CWE-532
AllowedInsertion of Sensitive Information into Log File
Abstraction: Base · Status: Incomplete
The product writes sensitive information to a log file.
1744 vulnerabilities reference this CWE, most recent first.
GHSA-3WCR-5C6G-86GM
Vulnerability from github – Published: 2026-06-04 09:30 – Updated: 2026-06-04 21:31System log files output unencrypted SMTP server authentication passwords alongside sensitive employee corporate identification data.
{
"affected": [],
"aliases": [
"CVE-2026-50205"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-04T07:16:28Z",
"severity": "HIGH"
},
"details": "System log files output unencrypted SMTP server authentication passwords alongside sensitive employee corporate identification data.",
"id": "GHSA-3wcr-5c6g-86gm",
"modified": "2026-06-04T21:31:20Z",
"published": "2026-06-04T09:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50205"
},
{
"type": "WEB",
"url": "https://community.acer.com/en/kb/articles/19707"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-3WG5-X88W-52FJ
Vulnerability from github – Published: 2024-10-09 18:31 – Updated: 2024-10-17 06:30A cleartext storage of sensitive information vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to reveal firewall usernames, passwords, and API keys generated using those credentials.
{
"affected": [],
"aliases": [
"CVE-2024-9466"
],
"database_specific": {
"cwe_ids": [
"CWE-312",
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-09T17:15:20Z",
"severity": "HIGH"
},
"details": "A cleartext storage of sensitive information vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to reveal firewall usernames, passwords, and API keys generated using those credentials.",
"id": "GHSA-3wg5-x88w-52fj",
"modified": "2024-10-17T06:30:32Z",
"published": "2024-10-09T18:31:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9466"
},
{
"type": "WEB",
"url": "https://security.paloaltonetworks.com/PAN-SA-2024-0010"
},
{
"type": "WEB",
"url": "https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:H/U:Red",
"type": "CVSS_V4"
}
]
}
GHSA-3WG9-G32R-G6J2
Vulnerability from github – Published: 2023-05-22 09:30 – Updated: 2024-04-04 04:16Insertion of Sensitive Information into Log File vulnerability in ABB QCS 800xA, ABB QCS AC450, ABB Platform Engineering Tools.
An attacker, who already has local access to the QCS nodes, could successfully obtain the password for a system user account. Using this information, the attacker could have the potential to exploit this vulnerability to gain control of system nodes.
This issue affects QCS 800xA: from 1.0;0 through 6.1SP2; QCS AC450: from 1.0;0 through 5.1SP2; Platform Engineering Tools: from 1.0:0 through 2.3.0.
{
"affected": [],
"aliases": [
"CVE-2022-0010"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-22T08:15:08Z",
"severity": "MODERATE"
},
"details": "Insertion of Sensitive Information into Log File vulnerability in ABB QCS 800xA, ABB QCS AC450, ABB Platform Engineering Tools.\n\n\nAn attacker, who already has local access to the QCS nodes, could successfully obtain the password for a system user account. Using this information, the attacker could have the potential to exploit this vulnerability to gain control of system nodes. \n\nThis issue affects QCS 800xA: from 1.0;0 through 6.1SP2; QCS AC450: from 1.0;0 through 5.1SP2; Platform Engineering Tools: from 1.0:0 through 2.3.0.\n\n",
"id": "GHSA-3wg9-g32r-g6j2",
"modified": "2024-04-04T04:16:03Z",
"published": "2023-05-22T09:30:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0010"
},
{
"type": "WEB",
"url": "https://search.abb.com/library/Download.aspx?DocumentID=3BUS221709\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch\u0026_ga=2.108646530.1437951308.1684739395-1142547495.1678209228"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3X3Q-GHCP-WHF7
Vulnerability from github – Published: 2025-08-15 18:43 – Updated: 2025-09-26 17:19A logging flaw in Backstage Scaffolder’s fetch:template action up to @backstage/plugin-scaffolder-backend 2.1.0 may write template secrets to logs. The action emitted a duplicate, pre-redaction copy of input parameters, so values provided via the {{ secrets }} bag could appear in local/server logs when the action ran. Exploitation requires use of the secrets argument and access to Scaffolder/build logs; integrity and availability are unaffected.
