attackers with access to system logs to obtain session credentials via passwords included in command-line arguments when launching WinSCP sessions
{
"affected": [],
"aliases": [
"CVE-2024-7421"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-25T16:15:11Z",
"severity": "MODERATE"
},
"details": "An information exposure in Devolutions Remote Desktop Manager 2024.2.20.0 and earlier on Windows allows local attackers with access to system logs to obtain session credentials via passwords included in command-line arguments when launching WinSCP sessions",
"id": "GHSA-p5fp-56mj-rxm3",
"modified": "2024-10-01T21:31:33Z",
"published": "2024-09-25T18:31:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7421"
},
{
"type": "WEB",
"url": "https://devolutions.net/security/advisories/DEVO-2024-0014"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-P632-5P4V-9HH3
Vulnerability from github – Published: 2022-03-08 00:00 – Updated: 2022-03-17 00:03The CorreosExpress WordPress plugin through 2.6.0 generates log files which are publicly accessible, and contain sensitive information such as sender/receiver names, phone numbers, physical and email addresses
{
"affected": [],
"aliases": [
"CVE-2021-25009"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-07T09:15:00Z",
"severity": "MODERATE"
},
"details": "The CorreosExpress WordPress plugin through 2.6.0 generates log files which are publicly accessible, and contain sensitive information such as sender/receiver names, phone numbers, physical and email addresses",
"id": "GHSA-p632-5p4v-9hh3",
"modified": "2022-03-17T00:03:03Z",
"published": "2022-03-08T00:00:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25009"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/ce2e3503-9a06-4f5c-ae0f-f40e7dfb2903"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-P6MM-27GQ-9V3P
Vulnerability from github – Published: 2022-08-06 05:29 – Updated: 2022-08-06 05:29Impact
An information disclosure vulnerability in next-auth before v4.10.2 and v3.29.9 allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log (which is thrown during OAuth error handling) and use it to leverage further attacks on the system, like impersonating the client to ask for extensive permissions.
Patches
We patched this vulnerability in v4.10.2 and v3.29.9 by moving the log for provider information to the debug level. In addition, we added a warning for having the debug: true option turned on in production and documented it here.
You have enabled the debug option. It is meant for development only, to help you catch issues in your authentication flow and you should consider removing this option when deploying to production. One way of only allowing debugging while not in production is to set debug: process.env.NODE_ENV !== "production", so you can commit this without needing to change the value.
If you want to log debug messages during production anyway, we recommend setting the logger option with proper sanitization of potentially sensitive user information.
To upgrade:
npm i next-auth@latest
# or
yarn add next-auth@latest
# or
pnpm add next-auth@latest
(This will update to the latest v4 version, but you can change latest to 3 if you want to stay on v3. This is not recommended. v3 is unmaintained.)
Workarounds
If for some reason you cannot upgrade, you can user the logger configuration option by sanitizing the logs:
// Example
import log from "your-logging-service"
export const authOptions: NextAuthOptions = {
debug: process.env.NODE_ENV !== "production",
logger: {
error: (code, metadata) => {
if (!(metadata instanceof Error) && metadata.provider) {
// redact the provider secret here
delete metadata.provider
log.error(code, metadata)
} else {
log.error(code, metadata)
}
}
},
}
References
Related documentation: - https://next-auth.js.org/warnings#debug_enabled - https://next-auth.js.org/configuration/options#logger - https://next-auth.js.org/getting-started/upgrade-v4
For more information
If you have any concerns, we request responsible disclosure, outlined here: https://next-auth.js.org/security#reporting-a-vulnerability
Timeline
The issue was reported 18th of July, a response was sent out in less than 20 minutes and after identifying the issue a patch was published within a week.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "next-auth"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.29.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "next-auth"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.10.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-31186"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2022-08-06T05:29:45Z",
"nvd_published_at": "2022-08-01T20:15:00Z",
"severity": "LOW"
},
