CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer
The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- zoom communications inc. clients, zoom meeting software development kit, rooms +3 more +5 moreZoom Clients - Improper Removal of Sensitive Information5.3 Medium
- weblateWeblate leaks the IP of project members inviting users to assume reviewer roles in Audit log2.6 Low
- mediawikiEventStreams publishes suppressed recent change entries that are suppressed from their creation2.7 Low
shopware/corePackagist,shopware/platformPackagist +1 moreShopware exposes sensitive user information via CSV export mapping4.9 Medium- ruby uriURI Credential Leakage Bypass over CVE-2025-272212.1 Low
- amd radeon™ pro v520 graphics products, radeon™ pro v620 graphics products, radeon™ pro v710 graphics products +16 more +18 moreImproper removal of sensitive information before storage or transfer in AMD Crash Defender could...3.3 Low
- xwiki, xwiki xwiki-platform +1 moreXWiki PDF export jobs store sensitive cookies unencrypted in job statuses5.8 Medium
- contaoContao discloses information in the news module5.3 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreQemu-kvm: uefi-vars: information disclosure vulnerability in uefi_vars_write callback3.3 Low
- ibm concert, concert software +1 moreIBM Concert Software information disclosure5.9 Medium
m00nl1ght-dev/steam-workshop-deployGitHub Actions,BoldestDungeon/steam-workshop-deployGitHub Actions +1 morem00nl1ght-dev/steam-workshop-deploy: Exposure of Version-Control Repository to an Unauthorized Control Sphere and Insufficiently Protected Credentials10.0 Critical- ibm mq operator, supplied mq advanced container images +1 moreIBM MQ Operator information disclosure6.2 Medium
- directusDirectus doesn't redact tokens in Flow logs4.5 Medium
- artifex ghostscriptgs_lib_ctx_stash_sanitized_arg in base/gslibctx.c in Artifex Ghostscript through 10.05.0 lacks...4.0 Medium
- wire wire-webappwire-webapp has no database deletion on client logout6.0 Medium
- ruby uriURI allows for userinfo Leakage in URI#join, URI#merge, and URI#+3.2 Low
- cisco application policy infrastructure controller, application policy infrastructure controller (apic) +1 moreCisco Application Policy Infrastructure Controller Authenticated Command Injection Due to Sensitive Disclosure Vulnerability4.4 Medium
- richardoc kube-audit-restkube-audit-rest's example logging configuration could disclose secret values in the audit log5.1 Medium
- openvpn connectOpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private...7.5 High
- jetbrains teamcityIn JetBrains TeamCity before 2024.12 backup file exposed user credentials and session cookies5.5 Medium
- hitachi energy tro600, hitachienergy tro610 firmware, tro620 firmware +1 more +3 moreProfile files from TRO600 series radios are extracted in plain-text and encrypted file formats....2.7 Low
- linux, linux kernel, siemens ruggedcom rst2428p +6 more +8 morenet: ethernet: lantiq_etop: fix memory disclosure7.5 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +23 more +25 moreWindows Kernel-Mode Driver Information Disclosure Vulnerability5.5 Medium
- phoenix contact fl mguard 2102, fl mguard 2105, fl mguard 4102 pci +69 more +71 morePhoenix Contact: Access to CSRF tokens of higher privileged users in MGUARD products5.7 Medium
- apache streamparkApache StreamPark: Information leakage vulnerability5.9 Medium
- devolutions remote desktop managerImproper removal of sensitive information in data source export feature in Devolutions Remote...4.7 Medium
- fortinet fortisoarAn improper removal of sensitive information before storage or transfer vulnerability [CWE-212]...6.0 Medium
- sixlabors imagesharpSixLabors.ImageSharp vulnerable to data leakage5.3 Medium
- opentelemetry, open-telemetry opentelemetry-dotnet +1 moreSensitive query parameters logged by default in OpenTelemetry.Instrumentation http and AspNetCore4.1 Medium
- huawei emui, harmonyos +1 moreInformation management vulnerability in the Gallery module.Successful exploitation of this...7.5 High
- nextcloud calendar, kiteworks security-advisories +1 moreCalendar app returns full stacktrace when an error happens while editing appointment3.5 Low
- gallagher controller 6000, controller 6000 firmware +1 moreSensitive information uncleared after debug/power state transition in the Controller 6000 could...2.4 Low
- linux kernelA known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB,...5.5 Medium
- nextcloud server, kiteworks security-advisories +1 moreFull path of data directory exposed to Nextcloud server users3.5 Low
- linux kernelA flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks...5.5 Medium
- octopus serverIn affected versions of Octopus Deploy it is possible for certain types of sensitive variables to...7.5 High
- usememos memos, usememos/memos +1 moreImproper Removal of Sensitive Information Before Storage or Transfer in usememos/memos8.1 High
- bytecodealliance wasmtimeWasmtime vulnerable to data leakage between instances in the pooling allocator8.6 High
- debian linux, linux kernel, redhat enterprise linux +1 more +3 moreA flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a...5.5 Medium
- agentejo cockpit, cockpit-hq cockpit-hq/cockpit +1 moreImproper Removal of Sensitive Information Before Storage or Transfer in cockpit-hq/cockpit9.8 Critical
- slack morphism project morphism, abdolence slack-morphism-rust +1 moreSlack Morphism for Rust before 0.41.0 can accidentally leak Slack OAuth client information in application debug logs7.5 High
- amd a10-9600p firmware, a10-9630p firmware, a12-9700p firmware +124 more +126 moreAMD microprocessor families 15h to 18h are affected by a new Spectre variant that is able to...6.5 Medium
- debian linux, fedoraproject fedora, linux kernel +1 more +3 moreLinux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the...7.1 High
- parse-community parse-serverProtected fields exposed via LiveQuery in parse-server8.2 High
- guzzle, debian linux +1 moreCURLOPT_HTTPAUTH option not cleared on change of origin in Guzzle7.7 High
- huawei emui, magic ui +1 moreVulnerability of residual files not being deleted after an update in the ChinaDRM module....7.5 High
- guzzle, debian linux, drupal +2 moreFix failure to strip Authorization header on HTTP downgrade in Guzzle7.5 High
- guzzle, debian linux, drupal +2 moreFailure to strip the Cookie header on change in host or HTTP downgrade in Guzzle7.5 High
- polonel polonel/trudesk, trudesk project trudesk +1 moreImproper Removal of Sensitive Information Before Storage or Transfer in polonel/trudesk4.6 Medium
- strapiImproper Removal of Sensitive Information Before Storage or Transfer in Strapi7.5 High
- Show moreLoading…