CWE-532

{
  "affected": [],
  "aliases": [
    "CVE-2024-20440"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-04T17:15:13Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information.\n\nThis vulnerability is due to excessive verbosity in a debug log file. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain log files that contain sensitive data, including credentials that can be used to access the API.",
  "id": "GHSA-g9j7-w55p-jq3w",
  "modified": "2024-09-04T18:30:58Z",
  "published": "2024-09-04T18:30:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20440"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cslu-7gHMzWmw"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/apache/solr-operator"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.3.0"
            },
            {
              "fixed": "0.8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-31391"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-12T21:16:19Z",
    "nvd_published_at": "2024-04-12T15:15:26Z",
    "severity": "MODERATE"
  },
  "details": "Insertion of Sensitive Information into Log File vulnerability in the Apache Solr Operator.\n\nThis issue affects all versions of the Apache Solr Operator from 0.3.0 through 0.8.0.\n\nWhen asked to bootstrap Solr security, the operator will enable basic authentication and create several accounts for accessing Solr: including the \"solr\" and \"admin\" accounts for use by end-users, and a \"k8s-oper\" account which the operator uses for its own requests to Solr.\nOne common source of these operator requests is healthchecks: liveness, readiness, and startup probes are all used to determine Solr\u0027s health and ability to receive traffic.\nBy default, the operator configures the Solr APIs used for these probes to be exempt from authentication, but\u00a0users may specifically request that authentication be required on probe endpoints as well.\nWhenever one of these probes would fail, if authentication was in use, the Solr Operator would create a Kubernetes \"event\" containing the username and password of the \"k8s-oper\" account.\n\nWithin the affected version range, this vulnerability affects any solrcloud resource which (1) bootstrapped security through use of the `.solrOptions.security.authenticationType=basic` option, and (2) required authentication be used on probes by setting `.solrOptions.security.probesRequireAuth=true`.\n\nUsers are recommended to upgrade to Solr Operator version 0.8.1, which fixes this issue by ensuring that probes no longer print the credentials used for Solr requests.\u00a0 Users may also mitigate the vulnerability by disabling authentication on their healthcheck probes using the setting `.solrOptions.security.probesRequireAuth=false`.",
  "id": "GHSA-g9qx-25vj-rf53",
  "modified": "2025-02-13T19:01:24Z",
  "published": "2024-04-12T15:37:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31391"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/solr-operator"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/w7011s78lzywzwyszvy4d8zm99ybt8c7"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2024/04/12/7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Apache Solr Operator liveness and readiness probes may leak basic auth credentials"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-80056"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-07T15:17:32Z",
    "severity": "MODERATE"
  },
  "details": "Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.",
  "id": "GHSA-gc5m-6245-9qmc",
  "modified": "2026-09-07T15:33:55Z",
  "published": "2026-09-07T15:33:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80056"
    },
    {
      "type": "WEB",
      "url": "https://www.dell.com/support/kbdoc/en-in/000503426/dsa-2026-382-security-update-for-dell-secure-connect-gateway-virtual-edition-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-45103"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-04-06T01:15:00Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in HTCondor 9.0.x before 9.0.10 and 9.1.x before 9.5.1. An attacker can access files stored in S3 cloud storage that a user has asked HTCondor to transfer.",
  "id": "GHSA-gf7w-pw5x-9jh7",
  "modified": "2022-04-14T00:00:32Z",
  "published": "2022-04-07T00:00:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45103"
    },
    {
      "type": "WEB",
      "url": "https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2021-0005"
    },
    {
      "type": "WEB",
      "url": "https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2022-0001"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-1223"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-09-17T16:29:00Z",
    "severity": "HIGH"
  },
  "details": "Cloud Foundry Container Runtime (kubo-release), versions prior to 0.14.0, may leak UAA and vCenter credentials to application logs. A malicious user with the ability to read the application logs could use these credentials to escalate privileges.",
  "id": "GHSA-gfwv-5245-24h8",
  "modified": "2022-05-13T01:27:58Z",
  "published": "2022-05-13T01:27:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1223"
    },
    {
      "type": "WEB",
      "url": "https://www.cloudfoundry.org/blog/cve-2018-1223"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.jenkins:configuration-as-code"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.25"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-10345"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-256",
      "CWE-522",
      "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-28T23:07:38Z",
    "nvd_published_at": "2019-07-31T13:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Jenkins Configuration as Code Plugin prior to version 1.25 did not treat the proxy password as a secret to be masked when logging or encrypted for export.",
  "id": "GHSA-ggmx-pq89-7mcr",
  "modified": "2022-06-28T23:07:38Z",
  "published": "2022-05-24T16:51:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10345"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jenkinsci/configuration-as-code-plugin/commit/73afe3cb10a723cb06e29c2e5499206aadae3a0d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jenkinsci/configuration-as-code-plugin"
    },
    {
      "type": "WEB",
      "url": "https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1303"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2019/07/31/1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Plaintext Storage of a Password in Jenkins Configuration as Code Plugin"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/jaegertracing/jaeger"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.18.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-10750"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-12T14:55:16Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "Sensitive information written to a log file vulnerability was found in jaegertracing/jaeger before version 1.18.1 when the Kafka data store is used. This flaw allows an attacker with access to the container\u0027s log file to discover the Kafka credentials.",
  "id": "GHSA-gh32-pc56-4c96",
  "modified": "2023-09-15T19:47:45Z",
  "published": "2021-05-18T18:35:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10750"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jaegertracing/jaeger/commit/360c38bec3f9718ebba7ddbf0b409b05995f3ace"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1838401"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10750"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jaegertracing/jaeger/releases/tag/v1.18.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Information Exposure in jaeger"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-51490"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-01-08T21:15:09Z",
    "severity": "MODERATE"
  },
  "details": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPMU DEV Defender Security \u2013 Malware Scanner, Login Security \u0026 Firewall.This issue affects Defender Security \u2013 Malware Scanner, Login Security \u0026 Firewall: from n/a through 4.1.0.",
  "id": "GHSA-gh6x-qpj6-x25r",
  "modified": "2026-04-28T21:33:46Z",
  "published": "2024-01-08T21:30:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51490"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/defender-security/wordpress-defender-security-plugin-4-1-0-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/openbao/openbao"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-20241114205727-b1235e585db7"
            },
            {
              "fixed": "0.0.0-20251022165510-cc2c476bac66"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-62513"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-10-22T19:37:53Z",
    "nvd_published_at": "2025-10-22T20:15:38Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nOpenBao\u0027s audit log experienced a regression wherein raw HTTP bodies used by few endpoints were not correctly redacted (HMAC\u0027d).  This impacted the following subsystems:\n\n - When using the ACME functionality of PKI, this would result in short-lived ACME verification challenge codes being leaked in the audit logs.\n - When using the OIDC issuer functionality of the identity subsystem, auth and token response codes along with claims could be leaked in the audit logs.\n\nThird-party plugins may be affected.\n\n### Patches\n\nOpenBao v2.4.2 will patch this issue.\n\n### Workarounds\n\nIf users do not use the above functionality, they are not impacted. ACME verification codes are not usable after verification or challenge expiry so are of limited long-term use.",
  "id": "GHSA-ghfh-fmx4-26h8",
  "modified": "2025-10-23T17:38:22Z",
  "published": "2025-10-22T19:37:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openbao/openbao/security/advisories/GHSA-ghfh-fmx4-26h8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62513"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openbao/openbao/commit/cc2c476bac66e1d94776c2629793daec3af625f8"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openbao/openbao"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenBao leaks HTTPRawBody in Audit Logs"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.27.2"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/filecoin-project/curio"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.24.3"
            },
            {
              "fixed": "1.27.3-rc2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-209",
      "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-26T22:48:00Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nMultiple HTTP handlers in Curio passed raw database error messages to HTTP clients via `http.Error()`. When the PostgreSQL/YugabyteDB driver (pgx) returned errors, these could contain the database connection string \u2014 including hostname, port, username, and password. Additionally, the internal connection string was constructed with the plaintext password embedded in the URL, which was also included in startup error messages and could surface in logs.\n\n## Details\n\nThree components were affected:\n\n1. **PDP handlers** (`pdp/handlers.go`) \u2014 18+ HTTP error paths passed `err.Error()` directly to HTTP responses. While these endpoints require ECDSA JWT authentication, an authenticated client (e.g., a FilPay service) that triggered a database error would receive the raw pgx error in the HTTP response body. Present since PDP was introduced in v1.25.1.\n\n2. **Market mk12 deal status** (`market/mk12/mk12_utils.go`) \u2014 The `GetDealStatus` handler included `err.Error()` in error responses: `\"failed to query the db for deal status: %s\"`. Present since v1.24.3.\n\n3. **Market mk20 auth middleware** (`market/mk20/http/http.go`) \u2014 Authentication error responses included `err.Error()`, potentially leaking database error details during auth flows. Present since v1.27.2.\n\n### Root Cause\n\nThe database connection string was constructed as:\n```\npostgresql://username:password@host:port/database?...\n```\nThe plaintext password was embedded directly in the URL. When pgx returned connection or query errors, the error text could contain fragments of this connection string. HTTP handlers forwarded these errors verbatim to clients.\n\n## Impact\n\nAn attacker with network access to Curio\u0027s PDP or Market HTTP endpoints and valid authentication credentials could intentionally trigger database errors (e.g., by sending malformed requests that cause SQL failures) and extract the YugabyteDB connection credentials from the error response. With these credentials, the attacker could directly access the database, which serves as Curio\u0027s control plane.\n\nPer Curio\u0027s [security boundary documentation](https://github.com/filecoin-project/curio/blob/main/documentation/en/design/README.md#security-boundary), these endpoints are expected to be on a trusted network. However, defense-in-depth requires that credentials are never exposed through HTTP responses regardless of network trust assumptions.\n\n## Remediation (PR #919)\n\n1. **Connection string password masking:** The password in the connection string is replaced with `********`. The real password is set separately via `cfg.ConnConfig.Password`, so it never appears in error messages or logs.\n\n2. **HTTP handler sanitization:** All affected handlers now log the detailed error server-side and return a generic error message to the HTTP client.\n\n3. **Error filter (`errFilter`):** A new function in the database layer detects and redacts any error messages containing keywords like \"password\", \"host\", \"port\", or \"://\" before they can propagate.\n\n4. **Prometheus metrics cleanup:** Database connection metrics that could expose connection details were removed from the metrics endpoint.\n\n5. **Security boundary documentation:** A new section documents what Curio expects operators to secure.\n\n## Resources\n\n- Fix: https://github.com/filecoin-project/curio/pull/919\n- Patched release: v1.27.3-rc2",
  "id": "GHSA-gj6x-q8rh-wj6x",
  "modified": "2026-02-26T22:48:00Z",
  "published": "2026-02-26T22:48:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/filecoin-project/curio/security/advisories/GHSA-gj6x-q8rh-wj6x"
    },
    {
      "type": "WEB",
      "url": "https://github.com/filecoin-project/curio/pull/919"
    },
    {
      "type": "WEB",
      "url": "https://github.com/filecoin-project/curio/commit/551da78e0123892600d8e6dfe9de7a579055d80b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/filecoin-project/curio"
    },
    {
      "type": "WEB",
      "url": "https://github.com/filecoin-project/curio/blob/main/documentation/en/design/README.md#security-boundary"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Curio exposes database credentials to users with network access through verbose HTTP error responses"
}