CWE-532

{
  "affected": [],
  "aliases": [
    "CVE-2019-0021"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-01-15T21:29:00Z",
    "severity": "MODERATE"
  },
  "details": "On Juniper ATP, secret passphrase CLI inputs, such as \"set mcm\", are logged to /var/log/syslog in clear text, allowing authenticated local user to be able to view these secret information. This issue affects Juniper ATP 5.0 versions prior to 5.0.4.",
  "id": "GHSA-6cqx-g9mw-4p5m",
  "modified": "2022-05-13T01:31:36Z",
  "published": "2022-05-13T01:31:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0021"
    },
    {
      "type": "WEB",
      "url": "https://kb.juniper.net/JSA10918"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-46675"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-12-13T07:15:23Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error or in the event where debug level logging is enabled in Kibana. Elastic has released Kibana 8.11.2 which resolves this issue. The messages recorded in the log may contain Account credentials for the kibana_system user, API Keys, and credentials of Kibana end-users, Elastic Security package policy objects which can contain private keys, bearer token, and sessions of 3rd-party integrations and finally Authorization headers, client secrets, local file paths, and stack traces. The issue may occur in any Kibana instance running an affected version that could potentially receive an unexpected error when communicating to Elasticsearch causing it to include sensitive data into Kibana error logs. It could also occur under specific circumstances when debug level logging is enabled in Kibana. Note: It was found that the fix for ESA-2023-25 in Kibana 8.11.1 for a similar issue was incomplete.\n",
  "id": "GHSA-6g3x-hhx6-885v",
  "modified": "2023-12-13T09:30:32Z",
  "published": "2023-12-13T09:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46675"
    },
    {
      "type": "WEB",
      "url": "https://discuss.elastic.co/t/kibana-8-11-2-7-17-16-security-update-esa-2023-27/349182/2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "simplesamlphp/simplesamlphp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.18.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-5225"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-01-24T20:46:16Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "### Background\n\nSimpleSAMLphp has a logging functionality that allows system administrators to keep track of the activity, errors, and statistics. Additionally, it allows users to report errors, shall they happen. An error report contains a report identifier, which is logged once submitted.\n\n### Description\n\nThe `www/erroreport.php` script, which receives error reports and sends them via email to the system administrator, didn\u0027t properly sanitize the report identifier obtained from the request. This allows an attacker, under specific circumstances, to inject new log lines by manually crafting this report ID.\n\nWhen configured to use the `file` logging handler, SimpleSAMLphp will output all its logs by appending each log line to a given file. Since the `reportID` parameter received in a request sent to `www/errorreport.php` was not properly sanitized, it was possible to inject newline characters into it, effectively allowing a malicious user to inject new log lines with arbitrary content.\n\n### Affected versions\n\nSimpleSAMLphp versions up to **1.18.3**.\n\n### Impact\n\nAn attacker may use this issue to inject logs messages into a SimpleSAMLphp log file, trying to trick or confuse system administrators. However, the attack surface is considered small, as the attack will only work with the `file` logging handler, which opens the log file in _append-only_ mode. This means an attacker cannot edit or remove existing log messages, and even if non-ascii characters are written to the log, the file will always be readable with a simple text editor.\n\n### Resolution\n\nUpgrade the SimpleSAMLphp installation to version **1.18.4**.\n\n### Credit\n\nThis vulnerability was discovered and reported by Frederic Vleminckx on January 23, 2020.",
  "id": "GHSA-6gc6-m364-85ww",
  "modified": "2021-01-08T20:33:05Z",
  "published": "2020-01-24T21:26:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/simplesamlphp/simplesamlphp/security/advisories/GHSA-6gc6-m364-85ww"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5225"
    },
    {
      "type": "WEB",
      "url": "https://simplesamlphp.org/security/202001-02"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Log injection in SimpleSAMLphp"
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-10695"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-12-12T00:15:00Z",
    "severity": "MODERATE"
  },
  "details": "When using the cd4pe::root_configuration task to configure a Continuous Delivery for PE installation, the root user?s username and password were exposed in the job?s Job Details pane in the PE console. These issues have been resolved in version 1.2.1 of the puppetlabs/cd4pe module.",
  "id": "GHSA-6gj6-8rp5-3qch",
  "modified": "2023-01-28T03:30:28Z",
  "published": "2022-05-24T17:03:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10695"
    },
    {
      "type": "WEB",
      "url": "https://puppet.com/security/cve/CVE-2019-10695"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-34527"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-06T00:15:10Z",
    "severity": "HIGH"
  },
  "details": "spaces_plugin/app.py in SolidUI 0.4.0 has an unnecessary print statement for an OpenAI key. The printed string might be logged.",
  "id": "GHSA-6gwg-c5gq-mp9h",
  "modified": "2024-08-22T21:31:28Z",
  "published": "2024-05-06T00:30:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34527"
    },
    {
      "type": "WEB",
      "url": "https://github.com/CloudOrc/SolidUI/issues/279"
    },
    {
      "type": "WEB",
      "url": "https://github.com/CloudOrc/SolidUI/blob/00d96b53bd0acf082996cef45b0f292eaba22fb7/solidui/spaces_plugin/app.py#L77"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-26207"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-06-13T09:15:16Z",
    "severity": "MODERATE"
  },
  "details": "An insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4 and FortiProxy 7.0.0 through 7.0.10. 7.2.0 through 7.2.1 allows an attacker to read certain passwords in plain text.",
  "id": "GHSA-6h43-h44j-jrm6",
  "modified": "2024-04-04T04:45:37Z",
  "published": "2023-06-13T09:30:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26207"
    },
    {
      "type": "WEB",
      "url": "https://fortiguard.com/psirt/FG-IR-22-455"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-13925"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-20T15:16:13Z",
    "severity": "MODERATE"
  },
  "details": "IBM Aspera Console 3.4.7 stores potentially sensitive information in log files that could be read by a local privileged user.",
  "id": "GHSA-6hm8-g2pm-5vgv",
  "modified": "2026-01-20T15:33:13Z",
  "published": "2026-01-20T15:33:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13925"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7256544"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-7577"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-29T00:15:24Z",
    "severity": "MODERATE"
  },
  "details": "IBM InfoSphere Information Server 11.7 could disclose sensitive user credentials from log files during new installation of the product.",
  "id": "GHSA-6hp9-7gg3-wp75",
  "modified": "2025-03-29T00:31:36Z",
  "published": "2025-03-29T00:31:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7577"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7185020"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/weaveworks/tf-controller"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.14.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/weaveworks/tf-controller"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.15.0-rc.1"
            },
            {
              "fixed": "0.15.0-rc.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-34236"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-312",
      "CWE-522",
      "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-14T21:52:09Z",
    "nvd_published_at": "2023-07-14T22:15:09Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nA vulnerability has been identified in Weave GitOps Terraform Controller which could allow an authenticated remote attacker to view sensitive information. This vulnerability stems from Weave GitOps Terraform Runners (`tf-runner`), where sensitive data is inadvertently printed - potentially revealing sensitive user data in their pod logs. In particular, functions `tfexec.ShowPlan`, `tfexec.ShowPlanRaw`, and `tfexec.Output` are implicated when the `tfexec` object set its `Stdout` and `Stderr` to be `os.Stdout` and `os.Stderr`.\n\nAn unauthorized remote attacker could exploit this vulnerability by accessing these prints of sensitive information, which may contain configurations or tokens that could be used to gain unauthorized control or access to resources managed by the Terraform controller.\n\nA successful exploit could allow the attacker to utilize this sensitive data, potentially leading to unauthorized access or control of the system.\n\n### Patches\n\nThis vulnerability has been addressed in Weave GitOps Terraform Controller versions `v0.14.4` and `v0.15.0-rc.5`. Users are urged to upgrade to one of these versions to mitigate the vulnerability.\n\nThe patches for this vulnerability are found in:\n- this commit: 9708fda28ccd0466cb0a8fd409854ab4d92f7dca\n- this commit: 6323b355bd7f5d2ce85d0244fe0883af3881df4e\n- this commit: 28282bc644054e157c3b9a3d38f1f9551ce09074\n- and this commit: 98a0688036e9dbcf43fa84960d9a1ef3e09a69cf\n\n### Workarounds\n\nAs a temporary measure until the patch can be applied, users can add the environment variable `DISABLE_TF_LOGS` to the tf-runners via the runner pod template of the Terraform Custom Resource. This will prevent the logging of sensitive information and mitigate the risk of this vulnerability.\n\n### References\n\n- The first issue: https://github.com/weaveworks/tf-controller/issues/637\n- The second issue: https://github.com/weaveworks/tf-controller/issues/649\n\n### For More Information\n\nIf you have any further questions or comments about this advisory:\n\nOpen an issue in the Weave GitOps Terraform Controller repository\nEmail us at [security@weave.works](mailto:security@weave.works)\n",
  "id": "GHSA-6hvv-j432-23cv",
  "modified": "2023-07-14T21:52:09Z",
  "published": "2023-07-14T21:52:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/weaveworks/tf-controller/security/advisories/GHSA-6hvv-j432-23cv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34236"
    },
    {
      "type": "WEB",
      "url": "https://github.com/weaveworks/tf-controller/issues/637"
    },
    {
      "type": "WEB",
      "url": "https://github.com/weaveworks/tf-controller/issues/649"
    },
    {
      "type": "WEB",
      "url": "https://github.com/weaveworks/tf-controller/commit/28282bc644054e157c3b9a3d38f1f9551ce09074"
    },
    {
      "type": "WEB",
      "url": "https://github.com/weaveworks/tf-controller/commit/6323b355bd7f5d2ce85d0244fe0883af3881df4e"
    },
    {
      "type": "WEB",
      "url": "https://github.com/weaveworks/tf-controller/commit/9708fda28ccd0466cb0a8fd409854ab4d92f7dca"
    },
    {
      "type": "WEB",
      "url": "https://github.com/weaveworks/tf-controller/commit/98a0688036e9dbcf43fa84960d9a1ef3e09a69cf"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/weaveworks/tf-controller"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Weave GitOps Terraform Controller Information Disclosure Vulnerability"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "snyk"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1297.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 0.0.0-20250623124518-ca7ba7d72e68"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/snyk/go-application-framework"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-6624"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-30T11:42:49Z",
    "nvd_published_at": "2025-06-26T05:15:23Z",
    "severity": "LOW"
  },
  "details": "Versions of the package snyk before 1.1297.3 are vulnerable to Insertion of Sensitive Information into Log File through local Snyk CLI debug logs. Container Registry credentials provided via environment variables or command line arguments can be exposed when executing Snyk CLI in DEBUG or DEBUG/TRACE mode.\n\nThe issue affects the following Snyk commands:\n\n1. When snyk container test or snyk container monitor commands are run against a container registry, with debug mode enabled, the container registry credentials may be written into the local Snyk CLI debug log. This only happens with credentials specified in environment variables (SNYK_REGISTRY_USERNAME and SNYK_REGISTRY_PASSWORD), or in the CLI (--password/-p and  --username/-u).\n\n2. When snyk auth command is executed with debug mode enabled AND the log level is set to TRACE, the Snyk access / refresh credential tokens used to connect the CLI to Snyk may be written into the local CLI debug logs.\n\n3. When snyk iac test is executed with a Remote IAC Custom rules bundle, debug mode enabled, AND the log level is set to TRACE, the docker registry token may be written into the local CLI debug logs.",
  "id": "GHSA-6hwc-9h8r-3vmf",
  "modified": "2025-06-30T11:42:49Z",
  "published": "2025-06-26T06:31:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6624"
    },
    {
      "type": "WEB",
      "url": "https://github.com/snyk/cli/commit/38322f377da7e5f1391e1f641710be50989fa4df"
    },
    {
      "type": "WEB",
      "url": "https://github.com/snyk/go-application-framework/commit/ca7ba7d72e68455afb466a7a47bb2c9aece86c18"
    },
    {
      "type": "WEB",
      "url": "https://docs.snyk.io/snyk-cli/debugging-the-snyk-cli"
    },
    {
      "type": "WEB",
      "url": "https://github.com/snyk"
    },
    {
      "type": "WEB",
      "url": "https://github.com/snyk/cli/releases/tag/v1.1297.3"
    },
    {
      "type": "WEB",
      "url": "https://security.snyk.io/vuln/SNYK-JS-SNYK-10497607"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Snyk CLI Insertion of Sensitive Information into Log File allowed in DEBUG or DEBUG/TRACE mode"
}