Common Weakness Enumeration

CWE-532

Allowed

Insertion of Sensitive Information into Log File

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The product writes sensitive information to a log file.

1988 vulnerabilities reference this CWE, most recent first.

GHSA-V5W4-FVFM-37M6

Vulnerability from github – Published: 2025-01-14 18:32 – Updated: 2025-01-14 18:32
VLAI
Details

Windows Kernel Memory Information Disclosure Vulnerability

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-21323"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-14T18:15:56Z",
    "severity": "MODERATE"
  },
  "details": "Windows Kernel Memory Information Disclosure Vulnerability",
  "id": "GHSA-v5w4-fvfm-37m6",
  "modified": "2025-01-14T18:32:04Z",
  "published": "2025-01-14T18:32:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21323"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21323"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-V6FX-59RV-2M7Q

Vulnerability from github – Published: 2022-05-24 17:45 – Updated: 2022-05-24 17:45
VLAI
Details

Information Exposure vulnerability in Samsung Account prior to version 12.1.1.3 allows physically proximate attackers to access user information via log.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-25350"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-03-25T17:15:00Z",
    "severity": "LOW"
  },
  "details": "Information Exposure vulnerability in Samsung Account prior to version 12.1.1.3 allows physically proximate attackers to access user information via log.",
  "id": "GHSA-v6fx-59rv-2m7q",
  "modified": "2022-05-24T17:45:23Z",
  "published": "2022-05-24T17:45:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25350"
    },
    {
      "type": "WEB",
      "url": "https://security.samsungmobile.com"
    },
    {
      "type": "WEB",
      "url": "https://security.samsungmobile.com/serviceWeb.smsb"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-V6MG-7F7P-QMQP

Vulnerability from github – Published: 2024-06-04 17:52 – Updated: 2024-06-04 17:52
VLAI
Summary
apko Exposure of HTTP basic auth credentials in log output
Details

Summary

Exposure of HTTP basic auth credentials from repository and keyring URLs in log output

Details

There was a handful of instances where the apko tool was outputting error messages and log entries where HTTP basic authentication credentials were exposed for one of two reasons:

  1. The%s verb was used to format a url.URL as a string, which includes un-redacted HTTP basic authentication credentials if they are included in the URL.
  2. A string URL value (such as from the configuration YAML file supplied used in an apko execution) was never parsed as a URL, so there was no chance of redacting credentials in the logical flow.

apko, as well as its companion library go-apk, have been updated to ensure URLs are parsed and redacted before being output as string values.

PoC

Create a config file like this apko.yaml:

contents:
  keyring:
    - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
  repositories:
    - https://me%40example.com:supersecretpassword@localhost:8080/os
  packages:
    - wolfi-base

cmd: /bin/sh -l

archs:
- x86_64
- aarch64

Then run:

apko build apko.yaml latest foo.tar --log-level debug

Observe instances of the password being shown verbatim in the log output, such as:

...
DEBU image configuration:
contents:
    repositories:
        - https://me%40example.com:supersecretpassword@localhost:8080/os
    keyring:
        - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
    packages:
        - wolfi-base
...

Impact

For users accessing keyring or APK repository content using HTTP basic auth, credentials were being logged in plaintext, depending on the user's logging settings. If you use apko in continuous integration jobs, it is likely that the credentials leak via logs of these jobs. Depending on the accessibility of these logs, this could be a company-internal or public leakage of credentials.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "chainguard.dev/apko"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.14.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-36127"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-522",
      "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-06-04T17:52:15Z",
    "nvd_published_at": "2024-06-03T15:15:09Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nExposure of HTTP basic auth credentials from repository and keyring URLs in log output\n\n### Details\n\nThere was a handful of instances where the `apko` tool was outputting error messages and log entries where HTTP basic authentication credentials were exposed for one of two reasons:\n\n1. The`%s` verb was used to format a `url.URL` as a string, which includes un-redacted HTTP basic authentication credentials if they are included in the URL.\n2. A string URL value (such as from the configuration YAML file supplied used in an apko execution) was never parsed as a URL, so there was no chance of redacting credentials in the logical flow.\n\napko, as well as its companion library `go-apk`, have been updated to ensure URLs are parsed and redacted before being output as string values.\n\n### PoC\n\nCreate a config file like this `apko.yaml`:\n\n```yaml\ncontents:\n  keyring:\n    - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub\n  repositories:\n    - https://me%40example.com:supersecretpassword@localhost:8080/os\n  packages:\n    - wolfi-base\n\ncmd: /bin/sh -l\n\narchs:\n- x86_64\n- aarch64\n```\n\nThen run:\n\n```shell\napko build apko.yaml latest foo.tar --log-level debug\n```\n\nObserve instances of the password being shown verbatim in the log output, such as:\n\n```text\n...\nDEBU image configuration:\ncontents:\n    repositories:\n        - https://me%40example.com:supersecretpassword@localhost:8080/os\n    keyring:\n        - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub\n    packages:\n        - wolfi-base\n...\n```\n\n### Impact\n\nFor users accessing keyring or APK repository content using HTTP basic auth, credentials were being logged in plaintext, depending on the user\u0027s logging settings. If you use apko in continuous integration jobs, it is likely that the credentials leak via logs of these jobs. Depending on the accessibility of these logs, this could be a company-internal or public leakage of credentials.",
  "id": "GHSA-v6mg-7f7p-qmqp",
  "modified": "2024-06-04T17:52:15Z",
  "published": "2024-06-04T17:52:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/chainguard-dev/apko/security/advisories/GHSA-v6mg-7f7p-qmqp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36127"
    },
    {
      "type": "WEB",
      "url": "https://github.com/chainguard-dev/apko/commit/2c0533e4d52e83031a04f6a83ec63fc2a11eff01"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/chainguard-dev/apko"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "apko Exposure of HTTP basic auth credentials in log output"
}

GHSA-V6V8-XJ6M-XWQH

Vulnerability from github – Published: 2024-06-24 18:31 – Updated: 2024-06-26 19:31
VLAI
Summary
go-retryablehttp can leak basic auth credentials to log files
Details

go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.

Severity
6.0 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/hashicorp/go-retryablehttp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.7.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-6104"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-06-24T21:32:07Z",
    "nvd_published_at": "2024-06-24T17:15:11Z",
    "severity": "MODERATE"
  },
  "details": "go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.",
  "id": "GHSA-v6v8-xj6m-xwqh",
  "modified": "2024-06-26T19:31:28Z",
  "published": "2024-06-24T18:31:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6104"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hashicorp/go-retryablehttp/commit/a99f07beb3c5faaa0a283617e6eb6bcf25f5049a"
    },
    {
      "type": "WEB",
      "url": "https://discuss.hashicorp.com/c/security"
    },
    {
      "type": "WEB",
      "url": "https://discuss.hashicorp.com/t/hcsec-2024-12-go-retryablehttp-can-leak-basic-auth-credentials-to-log-files/68027"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-v6v8-xj6m-xwqh"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/hashicorp/go-retryablehttp"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "go-retryablehttp can leak basic auth credentials to log files"
}

GHSA-V725-XJ67-9V99

Vulnerability from github – Published: 2023-10-17 12:30 – Updated: 2024-04-04 08:42
VLAI
Details

Mattermost Desktop fails to set an appropriate log level during initial run after fresh installation resulting in logging all keystrokes including password entry being logged. 

Severity
4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-5339"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-10-17T10:15:10Z",
    "severity": "MODERATE"
  },
  "details": "Mattermost Desktop\u00a0fails to set an appropriate log level during initial run after fresh installation\u00a0resulting in logging all keystrokes\u00a0including password entry\u00a0being logged.\u00a0\n\n",
  "id": "GHSA-v725-xj67-9v99",
  "modified": "2024-04-04T08:42:55Z",
  "published": "2023-10-17T12:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5339"
    },
    {
      "type": "WEB",
      "url": "https://mattermost.com/security-updates"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-V735-2PP6-H86R

Vulnerability from github – Published: 2022-05-14 01:14 – Updated: 2024-09-04 19:38
VLAI
Summary
Ansible Logs Passwords If PowerShell ScriptBlock is Enabled
Details

Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear in EventLogs in plaintext. A local user with administrator privileges on the machine can view these logs and discover the plaintext password. Ansible Engine 2.8 and older are believed to be vulnerable.

Severity
4.4 (Medium)
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
6.7 (Medium)
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "ansible"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.7.0a1"
            },
            {
              "fixed": "2.7.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "ansible"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.5.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "ansible"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.6.0a1"
            },
            {
              "fixed": "2.6.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2018-16859"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-22T22:07:45Z",
    "nvd_published_at": "2018-11-29T18:29:00Z",
    "severity": "MODERATE"
  },
  "details": "Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for \u0027become\u0027 passwords to appear in EventLogs in plaintext. A local user with administrator privileges on the machine can view these logs and discover the plaintext password. Ansible Engine 2.8 and older are believed to be vulnerable.",
  "id": "GHSA-v735-2pp6-h86r",
  "modified": "2024-09-04T19:38:45Z",
  "published": "2022-05-14T01:14:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16859"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ansible/ansible/pull/49142"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ansible/ansible/commit/0d746b4198abf84290a093b83cf02b4203d73d9f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ansible/ansible/commit/2f8d3fcf41107efafc14d51ab6e14531ca8f8c87"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ansible/ansible/commit/4d748d34f9392aa469da00a85c8e2d5fe6cec52b"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2018:3770"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2018:3771"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2018:3772"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2018:3773"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16859"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ansible/ansible"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ansible/ansible/blob/v2.5.13/changelogs/CHANGELOG-v2.5.rst"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2018-60.yaml"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20200227102121/http://www.securityfocus.com/bid/106004"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00077.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00020.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Ansible Logs Passwords If PowerShell ScriptBlock is Enabled"
}

GHSA-V75G-77VF-6JJQ

Vulnerability from github – Published: 2025-05-30 20:01 – Updated: 2025-06-03 01:10
VLAI
Summary
Para Server Logs Sensitive Information
Details

CWE ID: CWE-532 (Insertion of Sensitive Information into Log File) CVSS: 7.5 (High) Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected Component: Para Server Initialization Logging Version: Para v1.50.6 File Path: para-1.50.6/para-server/src/main/java/com/erudika/para/server/utils/HealthUtils.java Vulnerable Line(s): Line 132 (via logger.info(...) with root credentials)

Technical Details:

The vulnerability is located in the HealthUtils.java file, where a failed configuration file write triggers the following logging statement:

logger.info("Initialized root app with access key '{}' and secret '{}', but could not write these to {}.",
    rootAppCredentials.get("accessKey"),
    rootAppCredentials.get("secretKey"),
    confFile);

This exposes both access and secret keys in logs without redaction. These credentials are later reused in variable assignments for persistence but do not require logging for debugging or system health purposes.

Severity
6.2 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.erudika:para-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.50.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-48955"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-05-30T20:01:10Z",
    "nvd_published_at": "2025-06-02T12:15:25Z",
    "severity": "MODERATE"
  },
  "details": "CWE ID: CWE-532 (Insertion of Sensitive Information into Log File)\nCVSS:  7.5 (High)\nVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n\n**Affected Component:** Para Server Initialization Logging\n**Version:** Para v1.50.6\n**File Path:** `para-1.50.6/para-server/src/main/java/com/erudika/para/server/utils/HealthUtils.java`\n**Vulnerable Line(s):** Line 132 (via `logger.info(...)` with root credentials)\n\nTechnical Details:\n\nThe vulnerability is located in the HealthUtils.java file, where a failed configuration file write triggers the following logging statement:\n```java\nlogger.info(\"Initialized root app with access key \u0027{}\u0027 and secret \u0027{}\u0027, but could not write these to {}.\",\n    rootAppCredentials.get(\"accessKey\"),\n    rootAppCredentials.get(\"secretKey\"),\n    confFile);\n```\nThis exposes both access and secret keys in logs without redaction. These credentials are later reused in variable assignments for persistence but do not require logging for debugging or system health purposes.",
  "id": "GHSA-v75g-77vf-6jjq",
  "modified": "2025-06-03T01:10:53Z",
  "published": "2025-05-30T20:01:10Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Erudika/para/security/advisories/GHSA-v75g-77vf-6jjq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48955"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Erudika/para/commit/1e8a89558542854bb0683ab234c4429ad93b0835"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Erudika/para"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Para Server Logs Sensitive Information"
}

GHSA-V853-P72Q-4CFW

Vulnerability from github – Published: 2026-10-05 22:49 – Updated: 2026-10-05 22:49
VLAI
Summary
Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__
Details

Summary

Quart 0.23.0 contains a stray debug statement (print(data)) inside Body.__await__ in quart/wrappers/request.py. Any request whose body is awaited — await request.form, await request.get_data(), WTForms validate_on_submit(), etc. — has its raw, unparsed body printed to stdout, including plaintext form fields such as passwords and CSRF tokens. Confirmed present in 0.23.0, confirmed absent in 0.22.0.

Details

In src/quart/wrappers/request.py, Body.__await__ accumulates the request body into a bytearray:

​python data = bytearray() while not self._queue.empty(): data.extend(self._queue.get_nowait()) print(data) # <-- not present in 0.22.0 if ( self._max_content_length is not None and len(data) > self._max_content_length ): raise RequestEntityTooLarge() ​

This fires for every request that awaits its body — the overwhelming majority of POST/PUT routes in a typical Quart app (form submissions, JSON APIs via request.get_json(), file uploads, etc.).

PoC

  1. pip install quart==0.23.0 (requires Python 3.13+)
  2. Minimal route: ​python @app.route("/login", methods=["POST"]) async def login(): form_data = await request.form ... ​
  3. Submit a POST with form data, e.g. a login form with staff_id/password fields.
  4. Observe stdout: the full raw body is printed as bytearray(b'csrf_token=...&staff_id=...&password=...').

Confirmed via source diff against 0.22.0's request.py, where this line does not exist.

Impact

Any app that captures stdout in logs (terminal redirect, systemd/journald, Docker logs, cloud log aggregation, etc.) will have every submitted form body — including login credentials — written to logs in plaintext. This affects any Quart 0.23.0 app handling authentication or any sensitive form data, and is trivially triggerable by any user simply submitting a form (no attacker action required beyond normal use).

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "quart"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.23.0"
            },
            {
              "fixed": "0.23.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.23.0"
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-05T22:49:44Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nQuart 0.23.0 contains a stray debug statement (`print(data)`) inside `Body.__await__` in `quart/wrappers/request.py`. Any request whose body is awaited \u2014 `await request.form`, `await request.get_data()`, WTForms `validate_on_submit()`, etc. \u2014 has its raw, unparsed body printed to stdout, including plaintext form fields such as passwords and CSRF tokens. Confirmed present in 0.23.0, confirmed absent in 0.22.0.\n\n### Details\nIn `src/quart/wrappers/request.py`, `Body.__await__` accumulates the request body into a bytearray:\n\n\u200b```python\ndata = bytearray()\nwhile not self._queue.empty():\n    data.extend(self._queue.get_nowait())\n    print(data)          # \u003c-- not present in 0.22.0\n    if (\n        self._max_content_length is not None\n        and len(data) \u003e self._max_content_length\n    ):\n        raise RequestEntityTooLarge()\n\u200b```\n\nThis fires for every request that awaits its body \u2014 the overwhelming majority of POST/PUT routes in a typical Quart app (form submissions, JSON APIs via `request.get_json()`, file uploads, etc.).\n\n### PoC\n1. `pip install quart==0.23.0` (requires Python 3.13+)\n2. Minimal route:\n\u200b```python\n@app.route(\"/login\", methods=[\"POST\"])\nasync def login():\n    form_data = await request.form\n    ...\n\u200b```\n3. Submit a POST with form data, e.g. a login form with `staff_id`/`password` fields.\n4. Observe stdout: the full raw body is printed as `bytearray(b\u0027csrf_token=...\u0026staff_id=...\u0026password=...\u0027)`.\n\nConfirmed via source diff against 0.22.0\u0027s `request.py`, where this line does not exist.\n\n### Impact\nAny app that captures stdout in logs (terminal redirect, systemd/journald, Docker logs, cloud log aggregation, etc.) will have every submitted form body \u2014 including login credentials \u2014 written to logs in plaintext. This affects any Quart 0.23.0 app handling authentication or any sensitive form data, and is trivially triggerable by any user simply submitting a form (no attacker action required beyond normal use).",
  "id": "GHSA-v853-p72q-4cfw",
  "modified": "2026-10-05T22:49:44Z",
  "published": "2026-10-05T22:49:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pallets/quart/security/advisories/GHSA-v853-p72q-4cfw"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pallets/quart/commit/e8eb3b8a0cb98e7574bf3841312fc7f96883d055"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pallets/quart"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pallets/quart/releases/tag/0.23.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__"
}

GHSA-V8G5-PXM4-XG6J

Vulnerability from github – Published: 2026-09-09 15:35 – Updated: 2026-09-09 15:35
VLAI
Details

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.

Severity
3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-80169"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-09T13:20:43Z",
    "severity": "LOW"
  },
  "details": "Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.",
  "id": "GHSA-v8g5-pxm4-xg6j",
  "modified": "2026-09-09T15:35:09Z",
  "published": "2026-09-09T15:35:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80169"
    },
    {
      "type": "WEB",
      "url": "https://www.dell.com/support/kbdoc/en-in/000503426/dsa-2026-382-security-update-for-dell-secure-connect-gateway-virtual-edition-multiple-vulnerabilities"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-V8WF-H34R-55F7

Vulnerability from github – Published: 2026-02-18 18:30 – Updated: 2026-02-20 15:31
VLAI
Details

In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster (SHC) deployment who holds a role with access to the Splunk _internal index could view the integrationKey, secretKey, and appSecretKey secrets, generated by Duo Two-Factor Authentication for Splunk Enterprise, in plain text.

Severity
6.8 (Medium)
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-20138"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-18T18:24:23Z",
    "severity": "MODERATE"
  },
  "details": "In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster (SHC) deployment who holds a role with access to the Splunk `_internal` index could view the  `integrationKey`, `secretKey`, and `appSecretKey` secrets, generated by [Duo Two-Factor Authentication for Splunk Enterprise](https://duo.com/docs/splunk), in plain text.",
  "id": "GHSA-v8wf-h34r-55f7",
  "modified": "2026-02-20T15:31:00Z",
  "published": "2026-02-18T18:30:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20138"
    },
    {
      "type": "WEB",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0203"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Architecture and Design Implementation

Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.

Mitigation
Distribution

Remove debug log files before deploying the application into production.

Mitigation
Operation

Protect log files against unauthorized read/write.

Mitigation
Implementation

Adjust configurations appropriately when software is transitioned from a debug state to production.

CAPEC-215: Fuzzing for application mapping

An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes the application's log or error messages returned. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to observe the application's log and error messages, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash.

← Back to the CWE list