CWE-214 Invocation of Process Using Visible Sensitive Information
baseA process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
Schwachstellen (45)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-48709US | high7.8 | — | ||
BMC Control-M/Server 9.0.21.300 displays cleartext database credentials in process lists and logs. An authenticated attacker with shell access could observe these credentials and u… | ||||
| CVE-2020-36771US | high7.8 | — | ||
CloudLinux CageFS 7.1.1-1 or below passes the authentication token as a command line argument. In some configurations this allows local users to view the authentication token via t… | ||||
| CVE-2021-3859US | high7.5 | — | ||
A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks… | ||||
| CVE-2019-13313US | high7.8 | — | ||
libosinfo 1.5.0 allows local users to discover credentials by listing a process, because credentials are passed to osinfo-install-script via the command line. | ||||
| CVE-2018-17957US | high7.8 | — | ||
The YaST2 RMT module for configuring the SUSE Repository Mirroring Tool (RMT) before 1.1.2 exposed MySQL database passwords on process commandline, allowing local attackers to acce… | ||||
| CVE-2018-16837US | high7.8OT erhöht | — | ||
Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a paramete… | ||||
| CVE-2016-7062US | high7.8 | — | ||
rhscon-ceph in Red Hat Storage Console 2 x86_64 and Red Hat Storage Console Node 2 x86_64 allows local users to obtain the password as cleartext. | ||||
| CVE-2024-28799US | high7.5 | — | ||
IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 displays sensitive data improperly to a local privileged user, in no… | ||||
| CVE-2019-3869US | high7.2 | — | ||
When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability to… | ||||
| CVE-2026-92171US | medium6.5 | — | ||
A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site (xsite) TLS is enabled, the operator launches the Gossip Router container with keystore and trust… | ||||
| CVE-2025-5452US | medium6.6 | — | ||
A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to potential privilege escalation of the malic… | ||||
| CVE-2025-1333US | medium6.5 | — | ||
IBM MQ Container when used with the IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, and MQ Operator S… | ||||
| CVE-2020-5422US | medium6.5 | — | ||
BOSH System Metrics Server releases prior to 0.1.0 exposed the UAA password as a flag to a process running on the BOSH director. It exposed the password to any user or process with… | ||||
| CVE-2026-81684US | medium6.2 | — | ||
In openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8, the desktop GUI passes the steganography password to the CLI child process on the command line via the --stego-p… | ||||
| CVE-2025-59955US | medium5.7 | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.8 have an information di… | ||||
| CVE-2026-92768US | medium5.5 | — | ||
A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine (VM) credentials, including plaintext passwords, by inspecting… | ||||
| CVE-2026-80158US | medium5.5 | — | ||
A flaw was found in the ipa_getkeytab module of the community.general
Ansible collection. The module's bind_pw parameter, used to supply the LDAP simple-bind password when retrievi… | ||||
| CVE-2026-12139US | medium5.5 | — | ||
Tanium addressed an information disclosure vulnerability in Connect. | ||||
| CVE-2023-46316US | medium5.5 | — | ||
In buc Traceroute 2.0.12 through 2.1.2 before 2.1.3, the wrapper scripts do not properly parse command lines. | ||||
| CVE-2023-25722US | medium5.5 | — | ||
A credential-leak issue was discovered in related Veracode products before 2023-03-27. Veracode Scan Jenkins Plugin before 23.3.19.0, when configured for remote agent jobs, invokes… | ||||
03
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan