CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer
baseThe product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
untergeordnete Schwächen
Spezifischere Einträge unterhalb dieses.
03
Schwachstellen (185)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-0340US | high8.8 | Exploit | ||
In parseNextBox of IsoInterface.java, there is a possible leak of unredacted location information due to improper input validation. This could lead to remote information disclosure… | ||||
| CVE-2000-0057US | high7.5 | Exploit | ||
Cold Fusion CFCACHE tag places temporary cache files within the web document root, allowing remote attackers to obtain sensitive system information. | ||||
| CVE-1999-0678US | medium5.0 | Exploit | ||
A default configuration of Apache on Debian GNU/Linux sets the ServerRoot to /usr/doc, which allows remote users to read documentation files for the entire server. | ||||
| CVE-2022-1650US | critical9.3 | — | ||
Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository eventsource/eventsource prior to v2.0.2. | ||||
| CVE-2022-29900US | medium6.5 | Exploit | ||
Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions. | ||||
| CVE-2022-2818US | high8.8 | — | ||
Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository cockpit-hq/cockpit prior to 2.2.2. | ||||
| CVE-2022-30617US | high8.8 | — | ||
An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel users that have a re… | ||||
| CVE-2020-11684US | critical9.1 | — | ||
AT91bootstrap before 3.9.2 does not properly wipe encryption and authentication keys from memory before passing control to a less privileged software component. This can be exploit… | ||||
| CVE-2020-15094US | high8.8 | — | ||
In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests. HttpCache uses inte… | ||||
| CVE-2019-11711US | high8.8 | — | ||
When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomains ever cooperatively use document.domai… | ||||
| CVE-2019-13402US | high8.8 | — | ||
/usr/sbin/default.sh and /usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi on Dynacolor FCM-MB40 v1.2.0.0 devices implement an incomplete factory-reset process. A backdoor ca… | ||||
| CVE-2022-39393US | high8.6 | — | ||
Wasmtime is a standalone runtime for WebAssembly. Prior to versions 2.0.2 and 1.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator where when a line… | ||||
| CVE-2022-31112US | high8.2 | — | ||
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions parse Server LiveQuery does not remove protected fields… | ||||
| CVE-2019-11243US | high8.1 | — | ||
In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials removed (bearer token, username/password,… | ||||
| CVE-2022-31090US | high7.7 | — | ||
Guzzle, an extensible PHP HTTP client. `Authorization` headers on requests are sensitive information. In affected versions when using our Curl handler, it is possible to use the `C… | ||||
| CVE-2020-1940US | high7.5 | — | ||
The optional initial password change and password expiration features present in Apache Jackrabbit Oak 1.2.0 to 1.22.0 are prone to a sensitive information disclosure vulnerability… | ||||
| CVE-2002-2032US | medium5.0 | Exploit | ||
sql_layer.php in PHP-Nuke 5.4 and earlier does not restrict access to debugging features, which allows remote attackers to gain SQL query information by setting the sql_debug param… | ||||
| CVE-2022-31043US | high7.5OT erhöht | — | ||
Guzzle is an open source PHP HTTP client. In affected versions `Authorization` headers on requests are sensitive information. On making a request using the `https` scheme to a serv… | ||||
| CVE-2022-31042US | high7.5OT erhöht | — | ||
Guzzle is an open source PHP HTTP client. In affected versions the `Cookie` headers on requests are sensitive information. On making a request using the `https` scheme to a server… | ||||
| CVE-2022-0355US | high7.5 | — | ||
Improper Removal of Sensitive Information Before Storage or Transfer in NPM simple-get prior to 4.0.1. | ||||
04
Angriffsmuster (1)
CAPEC-Angriffsmuster, die dies ausnutzen.
05
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan