CWE-532
AllowedInsertion of Sensitive Information into Log File
Abstraction: Base · Status: Incomplete
The product writes sensitive information to a log file.
1955 vulnerabilities reference this CWE, most recent first.
GHSA-QQC5-RGCC-CJQH
Vulnerability from github – Published: 2021-05-18 18:34 – Updated: 2023-08-30 11:37The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application panic it is possible the headers will not be sanitized before being sent.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "go.elastic.co/apm"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.11.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-22133"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-07T22:01:55Z",
"nvd_published_at": null,
"severity": "LOW"
},
"details": "The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application panic it is possible the headers will not be sanitized before being sent.",
"id": "GHSA-qqc5-rgcc-cjqh",
"modified": "2023-08-30T11:37:11Z",
"published": "2021-05-18T18:34:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22133"
},
{
"type": "WEB",
"url": "https://github.com/elastic/apm-agent-go/pull/888"
},
{
"type": "WEB",
"url": "https://github.com/elastic/apm-agent-go/commit/c5c7e21aa26a6def7790f74fbceed792ad47ef35"
},
{
"type": "WEB",
"url": "https://github.com/elastic/apm-agent-go/commit/dd3e8c593580e7b80a98b57e1cc6e017e56747b4"
},
{
"type": "WEB",
"url": "https://discuss.elastic.co/t/elastic-apm-agent-for-go-1-11-0-security-update/263252"
},
{
"type": "PACKAGE",
"url": "https://github.com/elastic/apm-agent-go"
},
{
"type": "WEB",
"url": "https://github.com/elastic/apm-agent-go/compare/v1.10.0...v1.11.0"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2022-0706"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Information Disclosure in go.elastic.co/apm"
}
GHSA-QQHQ-8R2C-C3F5
Vulnerability from github – Published: 2023-12-15 23:43 – Updated: 2023-12-16 00:51Summary
The value of nvdApiKey configuration parameter is logged in clear text in debug mode.
Details
The NVD API key is a kind of secret and should be treated like other secrets when logging in debug mode.
Expecting the same behavior as for several password configurations: just print ******
Note that while the NVD API Key is an access token for the NVD API - they are not that sensitive. The only thing an NVD API Token grants is a higher rate limit when making calls to publicly available data. The data available from the NVD API is the same whether you have an API Key or not.
PoC
The nvdApiKey is configured to use an environment variable; when running mvn -X dependency-check:check the clear value is logged twice.
Impact
The NVD API key is a kind of secret and should not be exposed. If stolen, an attacker can use this key to obtain already public information.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 9.0.5"
},
"package": {
"ecosystem": "Maven",
"name": "org.owasp:dependency-check-ant"
},
"ranges": [
{
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.0.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 9.0.5"
},
"package": {
"ecosystem": "Maven",
"name": "org.owasp:dependency-check-cli"
},
"ranges": [
{
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.0.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.owasp:dependency-check-maven"
},
"ranges": [
{
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.0.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2023-12-15T23:43:30Z",
"nvd_published_at": null,
"severity": "LOW"
},
"details": "### Summary\nThe value of `nvdApiKey` configuration parameter is logged in clear text in debug mode.\n\n### Details\nThe NVD API key is a kind of secret and should be treated like other secrets when logging in debug mode.\nExpecting the same behavior as for several password configurations: just print `******`\n\nNote that while the NVD API Key is an access token for the NVD API - they are not that sensitive. The only thing an NVD API Token grants is a higher rate limit when making calls to publicly available data. The data available from the NVD API is the same whether you have an API Key or not.\n\n### PoC\nThe nvdApiKey is configured to use an environment variable; when running `mvn -X dependency-check:check` the clear value is logged twice.\n\n### Impact\nThe NVD API key is a kind of secret and should not be exposed. If stolen, an attacker can use this key to obtain already public information.\n\n",
"id": "GHSA-qqhq-8r2c-c3f5",
"modified": "2023-12-16T00:51:51Z",
"published": "2023-12-15T23:43:30Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/jeremylong/DependencyCheck/security/advisories/GHSA-qqhq-8r2c-c3f5"
},
{
"type": "PACKAGE",
"url": "https://github.com/jeremylong/DependencyCheck"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "nvdApiKey is logged in debug mode"
}
GHSA-QQJ6-54Q6-CXV6
Vulnerability from github – Published: 2026-10-05 22:55 – Updated: 2026-10-05 22:55Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be written to diagnostic logs in circumstances where the available log redaction did not cover all affected log paths and data types. An attacker with read access to the log destination, whether the local filesystem, a log aggregation service, or a CI/CD artifact store, could obtain credentials and decryption keys that, if still valid at the time of access, could be used to authenticate to the corresponding Snowflake account or cloud-storage object. Successful exploitation requires read access to the log destination, and impact is bounded by credential lifetime and object scope. The fix is available in Snowflake Connector for Python v4.7.3, Snowflake Go Driver v2.2.0, Snowflake JDBC Driver v4.3.4 (including the snowflake-jdbc-fips and snowflake-jdbc-thin), Snowflake Node.js Driver v3.3.0, Snowflake PHP PDO Driver v4.2.0, and Snowflake ODBC Driver v3.20.0. Users must manually upgrade and should securely delete previously generated diagnostic logs containing sensitive information where retention is not required.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "snowflake-sdk"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "snowflake-connector-python"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.7.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/snowflakedb/gosnowflake"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.19.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "net.snowflake:snowflake-jdbc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.3.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "net.snowflake:snowflake-jdbc-thin"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.3.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "net.snowflake:snowflake-jdbc-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.3.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/snowflakedb/gosnowflake/v2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-86597"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-05T22:55:47Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be written to diagnostic logs in circumstances where the available log redaction did not cover all affected log paths and data types. An attacker with read access to the log destination, whether the local filesystem, a log aggregation service, or a CI/CD artifact store, could obtain credentials and decryption keys that, if still valid at the time of access, could be used to authenticate to the corresponding Snowflake account or cloud-storage object. Successful exploitation requires read access to the log destination, and impact is bounded by credential lifetime and object scope. The fix is available in Snowflake Connector for Python v4.7.3, Snowflake Go Driver v2.2.0, Snowflake JDBC Driver v4.3.4 (including the snowflake-jdbc-fips and snowflake-jdbc-thin), Snowflake Node.js Driver v3.3.0, Snowflake PHP PDO Driver v4.2.0, and Snowflake ODBC Driver v3.20.0. Users must manually upgrade and should securely delete previously generated diagnostic logs containing sensitive information where retention is not required.",
"id": "GHSA-qqj6-54q6-cxv6",
"modified": "2026-10-05T22:55:47Z",
"published": "2026-10-05T22:55:47Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/snowflakedb/snowflake-connector-nodejs/security/advisories/GHSA-qqj6-54q6-cxv6"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86597"
},
{
"type": "WEB",
"url": "https://docs.snowflake.com/en/release-notes/clients-drivers/golang-2026#version-220-sep-03-2026"
},
{
"type": "WEB",
"url": "https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc-2026#version-434-sep-03-2026"
},
{
"type": "WEB",
"url": "https://docs.snowflake.com/en/release-notes/clients-drivers/nodejs-2026#version-330-september-3-2026"
},
{
"type": "WEB",
"url": "https://docs.snowflake.com/en/release-notes/clients-drivers/odbc-2026#version-3200-sep-3-2026"
},
{
"type": "WEB",
"url": "https://docs.snowflake.com/en/release-notes/clients-drivers/php-pdo-2026#version-420-sep-3-2026"
},
{
"type": "PACKAGE",
"url": "https://github.com/snowflakedb/snowflake-connector-nodejs"
},
{
"type": "WEB",
"url": "https://github.com/snowflakedb/snowflake-connector-python/releases/tag/v4.7.3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Snowflake drivers writes sensitive information to logs"
}
GHSA-QQMP-WF37-98F9
Vulnerability from github – Published: 2026-10-05 22:52 – Updated: 2026-10-05 22:52Impact
Multiple @opentelemetry/instrumentation-* packages recorded the database connection username as the db.user
span attribute on every instrumented database operation. This attribute was emitted unconditionally — it was
not gated by enhancedDatabaseReporting or any other opt-in flag, and it was the default behaviour for
all users of the affected packages until the patched releases shipped on 2026-07-23.
The attribute is forwarded to every configured observability backend (Jaeger, Zipkin, Datadog, OTLP collectors, etc.). Depending on the database account naming convention in use, the exported value may reveal:
- Internal service account names that disclose architecture topology.
