CWE-359: Privacy violation
The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.
Also known as Exposure of Private Personal Information to an Unauthorized Actor, Privacy leak / Privacy leakage, PPI.
A kind of CWE-200 Information Disclosure.
From the CWE List. © The MITRE Corporation.
Newest
- circutor q-smt, q smt, q-smt firmware +2 moreExposure of Private Personal Information to an Unauthorized Actor vulnerability on CIRCUTOR Q-SMT5.3 Medium
- reedos aim-star, reedos software solutions mutual fund distribution product (aim-star) +1 moreInformation Disclosure Vulnerability8.7 High
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform document history including authors of any page exposed to unauthorized actors5.3 Medium
- sap se business warehouse (bex analyzer)Information Disclosure vulnerability in the SAP Business Warehouse (BEx Analyzer)4.3 Medium
- sap se netweaver bw (bex analyzer)Information Disclosure vulnerability in the SAP NetWeaver BW (BEx Analyzer)4.3 Medium
- dell path to power, path to powerprotect +1 moreDell Path to PowerProtect, versions 1.1, 1.2, contains an Exposure of Private Personal...6.8 Medium
- teamviewer meeting, teamviewer, teamviewer remote full client +2 moreImproper access control in the clipboard synchronization feature4.3 Medium
- tecno com.transsion.carlcare, transsion carlcare +1 moreLogical vulnerability in com.transsion.carlcare7.5 High
- matrix matrix-react-sdkURL preview setting for a room is controllable by the homeserver in matrix-react-sdk7.7 High
- apple macosA privacy issue was addressed with improved private data redaction for log entries. This issue is...5.3 Medium
- apple ipados, macos, ios and ipados +1 more +3 moreA privacy issue was addressed with improved private data redaction for log entries. This issue is...5.3 Medium
- microsoft edge, edge (chromium-based) +1 moreMicrosoft Edge (Chromium-based) Information Disclosure Vulnerability5.9 Medium
- ibm infosphere information serverIBM InfoSphere Information Server information disclosure2.4 Low
- siemens simatic pcs 7 v9.1, simatic wincc runtime professional v18, simatic wincc runtime professional v19 +6 more +8 moreA vulnerability has been identified in SIMATIC PCS 7 V9.1 (All versions), SIMATIC WinCC Runtime...8.2 High
- prestashopmodules themesettingsIn the module "Theme settings" (pk_themesettings) <= 1.8.8 from Promokit.eu for PrestaShop, a...7.5 High
- prestashop loginascustomerproIn the module "Login as customer PRO" (loginascustomerpro) <1.2.7 from Weblir for PrestaShop, a...7.5 High
- apple ipados, macos, safari +4 more +6 moreThis issue was addressed with improvements to the noise injection algorithm. This issue is fixed...6.5 Medium
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Information Disclosure Vulnerability7.1 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreIf the `browser.privatebrowsing.autostart` preference is enabled, IndexedDB files were not...4.3 Medium
- foundation platform appAn issue in Foundation.app Foundation platform 1.0 allows a remote attacker to obtain sensitive...7.6 High
- prestashop fmeAn issue in FME Modules eventsmanager before 4.4.0 allows an attacker to obtain sensitive...7.5 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Information Disclosure Vulnerability6.5 Medium
- microsoft edge chromium, edge (chromium-based) +1 moreMicrosoft Edge for Android (Chromium-based) Information Disclosure Vulnerability5.4 Medium
- beaver builder themer, fastlinemedia beaver themer +1 moreBeaver Themer <= 1.4.9 - Authenticated (Contributor+) Sensitive Information Exposure via shortcode6.5 Medium
- saleorSaleor vulnerable to customers addresses leak when using Warehouse as a `Pickup: Local stock only` delivery method4.2 Medium
- axonautAn issue in axonaut v.3.1.23 and before allows a remote attacker to obtain sensitive information...7.5 High
- acronis cyber protect 16, cyber protect +1 moreSensitive information disclosure due to excessive collection of system information. The following...3.3 Low
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Information Disclosure Vulnerability8.2 High
- amitzy molongui authorship, molongui authorship – author boxes, guest authors & co-authors for wordpress +1 moreAuthor Box, Guest Author and Co-Authors for Your Posts – Molongui <= 4.7.4 - Information Exposure via ma_debug5.3 Medium
- apple ipados, macos, safari +3 more +5 moreA privacy issue was addressed with improved handling of user preferences. This issue is fixed in...3.3 Low
- rocklobster contact form 7, sevenspark contact form 7 – dynamic text extension +1 moreContact Form 7 – Dynamic Text Extension <= 4.1.0 - Insecure Direct Object Reference4.3 Medium
- apple ipados, macos, ios and ipados +1 more +3 moreA privacy issue was addressed with improved private data redaction for log entries. This issue is...3.3 Low
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform Solr search discloses password hashes of all users7.5 High
- naver whale browserThe Android Mobile Whale browser app before 3.0.1.2 allows the attacker to bypass its browser...5.5 Medium
- botanik software pharmacy automationInformation Disclosure in Botanik Software Pharmacy Automation7.5 High
- microsoft jupyter, jupyter extension for visual studio code +1 moreVisual Studio Code Jupyter Extension Spoofing Vulnerability7.8 High
- microsoft azure app service, azure function app, azure logic app +1 more +3 moreAzure CLI REST Command Information Disclosure Vulnerability8.6 High
- asyncssh project asyncsshAsyncSSH Rogue Session Attack6.8 Medium
- ping identity pingfederateUser Attribute Disclosure via DynamoDB Data Stores2.6 Low
- nautobotExposure of hashed user passwords via REST API in Nautobot6.5 Medium
- acronis cyber protect 16, cyber protect cloud agent, agent +2 moreSensitive information disclosure due to excessive collection of system information. The following...3.3 Low
- acronis cyber protect 15, cyber protect +1 moreSensitive information disclosure due to spell-jacking. The following products are affected:...5.7 Medium
- gitlabExposure of Private Personal Information to an Unauthorized Actor in GitLab3.5 Low
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform may show email addresses in clear in REST results7.5 High
- microsoft snipping tool, snip & sketch for windows 10, snip \& sketch +2 moreWindows Snipping Tool Information Disclosure Vulnerability3.3 Low
- finex media competition management systemInformation Disclosure in Finex Media's Competition Management System7.5 High
- zyxel atp series firmware, nwa110ax firmware, usg flex 50(w) firmware +53 more +55 moreA post-authentication information exposure vulnerability in the CGI program of Zyxel ATP series...6.5 Medium
- microweber, microweber microweber/microweber +1 moreExposure of Private Personal Information to an Unauthorized Actor in microweber/microweber7.1 High
- xwiki, xwiki xwiki-platform +1 moreUnauthenticated user can have information about hidden users on subwikis through uorgsuggest.vm3.7 Low
- discourseDiscourse tags with no visibility are leaking into og:article:tag5.3 Medium
- Show moreLoading…