Common Weakness Enumeration

CWE-532

Allowed

Insertion of Sensitive Information into Log File

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The product writes sensitive information to a log file.

1739 vulnerabilities reference this CWE, most recent first.

GHSA-RPQ8-Q44M-2RPG

Vulnerability from github – Published: 2025-04-09 18:58 – Updated: 2025-04-09 18:58
VLAI
Summary
Microsoft Identity Web Exposes Client Secrets and Certificate Information in Service Logs
Details

Impact

What kind of vulnerability is it? Who is impacted?

Description: This vulnerability affects confidential client applications, including daemons, web apps, and web APIs. Under specific circumstances, sensitive information such as client secrets or certificate details may be exposed in the service logs of these applications. Service logs are intended to be handled securely.

Impact: The vulnerability impacts service logs that meet the following criteria:

  • Logging Level: Logs are generated at the information level.
  • Credential Descriptions: containing:
    • Local file paths with passwords.
    • Base64 encoded values.
    • Client secret.

Additionally, logs of services using Base64 encoded certificates or certificate paths with password credential descriptions are also affected if the certificates are invalid or expired, regardless of the log level. Note that these credentials are not usable due to their invalid or expired status.

If your service logs are handled securely, you are not impacted.

Otherwise, the following table shows when you can be impacted   | Log Level Information for Microsoft.Identity.Web | Invalid Certificate -- | -- | -- One of the ClientCredentials credential description has a CredentialSource = Base64Encoded or (CredentialSource = Path) | Impacted | Impacted One of the ClientCredentials credential description is a Client secret (CredentialSource = ClientSecret) | Impacted | Not impacted Other credential descriptions | Not Impacted | Not Impacted

Patches

Has the problem been patched? What versions should users upgrade to? To mitigate this vulnerability, update to Microsoft.Identity.Web 3.8.2 or Microsoft.Identity.Abstractions 9.0.0.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading? You can work around the issue in the following ways:

  • Ensure that service logs are handled securely and access to logs is restricted

  • Don’t use LogLevel = Information for the Microsoft.Identity.Web namespace

Recommendation for production environment

Avoid using ClientCredentials with CredentialDescriptions which CredentialSource is ClientSecret, or Base64Encoded, or Path. Rather use certificate from KeyVault or a certificate store, or Federation identity credential with Managed identity.

References

Are there any links users can visit to find out more?

Severity
4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.Identity.Web"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.2.0"
            },
            {
              "fixed": "3.8.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.Identity.Abstractions"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.1.0"
            },
            {
              "fixed": "9.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-32016"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-04-09T18:58:35Z",
    "nvd_published_at": "2025-04-09T16:15:24Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\n**Description:** This vulnerability affects confidential client applications, including daemons, web apps, and web APIs. Under specific circumstances, sensitive information such as client secrets or certificate details may be exposed in the service logs of these applications. Service logs are intended to be handled securely.\n\n**Impact:** The vulnerability impacts service logs that meet the following criteria:\n\n- **Logging Level:** Logs are generated at the information level.\n- **Credential Descriptions:** containing:\n    - Local file paths with passwords.\n    - Base64 encoded values.\n    - Client secret.\n    \nAdditionally, logs of services using Base64 encoded certificates or certificate paths with password credential descriptions are also affected if the certificates are invalid or expired, regardless of the log level. Note that these credentials are not usable due to their invalid or expired status.\n\nIf your service logs are handled securely, you are not impacted. \n\nOtherwise, the following table shows when you can be impacted \n\u00a0 | Log Level Information for Microsoft.Identity.Web | Invalid Certificate\n-- | -- | --\nOne of the ClientCredentials credential description has a CredentialSource = Base64Encoded or (CredentialSource = Path) | Impacted | Impacted\nOne of the ClientCredentials credential description is a Client secret (CredentialSource = ClientSecret) | Impacted | Not impacted\nOther credential descriptions | Not Impacted | Not Impacted\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\nTo mitigate this vulnerability, update to Microsoft.Identity.Web 3.8.2 or Microsoft.Identity.Abstractions 9.0.0.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\nYou can work around the issue in the following ways: \n\n- Ensure that service logs are handled securely and access to logs is restricted\n\n- Don\u2019t use `LogLevel = Information` for the Microsoft.Identity.Web namespace \n\n### Recommendation for production environment\nAvoid using `ClientCredentials` with [`CredentialDescriptions`](https://learn.microsoft.com/en-us/dotnet/api/microsoft.identity.abstractions.credentialdescription.base64encodedvalue?view=msal-model-dotnet-latest) which `CredentialSource` is `ClientSecret`, or `Base64Encoded`, or `Path`. Rather use certificate from KeyVault or a certificate store, or Federation identity credential with Managed identity.\n\n### References\n_Are there any links users can visit to find out more?_",
  "id": "GHSA-rpq8-q44m-2rpg",
  "modified": "2025-04-09T18:58:35Z",
  "published": "2025-04-09T18:58:35Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/AzureAD/microsoft-identity-web/security/advisories/GHSA-rpq8-q44m-2rpg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32016"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/AzureAD/microsoft-identity-web"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Microsoft Identity Web Exposes Client Secrets and Certificate Information in Service Logs"
}

GHSA-RQ5C-HVW6-8PR7

Vulnerability from github – Published: 2023-08-29 17:35 – Updated: 2023-08-29 17:35
VLAI
Summary
Improper log output when using GitHub Status Notifications in spinnaker
Details

Impact

ONLY IMPACTS those use GitHub Status Notifications

Log output when updating GitHub status is improperly set to FULL always. It's recommended to apply the patch and rotate the GitHub token used for github status notifications. Given that this would output github tokens to a log system, the risk is slightly higher than a "low" since token exposure could grant elevated access to repositories outside of control. If using READ restricted tokens, the exposure is such that the token itself could be used to access resources otherwise restricted from reads.

Patches

Patch is in progress. https://github.com/spinnaker/echo/pull/1316

Workarounds

Disable GH Status Notifications. Filter your logs for Echo log data. Use read-only tokens that are limited in scope.

References

sig-security in slack: https://spinnakerteam.slack.com/archives/CFN8F5UR2

Severity
4.0 (Medium)
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 1.28.8"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/spinnaker/spinnaker"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 1.29.6"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/spinnaker/spinnaker"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.29.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 1.30.3"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/spinnaker/spinnaker"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.30.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 1.31.1"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/spinnaker/spinnaker"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.31.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-39348"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-08-29T17:35:55Z",
    "nvd_published_at": "2023-08-28T20:15:08Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nONLY IMPACTS those use GitHub Status Notifications\n\nLog output when updating GitHub status is improperly set to FULL always.  It\u0027s recommended to apply the patch and rotate the GitHub token used for github status notifications.  Given that this would output github tokens to a log system, the risk is slightly higher than a \"low\" since token exposure could grant elevated access to repositories outside of control.  If using READ restricted tokens, the exposure is such that the token itself could be used to access resources otherwise restricted from reads.\n\n### Patches\nPatch is in progress.  https://github.com/spinnaker/echo/pull/1316\n\n### Workarounds\nDisable GH Status Notifications.  Filter your logs for Echo log data.  Use read-only tokens that are limited in scope.\n\n### References\nsig-security in slack: https://spinnakerteam.slack.com/archives/CFN8F5UR2\n",
  "id": "GHSA-rq5c-hvw6-8pr7",
  "modified": "2023-08-29T17:35:55Z",
  "published": "2023-08-29T17:35:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/spinnaker/spinnaker/security/advisories/GHSA-rq5c-hvw6-8pr7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39348"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spinnaker/echo/pull/1316"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/spinnaker/spinnaker"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Improper log output when using GitHub Status Notifications in spinnaker"
}

GHSA-RQ7M-QRQ2-MRG5

Vulnerability from github – Published: 2026-02-18 18:30 – Updated: 2026-02-23 15:31
VLAI
Details

In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster (SHC) deployment who holds a role with access to the Splunk _internal index could view the RSA accessKey value from the Authentication.conf file, in plain text.

Severity
6.8 (Medium)
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-20142"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-18T18:24:28Z",
    "severity": "MODERATE"
  },
  "details": "In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster (SHC) deployment who holds a role with access to the Splunk `_internal` index could view the RSA `accessKey` value from the [\u003cu\u003eAuthentication.conf\u003c/u\u003e ](https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/configuration-file-reference/10.2.0-configuration-file-reference/authentication.conf)file, in plain text.",
  "id": "GHSA-rq7m-qrq2-mrg5",
  "modified": "2026-02-23T15:31:14Z",
  "published": "2026-02-18T18:30:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20142"
    },
    {
      "type": "WEB",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0207"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-RQJ8-P2P7-JM55

Vulnerability from github – Published: 2022-03-24 00:00 – Updated: 2022-03-29 00:01
VLAI
Details

