CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer, page 3

The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.

What the weakness is: CWE-212 at MITRE. All weaknesses

1. 5.5CVE-2021-3602EPSS 0.3%2022-03-03

   An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent process…

2. 6.1CVE-2022-24719EPSS 0.8%2022-03-01

   Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Using `followRedirects` or `followRedirectsWith` with any of the redirection strategies built into fluture-node 4.0.0 or 4.0.1, paired with a request that inclu…

3. 6.5CVE-2022-25187EPSS 1.0%2022-02-15

   Jenkins Support Core Plugin 2.79 and earlier does not redact some sensitive information in the support bundle.

4. 5.9CVE-2022-23633EPSS 2.2%2022-02-11

   Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to res…

5. 3.7CVE-2022-22779EPSS 0.8%2022-02-09

   The Keybase Clients for macOS and Windows before version 5.9.0 fails to properly remove exploded messages initiated by a user. This can occur if the receiving user switches to a non-chat feature and places the host in a sleep state before …

6. 5.9CVE-2022-0536EPSS 1.3%2022-02-09

   Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.

7. 2.3CVE-2022-23605EPSS 0.3%2022-02-04

   Wire webapp is a web client for the wire messaging protocol. In versions prior to 2022-01-27-production.0 expired ephemeral messages were not reliably removed from local chat history of Wire Webapp. In versions before 2022-01-27-production…

8. 7.5CVE-2022-0355EPSS 2.0%2022-01-26

   Improper Removal of Sensitive Information Before Storage or Transfer in NPM simple-get prior to 4.0.1.

9. 4.9CVE-2021-39891EPSS 1.0%2021-10-05

   In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the end of impersonation which may lead to unnecessary sensitive info disclosure.

10. 7.5CVE-2020-36476EPSS 1.6%2021-08-23

    An issue was discovered in Mbed TLS before 2.24.0 (and before 2.16.8 LTS and before 2.7.17 LTS). There is missing zeroization of plaintext buffers in mbedtls_ssl_read to erase unused application data from memory.

11. 5.3CVE-2021-38554EPSS 0.9%2021-08-13

    HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8.0 and pending 1.7.4 / 1.6.6 releases.

12. 5.5CVE-2021-28689EPSS 0.4%2021-06-11

    x86: Speculative vulnerabilities with bare (non-shim) 32-bit PV guests 32-bit x86 PV guest kernels run in ring 1. At the time when Xen was developed, this area of the i386 architecture was rarely used, which is why Xen was able to use it t…

13. 4.6CVE-2021-32658EPSS 0.3%2021-06-08

    Nextcloud Android is the Android client for the Nextcloud open source home cloud system. Due to a timeout issue the Android client may not properly clean all sensitive data on account removal. This could include sensitive key material such…

14. 6.5CVE-2020-14301EPSS 1.2%2021-05-27

    An information disclosure vulnerability was found in libvirt in versions before 6.3.0. HTTP cookies used to access network-based disks were saved in the XML dump of the guest domain. This flaw allows an attacker to access potentially sensi…

15. 7.5CVE-2021-31780EPSS 1.0%2021-04-23

    In app/Model/MispObject.php in MISP 2.4.141, an incorrect sharing group association could lead to information disclosure on an event edit. When an object has a sharing group associated with an event edit, the sharing group object is ignore…

16. 6.7CVE-2020-11198EPSS 0.1%2021-02-22

    Key material used for TZ diag buffer encryption and other data related to log buffer is not wiped securely due to improper usage of memset in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…

17. 8.8CVE-2021-0340EPSS 2.2%2021-02-10

    In parseNextBox of IsoInterface.java, there is a possible leak of unredacted location information due to improper input validation. This could lead to remote information disclosure with no additional execution privileges needed. User inter…

18. 4.3CVE-2021-3031EPSS 0.5%2021-01-13

    Padding bytes in Ethernet packets on PA-200, PA-220, PA-500, PA-800, PA-2000 Series, PA-3000 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series firewalls are not cleared before the data frame is created. This leaks a small amount o…

19. 6.5CVE-2020-26965EPSS 1.3%2020-12-09

    Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field, revealing the typed password. If, when using a software keyboard that remembers user input, a user typed their passwor…

20. 5.5CVE-2020-8696EPSS 0.4%2020-11-12

    Improper removal of sensitive information before storage or transfer in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

21. 5.5CVE-2020-25635EPSS 0.3%2020-10-05

    A flaw was found in Ansible Base when using the aws_ssm connection plugin as garbage collector is not happening after playbook run is completed. Files would remain in the bucket exposing the data. This issue affects directly data confident…

22. 5.3CVE-2020-14370EPSS 1.4%2020-09-23

    An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short duration, the environme…

23. 9.1CVE-2020-11684EPSS 1.1%2020-09-14

    AT91bootstrap before 3.9.2 does not properly wipe encryption and authentication keys from memory before passing control to a less privileged software component. This can be exploited to disclose these keys and subsequently encrypt and sign…

24. 5.5CVE-2020-15024EPSS 0.3%2020-09-10

    An issue was discovered in the Login Password feature of the Password Manager component in Avast Antivirus 20.1.5069.562. An entered password continues to be stored in Windows main memory after a logout, and after a Lock Vault operation.

25. 8.8CVE-2020-15094EPSS 3.0%2020-09-02

    In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests. HttpCache uses internal headers like X-Body-Eval and X-Body-File to control th…

26. 5.5CVE-2020-13179EPSS 0.3%2020-08-11

    Broker Protocol messages in Teradici PCoIP Standard Agent for Windows and Graphics Agent for Windows prior to 20.04.1 are not cleaned up in server memory, which may allow an attacker to read confidential information from a memory dump via …

27. 5.5CVE-2020-11740EPSS 0.4%2020-04-14

    An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (without active profiling) to obtain sensitive information about other guests. Unprivileged guests can request to map xenoprof buffers, even if profiling ha…

28. 7.5CVE-2019-20637EPSS 1.8%2020-04-08

    An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before 6.3.1. It does not clear a pointer between the handling of one client request and the next request within the same connection. This s…

29. 3.3CVE-2020-9780EPSS 0.3%2020-04-01

    The issue was resolved by clearing application previews when content is deleted. This issue is fixed in iOS 13.4 and iPadOS 13.4. A local user may be able to view deleted content in the app switcher.

30. 5.3CVE-2020-3874EPSS 0.8%2020-02-27

    An issued existed in the naming of screenshots. The issue was corrected with improved naming. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. Screenshots of the Messages app may reveal additional message content.

31. 7.5CVE-2020-1940EPSS 4.5%2020-01-28

    The optional initial password change and password expiration features present in Apache Jackrabbit Oak 1.2.0 to 1.22.0 are prone to a sensitive information disclosure vulnerability. The code mandates the changed password to be passed as an…

32. 6.5CVE-2019-19362EPSS 2.1%2019-12-02

    An issue was discovered in the Chat functionality of the TeamViewer desktop application 14.3.4730 on Windows. (The vendor states that it was later fixed.) Upon login, every communication is saved within Windows main memory. When a user log…

33. 8.8CVE-2019-13402EPSS 1.5%2019-07-08

    /usr/sbin/default.sh and /usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi on Dynacolor FCM-MB40 v1.2.0.0 devices implement an incomplete factory-reset process. A backdoor can persist because neither system accounts nor the set of se…

34. 8.1CVE-2019-11243EPSS 1.7%2019-04-22

    In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials removed (bearer token, username/password, and client certificate/key data). In the affected versions…

35. 7.5CVE-2018-6337EPSS 1.8%2018-12-31

    folly::secureRandom will re-use a buffer between parent and child processes when fork() is called. That will result in multiple forked children producing repeat (or similar) results. This affects HHVM 3.26 prior to 3.26.3 and the folly lib…

36. 4.9CVE-2018-5559EPSS 0.6%2018-11-28

    In Rapid7 Komand version 0.41.0 and prior, certain endpoints that are able to list the always encrypted-at-rest connection data could return some configurations of connection data without obscuring sensitive data from the API response sent…

37. 6.6CVE-2017-15113EPSS 1.1%2018-07-27

    ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can change the log level and only administrators can access the logs. This presents a risk when debug-l…

38. 5.3CVE-2018-1062EPSS 1.4%2018-03-06

    A vulnerability was discovered in oVirt 4.1.x before 4.1.9, where the combination of Enable Discard and Wipe After Delete flags for VM disks managed by oVirt, could cause a disk to be incompletely zeroed when removed from a VM. If the same…

39. 6.5CVE-2012-5625EPSS 1.3%2012-12-26

    OpenStack Compute (Nova) Folsom before 2012.2.2 and Grizzly, when using libvirt and LVM backed instances, does not properly clear physical volume (PV) content when reallocating for instances, which allows attackers to obtain sensitive info…

40. 5.5CVE-2005-0406EPSS 0.5%2005-02-14

    A design flaw in image processing software that modifies JPEG images might not modify the original EXIF thumbnail, which could lead to an information leak of potentially sensitive visual information that had been removed from the main JPEG…

41. 7.5CVE-2002-0704EPSS 3.2%2002-07-26

    The Network Address Translation (NAT) capability for Netfilter ("iptables") 1.2.6a and earlier leaks translated IP addresses in ICMP error messages.