CWE-598: Use of HTTP Request With Sensitive Query String
The web application uses an HTTP method to process a request, but the request includes sensitive information in the query string.
A kind of CWE-201 Insertion of Sensitive Information Into Sent Data.
From the CWE List. © The MITRE Corporation.
Newest
- @apostrophecms passport-bridge, apostrophecms apostrophe +1 more ApostropheCMS: Cross-domain session token in URL confers session takeover 5.3 Medium
- auth0 auth0-lock Improper Request Handling for Active Directory Logins in auth0-lock 5.3 Medium
- eleveo call recording software Eleveo Call Recording Software JWT Token logout get request method with sensitive query strings 2.1 Low
- nginxui nginx ui, 0xjacky nginx-ui +1 more Nginx UI: Node Secret Credential Exposure via URL Query Parameter 8.8 High
- ash-project ash authentication phoenix, team-alembic ash authentication +1 more Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix 7.2 High
- flextype Flextype CMS through 1.0.0-alpha.3 API Token Exposure via Query String 8.2 High
- solidinvoice SolidInvoice's long-lived API tokens accepted as URL query parameters, exposing credentials in server logs and browser history 5.9 Medium
- le-yan medical practice management system Le-yan｜Medical Practice Management System - Sensitive Data in URL 6.8 Medium
- ebyte na111-m firmware Ebyte NA111-M Use of GET Request Method With Sensitive Query Strings 9.3 Critical
- quanovate tech inc. (operating as mira / mira care) mira android app, mira firmware +1 more Mira Hormone Monitor, Mira Android App Use of GET request method with sensitive query strings 6.9 Medium
- bilin software and informatics consultancy inc. humanist digital human resources Session Token Exposure in URL Leading to Account Takeover in Bilin Software's HUMANIST Digital Human Resources 7.4 High
- No product listed django-tastypie authentication.py ApiKeyAuthentication get request method with sensitive query strings 6.3 Medium
- ibm engineering ai hub Multiple Vulnerabilities in IBM Engineering AI hub. 7.5 High
- seppmail secure email gateway & seppmail cloud Sensitive Information Disclosure in HTTP header 7.5 High
- getgrav grav-plugin-api Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter 7.5 High
- getgrav grav Grav < 1.0.0-rc.16 Authentication Bypass via token URL Parameter 8.2 High
- auth0 symfony Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK 6.5 Medium
- blakeblackshear frigate Frigate viewer can read logs exposing admin and camera credentials 8.1 High
- getgrav grav Grav API Plugin - Cross-Origin Admin Account Takeover via CORS Wildcard and JWT Query Parameter 8.7 High
-
@nuxt/uinpm @nuxt/ui: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration 6.9 Medium - jleehr canto-saas-api canto-saas-api: OAuth credentials exposed in URL query string and exception messages 5.3 Medium
- juev nebula-mesh nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs) 5.5 Medium
- red hat quay 3 Quay/config-tool: quay/config-tool: gitlab oauth client_secret exposed in url querystring 2.7 Low
- dell storage manager A use of get request method with sensitive query strings vulnerability in volume encryption of... 6.2 Medium
- portainer Portainer: JWT accepted in URL query leaks tokens to logs and referers 7.7 High
- hcl aion HCL AION is affected by a vulnerability where sensitive information may be included in URL parameters. 2.6 Low
- wwbn avideo WWBN AVideo: Password Hash Leaked in MobileManager OAuth Redirect URL Enables Account Takeover 6.8 Medium
- v2board Sensitive server_token exposed via GET parameter in V2Board thru 1.7.4. In app/Http/Controllers... 5.3 Medium
- apache openmeetings Apache OpenMeetings: Login Credentials Passed via GET Query Parameters 7.5 High
- makeplane plane Plane Exposes User Email (PII and part of credential) in GET Parameter 2.0 Low
- futo immich immich-server: Insecure Transmission of Authentication Credentials via Password Parameter in HTTP Request Query String When Accessing Shared Albums 6.3 Medium
- nhost, nhost nhost\/auth +1 more Nhost Leaks the Refresh Token via URL Query Parameter in OAuth Provider Callback 2.3 Low
- jahlives openssl encrypt openssl_encrypt before 1.4.0 Token Leakage via Query Parameters 9.3 Critical
- ibm infosphere information server IBM InfoSphere Information Server is vulnerable due to disclosure of sensitive information 3.1 Low
- pinchtab PinchTab: API Bearer Token Exposed in URL Query Parameter via Server Logs and Intermediary Systems 4.3 Medium
- gainsight assist Gainsight Assist plugin information disclosure 5.3 Medium
- ibm sterling partner engagement manager IBM Sterling Partner Engagement Manager Information Disclosure 3.1 Low
- ibm aspera orchestrator Multiple vulnerabilities in IBM Aspera Orchestrator 5.9 Medium
- mbs ubr-01 mk ii, ubr-02, ubr-lon +1 more +3 more wwwupdate.cgi Session token in URL 7.5 High
- gogs Gogs: Access tokens get exposed through URL params in API requests 6.9 Medium
- hcl software zie for web Session Token Exposure via URL Query Parameters 5.9 Medium
- keystorage global facilities management software An issue in Key Systems Inc Global Facilities Management Software v.20230721a allows a remote... 7.1 High
- No product listed Cross Site Request Forgery vulnerability in Dolibarr ERP & CRM v.22.0.9 allows a remote attacker... 9.0 Critical
- quenary tugtainer Tugtainer vulnerable to Password Exposure via URL Query Parameter 8.1 High
- sick incoming goods suite Certain requests pass the authentication token in the URL as string query parameter, making it... 5.3 Medium
- broadcom dx netops spectrum Spectrum session token in URL 2.3 Low
- ibm i IBM i Information Disclosure 6.5 Medium
- hcl software iautomate, hcltech dryice iautomate +1 more HCL iAutomate is susceptible to a sensitive information disclosure 5.4 Medium
- checkmk Sensitive form data in URL query parameters 1.0 Low
- sick baggage analytics, enterprise analytics, logistic diagnostic analytics +2 more +4 more Plain Text Transmission of Username and Password in the URL 5.3 Medium
- Show olderLoading…