In CMDBuild from version 3.0 to 3.3.2 payload requests are saved in a temporary log table, which allows attackers with database access to read the password of the users who login to the application by querying the database table.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-25518"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-03-22T22:15:00Z",
    "severity": "MODERATE"
  },
  "details": "In CMDBuild from version 3.0 to 3.3.2 payload requests are saved in a temporary log table, which allows attackers with database access to read the password of the users who login to the application by querying the database table.",
  "id": "GHSA-rqj8-p2p7-jm55",
  "modified": "2022-03-29T00:01:21Z",
  "published": "2022-03-24T00:00:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25518"
    },
    {
      "type": "WEB",
      "url": "https://www.cmdbuild.org/en/reference/news/cmdbuild-3-3-3-intermediate-release-vulnerability-patch"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-RQRG-PC6Q-82HQ

Vulnerability from github – Published: 2024-07-07 00:37 – Updated: 2024-07-09 18:30
VLAI
Details

An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. The Special:Investigate feature can expose suppressed information for log events. (TimelineService does not support properly suppressing.)

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-40596"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-07T00:15:10Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. The Special:Investigate feature can expose suppressed information for log events. (TimelineService does not support properly suppressing.)",
  "id": "GHSA-rqrg-pc6q-82hq",
  "modified": "2024-07-09T18:30:43Z",
  "published": "2024-07-07T00:37:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40596"
    },
    {
      "type": "WEB",
      "url": "https://phabricator.wikimedia.org/T326866"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-RR6G-PJV7-W942

Vulnerability from github – Published: 2025-10-14 18:30 – Updated: 2025-10-14 18:30
VLAI
Details

Insertion of sensitive information into log file in Windows StateRepository API allows an authorized attacker to disclose information locally.

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-59203"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-14T17:16:00Z",
    "severity": "MODERATE"
  },
  "details": "Insertion of sensitive information into log file in Windows StateRepository API allows an authorized attacker to disclose information locally.",
  "id": "GHSA-rr6g-pjv7-w942",
  "modified": "2025-10-14T18:30:34Z",
  "published": "2025-10-14T18:30:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59203"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59203"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-RR73-64X7-PP2W

Vulnerability from github – Published: 2022-05-14 03:00 – Updated: 2022-05-14 03:00
VLAI
Details

Under certain circumstances SAP Dynamic Authorization Management (DAM) by NextLabs (Java Policy Controller versions 7.7 and 8.5) exposes sensitive information in the application logs.

Severity
4.4 (Medium)
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2018-2440"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-07-10T18:29:00Z",
    "severity": "MODERATE"
  },
  "details": "Under certain circumstances SAP Dynamic Authorization Management (DAM) by NextLabs (Java Policy Controller versions 7.7 and 8.5) exposes sensitive information in the application logs.",
  "id": "GHSA-rr73-64x7-pp2w",
  "modified": "2022-05-14T03:00:58Z",
  "published": "2022-05-14T03:00:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-2440"
    },
    {
      "type": "WEB",
      "url": "https://launchpad.support.sap.com/#/notes/2664767"
    },
    {
      "type": "WEB",
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=497256000"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-RR7J-V2Q5-CHGV

Vulnerability from github – Published: 2026-04-16 01:20 – Updated: 2026-04-24 20:52
VLAI
Summary
LangSmith SDK: Streaming token events bypass output redaction
Details

Summary

The LangSmith SDK's output redaction controls (hideOutputs in JS, hide_outputs in Python) do not apply to streaming token events. When an LLM run produces streaming output, each chunk is recorded as a new_token event containing the raw token value. These events bypass the redaction pipeline entirely — prepareRunCreateOrUpdateInputs (JS) and _hide_run_outputs (Python) only process the inputs and outputs fields on a run, never the events array. As a result, applications relying on output redaction to prevent sensitive LLM output from being stored in LangSmith will still leak the full streamed content via run events.

Details

Both JS and Python SDKs are affected. The same pattern exists in both:

  • JS SDK: traceable.ts:997-1003 and traceable.ts:1044-1050
  • Python SDK: run_helpers.py:1924 and run_helpers.py:1996

In both SDKs, new_token events with raw kwargs.token values are added during streaming, and the redaction pipeline (hideOutputs in JS, hide_outputs in Python) only processes inputs/outputs — never events.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.5.18"
      },
      "package": {
        "ecosystem": "npm",
        "name": "langsmith"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.19"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.7.30"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "langsmith"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.7.31"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-41182"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-359",
      "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-16T01:20:37Z",
    "nvd_published_at": "2026-04-23T02:16:16Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe LangSmith SDK\u0027s output redaction controls (hideOutputs in JS, hide_outputs in Python) do not apply to streaming token events. When an LLM run produces streaming output, each chunk is recorded as a new_token event containing the raw token value. These events bypass the redaction pipeline entirely \u2014 prepareRunCreateOrUpdateInputs (JS) and _hide_run_outputs (Python) only process the inputs and outputs fields on a run, never the events array. As a result, applications relying on output redaction to prevent sensitive LLM output from being stored in LangSmith will still leak the full streamed content via run events.\n\n## Details\n\n**Both JS and Python SDKs are affected.** The same pattern exists in both:\n\n- **JS SDK**: `traceable.ts:997-1003` and `traceable.ts:1044-1050`\n- **Python SDK**: `run_helpers.py:1924` and `run_helpers.py:1996`\n\nIn both SDKs, `new_token` events with raw `kwargs.token` values are added during streaming, and the redaction pipeline (`hideOutputs` in JS, `hide_outputs` in Python) only processes `inputs`/`outputs` \u2014 never `events`.",
  "id": "GHSA-rr7j-v2q5-chgv",
  "modified": "2026-04-24T20:52:13Z",
  "published": "2026-04-16T01:20:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/langchain-ai/langsmith-sdk/security/advisories/GHSA-rr7j-v2q5-chgv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41182"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/langchain-ai/langsmith-sdk"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "LangSmith SDK: Streaming token events bypass output redaction"
}

GHSA-RRMF-6VF5-86V9

Vulnerability from github – Published: 2026-04-14 18:30 – Updated: 2026-04-14 18:30
VLAI
Details

A vulnerability exists in FlashBlade whereby sensitive information may be logged under specific conditions.

Severity
8.5 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-0207"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-14T18:16:41Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability exists in FlashBlade whereby sensitive information may be logged under specific conditions.",
  "id": "GHSA-rrmf-6vf5-86v9",
  "modified": "2026-04-14T18:30:36Z",
  "published": "2026-04-14T18:30:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0207"
    },
    {
      "type": "WEB",
      "url": "https://support.purestorage.com/bundle/m_security_bulletins/page/Pure_Security/topics/concept/c_security_bulletins.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-RVVF-GHR3-J46W

Vulnerability from github – Published: 2025-10-15 18:31 – Updated: 2025-10-15 18:31
VLAI
Details

A vulnerability in the logging component of Cisco TelePresence Collaboration Endpoint (CE) and Cisco RoomOS Software could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. To exploit this vulnerability, the attacker must have valid administrative credentials.

This vulnerability exists because certain unencrypted credentials are stored when SIP media component logging is enabled. An attacker could exploit this vulnerability by accessing the audit logs on an affected system and obtaining credentials to which they may not normally have access. A successful exploit could allow the attacker to use those credentials to access confidential information, some of which may contain personally identifiable information (PII). Note: To access the logs that are stored in the Webex Cloud or stored on the device itself, an attacker must have valid administrative credentials.

Severity
4.9 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-20329"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-15T17:15:48Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in the logging component of Cisco TelePresence Collaboration Endpoint (CE) and Cisco RoomOS Software could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. To exploit this vulnerability, the attacker must have valid administrative\u0026nbsp;credentials.\n\nThis vulnerability exists because certain unencrypted credentials are stored when SIP media component logging is enabled. An attacker could exploit this vulnerability by accessing the audit logs on an affected system and obtaining credentials to which they may not normally have access. A successful exploit could allow the attacker to use those credentials to access confidential information, some of which may contain personally identifiable information (PII).\nNote: To access the logs that are stored in the Webex Cloud or stored on the device itself, an attacker must have valid administrative credentials.",
  "id": "GHSA-rvvf-ghr3-j46w",
  "modified": "2025-10-15T18:31:51Z",
  "published": "2025-10-15T18:31:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20329"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-inf-disc-qGgsbxAm"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Architecture and Design Implementation

Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.

Mitigation
Distribution

Remove debug log files before deploying the application into production.

Mitigation
Operation

Protect log files against unauthorized read/write.

Mitigation
Implementation

Adjust configurations appropriately when software is transitioned from a debug state to production.

CAPEC-215: Fuzzing for application mapping

An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes the application's log or error messages returned. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to observe the application's log and error messages, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash.

← Back to the CWE list