CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer
The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- strapiImproper Removal of Sensitive Information Before Storage or Transfer in Strapi8.8 High
- intel optane memory h10 with solid state storage firmware, optane memory h20 with solid state storage firmware, optane ssd 900p firmware +4 more +6 moreSensitive information in resource not removed before reuse in firmware for some Intel(R) SSD and...4.6 Medium
- intel optane memory h10 with solid state storage firmware, optane memory h20 with solid state storage firmware, optane ssd 900p firmware +4 more +6 moreExposure of sensitive system information due to uncleared debug information in firmware for some...6.8 Medium
- eventsource, eventsource eventsource/eventsource, debian linux +2 moreImproper Removal of Sensitive Information Before Storage or Transfer in eventsource/eventsource8.1 High
- internet routing registry daemon project routing registry daemon, irrdnet irrd +1 moreInsufficient password hash filtering in some IRRd queries and exports7.5 High
- amd a10-9600p firmware, a10-9630p firmware, a12-9700p firmware +124 more +126 moreSome AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially...6.5 Medium
- fluture-js fluture-nodeUnauthorized forwarding of confidential headers in fluture-node2.6 Low
- jenkins support core, jenkins project support core plugin +1 moreJenkins Support Core Plugin stores sensitive data in plain text6.5 Medium
- rails, debian linux +1 moreExposure of sensitive information in Action Pack7.4 High
- keybase, zoom video communications inc keybase client for macos, keybase client for windows +2 moreRetained exploded messages in Keybase clients for macOS and Windows3.7 Low
- follow-redirects follow-redirects/follow-redirects, follow-redirects project follow-redirects +1 moreImproper Removal of Sensitive Information Before Storage or Transfer in follow-redirects/follow-redirects2.6 Low
- wire wire-webappExpired Ephemeral Messages not reliably removed in wire-webapp4.4 Medium
- feross feross/simple-get, simple-get project simple-get +1 moreImproper Removal of Sensitive Information Before Storage or Transfer in feross/simple-get8.8 High
- gitlabIn all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's...5.9 Medium
- arm mbed tls, debian linux +1 moreAn issue was discovered in Mbed TLS before 2.24.0 (and before 2.16.8 LTS and before 2.7.17 LTS)....7.5 High
- hashicorp vaultImproper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault5.3 Medium
- buildah project buildah, redhat enterprise linux, enterprise linux for ibm z systems +1 more +3 moreBuildah processes using chroot isolation may leak environment values to intermediate processes5.5 Medium
- nextcloud, kiteworks security-advisories +1 moreSensitive data may not be removed from storage on account removal4.7 Medium
- xenx86: Speculative vulnerabilities with bare (non-shim) 32-bit PV guests 32-bit x86 PV guest...5.5 Medium
- misp-project mispIn app/Model/MispObject.php in MISP 2.4.141, an incorrect sharing group association could lead to...7.5 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wired infrastructure and networking, qualcomm aqt1000 firmware, ar8031 firmware +299 more +301 moreKey material used for TZ diag buffer encryption and other data related to log buffer is not wiped...6.7 Medium
- google androidIn parseNextBox of IsoInterface.java, there is a possible leak of unredacted location information...8.8 High
- palo alto networks pan-osPAN-OS: Information exposure in Ethernet data frame construction (Etherleak)4.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreSome websites have a feature "Show Password" where clicking a button will change a password field...6.5 Medium
- debian linux, fedoraproject fedora, intel microcode +4 more +6 moreImproper removal of sensitive information before storage or transfer in some Intel(R) Processors...5.5 Medium
- redhat libvirt, netapp ontap select deploy administration utility, redhat codeready linux builder +10 more +12 moreAn information disclosure vulnerability was found in libvirt in versions before 6.3.0. HTTP...6.5 Medium
- redhat ansible, ansible community community collections +1 moreAnsible does not collect garbage after playbook run5.0 Medium
- containers podman, fedoraproject fedora, redhat enterprise linux +1 more +3 moreInformation disclosure in podman5.3 Medium
- linux4sam at91bootstrapAT91bootstrap before 3.9.2 does not properly wipe encryption and authentication keys from memory...9.1 Critical
- avast antivirusAn issue was discovered in the Login Password feature of the Password Manager component in Avast...5.5 Medium
- sensiolabs httpclient, symfony, fedoraproject fedora +2 moreRCE in Symfony8.0 High
- teradici graphics agent, pcoip standard agent +1 moreBroker Protocol messages in Teradici PCoIP Standard Agent for Windows and Graphics Agent for...5.5 Medium
- xen, debian linux, fedoraproject fedora +1 more +3 moreAn issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (without...5.5 Medium
- varnish-cache varnish cache, opensuse backports sle, leap +2 moreAn issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3...7.5 High
- apple ios, ipados, iphone os +2 moreThe issue was resolved by clearing application previews when content is deleted. This issue is...3.3 Low
- apple ios, ipados, iphone os +2 moreAn issued existed in the naming of screenshots. The issue was corrected with improved naming....5.3 Medium
- apache jackrabbit oakImproper Removal of Sensitive Information Before Storage or Transfer in Apache Jackrabbit Oak7.5 High
- teamviewerAn issue was discovered in the Chat functionality of the TeamViewer desktop application 14.3.4730...4.3 Medium
- fortinet fcm-mb40 firmware/usr/sbin/default.sh and /usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi on Dynacolor FCM...8.8 High
- kubernetes, netapp trident +1 moreKubernetes did not effectively clear service account credentials3.1 Low
- facebook folly, hhvm +1 morefolly::secureRandom will re-use a buffer between parent and child processes when fork() is called...7.5 High
- rapid7 komandIn Rapid7 Komand version 0.41.0 and prior, certain endpoints that are able to list the always...3.4 Low
- ovirt, red hat ovirt-engine, redhat virtualization +2 moreovirt-engine Logs Plaintext Passwords To File7.2 High
- ovirt, redhat ovirt-engine +1 moreA vulnerability was discovered in oVirt 4.1.x before 4.1.9, where the combination of Enable...5.3 Medium
- openstack folsom, grizzly, red hat openstack folsom for rhel 6 +3 more +5 moreOpenstack nova: information leak in libvirt lvm-backed instances6.5 Medium
- image processing project processingA design flaw in image processing software that modifies JPEG images might not modify the...5.5 Medium
- linux kernelThe Network Address Translation (NAT) capability for Netfilter ("iptables") 1.2.6a and earlier...7.5 High