Insertion of Sensitive Information into Log File

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

CVEs (1,164)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2017-8074 1Tp Link 1Tl Sg108e Firmware May 13, 2026 Apr 23, 2017 N/A· v4 9.8 CRITICAL· v3 5.0 MEDIUM· v2 On the TP-Link TL-SG108E 1.0, a remote attacker could retrieve credentials from "SEND data" log lines where passwords are encoded in hexadecimal. This affects the 1.1.2 Build 20141017 Rel.50749 firmware.
CVE-2017-7214 1Openstack 1Nova May 13, 2026 Mar 21, 2017 N/A· v4 9.8 CRITICAL· v3 5.0 MEDIUM· v2 An issue was discovered in exception_wrapper.py in OpenStack Nova 13.x through 13.1.3, 14.x through 14.0.4, and 15.x through 15.0.1. Legacy notification exception contexts appearing in ERROR level logs may include sensit...Show more An issue was discovered in exception_wrapper.py in OpenStack Nova 13.x through 13.1.3, 14.x through 14.0.4, and 15.x through 15.0.1. Legacy notification exception contexts appearing in ERROR level logs may include sensitive information such as account passwords and authorization tokens.Show less
CVE-2016-9985 1Ibm 1Cognos Business Intelligence May 13, 2026 Mar 8, 2017 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 IBM Cognos Server 10.1.1 and 10.2 stores highly sensitive information in log files that could be read by a local user. IBM Reference #: 1999671.
CVE-2016-8233 1Lenovo 1Xclarity Administrator May 13, 2026 Mar 1, 2017 N/A· v4 9.8 CRITICAL· v3 5.0 MEDIUM· v2 Log files generated by Lenovo XClarity Administrator (LXCA) versions earlier than 1.2.2 may contain user credentials in a non-secure, clear text form that could be viewed by a non-privileged user.
CVE-2017-5153 1Osisoft 2Pi Coresight Pi Web Api May 13, 2026 Feb 13, 2017 N/A· v4 7.8 HIGH· v3 2.1 LOW· v2 An issue was discovered in OSIsoft PI Coresight 2016 R2 and earlier versions, and PI Web API 2016 R2 when deployed using the PI AF Services 2016 R2 integrated install kit. An information exposure through server log files...Show more An issue was discovered in OSIsoft PI Coresight 2016 R2 and earlier versions, and PI Web API 2016 R2 when deployed using the PI AF Services 2016 R2 integrated install kit. An information exposure through server log files vulnerability has been identified, which may allow service account passwords to become exposed for the affected services, potentially leading to unauthorized shutdown of the affected PI services as well as potential reuse of domain credentials.Show less
CVE-2016-9344 1Moxa 3Miineport E1 Firmware Miineport E2 FirmwareMiineport E3 Firmware May 13, 2026 Feb 13, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An issue was discovered in Moxa MiiNePort E1 versions prior to 1.8, E2 versions prior to 1.4, and E3 versions prior to 1.1. An attacker may be able to brute force an active session cookie to be able to download configura...Show more An issue was discovered in Moxa MiiNePort E1 versions prior to 1.8, E2 versions prior to 1.4, and E3 versions prior to 1.1. An attacker may be able to brute force an active session cookie to be able to download configuration files.Show less
CVE-2016-8346 1Moxa 1Edr 810 Firmware May 13, 2026 Feb 13, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An issue was discovered in Moxa EDR-810 Industrial Secure Router. By accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to access configuration and log files (PRIVILEGE ESCALA...Show more An issue was discovered in Moxa EDR-810 Industrial Secure Router. By accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to access configuration and log files (PRIVILEGE ESCALATION).Show less
CVE-2017-5549 1Linux 1Linux Kernel May 13, 2026 Feb 6, 2017 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 The klsi_105_get_line_state function in drivers/usb/serial/kl5kusb105.c in the Linux kernel before 4.9.5 places uninitialized heap-memory contents into a log entry upon a failure to read the line status, which allows loc...Show more The klsi_105_get_line_state function in drivers/usb/serial/kl5kusb105.c in the Linux kernel before 4.9.5 places uninitialized heap-memory contents into a log entry upon a failure to read the line status, which allows local users to obtain sensitive information by reading the log.Show less
CVE-2017-5137 1Sendquick 2Avera Sms Gateway Firmware Entera Sms Gateway Firmware May 13, 2026 Feb 5, 2017 N/A· v4 6.2 MEDIUM· v3 5.0 MEDIUM· v2 An issue was discovered on SendQuick Entera and Avera devices before 2HF16. An attacker could request and download the SMS logs from an unauthenticated perspective.
CVE-2016-8912 1Ibm 1Kenexa Lms On Cloud May 13, 2026 Feb 1, 2017 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 stores potentially sensitive information in in log files that could be read by an authenticated user.
CVE-2016-0296 1Ibm 1Bigfix Platform May 13, 2026 Feb 1, 2017 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 IBM Tivoli Endpoint Manager - Mobile Device Management (MDM) stores potentially sensitive information in log files that could be available to a local user.
CVE-2015-8977 1Mybb 2Merge System Mybb May 13, 2026 Jan 31, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via vectors involving error log files.
CVE-2016-9882 1Cloudfoundry 2Capi Release Cf Release May 13, 2026 Jan 13, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v250 and CAPI-release versions prior to v1.12.0. Cloud Foundry logs the credentials returned from service brokers in Cloud Controller syste...Show more An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v250 and CAPI-release versions prior to v1.12.0. Cloud Foundry logs the credentials returned from service brokers in Cloud Controller system component logs. These logs are written to disk and often sent to a log aggregator via syslog.Show less
CVE-2016-4443 1Redhat 1Enterprise Virtualization May 6, 2026 Dec 14, 2016 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 Red Hat Enterprise Virtualization (RHEV) Manager 3.6 allows local users to obtain encryption keys, certificates, and other sensitive information by reading the engine-setup log file.
CVE-2016-2943 1Ibm 1Bigfix Remote Control May 6, 2026 Nov 30, 2016 N/A· v4 1.9 LOW· v3 1.9 LOW· v2 IBM BigFix Remote Control before 9.1.3 allows local users to obtain sensitive information by leveraging unspecified privileges to read a log file.
CVE-2016-2928 1Ibm 1Bigfix Remote Control May 6, 2026 Nov 25, 2016 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 IBM BigFix Remote Control before 9.1.3 allows remote authenticated users to obtain sensitive information by reading error logs.
CVE-2016-5967 1Ibm 1Rational Asset Analyzer May 6, 2026 Nov 25, 2016 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 The installation component in IBM Rational Asset Analyzer (RAA) 6.1.0 before FP10 allows local users to discover the WAS Admin password by reading IM native logs.
CVE-2016-5432 1Redhat 1Enterprise Virtualization May 6, 2026 Oct 3, 2016 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 The ovirt-engine-provisiondb utility in Red Hat Enterprise Virtualization (RHEV) Engine 4.0 allows local users to obtain sensitive database provisioning information by reading log files.
CVE-2016-0879 1Moxa 1Edr G903 Firmware May 6, 2026 May 31, 2016 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 Moxa Secure Router EDR-G903 devices before 3.4.12 do not delete copies of configuration and log files after completing the import function, which allows remote attackers to obtain sensitive information by requesting thes...Show more Moxa Secure Router EDR-G903 devices before 3.4.12 do not delete copies of configuration and log files after completing the import function, which allows remote attackers to obtain sensitive information by requesting these files at an unspecified URL.Show less
CVE-2016-0875 1Moxa 1Edr G903 Firmware May 6, 2026 May 31, 2016 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Moxa Secure Router EDR-G903 devices before 3.4.12 allow remote attackers to read configuration and log files via a crafted URL.

Previous 1...55 56 575859 Next