- Fix: upgrade to
2.1.1, which removes the duplicate log path and ensures secrets are redacted. - Mitigation: avoid passing
{{ secrets }}tofetch:templateif upgrade is not possible.
Open an issue in the Backstage repository
Visit our Discord, linked to in Backstage README
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.1.0"
},
"package": {
"ecosystem": "npm",
"name": "@backstage/plugin-scaffolder-backend"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-55285"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2025-08-15T18:43:16Z",
"nvd_published_at": "2025-08-15T18:15:27Z",
"severity": "LOW"
},
"details": "A logging flaw in Backstage Scaffolder\u2019s `fetch:template` action up to `@backstage/plugin-scaffolder-backend` **2.1.0** may write template secrets to logs. The action emitted a duplicate, pre-redaction copy of input parameters, so values provided via the `{{ secrets }}` bag could appear in local/server logs when the action ran. Exploitation requires use of the `secrets` argument and access to Scaffolder/build logs; integrity and availability are unaffected.\n\n* **Fix:** upgrade to `2.1.1`, which removes the duplicate log path and ensures secrets are redacted.\n* **Mitigation:** avoid passing `{{ secrets }}` to `fetch:template` if upgrade is not possible.\n\n\u003e Open an issue in the [Backstage repository](https://github.com/backstage/backstage)\n\u003e\n\u003e Visit our Discord, linked to in [Backstage README](https://github.com/backstage/backstage)",
"id": "GHSA-3x3q-ghcp-whf7",
"modified": "2025-09-26T17:19:17Z",
"published": "2025-08-15T18:43:16Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/backstage/backstage/security/advisories/GHSA-3x3q-ghcp-whf7"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55285"
},
{
"type": "WEB",
"url": "https://github.com/backstage/backstage/commit/c371f6fe12371de31dca537510e6653e287cdc2e"
},
{
"type": "PACKAGE",
"url": "https://github.com/backstage/backstage"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Template Secret leakage in logs in Scaffolder when using `fetch:template`"
}
GHSA-3XC7-XG67-PW99
Vulnerability from github – Published: 2019-06-05 20:43 – Updated: 2021-08-04 20:54Versions of sequelize-cli prior to 5.5.0 are vulnerable to Sensitive Data Exposure. The function filteredURL() does not properly sanitize the config.password value which may cause passwords with special characters to be logged in plain text.
Recommendation
Upgrade to version 5.5.0 or later.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "sequelize-cli"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.4.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2019-06-05T20:42:54Z",
"nvd_published_at": null,
"severity": "LOW"
},
"details": "Versions of `sequelize-cli` prior to 5.5.0 are vulnerable to Sensitive Data Exposure. The function `filteredURL()` does not properly sanitize the `config.password` value which may cause passwords with special characters to be logged in plain text.\n\n\n## Recommendation\n\nUpgrade to version 5.5.0 or later.",
"id": "GHSA-3xc7-xg67-pw99",
"modified": "2021-08-04T20:54:45Z",
"published": "2019-06-05T20:43:10Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/sequelize/cli/issues/172"
},
{
"type": "WEB",
"url": "https://github.com/sequelize/cli/pull/722"
},
{
"type": "WEB",
"url": "https://github.com/FelixLC/cli/commit/da59652c061a798282e18efad0b6d0afefa15465"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-SEQUELIZECLI-174320"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/825"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Sensitive Data Exposure in sequelize-cli"
}
GHSA-3XR7-767Q-QR44
Vulnerability from github – Published: 2026-05-28 06:31 – Updated: 2026-05-28 06:31This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.
{
"affected": [],
"aliases": [
"CVE-2026-32996"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-28T05:16:35Z",
"severity": "HIGH"
},
"details": "This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.",
"id": "GHSA-3xr7-767q-qr44",
"modified": "2026-05-28T06:31:08Z",
"published": "2026-05-28T06:31:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32996"
},
{
"type": "WEB",
"url": "https://www.veeam.com/kb4852"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-423P-CH83-27QW
Vulnerability from github – Published: 2022-05-24 17:37 – Updated: 2022-05-24 17:37Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contain a plain-text password storage vulnerability. A user credentials (including the Unisphere admin privilege user) password is stored in a plain text in multiple log files. A local authenticated attacker with access to the log files may use the exposed password to gain access with the privileges of the compromised user.
{
"affected": [],
"aliases": [
"CVE-2020-26199"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-01-05T22:15:00Z",
"severity": "MODERATE"
},
"details": "Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contain a plain-text password storage vulnerability. A user credentials (including the Unisphere admin privilege user) password is stored in a plain text in multiple log files. A local authenticated attacker with access to the log files may use the exposed password to gain access with the privileges of the compromised user.",
"id": "GHSA-423p-ch83-27qw",
"modified": "2022-05-24T17:37:59Z",
"published": "2022-05-24T17:37:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26199"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/000181248"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-4255-C27H-62M5
Vulnerability from github – Published: 2026-02-10 00:25 – Updated: 2026-02-10 02:56The sign-package command in @rage-against-the-pixel/unity-cli logs sensitive credentials in plaintext when the --verbose flag is used. Command-line arguments including --email and --password are output via JSON.stringify without sanitization, exposing secrets to shell history, CI/CD logs, and log aggregation systems.
Users who run sign-package with --verbose and credential arguments expose their Unity account passwords. This affects all versions prior to 1.8.2. The vulnerability requires explicit user action (using --verbose) but creates significant risk in automated and shared environments.
Workaround: Use environment variables (UNITY_USERNAME, UNITY_PASSWORD) instead of command-line arguments, and avoid the --verbose flag when working with credentials.
Existing RageAgainstThePixel and Buildalon GitHub actions are unaffected as they use the environment variables exclusively.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@rage-against-the-pixel/unity-cli"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.8.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-25918"
],
"database_specific": {
"cwe_ids": [
"CWE-352",
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-10T00:25:32Z",
"nvd_published_at": "2026-02-09T22:16:04Z",
"severity": "MODERATE"
},
"details": "The sign-package command in @rage-against-the-pixel/unity-cli logs sensitive credentials in plaintext when the `--verbose` flag is used. Command-line arguments including `--email` and `--password` are output via JSON.stringify without sanitization, exposing secrets to shell history, CI/CD logs, and log aggregation systems.\n\nUsers who run sign-package with `--verbose` and credential arguments expose their Unity account passwords. This affects all versions prior to 1.8.2. The vulnerability requires explicit user action (using `--verbose`) but creates significant risk in automated and shared environments.\n\nWorkaround: Use environment variables (`UNITY_USERNAME`, `UNITY_PASSWORD`) instead of command-line arguments, and avoid the `--verbose` flag when working with credentials.\n\nExisting RageAgainstThePixel and Buildalon GitHub actions are unaffected as they use the environment variables exclusively.",
"id": "GHSA-4255-c27h-62m5",
"modified": "2026-02-10T02:56:53Z",
"published": "2026-02-10T00:25:32Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/RageAgainstThePixel/unity-cli/security/advisories/GHSA-4255-c27h-62m5"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25918"
},
{
"type": "WEB",
"url": "https://github.com/RageAgainstThePixel/unity-cli/commit/8d4d67b23d7c5fd8f00df3f0f10bec2961c95342"
},
{
"type": "PACKAGE",
"url": "https://github.com/RageAgainstThePixel/unity-cli"
},
{
"type": "WEB",
"url": "https://github.com/RageAgainstThePixel/unity-cli/releases/tag/v1.8.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "unity-cli Exposes Plaintext Credentials in Debug Logs (sign-package command)"
}
GHSA-43CP-H386-XGFV
Vulnerability from github – Published: 2025-11-11 18:30 – Updated: 2025-12-08 15:30Login credentials are inadvertently recorded in logs if a Syslog Server is configured in NETGEAR WAX610 and WAX610Y (AX1800 Dual Band PoE Multi-Gig Insight Managed WiFi 6 Access Points). An user having access to the syslog server can read the logs containing these credentials.
