CWE-598: Use of HTTP Request With Sensitive Query String
The web application uses an HTTP method to process a request, but the request includes sensitive information in the query string.
A kind of CWE-201 Insertion of Sensitive Information Into Sent Data.
From the CWE List. © The MITRE Corporation.
Newest
- directadminAn issue in DirectAdmin v1.680 allows unauthorized attackers to manipulate the page layout and...8.2 High
- No product listedAn issue in Perplexity AI GPT-4 allows a remote attacker to obtain sensitive information via a...4.3 Medium
- No product listedAn issue was discovered in the method push.lite.avtech.com.AvtechLib.GetHttpsResponse in AVTECH...8.8 High
- opensolution quickcms, quick.cms +1 moreSending Password in GET Request6.9 Medium
- opentext enterprise security managerOpenText Enterprise Security Manager Information Exposure5.7 Medium
- advplyr audiobookshelfAudiobookshelf vulnerable to OIDC token exfiltration and account takeover8.8 High
- chshcms mccmsAn authenticated arbitrary file download vulnerability in the component /admin/Backups.php of...5.5 Medium
- siemens siprotec 5 6md84 (cp300), siprotec 5 6md85 (cp300), siprotec 5 6md86 (cp300) +61 more +63 moreA vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions), SIPROTEC 5 6MD85 ...6.0 Medium
- filebrowserFile Browser allows sensitive data to be transferred in URL4.5 Medium
- sick field analyticsSensitive Data in URL5.3 Medium
- tridium niagara, niagara enterprise security, niagara framework +2 moreUse of GET Request Method With sensitive Query Strings4.1 Medium
- abb anc, anc-l, anc-mini +2 moreSensitive information submitted using GET method5.3 Medium
- moodleMoodle: csrf token exposure via url in moodle mod_data module3.1 Low
- weblateWeblate VCS credentials included in URL parameters are potentially logged and saved into browser history as plaintext2.2 Low
- joturlIn JotUrl 2.0, passwords are sent via HTTP GET-type requests, potentially exposing credentials to...6.5 Medium
- blackvue appBlackVue App API deviceDelete get request method with sensitive query strings6.3 Medium
- No product listedMaharashtra State Electricity Distribution Company Limited Mahavitran IOS Application 16.1...7.5 High
- trivision camera nc227wfMultiple vulnerabilities in Trivision Camera NC227WF6.2 Medium
- webkul qloappsWebkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection. When users access...4.2 Medium
- outback power mojave inverter, outbackpower mojave inverter oghi8048a firmware +1 moreOutback Power Mojave Inverter Use of GET Request Method With Sensitive Query Strings8.7 High
- zettler 130.8005A CWE-598 “Use of GET Request Method with Sensitive Query Strings” was discovered affecting the...5.7 Medium
- tp-link tl-sg108e, tl-sg108e firmware +1 moreTP-Link TL-SG108E HTTP GET Request usr_account_set.cgi get request method with sensitive query strings6.3 Medium
- optimizely configured commerceAn issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity...7.5 High
- ibm txseries for multiplatformsIBM TXSeries for Multiplatforms information disclosure5.9 Medium
- checkmkCSRF token leaked in URL parameters2.0 Low
- johnson controls exacqvision, johnsoncontrols exacqvision web service +1 moreexacqVison - Token Disclosed in URL5.7 Medium
- ibm infosphere information serverIBM InfoSphere Information Server information disclosure4.3 Medium
- hms-networks anybus x-gateway ab7832-f3An issue was discovered on HMS Anybus X-Gateway AB7832-F 3 devices. The gateway exposes a web...7.5 High
- jstnmcbrd dectalk-ttsUse of Unencrypted HTTP Request in dectalk-tts8.2 High
- rapid7 insightvmRapid7 InsightVM Sensitive Information Exposure via URL3.3 Low
- ibm maximo application suite, maximo asset management +1 moreIBM Maximo Application Suite information disclosure3.7 Low
- directusSession Token in URL in directus2.3 Low
- hcl software sametimeHCL Sametime is impacted by a sensitive information disclosure1.7 Low
- ibm powerscIBM PowerSC information disclosure3.7 Low
- checkmk gmbh appliance, tribe29 checkmk appliance firmware +1 moreBackup password in GET parameter3.3 Low
- lfprojects mlflow, mlflow mlflow/mlflow +1 moreMLflow Authentication Bypass9.1 Critical
- ray project ray, ray-project ray-project/ray +1 moreRay Static File Local File Include7.5 High
- fortinet fortiosA use of GET request method with sensitive query strings vulnerability in Fortinet FortiOS 7.0.0 ...6.5 Medium
- nvidia omniverse workstation launcher, omniverse launcher +1 moreNVIDIA Omniverse Workstation Launcher for Windows and Linux contains a vulnerability in the...4.0 Medium
- checkmk gmbh appliance, tribe29 checkmk appliance, checkmk appliance firmware +2 moreSite-Passwords in GET parameters5.5 Medium
- dell powerpath management appliancePowerPath Management Appliance with versions 3.3, 3.2*, 3.1 & 3.0* contains sensitive information...2.7 Low
- dell cloudlinkDell EMC CloudLink 7.1.3 and all earlier versions, Auth Token is exposed in GET requests. These...7.6 High
- secomea gatemanager, gatemanager 4250 firmware, gatemanager 4260 firmware +2 more +4 moreGTA URLs issued by LMM WEB API may leak information7.5 High
- dell appsync, emc appsync +1 moreDELL EMC AppSync versions 3.9 to 4.3 use GET request method with sensitive query strings. An...8.3 High
- dell emc streaming data platformDell EMC Streaming Data Platform versions before 1.3 contain a SQL Injection Vulnerability. A...8.8 High
- dell powerscale onefs, emc powerscale onefs +1 moreDell PowerScale OneFS versions 8.2.2 - 9.1.0.x contain a use of get request method with sensitive...8.2 High
- dell rsa archer, rsa archer +1 moreRSA Archer, versions prior to 6.7 P3 (6.7.0.3), contain an information exposure vulnerability....8.8 High
- dell rsa identity governance and lifecycle, rsa identity governance & lifecycle +1 moreThe RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to...8.7 High
- ics-cert pr100088 modbus gateway, kunbus pr100088 modbus gateway firmware +1 moreAn attacker could retrieve passwords from a HTTP GET request from the Kunbus PR100088 Modbus...8.1 High
- entes emg12, emg-12 firmware +1 moreEntes EMG12 versions 2.57 and prior an information exposure through query strings vulnerability...9.8 Critical
- Show moreLoading…