"details": "### Impact\nAn information disclosure vulnerability in `next-auth` before `v4.10.2` and `v3.29.9` allows an attacker with log access privilege to obtain excessive information such as an identity provider\u0027s secret in the log (which is thrown during OAuth error handling) and use it to leverage further attacks on the system, like impersonating the client to ask for extensive permissions.\n\n### Patches\nWe patched this vulnerability in `v4.10.2` and `v3.29.9` by moving the log for `provider` information to the debug level. In addition, we added a warning for having the `debug: true` option turned on in production and documented it [here](https://next-auth.js.org/warnings#debug_enabled).\n\u003e You have enabled the debug option. It is meant for development only, to help you catch issues in your authentication flow and you should consider removing this option when deploying to production. One way of only allowing debugging while not in production is to set debug: process.env.NODE_ENV !== \"production\", so you can commit this without needing to change the value.\n\u003e \n\u003e If you want to log debug messages during production anyway, we recommend setting the [logger option](https://next-auth.js.org/configuration/options#logger) with proper sanitization of potentially sensitive user information.\n\nTo upgrade:\n\n```sh\nnpm i next-auth@latest\n# or\nyarn add next-auth@latest\n# or\npnpm add next-auth@latest\n```\n(This will update to the latest v4 version, but you can change `latest` to 3 if you want to stay on v3. This is not recommended. v3 is unmaintained.)\n\n### Workarounds\n\nIf for some reason you cannot upgrade, you can user the `logger` configuration option by sanitizing the logs:\n```ts\n// Example\nimport log from \"your-logging-service\"\nexport const authOptions: NextAuthOptions = {\n debug: process.env.NODE_ENV !== \"production\",\n logger: {\n error: (code, metadata) =\u003e {\n if (!(metadata instanceof Error) \u0026\u0026 metadata.provider) {\n // redact the provider secret here\n delete metadata.provider\n log.error(code, metadata)\n } else {\n log.error(code, metadata)\n }\n }\n },\n}\n```\n\n### References\nRelated documentation:\n- https://next-auth.js.org/warnings#debug_enabled\n- https://next-auth.js.org/configuration/options#logger \n- https://next-auth.js.org/getting-started/upgrade-v4\n\n### For more information\nIf you have any concerns, we request responsible disclosure, outlined here: https://next-auth.js.org/security#reporting-a-vulnerability\n\n### Timeline\nThe issue was reported 18th of July, a response was sent out in less than 20 minutes and after identifying the issue a patch was published within a week.",
"id": "GHSA-p6mm-27gq-9v3p",
"modified": "2022-08-06T05:29:45Z",
"published": "2022-08-06T05:29:45Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-p6mm-27gq-9v3p"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31186"
},
{
"type": "PACKAGE",
"url": "https://github.com/nextauthjs/next-auth"
},
{
"type": "WEB",
"url": "https://next-auth.js.org/configuration/options#logger"
},
{
"type": "WEB",
"url": "https://next-auth.js.org/getting-started/upgrade-v4"
},
{
"type": "WEB",
"url": "https://next-auth.js.org/warnings#debug_enabled"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "next-auth before v4.10.2 and v3.29.9 leaks excessive information into log"
}
GHSA-P737-P57G-4CPR
Vulnerability from github – Published: 2022-03-25 19:20 – Updated: 2022-03-25 19:20Impact
What kind of vulnerability is it?
Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter Server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, steal sensitive auth/cookie information, and gain access to the Jupyter server.
Patches
Has the problem been patched? What versions should users upgrade to?
Upgrade to Jupyter Server version 1.15.4
For more information
If you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list security@ipython.org.
Credit: @3coins for reporting. Thank you!
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "jupyter-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.15.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-24757"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2022-03-25T19:20:39Z",
"nvd_published_at": "2022-03-23T21:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\n_What kind of vulnerability is it?_\n\nAnytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter Server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, steal sensitive auth/cookie information, and gain access to the Jupyter server.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nUpgrade to Jupyter Server version 1.15.4\n\n### For more information\n\nIf you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list [security@ipython.org](mailto:security@ipython.org).\n\nCredit: @3coins for reporting. Thank you!\n\n",
"id": "GHSA-p737-p57g-4cpr",
"modified": "2022-03-25T19:20:39Z",
"published": "2022-03-25T19:20:39Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-p737-p57g-4cpr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24757"
},
{
"type": "WEB",
"url": "https://github.com/jupyter-server/jupyter_server/commit/a5683aca0b0e412672ac6218d09f74d44ca0de5a"
},
{
"type": "PACKAGE",
"url": "https://github.com/jupyter-server/jupyter_server"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/jupyter-server/PYSEC-2022-179.yaml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Insertion of Sensitive Information into Log File in Jupyter notebook"
}
GHSA-P77H-Q5M6-CRXC
Vulnerability from github – Published: 2023-02-16 21:30 – Updated: 2023-02-24 21:30An insertion of sensitive information into log file vulnerability [CWE-532] in the FortiPortal management interface 7.0.0 through 7.0.2 may allow a remote authenticated attacker to read other devices' passwords in the audit log page.
