CWE-359: Privacy violation
The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.
Also known as Exposure of Private Personal Information to an Unauthorized Actor, Privacy leak / Privacy leakage, PPI.
A kind of CWE-200 Information Disclosure.
From the CWE List. © The MITRE Corporation.
Newest
- prestashopPresta Shop vulnerable to email enumeration3.7 Low
- sma ennexos.sunnyportal.comSMA: Sunny Portal limited disclosure of personal data of registered users to an authenticated user6.5 Medium
- microsoft azure stack hub, azure app service on azure stack +1 moreAzure Stack Hub Information Disclosure Vulnerability4.4 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform: Password and email exposure in xml.vm fields8.7 High
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform: Any user with editing rights can access password properties through Database List Properties7.1 High
- apple ipados, ios and ipados, iphone os +2 moreThe issue was addressed by adding additional logic. This issue is fixed in iPadOS 17.7.9, iOS 18...4.0 Medium
- apple ipados, ios and ipados, iphone os +2 moreThis issue was addressed through improved state management. This issue is fixed in iOS 18.6 and...5.3 Medium
- apple ipados, macos, safari +5 more +7 moreThis issue was addressed through improved state management. This issue is fixed in iOS 18.6 and...7.5 High
- apple macosThis issue was addressed with improved redaction of sensitive information. This issue is fixed in...4.6 Medium
- universal-omega dynamicpagelist3DynamicPageList3 exposes hidden/suppressed usernames8.7 High
- dokployDokploy Improperly Discloses User Information via user.one Endpoint1.3 Low
- red hat advanced cluster management for kubernetes 2.11 for rhel 9, advanced cluster management for kubernetes 2.12 for rhel 9, redhat advanced cluster management for kubernetes +2 moreRhacm: users with clusterreader role can see credentials from managed-clusters5.5 Medium
- microsoft dynamics 365 fasttrack implementation, dynamics 365 +1 moreDynamics 365 FastTrack Implementation Assets Information Disclosure Vulnerability7.5 High
- weblateWeblate exposes personal IP address via e-mail2.1 Low
- devolutions remote desktop managerExposure of private personal information to an unauthorized actor in the user vaults component of...7.5 High
- abb aspect-enterprise, matrix series, nexus series +2 moreSensitive Information disclosed in log files6.9 Medium
- gitlabExposure of Private Personal Information to an Unauthorized Actor in GitLab4.3 Medium
- hcl software domino leapHCL Domino Volt and Domino Leap are affected by a disclosure of private personal information vulnerability5.3 Medium
- hcl software leap, hcltech hcl leap +1 moreHCL Leap is affected by a disclosure of private personal information vulnerability5.3 Medium
- zabbixExcessive information returned by user.get2.1 Low
- mozilla firefoxTab title disclosure across pages when using AI chatbot5.3 Medium
- superagi, transformeroptimus transformeroptimus/superagi +1 moreInformation Disclosure in transformeroptimus/superagi7.5 High
- No product listedA vulnerability in Intrexx Portal Server 12.0.2 and earlier which was classified as problematic...6.5 Medium
- hewlett packard enterprise (hpe) aos-cxAuthenticated Sensitive Information Disclosure exposes Credentials in AOS-CX Command Line Interface6.0 Medium
- hewlett packard enterprise (hpe) aos-cxAuthenticated Access Control Vulnerability allows Sensitive Information Disclosure in AOS-CX REST Interface4.3 Medium
- themeum qubely, qubely – advanced gutenberg blocks +1 moreQubely – Advanced Gutenberg Blocks <= 1.8.13 - Authenticated (Contributor+) Sensitive Information Exposure via qubely_get_content4.3 Medium
- pik online yazılım çözümleri a.ş. online, pozitifik pik online +1 moreBroken Access Control in PozitifIK's Pik Online7.6 High
- mozilla firefoxTapjacking in Android Custom Tabs using transition animations3.9 Low
- dario health application database and internet-based server infrastructure, usb-c blood glucose monitoring system starter kit android applications +1 moreDario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Exposure of Private Personal Information to an Unauthorized Actor8.7 High
- jegtheme jeg elementor kit, jeg kit for elementor – powerful addons for elementor, widgets & templates for wordpress +1 moreJeg Elementor Kit <= 2.6.11 - Authenticated (Contributor+) Sensitive Information Exposure via Countdown and Off-Canvas4.3 Medium
- qardio heart health ios mobile application, qardio +1 moreQardio Heart Health IOS Mobile Application Exposure of Private Personal Information to an Unauthorized Actor6.2 Medium
- wpwax directorist, directorist: ai-powered business directory, listings & classified ads +1 moreDirectorist – AI-Powered WordPress Business Directory Plugin with Classified Ads Listings <= 8.0.12 - Unauthenticated User Information Exposure5.3 Medium
- devitemsllc ht event – wordpress event manager plugin for elementorHT Event – WordPress Event Manager Plugin for Elementor <= 1.4.7 - Authenticated (Contributor+) Sensitive Information Exposure via HT Event: Sponsor4.3 Medium
- contec health cms8000 patient monitorExposure of Private Personal Information to an Unauthorized Actor vulnerability in Contec Health CMS8000 Patient Monitor8.2 High
- updatecliUpdatecli may expose Maven credentials in console output7.1 High
- webtechstreet elementor addon elements, wpvibes addon elements for elementor (formerly elementor addon elements) +1 moreElementor Addon Elements <= 1.13.10 - Authenticated (Contributor+) Sensitive Information Exposure via Modal Popup4.3 Medium
- awplife event monster, awordpresslife event monster – manager & ticket booking +1 moreEvent monster <= 1.4.3 - Information Exposure Via Visitors List Export5.3 Medium
- ibm jazz foundationIBM Jazz Foundation information disclosure4.2 Medium
- discourseBypass of Discourse Connect using other login paths if enabled in Discourse5.3 Medium
- wpjobportal wp job portal, wp job portal – ai-powered recruitment system for company or job board website +1 moreWP Job Portal <= 2.2.2 - Missing Authorization to Unauthenticated Arbitrary Resume Download5.3 Medium
- ruijie reyee osRuijie Reyee OS Exposure of Private Personal Information to an Unauthorized Actor7.1 High
- autolabdownload_all_submissions allows student to download another student's submissions in Autolab7.1 High
- ibm concert, concert software +1 moreIBM Concert Software information disclosure4.3 Medium
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Information Disclosure Vulnerability5.4 Medium
- tecno com.transsion.phoenixUnauthorized access vulnerability in the mobile application (com.transsion.phoenix) can lead to...7.5 High
- fortinet fortianalyzer, fortimanager, fortianalyzer big data +2 moreAn exposure of sensitive information to an unauthorized actor [CWE-200] in Fortinet FortiManager...3.9 Low
- acronis cyber filesSensitive information disclosure due to spell-jacking. The following products are affected:...5.7 Medium
- apex softcell ld geo, apexsoftcell ld dp back office +1 moreInformation Disclosure Vulnerability8.7 High
- apex softcell ld dp back office, apexsoftcell ld geo +1 moreParameter Manipulation Vulnerability8.7 High
- xwiki, xwiki xwiki-platform +1 moreData leak of notification filters of users in XWiki Platform5.3 Medium
- Show moreLoading…