- Role-encoded usernames (e.g.
admin_readwrite,app_readonly_prod) useful for privilege inference. - Database account naming patterns useful for credential enumeration.
Affected packages (all are vulnerable from the first published version through the version listed below):
| Package | Vulnerable range | Patched version |
|---|---|---|
@opentelemetry/instrumentation-cassandra-driver |
< 0.66.0 |
0.66.0 |
@opentelemetry/instrumentation-knex |
< 0.65.0 |
0.65.0 |
@opentelemetry/instrumentation-mongoose |
< 0.67.0 |
0.67.0 |
@opentelemetry/instrumentation-mysql |
< 0.67.0 |
0.67.0 |
@opentelemetry/instrumentation-mysql2 |
< 0.67.0 |
0.67.0 |
@opentelemetry/instrumentation-oracledb |
< 0.46.0 |
0.46.0 |
@opentelemetry/instrumentation-pg |
< 0.73.0 |
0.73.0 |
@opentelemetry/instrumentation-tedious |
< 0.40.0 |
0.40.0 |
Patches
Fixed in the coordinated release on 2026-07-23 via feat!: only emit stable http, network and database attributes (#3585).
Upgrade to the patched version listed in the table above for each instrumentation package in use.
Workarounds
No configuration-level workaround exists in the affected versions: the db.user attribute cannot be
suppressed without patching. As a partial mitigation, a custom SpanProcessor can be used to strip db.user from spans before they leave the process:
// Example: drop db.user in a custom SpanProcessor
class StripDbUserProcessor implements SpanProcessor {
onStart(span: Span) {
span.setAttribute('db.user', null);
}
onEnd() {}
shutdown() { return Promise.resolve(); }
forceFlush() { return Promise.resolve(); }
}
Users who control the downstream collector can also filter the attribute at the collector pipeline level.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@opentelemetry/instrumentation-cassandra-driver"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.66.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@opentelemetry/instrumentation-tedious"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.40.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@opentelemetry/instrumentation-oracledb"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.46.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@opentelemetry/instrumentation-mongoose"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.67.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@opentelemetry/instrumentation-mysql"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.67.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@opentelemetry/instrumentation-knex"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.65.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@opentelemetry/instrumentation-mysql2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.67.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@opentelemetry/instrumentation-pg"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.73.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-104872"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-05T22:52:44Z",
"nvd_published_at": "2026-10-02T20:17:01Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nMultiple `@opentelemetry/instrumentation-*` packages recorded the database connection username as the `db.user`\nspan attribute on every instrumented database operation. This attribute was emitted unconditionally \u2014 it was\nnot gated by `enhancedDatabaseReporting` or any other opt-in flag, and it was the **default** behaviour for\nall users of the affected packages until the patched releases shipped on 2026-07-23.\n\nThe attribute is forwarded to every configured observability backend (Jaeger, Zipkin, Datadog, OTLP\ncollectors, etc.). Depending on the database account naming convention in use, the exported value may\nreveal:\n\n- Internal service account names that disclose architecture topology.\n- Role-encoded usernames (e.g. `admin_readwrite`, `app_readonly_prod`) useful for privilege inference.\n- Database account naming patterns useful for credential enumeration.\n\nAffected packages (all are vulnerable from the first published version through the version listed below):\n\n| Package | Vulnerable range | Patched version |\n|---------|-----------------|-----------------|\n| `@opentelemetry/instrumentation-cassandra-driver` | `\u003c 0.66.0` | `0.66.0` |\n| `@opentelemetry/instrumentation-knex` | `\u003c 0.65.0` | `0.65.0` |\n| `@opentelemetry/instrumentation-mongoose` | `\u003c 0.67.0` | `0.67.0` |\n| `@opentelemetry/instrumentation-mysql` | `\u003c 0.67.0` | `0.67.0` |\n| `@opentelemetry/instrumentation-mysql2` | `\u003c 0.67.0` | `0.67.0` |\n| `@opentelemetry/instrumentation-oracledb` | `\u003c 0.46.0` | `0.46.0` |\n| `@opentelemetry/instrumentation-pg` | `\u003c 0.73.0` | `0.73.0` |\n| `@opentelemetry/instrumentation-tedious` | `\u003c 0.40.0` | `0.40.0` |\n\n### Patches\n\nFixed in the coordinated release on 2026-07-23 via\n[feat!: only emit stable http, network and database attributes (#3585)](https://github.com/open-telemetry/opentelemetry-js-contrib/pull/3585).