Weaknesses of type CWE-779

20 results

Registro excessivo de dados sensíveis

Quando a aplicação escreve em logs informações confidenciais (senhas, tokens, dados pessoais, chaves criptográficas) sem filtro ou mascaramento. O risco é que esses logs, frequentemente menos protegidos que a base de dados principal, se tornam alvo atrativo para atacantes ou acabam expostos acidentalmente.

Example

Uma API de login registra o corpo completo das requisições HTTP no syslog, incluindo credenciais. Ou um sistema de pagamento escreve números de cartão inteiros em arquivos de debug. Um dev com acesso aos logs consegue extrair essas credenciais e comprometer contas ou transações.

How to mitigate

Aplique sanitização: não registre campos sensíveis (senha, token, cartão) ou registre apenas hashes/mascarados (primeiros 4 dígitos). Revise a política de logs, defina quais dados são permitidos, e use ferramentas de mascaramento automático antes de escrever em disco ou centralizado.

CVE-2024-36416HIGHSuiteCRM v4 API Excessive log data DOSEPSS 2.0%CVE-2024-36072CRITICALNetwrix CoSoSys Endpoint Protector through 5.9.3 and CoSoSys Unify through 7.0.6 contain a remote code execution vulnerability in the logginEPSS 1.0%CVE-2022-31004HIGHPotential secrets being logged to disk in CVE ServicesEPSS 0.9%CVE-2025-51397MEDIUMA stored cross-site scripting (XSS) vulnerability in the Facebook Chat module of Live Helper Chat v4.60 allows attackers to execute arbitrarEPSS 0.9%CVE-2024-55628HIGHSuricata oversized resource names utilizing DNS name compression can lead to resource starvationEPSS 0.7%CVE-2023-23949HIGHAn authenticated user can supply malicious HTML and JavaScript code that will be executed in the client browser.EPSS 0.6%CVE-2022-25779MEDIUMInsufficient scope checks allows adding unrelated audit log entriesEPSS 0.5%CVE-2025-8696HIGHDoS attack against the Stork UI from an unauthenticated userEPSS 0.4%CVE-2026-28718MEDIUMDenial of service due to insufficient input validation in authentication logging. The following products are affected: Acronis Cyber ProtectEPSS 0.3%CVE-2025-69230LOWAIOHTTP Vulnerable to Cookie Parser Warning StormEPSS 0.3%CVE-2025-53636MEDIUMOpen OnDemand Shell App closed websocket DoSEPSS 0.3%CVE-2021-25422—Improper log management vulnerability in Watch Active PlugIn prior to version 2.2.07.21033151 allows attacker with log permissions to leak WEPSS 0.2%CVE-2021-25423—Improper log management vulnerability in Watch Active2 PlugIn prior to 2.2.08.21033151 version allows attacker with log permissions to leak EPSS 0.2%CVE-2021-25421—Improper log management vulnerability in Galaxy Watch3 PlugIn prior to version 2.2.09.21033151 allows attacker with log permissions to leak EPSS 0.2%CVE-2021-25420—Improper log management vulnerability in Galaxy Watch PlugIn prior to version 2.2.05.21033151 allows attacker with log permissions to leak WEPSS 0.2%CVE-2024-1141MEDIUMGlance-store: glance store access key logged in debug log levelEPSS 0.2%CVE-2026-20209MEDIUMCisco Catalyst SD-WAN Manager Privilege Escalation VulnerabilityEPSS 0.2%CVE-2026-20210MEDIUMCisco Catalyst SD-WAN Manager Privilege Escalation VulnerabilityEPSS 0.2%CVE-2022-39874MEDIUMSensitive log information leakage vulnerability in Samsung Account prior to version 13.5.0 allows attackers to unauthorized logout.EPSS 0.2%CVE-2022-22291MEDIUMLogging of excessive data vulnerability in telephony prior to SMR Feb-2022 Release 1 allows privileged attackers to get Cell Location InformEPSS 0.1%