CWE-1258: Exposure of Sensitive System Information Due to Uncleared Debug Information
Filter
The hardware product enters debug mode but does not fully clear security-sensitive values, such as keys and intermediate values in cryptographic operations.
What the weakness is: CWE-1258 at MITRE. All weaknesses
Related attack patterns (CAPEC): 4
- CAPEC-37 Retrieve Embedded Sensitive Data Likelihood: High · Severity: Very High
- CAPEC-150 Collect Data from Common Resource Locations Severity: Medium
- CAPEC-204 Lifting Sensitive Data Embedded in Cache Severity: Medium
- CAPEC-545 Pull Data from System Resources
The attack patterns MITRE's CAPEC relates to CWE-1258, as MITRE names them. Credits.
Ask an AI about CWE-1258
Show the prompt
Explain CWE-1258: Exposure of Sensitive System Information Due to Uncleared Debug Information and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/1258.html and https://cve.bz/cve/cwe/1258?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 4.9CVE-2026-65127EPSS 0.3%
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause exposure of sensitive system information due to uncleared debug information. A successful exploit of this vulnerability might lead to informa…
- 2.4CVE-2026-80239EPSS 0.2%
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Exposure of Sensitive System Information Due to Uncleared Debug Information vulnerability. An unauthenticated attack…
- 3.3CVE-2026-79727EPSS 0.1%
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Exposure of Sensitive System Information Due to Uncleared Debug Information vulnerability. A low privileged attacker…
- 7.5CVE-2026-66432EPSS 0.4%
Subscriber Sensitive Data Exposure in WPJAM Basic <= 7.0.2.1 versions.
- 7.5CVE-2026-52696EPSS 0.2%
Unauthenticated Sensitive Data Exposure in JetBlog <= 2.4.8 versions.
- 2.7CVE-2025-15480EPSS 0.3%
In Ubuntu, ubuntu-desktop-provision version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, ubuntu-desktop-provision could include the user's p…
- 2.7CVE-2025-14551EPSS 0.3%
In Ubuntu, Subiquity version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, Subiquity could include certain user credentials, such as the user…
- 4.9CVE-2026-26948EPSS 0.3%
Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.174, 15G and 16G versions prior to 7.10.90.00, contain an Exposure of Sensitive System Information Due to Uncleared Debug Information vulnerability. A high priv…
- 4.9CVE-2025-26482EPSS 0.3%
Dell PowerEdge Server BIOS and Dell iDRAC9, all versions, contains an Information Disclosure vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information Disclosure.
- 5.3CVE-2025-32257ExploitEPSS 0.8%
Exposure of Sensitive System Information Due to Uncleared Debug Information vulnerability in 1clickmigration 1 Click WordPress Migration 1-click-migration allows Retrieve Embedded Sensitive Data.This issue affects 1 Click WordPress Migrati…
- 9.3CVE-2024-36913EPSS 0.7%
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted(…
- 9.6CVE-2024-36912EPSS 1.0%
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to …
- 6.5CVE-2023-48308EPSS 0.5%
Nextcloud/Cloud is a calendar app for Nextcloud. An attacker can gain access to stacktrace and internal paths of the server when generating an exception while editing a calendar appointment. It is recommended that the Nextcloud Calendar ap…
- 5.5CVE-2022-43666EPSS 0.2%
Exposure of sensitive system information due to uncleared debug information for some Intel Unison software may allow an authenticated user to potentially enable information disclosure via local access.
- 7.5CVE-2022-39292EPSS 0.9%
Slack Morphism is a modern client library for Slack Web/Events API/Socket Mode and Block Kit. Debug logs expose sensitive URLs for Slack webhooks that contain private information. The problem is fixed in version 1.3.2 which redacts sensiti…
- 7.5CVE-2022-31162EPSS 0.9%
Slack Morphism is an async client library for Rust. Prior to 0.41.0, it was possible for Slack OAuth client information to leak in application debug logs. Stricter and more secure debug formatting was introduced in v0.41.0 for OAuth secret…