\n\nUpgrade to the patched version listed in the table above for each instrumentation package in use.\n\n### Workarounds\n\nNo configuration-level workaround exists in the affected versions: the `db.user` attribute cannot be\nsuppressed without patching. As a partial mitigation, a custom `SpanProcessor` can be used to strip `db.user` from spans before they leave the process:\n\n```ts\n// Example: drop db.user in a custom SpanProcessor\nclass StripDbUserProcessor implements SpanProcessor {\n onStart(span: Span) {\n span.setAttribute(\u0027db.user\u0027, null);\n }\n onEnd() {}\n shutdown() { return Promise.resolve(); }\n forceFlush() { return Promise.resolve(); }\n}\n```\n\nUsers who control the downstream collector can also filter the attribute at the collector pipeline level.",
"id": "GHSA-qqmp-wf37-98f9",
"modified": "2026-10-05T22:52:44Z",
"published": "2026-10-05T22:52:44Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/open-telemetry/opentelemetry-js-contrib/security/advisories/GHSA-qqmp-wf37-98f9"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104872"
},
{
"type": "WEB",
"url": "https://github.com/open-telemetry/opentelemetry-js-contrib/pull/3585"
},
{
"type": "WEB",
"url": "https://github.com/open-telemetry/opentelemetry-js-contrib/commit/27e172a9e0d549559056ccd58f27d13467454156"
},
{
"type": "WEB",
"url": "https://github.com/open-telemetry/opentelemetry-js-contrib/commit/5b7dd0e102e940d653e04b08b5a1b721a8271037"
},
{
"type": "PACKAGE",
"url": "https://github.com/open-telemetry/opentelemetry-js-contrib"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute"
}
GHSA-QR2V-788M-XVQC
Vulnerability from github – Published: 2026-02-10 18:30 – Updated: 2026-02-10 18:30Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally.
{
"affected": [],
"aliases": [
"CVE-2026-21222"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-10T18:16:23Z",
"severity": "MODERATE"
},
"details": "Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally.",
"id": "GHSA-qr2v-788m-xvqc",
"modified": "2026-02-10T18:30:41Z",
"published": "2026-02-10T18:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21222"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21222"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QR5H-XP65-3PM4
Vulnerability from github – Published: 2025-09-19 21:31 – Updated: 2025-09-24 21:30Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 1.0.735 and Application prior to 20.0.1330 (macOS/Linux client deployments) contain a vulnerability in the local logging mechanism. Authentication session tokens, including PHPSESSID, XSRF-TOKEN, and laravel_session, are stored in cleartext within world-readable log files. Any local user with access to the machine can extract these session tokens and use them to authenticate remotely to the SaaS environment, bypassing normal login credentials, potentially leading to unauthorized system access and exposure of sensitive information.
{
"affected": [],
"aliases": [
"CVE-2025-34188"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-19T19:15:38Z",
"severity": "HIGH"
},
"details": "Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 1.0.735 and Application prior to 20.0.1330 (macOS/Linux client deployments) contain a vulnerability in the local logging mechanism. Authentication session tokens, including PHPSESSID, XSRF-TOKEN, and laravel_session, are stored in cleartext within world-readable log files. Any local user with access to the machine can extract these session tokens and use them to authenticate remotely to the SaaS environment, bypassing normal login credentials, potentially leading to unauthorized system access and exposure of sensitive information.",
"id": "GHSA-qr5h-xp65-3pm4",
"modified": "2025-09-24T21:30:35Z",
"published": "2025-09-19T21:31:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-34188"
},
{
"type": "WEB",
"url": "https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm"
},
{
"type": "WEB",
"url": "https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm"
},
{
"type": "WEB",
"url": "https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#mac-leak-secrets"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/vasion-print-printerlogic-local-log-disclosure-of-cleartext-sessions"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-QRF6-GX4G-HQV9
Vulnerability from github – Published: 2022-09-14 00:00 – Updated: 2022-09-16 00:00In NOKIA 1350 OMS R14.2, an Insertion of Sensitive Information into an Application Log File vulnerability occurs under /usr/Systems/OTNE_1_14_Master/maintenance/trace/web/.otn.default.log. The web application stores critical information, such as cleartext user credentials, in world-readable files in the filesystem.
{
"affected": [],
"aliases": [
"CVE-2022-39821"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-13T21:15:00Z",
"severity": "HIGH"
},
"details": "In NOKIA 1350 OMS R14.2, an Insertion of Sensitive Information into an Application Log File vulnerability occurs under /usr/Systems/OTNE_1_14_Master/maintenance/trace/web/.otn.default.log. The web application stores critical information, such as cleartext user credentials, in world-readable files in the filesystem.",
"id": "GHSA-qrf6-gx4g-hqv9",
"modified": "2022-09-16T00:00:29Z",
"published": "2022-09-14T00:00:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39821"
},
{
"type": "WEB",
"url": "https://www.gruppotim.it/it/footer/red-team.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QRPM-2F6M-PF3C
Vulnerability from github – Published: 2022-04-28 00:00 – Updated: 2022-05-05 00:00IBM QRadar SIEM 7.3, 7.4, and 7.5 stores potentially sensitive information in log files that could be read by an user with access to creating domains. IBM X-Force ID: 211037.
{
"affected": [],
"aliases": [
"CVE-2021-38939"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-27T16:15:00Z",
"severity": "MODERATE"
},
"details": "IBM QRadar SIEM 7.3, 7.4, and 7.5 stores potentially sensitive information in log files that could be read by an user with access to creating domains. IBM X-Force ID: 211037.",
"id": "GHSA-qrpm-2f6m-pf3c",
"modified": "2022-05-05T00:00:31Z",
"published": "2022-04-28T00:00:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38939"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/211037"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6574787"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QV9R-4W4X-36G7
Vulnerability from github – Published: 2023-08-11 15:30 – Updated: 2024-04-04 06:52Plaintext Password vulnerability in AddAdmin.py in cms-dev/cms v1.4.rc1, allows attackers to gain sensitive information via audit logs.
{
"affected": [],
"aliases": [
"CVE-2020-24804"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-11T14:15:10Z",
"severity": "MODERATE"
},
"details": "Plaintext Password vulnerability in AddAdmin.py in cms-dev/cms v1.4.rc1, allows attackers to gain sensitive information via audit logs.",
"id": "GHSA-qv9r-4w4x-36g7",
"modified": "2024-04-04T06:52:36Z",
"published": "2023-08-11T15:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24804"
},
{
"type": "WEB",
"url": "https://github.com/cms-dev/cms/issues/1160"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QVH5-87JF-4G7P
Vulnerability from github – Published: 2026-08-27 18:32 – Updated: 2026-08-27 18:32openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g. -apHunter2) or abbreviated long-option spellings (e.g. --passw). The sanitizer only recognized exact option names, --option=value forms, and tokens starting with -p, so these spellings bypass the redaction chokepoint and the cleartext password is written to stderr. Anyone with access to that output (terminal scrollback, merged 2>&1 output, CI job logs, or the GUI's persistent debug log) can recover the password.
{
"affected": [],
"aliases": [
"CVE-2026-81705"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-27T17:21:01Z",
"severity": "HIGH"
},
"details": "openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g. -apHunter2) or abbreviated long-option spellings (e.g. --passw). The sanitizer only recognized exact option names, --option=value forms, and tokens starting with -p, so these spellings bypass the redaction chokepoint and the cleartext password is written to stderr. Anyone with access to that output (terminal scrollback, merged 2\u003e\u00261 output, CI job logs, or the GUI\u0027s persistent debug log) can recover the password.",
"id": "GHSA-qvh5-87jf-4g7p",
"modified": "2026-08-27T18:32:29Z",
"published": "2026-08-27T18:32:29Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-jgvm-7jxv-cgcc"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81705"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-password-cleartext-leak-via-debug"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
Mitigation
Remove debug log files before deploying the application into production.
Mitigation
Protect log files against unauthorized read/write.
Mitigation
Adjust configurations appropriately when software is transitioned from a debug state to production.
CAPEC-215: Fuzzing for application mapping
An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes the application's log or error messages returned. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to observe the application's log and error messages, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash.