CWE-532 通过日志文件的信息暴露 类弱点 770 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-532指将敏感信息写入日志文件的漏洞，属于信息泄露类安全风险。攻击者常通过读取服务器日志或访问日志存储位置，窃取密码、密钥或个人隐私数据，进而实施身份冒充或横向移动。开发者应避免在日志中记录明文凭证、会话令牌或敏感业务数据，采用数据脱敏、加密存储及严格的日志访问控制机制，确保仅记录必要的非敏感审计信息，从而降低数据泄露风险。
logger.info("Username: " + usernme + ", CCN: " + ccn);locationClient = new LocationClient(this, this, this); locationClient.connect(); currentUser.setLocation(locationClient.getLastLocation()); ... catch (Exception e) { AlertDialog.Builder builder = new AlertDialog.Builder(this); builder.setMessage("Sorry, this application has experienced an error."); AlertDialog alert = builder.create(); alert.show(); Log.e("ExampleActivity", "Caught exception: " + e + " While on User:" + User.toString()); }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-43444 | OTRS 安全漏洞 — OTRS | 8.2 | High | 2024-08-26 |
| CVE-2024-41719 | F5 BIG-IP Next Central Manager 安全漏洞 — BIG-IP Next Central Manager | 4.2 | Medium | 2024-08-14 |
| CVE-2024-41978 | Siemens多款产品 日志信息泄露漏洞 — RUGGEDCOM RM1224 LTE(4G) EU | 6.5 | Medium | 2024-08-13 |
| CVE-2024-37930 | WordPress theme SmartMag 安全漏洞 — SmartMag | 5.3 | Medium | 2024-08-12 |
| CVE-2024-37283 | Elastic Agent 安全漏洞 — Elastic Agent | 7.5AI | High AI | 2024-08-08 |
| CVE-2024-37286 | Elastic APM Server 安全漏洞 — APM Server | 5.7 | Medium | 2024-08-03 |
| CVE-2024-38321 | IBM Business Automation Workflow 日志信息泄露漏洞 — Business Automation Workflow | 5.3 | Medium | 2024-08-03 |
| CVE-2024-42349 | FOGProject 安全漏洞 — fogproject | 5.3 | Medium | 2024-08-02 |
| CVE-2024-6977 | Cato Networks Windows SDP Client 安全漏洞 — SDP Client | 6.5 | Medium | 2024-07-31 |
| CVE-2023-49921 | Elasticsearch 安全漏洞 — Elasticsearch | 5.2 | Medium | 2024-07-26 |
| CVE-2024-41178 | Apache Arrow 日志信息泄露漏洞 — Apache Arrow Rust Object Store | 8.1AI | High AI | 2024-07-23 |
| CVE-2024-41824 | JetBrains TeamCity 安全漏洞 — TeamCity | 6.4 | Medium | 2024-07-22 |
| CVE-2024-41129 | ops 安全漏洞 — operator | 4.4 | Medium | 2024-07-22 |
| CVE-2024-0006 | YugabyteDB 安全漏洞 — YugabyteDB Anywhere | 7.1 | - | 2024-07-19 |
| CVE-2024-40636 | Steeltoe 安全漏洞 — security-advisories | 5.3 | Medium | 2024-07-17 |
| CVE-2024-39532 | Juniper Networks Junos OS和Juniper Networks Junos OS Evolved 安全漏洞 — Junos OS | 6.3 | Medium | 2024-07-11 |
| CVE-2024-37205 | WordPress plugin affiliate-toolkit 日志信息泄露漏洞 — affiliate-toolkit | 5.3 | Medium | 2024-07-10 |
| CVE-2024-37270 | WordPress plugin TrustedLogin Vendor 日志信息泄露漏洞 — TrustedLogin Vendor | 5.3 | Medium | 2024-07-10 |
| CVE-2024-27784 | Fortinet FortiAIOps 日志信息泄露漏洞 — FortiAIOps | 8.3 | High | 2024-07-09 |
| CVE-2024-32757 | Johnson Controls Illustra Essentials Gen 4 安全漏洞 — American Dynamics Illustra Essentials Gen 4 | 6.8 | Medium | 2024-07-02 |
| CVE-2023-30430 | IBM Security Verify Access 日志信息泄露漏洞 — Security Verify Access | 5.5 | Medium | 2024-06-27 |
| CVE-2024-28830 | Checkmk 安全漏洞 — Checkmk | 2.7 | Low | 2024-06-26 |
| CVE-2024-29177 | Dell PowerProtect Data Domain 日志信息泄露漏洞 — PowerProtect DD | 2.7 | Low | 2024-06-26 |
| CVE-2024-6060 | phloc-webbasics 安全漏洞 — Webscopes | 7.1AI | High AI | 2024-06-25 |
| CVE-2024-6104 | HashiCorp go-retryablehttp 安全漏洞 — Shared library | 6.0 | Medium | 2024-06-24 |
| CVE-2022-44587 | WordPress plugin WP 2FA 日志信息泄露漏洞 — WP 2FA | 5.3 | Medium | 2024-06-21 |
| CVE-2024-27157 | Toshiba e-STUDIO 安全漏洞 — Toshiba Tec e-Studio multi-function peripheral (MFP) | 6.8 | Medium | 2024-06-14 |
| CVE-2024-27156 | Toshiba e-STUDIO 安全漏洞 — Toshiba Tec e-Studio multi-function peripheral (MFP) | 6.8 | Medium | 2024-06-14 |
| CVE-2024-27154 | Toshiba e-STUDIO 安全漏洞 — Toshiba Tec e-Studio multi-function peripheral (MFP) | 6.2 | Medium | 2024-06-14 |
| CVE-2024-5557 | Schneider Electric SpaceLogic AS-P 日志信息泄露漏洞 — SpaceLogic AS-P | 4.5 | Medium | 2024-06-12 |
CWE-532（通过日志文件的信息暴露） 是常见的弱点类别，本平台收录该类弱点关联的 770 条 CVE 漏洞。