{
"affected": [],
"aliases": [
"CVE-2022-43954"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-16T19:15:00Z",
"severity": "MODERATE"
},
"details": "An insertion of sensitive information into log file vulnerability [CWE-532] in the FortiPortal management interface 7.0.0 through 7.0.2 may allow a remote authenticated attacker to read other devices\u0027 passwords in the audit log page.",
"id": "GHSA-p77h-q5m6-crxc",
"modified": "2023-02-24T21:30:17Z",
"published": "2023-02-16T21:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43954"
},
{
"type": "WEB",
"url": "https://fortiguard.com/psirt/FG-IR-22-430"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-P77J-G7H5-R2VW
Vulnerability from github – Published: 2026-08-19 19:22 – Updated: 2026-08-19 19:23GeoLens 1.2.4 fixes a set of vulnerabilities, the most serious of which allow authenticated or anonymous users to obtain data and metadata for datasets they are not authorized to access.
Impact
- Private record metadata disclosure. Record contact, keyword, and distribution sub-resource endpoints did not re-authorize the backing dataset, so any authenticated user could read a private record's contact details (PII), keywords, and distributions. (Runtime-proven.)
- Private tile data via shared caches. Private raster and vector tiles were served with shared-cache (
Cache-Control: public) headers, so a shared cache (a CDN or the bundled reverse proxy) could retain private tile bytes and replay them to later unauthenticated requests, including unpublished public-dataset previews. - Private dataset title enumeration. The map visibility-check endpoint did not authorize read access to the map, allowing any editor to enumerate the titles of non-public datasets in any map by ID — including private maps owned by other users.
- SSRF via DNS rebinding. URL validation for user-supplied service URLs (probes, STAC/OGC API sources, manifest downloads) resolved DNS once and then let the HTTP client re-resolve at connect time, allowing a low-TTL domain to pass validation as a public address and connect to an internal/metadata address.
- Token leak + header injection in service preview. The remote-service preview path passed the authorization token to GDAL via the process environment without sanitization, leaking it through
/proc/<pid>/environand allowing CRLF header injection. - Unauthenticated STAC search DoS.
POST /searchdid not cap the size of GeoJSONintersectsgeometries (theGETsibling did). - API key written to access logs. The bundled reverse proxy logged the
api_keyquery-string credential in cleartext. - Security posture coupled to a logging flag. API documentation exposure and the Secure flag on the OAuth session cookie were keyed off the
LOG_JSONlogging flag rather than an explicit environment setting, so a production deployment at the default could expose/docsand emit a non-Secure session cookie. - Missing Content-Security-Policy (defense-in-depth). The web application shipped no
script-src/default-srcCSP, leaving no containment for token exfiltration if an XSS issue were introduced. - Weak default install credentials. The installer kept the published default database password and could silently retain the default admin password on a headless install.
Patches
Upgrade to GeoLens 1.2.4. No configuration changes are required for the authorization and cache fixes. Operators on a public, TLS-terminated deployment should additionally set ENVIRONMENT=production to make the production security posture explicit; deployments that do not set it retain their prior behavior.
Workarounds
None for the authorization/cache disclosure flaws — upgrading is required. The SSRF and STAC-DoS surfaces can be partially mitigated at the network/proxy layer (egress filtering to block link-local metadata addresses; a request-size limit on POST /search), but the code fix is the durable remedy.
References
- Release: https://github.com/geolens-io/geolens/releases/tag/v1.2.4
- Pull request: https://github.com/geolens-io/geolens/pull/243
- Prior related advisory: GHSA-p23g-mvhj-jh3j
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "geolens"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-1021",
"CWE-1392",
"CWE-200",
"CWE-285",
"CWE-400",
"CWE-524",
"CWE-532",
"CWE-918",
"CWE-93"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-19T19:22:59Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "GeoLens 1.2.4 fixes a set of vulnerabilities, the most serious of which allow authenticated or anonymous users to obtain data and metadata for datasets they are not authorized to access.\n\n### Impact\n\n- **Private record metadata disclosure.** Record contact, keyword, and distribution sub-resource endpoints did not re-authorize the backing dataset, so any authenticated user could read a private record\u0027s contact details (PII), keywords, and distributions. (Runtime-proven.)\n- **Private tile data via shared caches.** Private raster and vector tiles were served with shared-cache (`Cache-Control: public`) headers, so a shared cache (a CDN or the bundled reverse proxy) could retain private tile bytes and replay them to later unauthenticated requests, including unpublished public-dataset previews.\n- **Private dataset title enumeration.** The map visibility-check endpoint did not authorize read access to the map, allowing any editor to enumerate the titles of non-public datasets in any map by ID \u2014 including private maps owned by other users.\n- **SSRF via DNS rebinding.** URL validation for user-supplied service URLs (probes, STAC/OGC API sources, manifest downloads) resolved DNS once and then let the HTTP client re-resolve at connect time, allowing a low-TTL domain to pass validation as a public address and connect to an internal/metadata address.\n- **Token leak + header injection in service preview.** The remote-service preview path passed the authorization token to GDAL via the process environment without sanitization, leaking it through `/proc/\u003cpid\u003e/environ` and allowing CRLF header injection.\n- **Unauthenticated STAC search DoS.** `POST /search` did not cap the size of GeoJSON `intersects` geometries (the `GET` sibling did).\n- **API key written to access logs.** The bundled reverse proxy logged the `api_key` query-string credential in cleartext.\n- **Security posture coupled to a logging flag.** API documentation exposure and the Secure flag on the OAuth session cookie were keyed off the `LOG_JSON` logging flag rather than an explicit environment setting, so a production deployment at the default could expose `/docs` and emit a non-Secure session cookie.\n- **Missing Content-Security-Policy (defense-in-depth).** The web application shipped no `script-src`/`default-src` CSP, leaving no containment for token exfiltration if an XSS issue were introduced.\n- **Weak default install credentials.** The installer kept the published default database password and could silently retain the default admin password on a headless install.\n\n### Patches\n\nUpgrade to **GeoLens 1.2.4**. No configuration changes are required for the authorization and cache fixes. Operators on a public, TLS-terminated deployment should additionally set `ENVIRONMENT=production` to make the production security posture explicit; deployments that do not set it retain their prior behavior.\n\n### Workarounds\n\nNone for the authorization/cache disclosure flaws \u2014 upgrading is required. The SSRF and STAC-DoS surfaces can be partially mitigated at the network/proxy layer (egress filtering to block link-local metadata addresses; a request-size limit on `POST /search`), but the code fix is the durable remedy.\n\n### References\n\n- Release: https://github.com/geolens-io/geolens/releases/tag/v1.2.4\n- Pull request: https://github.com/geolens-io/geolens/pull/243\n- Prior related advisory: GHSA-p23g-mvhj-jh3j",
"id": "GHSA-p77j-g7h5-r2vw",
"modified": "2026-08-19T19:23:00Z",
"published": "2026-08-19T19:22:59Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/geolens-io/geolens/security/advisories/GHSA-p77j-g7h5-r2vw"
},
{
"type": "WEB",
"url": "https://github.com/geolens-io/geolens/pull/243"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-p23g-mvhj-jh3j"
},
{
"type": "PACKAGE",
"url": "https://github.com/geolens-io/geolens"
},
{
"type": "WEB",
"url": "https://github.com/geolens-io/geolens/releases/tag/v1.2.4"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "GeoLens\u0027s authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)"
}
GHSA-P7F2-6479-84WX
Vulnerability from github – Published: 2026-04-16 21:31 – Updated: 2026-04-16 21:31Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an insertion of sensitive information into log file vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.
{
"affected": [],
"aliases": [
"CVE-2025-43937"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-16T19:16:32Z",
"severity": "MODERATE"
},
"details": "Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an insertion of sensitive information into log file vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.",
"id": "GHSA-p7f2-6479-84wx",
"modified": "2026-04-16T21:31:13Z",
"published": "2026-04-16T21:31:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43937"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000376214/dsa-2025-347-security-update-for-dell-powerscale-onefs-multiple-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
Mitigation
Remove debug log files before deploying the application into production.
Mitigation
Protect log files against unauthorized read/write.
Mitigation
Adjust configurations appropriately when software is transitioned from a debug state to production.
CAPEC-215: Fuzzing for application mapping
An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes the application's log or error messages returned. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to observe the application's log and error messages, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash.