CWE-359: Privacy violation
The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.
Also known as Exposure of Private Personal Information to an Unauthorized Actor, Privacy leak / Privacy leakage, PPI.
A kind of CWE-200 Information Disclosure.
From the CWE List. © The MITRE Corporation.
Newest
- nextcloud talk, kiteworks security-advisories +1 moreNextcloud Talk messages can still be seen on conversation after expiring when cron is misconfigured2.6 Low
- discourseGroup SMTP user emails are exposed in CC email header3.5 Low
- nextcloud talk, kiteworks security-advisories +1 moreNextcloud Talk guests can continue to receive video streams from call after being removed from a conversation4.8 Medium
- xwiki, xwiki xwiki-platform +1 moreExposure of Private Personal Information to an Unauthorized Actor in xwiki-platform-rest-server5.3 Medium
- cisco secure email, secure email and web manager, secure web appliance +1 more +3 moreA vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA),...6.5 Medium
- octopus serverIn affected versions of Octopus Server it was identified that when a sensitive value is a...5.3 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform Web Templates vulnerable to Missing Authorization and Exposure of Private Personal Information to an Unauthorized Actor7.5 High
- convert2rhel project convert2rhel, redhat enterprise linux +1 moreThere is a flaw in convert2rhel. convert2rhel passes the Red Hat account password to subscription...5.5 Medium
- notrinos notrinos/notrinoserp, notrinoserp +1 moreExposure of Private Personal Information to an Unauthorized Actor in notrinos/notrinoserp8.8 High
- nextcloud talk, kiteworks security-advisories +1 moreMissing rate limit when trying to join a password protected Nextcloud Talk conversation3.5 Low
- jfrog artifactoryJFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure...4.9 Medium
- nextcloud talk, kiteworks security-advisories +1 moreExposure of Private Personal Information to an Unauthorized Actor in Nextcloud Talk2.4 Low
- cross-fetch project cross-fetch, lquixada lquixada/cross-fetch +1 moreExposure of Private Personal Information to an Unauthorized Actor in lquixada/cross-fetch8.8 High
- gnuboard gnuboard/gnuboard5, sir gnuboard +1 moreUse of a Broken or Risky Cryptographic Algorithm in gnuboard/gnuboard58.2 High
- xwiki, xwiki xwiki-platform +1 moreUnauthenticated user can list hidden document from multiple velocity templates5.3 Medium
- xwiki, xwiki xwiki-platform +1 moreUnauthenticated user can retrieve the list of users through uorgsuggest.vm5.3 Medium
- alextselegidis alextselegidis/easyappointments, easyappointments +1 moreExposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments9.1 Critical
- fluture-js fluture-nodeUnauthorized forwarding of confidential headers in fluture-node2.6 Low
- follow-redirects follow-redirects/follow-redirects, follow-redirects project follow-redirects, siemens sinec ins +2 moreExposure of Private Personal Information to an Unauthorized Actor in follow-redirects/follow-redirects8.0 High
- emuse eservices / envoice, emuse - eservices \/ envoice project - eservices \/ envoice +1 moreEmuse - eServices / eNvoice Exposure Of Private Personal Information6.1 Medium
- elgg, elgg elgg/elgg +1 moreExposure of Private Personal Information to an Unauthorized Actor in elgg/elgg5.3 Medium
- adobe acrobat, acrobat reader, acrobat reader dc +1 more +3 moreAdobe Acrobat Reader privacy violation vulnerability could lead to privilege escalation5.3 Medium
- komootAn information disclosure vulnerability exists in the Friend finder functionality of GmbH Komoot...5.3 Medium
- haxx libcurl, broadcom fabric operating system, debian linux +12 more +14 morecurl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information...5.3 Medium
- juniper junos, juniper networks junos os +1 moreJunos OS: SRX and NFX Series: Insufficient Web API private key protection6.5 Medium
- mattermost serverMattermost Server: initial_load API exposes unnecessary information7.5 High
- hackerone nextcloud server, nextcloud server, opensuse backports sle +1 more +3 moreExposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain...5.3 Medium
- synology photo stationExposure of private information vulnerability in Photo Viewer in Synology Photo Station 6.8.1...5.3 Medium