This issue affects WAX610: before 10.8.11.4; WAX610Y: before 10.8.11.4.
Devices managed with Insight get automatic updates. If not, please check the firmware version and update to the latest.
Fixed in:
WAX610 firmware 11.8.0.10 or later.
WAX610Y firmware 11.8.0.10 or later.
{
"affected": [],
"aliases": [
"CVE-2025-12940"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-11T17:15:39Z",
"severity": "LOW"
},
"details": "Login credentials are inadvertently recorded in logs if a Syslog Server is configured in NETGEAR WAX610\nand WAX610Y (AX1800 Dual Band PoE Multi-Gig Insight Managed WiFi 6\nAccess Points). An user having access to the syslog server can read the logs containing these credentials.\u00a0\n\nThis issue affects WAX610: before 10.8.11.4; WAX610Y: before 10.8.11.4.\n\n\nDevices\nmanaged with Insight get automatic updates. If not, please check the firmware version\nand update to the latest. \n\n\n\n\n\nFixed in:\n\n\n\nWAX610 firmware\n11.8.0.10 or later.\n\n\n\nWAX610Y firmware\n11.8.0.10 or later.",
"id": "GHSA-43cp-h386-xgfv",
"modified": "2025-12-08T15:30:29Z",
"published": "2025-11-11T18:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12940"
},
{
"type": "WEB",
"url": "https://kb.netgear.com/000070355/NETGEAR-Security-Advisories-November-2025"
},
{
"type": "WEB",
"url": "https://www.netgear.com/support/product/wax610"
},
{
"type": "WEB",
"url": "https://www.netgear.com/support/product/wax610y"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:L/U:Amber",
"type": "CVSS_V4"
}
]
}
GHSA-43M2-C25V-9RRV
Vulnerability from github – Published: 2025-10-24 09:31 – Updated: 2025-10-24 09:31The Quickcreator – AI Blog Writer plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 0.0.9 to 0.1.17 through the /wp-content/plugins/quickcreator/dupasrala.txt file. This makes it possible for unauthenticated attackers to view the plugin's API key and subsequently use that to perform actions on the site like creating new posts and injecting XSS payloads.
{
"affected": [],
"aliases": [
"CVE-2025-11504"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-24T09:15:42Z",
"severity": "HIGH"
},
"details": "The Quickcreator \u2013 AI Blog Writer plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 0.0.9 to 0.1.17 through the /wp-content/plugins/quickcreator/dupasrala.txt file. This makes it possible for unauthenticated attackers to view the plugin\u0027s API key and subsequently use that to perform actions on the site like creating new posts and injecting XSS payloads.",
"id": "GHSA-43m2-c25v-9rrv",
"modified": "2025-10-24T09:31:59Z",
"published": "2025-10-24T09:31:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11504"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/quickcreator"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/561f171e-f13e-408b-a63e-bf6a512d4463?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
Mitigation
Remove debug log files before deploying the application into production.
Mitigation
Protect log files against unauthorized read/write.
Mitigation
Adjust configurations appropriately when software is transitioned from a debug state to production.
CAPEC-215: Fuzzing for application mapping
An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes the application's log or error messages returned. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to observe the application's log and error messages, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash.