Common Weakness Enumeration
CWE-532
AllowedInsertion of Sensitive Information into Log File
Abstraction: Base · Status: Incomplete
The product writes sensitive information to a log file.
1920 vulnerabilities reference this CWE, most recent first.
GHSA-MHJJ-G9CV-766W
Vulnerability from github – Published: 2022-05-14 03:37 – Updated: 2022-05-14 03:37
VLAI
Details
The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2018-7433"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-03-02T20:29:00Z",
"severity": "HIGH"
},
"details": "The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page.",
"id": "GHSA-mhjj-g9cv-766w",
"modified": "2022-05-14T03:37:08Z",
"published": "2022-05-14T03:37:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7433"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/better-wp-security/#developers"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MHP8-7XP2-CHW4
Vulnerability from github – Published: 2025-07-29 06:30 – Updated: 2025-07-29 06:30
VLAI
Details
"SwitchBot" App for iOS/Android contains an insertion of sensitive information into log file vulnerability in versions V6.24 through V9.12. If this vulnerability is exploited, sensitive user information may be exposed to an attacker who has access to the application logs.
Severity
5.1 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-53649"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-29T05:15:32Z",
"severity": "MODERATE"
},
"details": "\"SwitchBot\" App for iOS/Android contains an insertion of sensitive information into log file vulnerability in versions V6.24 through V9.12. If this vulnerability is exploited, sensitive user information may be exposed to an attacker who has access to the application logs.",
"id": "GHSA-mhp8-7xp2-chw4",
"modified": "2025-07-29T06:30:21Z",
"published": "2025-07-29T06:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53649"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN59585716"
},
{
"type": "WEB",
"url": "https://www.switchbot.jp/pages/switchbot-app-vulnerability-fix202507"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-MJ96-MH85-R574
Vulnerability from github – Published: 2025-07-21 19:12 – Updated: 2025-07-21 19:12
VLAI
Summary
buildalon/setup-steamcmd leaked authentication token in job output logs
Details
Summary
Log output includes authentication token that provides full account access
Details
The post job action prints the contents of config/config.vdf which holds the saved authentication token and can be used to sign in on another machine. This means any public use of this action leaves authentication tokes for the associated steam accounts publicly available. Additionally, userdata/$user_id$/config/localconfig.vdf contains potentially sensitive information which should not be included in public logs.
PoC
Use the following workflow step
steps:
- name: Setup SteamCMD
uses: buildalon/setup-steamcmd@v1.0.4
- name: Sign into steam
shell: bash
run: |
steamcmd +login ${{ secrets.WORKSHOP_USERNAME }} ${{ secrets.WORKSHOP_PASSWORD }} +quit
Impact
Anyone who has used this workflow action with a steam account is affected and has had valid authentication tokens leaked in the job logs. This is particularly bad for public repositories, as anyone with a GitHub account can access the logs and view the token.
Severity
{
"affected": [
{
"package": {
"ecosystem": "GitHub Actions",
"name": "buildalon/setup-steamcmd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2025-07-21T19:12:48Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\nLog output includes authentication token that provides full account access\n\n### Details\nThe post job action prints the contents of `config/config.vdf` which holds the saved authentication token and can be used to sign in on another machine. This means any public use of this action leaves authentication tokes for the associated steam accounts publicly available. Additionally, `userdata/$user_id$/config/localconfig.vdf` contains potentially sensitive information which should not be included in public logs.\n\n### PoC\nUse the following workflow step\n```\nsteps:\n - name: Setup SteamCMD\n uses: buildalon/setup-steamcmd@v1.0.4\n\n - name: Sign into steam\n shell: bash\n run: |\n steamcmd +login ${{ secrets.WORKSHOP_USERNAME }} ${{ secrets.WORKSHOP_PASSWORD }} +quit\n```\n\n### Impact\nAnyone who has used this workflow action with a steam account is affected and has had valid authentication tokens leaked in the job logs. This is particularly bad for public repositories, as anyone with a GitHub account can access the logs and view the token.",
"id": "GHSA-mj96-mh85-r574",
"modified": "2025-07-21T19:12:48Z",
"published": "2025-07-21T19:12:48Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/buildalon/setup-steamcmd/security/advisories/GHSA-mj96-mh85-r574"
},
{
"type": "WEB",
"url": "https://github.com/buildalon/setup-steamcmd/commit/c3301963a182b14fd7a5b4991e6ae91ed39e4a5c"
},
{
"type": "PACKAGE",
"url": "https://github.com/buildalon/setup-steamcmd"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "buildalon/setup-steamcmd leaked authentication token in job output logs"
}
GHSA-MJJG-JGRJ-9453
Vulnerability from github – Published: 2025-02-11 21:32 – Updated: 2025-02-13 18:32
VLAI
Details
A security issue in Sitevision version 10.3.1 and older allows a remote attacker, in certain (non-default) scenarios, to gain access to the private keys used for signing SAML Authn requests. The underlying issue is a Java keystore that may become accessible and downloadable via WebDAV. This keystore is protected with a low-complexity, auto-generated password.
Severity
5.1 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-35202"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-11T19:15:10Z",
"severity": "MODERATE"
},
"details": "A security issue in Sitevision version 10.3.1 and older allows a remote attacker, in certain (non-default) scenarios, to gain access to the private keys used for signing SAML Authn requests. The underlying issue is a Java keystore that may become accessible and downloadable via WebDAV. This keystore is protected with a low-complexity, auto-generated password.",
"id": "GHSA-mjjg-jgrj-9453",
"modified": "2025-02-13T18:32:31Z",
"published": "2025-02-11T21:32:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-35202"
},
{
"type": "WEB",
"url": "https://developer.sitevision.se/archives/release-notes/release-notes/2022-05-06-release-notes-sitevision-10.3"
},
{
"type": "WEB",
"url": "https://www.shelltrail.com/research/how-auto-generated-passwords-in-sitevision-leads-to-signing-key-leakage-cve-2022-35202"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MJR4-9RV8-9G3F
Vulnerability from github – Published: 2022-05-13 01:34 – Updated: 2022-05-13 01:34
VLAI
Details
Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of unencrypted data in logs. An attacker could exploit this vulnerability to obtain two API keys, a token and other sensitive information.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2018-17499"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-03-21T16:00:00Z",
"severity": "MODERATE"
},
"details": "Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of unencrypted data in logs. An attacker could exploit this vulnerability to obtain two API keys, a token and other sensitive information.",
"id": "GHSA-mjr4-9rv8-9g3f",
"modified": "2022-05-13T01:34:02Z",
"published": "2022-05-13T01:34:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17499"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/149659"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MJV9-VP6W-3RC9
Vulnerability from github – Published: 2023-04-26 16:01 – Updated: 2026-04-06 17:17
VLAI
Summary
AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending
Details
The aws_sigv4::SigningParams struct had a derived Debug implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, SigningParams is printed, thereby revealing those credentials to anyone with access to logs.
Impact
All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. RUST_LOG=trace), or for the aws-sigv4 crate specifically.
Patches
- Versions >=
0.55.1 0.54.20.53.20.52.10.51.10.50.10.49.10.48.10.47.10.46.10.15.10.14.10.13.10.12.10.11.10.10.20.9.10.8.10.7.10.6.10.5.30.3.10.2.1
Workarounds
Disable TRACE-level logging for AWS Rust SDK crates.
Severity
5.5 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "aws-sigv4"
},
"ranges": [
{
"events": [
{
"introduced": "0.55.0"
},
{
"fixed": "0.55.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.55.0"
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "aws-sigv4"
},
"ranges": [
{
"events": [
{
"introduced": "0.54.1"
},
{
"fixed": "0.54.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.54.1"
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "aws-sigv4"
},
"ranges": [
{
"events": [
{
"introduced": "0.53.1"
},
{
"fixed": "0.53.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.53.1"
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "aws-sigv4"
},
"ranges": [
{
"events": [
{
"introduced": "0.52.0"
},
{
"fixed": "0.52.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.52.0"
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "aws-sigv4"
},
"ranges": [
{
"events": [
{
"introduced": "0.51.0"
},
{
"fixed": "0.51.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.51.0"
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "aws-sigv4"
},
"ranges": [
{
"events": [
{
"introduced": "0.49.0"
},
{
"fixed": "0.49.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.49.0"
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "aws-sigv4"
},
"ranges": [
{
"events": [
{
"introduced": "0.48.0"
},
{
"fixed": "0.48.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.48.0"
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "aws-sigv4"
},
"ranges": [
{
"events": [
{
"introduced": "0.47.0"
},
{
"fixed": "0.47.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.47.0"
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "aws-sigv4"
},
"ranges": [
{
"events": [
{
"introduced": "0.46.0"
},
{
"fixed": "0.46.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.46.0"
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "aws-sigv4"
},
"ranges": [
{
"events": [
{
"introduced": "0.15.0"
},
{
"fixed": "0.15.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.15.0"
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "aws-sigv4"
},
"ranges": [
{
"events": [
{
"introduced": "0.14.0"
},
{
"fixed": "0.14.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.14.0"
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "aws-sigv4"
},
"ranges": [
{
"events": [
{
"introduced": "0.13.0"
},
{
"fixed": "0.13.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.13.0"
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "aws-sigv4"
},
"ranges": [
{
"events": [
{
"introduced": "0.12.0"
},
{
"fixed": "0.12.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.12.0"
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "aws-sigv4"
},
"ranges": [
{
"events": [
{
"introduced": "0.11.0"
},
{
"fixed": "0.11.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.11.0"
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "aws-sigv4"
},
"ranges": [
{
"events": [
{
"introduced": "0.10.1"
},
{
"fixed": "0.10.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.10.1"
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "aws-sigv4"
},
"ranges": [
{
"events": [
{
"introduced": "0.9.0"
},
{
"fixed": "0.9.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.9.0"
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "aws-sigv4"
},
"ranges": [
{
"events": [
{
"introduced": "0.8.0"
},
{
"fixed": "0.8.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.8.0"
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "aws-sigv4"
},
"ranges": [
{
"events": [
{
"introduced": "0.7.0"
},
{
"fixed": "0.7.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.7.0"
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "aws-sigv4"
},
"ranges": [
{
"events": [
{
"introduced": "0.6.0"
},
{
"fixed": "0.6.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.6.0"
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "aws-sigv4"
},
"ranges": [
{
"events": [
{
"introduced": "0.5.2"
},
{
"fixed": "0.5.3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.5.2"
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "aws-sigv4"
},
"ranges": [
{
"events": [
{
"introduced": "0.4.1"
},
{
"fixed": "0.4.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.4.1"
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "aws-sigv4"
},
"ranges": [
{
"events": [
{
"introduced": "0.3.0"
},
{
"fixed": "0.3.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.3.0"
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "aws-sigv4"
},
"ranges": [
{
"events": [
{
"introduced": "0.2.0"
},
{
"fixed": "0.2.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.2.0"
]
}
],
"aliases": [
"CVE-2023-30610"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2023-04-26T16:01:10Z",
"nvd_published_at": "2023-04-19T18:15:07Z",
"severity": "MODERATE"
},
"details": "The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation. When debug-formatted, it would include a user\u0027s AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, `SigningParams` is printed, thereby revealing those credentials to anyone with access to logs.\n\n### Impact\nAll users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. `RUST_LOG=trace`), or for the `aws-sigv4` crate specifically.\n\n### Patches\n- Versions \u003e= `0.55.1`\n- `0.54.2`\n- `0.53.2`\n- `0.52.1`\n- `0.51.1`\n- `0.50.1`\n- `0.49.1`\n- `0.48.1`\n- `0.47.1`\n- `0.46.1`\n- `0.15.1`\n- `0.14.1`\n- `0.13.1`\n- `0.12.1`\n- `0.11.1`\n- `0.10.2`\n- `0.9.1`\n- `0.8.1`\n- `0.7.1`\n- `0.6.1`\n- `0.5.3`\n- `0.3.1`\n- `0.2.1`\n\n### Workarounds\nDisable TRACE-level logging for AWS Rust SDK crates.",
"id": "GHSA-mjv9-vp6w-3rc9",
"modified": "2026-04-06T17:17:04Z",
"published": "2023-04-26T16:01:10Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/awslabs/aws-sdk-rust/security/advisories/GHSA-mjv9-vp6w-3rc9"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30610"
},
{
"type": "PACKAGE",
"url": "https://github.com/awslabs/aws-sdk-rust"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2023-0125.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending"
}
GHSA-MM4C-WVRQ-74QM
Vulnerability from github – Published: 2026-09-08 21:34 – Updated: 2026-09-08 21:34
VLAI
Details
The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. The credential is recorded in plaintext in the installer log, the Application Event Log, and the process command line, all of which are readable by an authenticated local user on the workstation.
Severity
7.3 (High)
{
"affected": [],
"aliases": [
"CVE-2026-78627"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-08T20:18:38Z",
"severity": "HIGH"
},
"details": "The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. The credential is recorded in plaintext in the installer log, the Application Event Log, and the process command line, all of which are readable by an authenticated local user on the workstation.",
"id": "GHSA-mm4c-wvrq-74qm",
"modified": "2026-09-08T21:34:29Z",
"published": "2026-09-08T21:34:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78627"
},
{
"type": "WEB",
"url": "https://trust.okta.com/security-advisories/improper-credential-protection-in-okta-hyperdrive-integration-installer-logging-cve-2026-78627"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MMC8-8J7M-RCWJ
Vulnerability from github – Published: 2025-09-12 18:31 – Updated: 2025-09-12 18:31
VLAI
Details
A problem with the Palo Alto Networks Cortex XDR Microsoft 365 Defender Pack can result in exposure of user credentials in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these credentials are exposed to recipients of the application logs.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-4234"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-12T18:15:34Z",
"severity": "LOW"
},
"details": "A problem with the Palo Alto Networks Cortex XDR Microsoft 365 Defender Pack can result in exposure of user credentials in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these credentials are exposed to recipients of the application logs.",
"id": "GHSA-mmc8-8j7m-rcwj",
"modified": "2025-09-12T18:31:10Z",
"published": "2025-09-12T18:31:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4234"
},
{
"type": "WEB",
"url": "https://security.paloaltonetworks.com/CVE-2025-4234"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber",
"type": "CVSS_V4"
}
]
}
GHSA-MMW4-F58V-GJ6M
Vulnerability from github – Published: 2025-01-14 18:32 – Updated: 2025-01-14 18:32
VLAI
Details
Windows Kernel Memory Information Disclosure Vulnerability
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-21319"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-14T18:15:56Z",
"severity": "MODERATE"
},
"details": "Windows Kernel Memory Information Disclosure Vulnerability",
"id": "GHSA-mmw4-f58v-gj6m",
"modified": "2025-01-14T18:32:04Z",
"published": "2025-01-14T18:32:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21319"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21319"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MP65-CJ4X-X9FQ
Vulnerability from github – Published: 2022-05-24 19:04 – Updated: 2022-05-24 19:04
VLAI
Details
Dell EMC NetWorker, 18.x, 19.1.x, 19.2.x 19.3.x, 19.4 and 19.4.0.1, contains an Information Disclosure vulnerability. A local administrator of the gstd system may potentially exploit this vulnerability to read LDAP credentials from local logs and use the stolen credentials to make changes to the network domain.
{
"affected": [],
"aliases": [
"CVE-2021-21558"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-08T18:15:00Z",
"severity": "MODERATE"
},
"details": "Dell EMC NetWorker, 18.x, 19.1.x, 19.2.x 19.3.x, 19.4 and 19.4.0.1, contains an Information Disclosure vulnerability. A local administrator of the gstd system may potentially exploit this vulnerability to read LDAP credentials from local logs and use the stolen credentials to make changes to the network domain.",
"id": "GHSA-mp65-cj4x-x9fq",
"modified": "2022-05-24T19:04:19Z",
"published": "2022-05-24T19:04:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21558"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000186638/dsa-2021-104-dell-emc-networker-security-update-for-multiple-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
Architecture and Design
Implementation
Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
Mitigation
Distribution
Remove debug log files before deploying the application into production.
Mitigation
Operation
Protect log files against unauthorized read/write.
Mitigation
Implementation
Adjust configurations appropriately when software is transitioned from a debug state to production.
CAPEC-215: Fuzzing for application mapping
An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes the application's log or error messages returned. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to observe the application's log and error messages, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash.