cve.bz

CWE-359: Exposure of Private Personal Information to an Unauthorized Actor, page 3

Filter

The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.

What the weakness is: CWE-359 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

Related attack patterns (CAPEC): 4

The attack patterns MITRE's CAPEC relates to CWE-359, as MITRE names them. Credits.

Ask an AI about CWE-359

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-359: Exposure of Private Personal Information to an Unauthorized Actor and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/359.html and https://cve.bz/cve/cwe/359?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.0CVE-2025-43217EPSS 0.2%

    The issue was addressed by adding additional logic. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9. Privacy Indicators for microphone or camera access may not be correctly displayed.

  2. 5.3CVE-2025-31276EPSS 0.5%

    This issue was addressed through improved state management. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9. Remote content may be loaded even when the 'Load Remote Images' setting is turned off.

  3. 8.7CVE-2025-53625EPSS 0.5%

    The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with various formats and details. Several #dpl parameters can leak usernames that have been hidden using revision deletion, suppre…

  4. 1.3CVE-2025-53374EPSS 0.2%

    Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated low-privileged account can retrieve detailed profile information about another users in t…

  5. 5.5CVE-2025-6017EPSS 0.2%

    A flaw was found in Red Hat Advanced Cluster Management through versions 2.10, before 2.10.7, 2.11, before 2.11.4, and 2.12, before 2.12.4. This vulnerability allows an unprivileged user to view confidential managed cluster credentials thr…

  6. 7.5CVE-2025-49715EPSS 0.8%

    Exposure of private personal information to an unauthorized actor in Dynamics 365 FastTrack Implementation Assets allows an unauthorized attacker to disclose information over a network.

  7. 2.1CVE-2025-49134EPSS 0.3%

    Weblate is a web based localization tool. Prior to version 5.12, the audit log notifications included the full IP address of the acting user. This could be obtained by third-party servers such as SMTP relays, or spam filters. This issue ha…

  8. 7.5CVE-2025-5334EPSS 0.6%

    Exposure of private personal information to an unauthorized actor in the user vaults component of Devolutions Remote Desktop Manager allows an authenticated user to gain unauthorized access to private personal information. Under specif…

  9. 6.9CVE-2024-13953EPSS 0.4%

    Sensitive device logger information in ASPECT may be exposed if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

  10. 4.3CVE-2025-0679EPSS 0.3%

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.1 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Under certain conditions un-authorised users can view full email addresses that should be partially…

  11. 5.3CVE-2023-45721EPSS 0.3%

    Insufficient default configuration in HCL Leap allows anonymous access to directory information.

  12. 5.3CVE-2023-45720EPSS 0.3%

    Insufficient default configuration in HCL Leap allows anonymous access to directory information.

  13. 2.1CVE-2024-42325EPSS 0.3%

    Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc.

  14. 5.3CVE-2025-3035EPSS 0.3%

    By first using the AI chatbot in one tab and later activating it in another tab, the document title of the previous tab would leak into the chat prompt. This vulnerability was fixed in Firefox 137.

  15. 7.5CVE-2024-10267EPSS 0.6%

    An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. An attacker can leak sensitive user information, including names, emails, and passwords, by attempting to register a new account with an e…

  16. 6.5CVE-2025-26816EPSS 0.4%

    A vulnerability in Intrexx Portal Server 12.0.2 and earlier which was classified as problematic potentially allows users with particular permissions under certain conditions to see potentially sensitive data from a different user context.

  17. 6.0CVE-2025-27080EPSS 0.2%

    Vulnerabilities in the command line interface of AOS-CX could allow an authenticated remote attacker to expose sensitive information. Successful exploitation could allow an attacker to gain unauthorized access to services outside of the im…

  18. 4.3CVE-2025-25042EPSS 0.3%

    A vulnerability in the AOS-CX REST interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploitation could allow an attacker to read encrypted credentials of other users on th…

  19. 6.5CVE-2024-13228EPSS 0.4%

    The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.13 via the 'qubely_get_content'. This makes it possible for authenticated attackers, with…

  20. 7.6CVE-2024-11216EPSS 0.3%

    Authorization Bypass Through User-Controlled Key, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in PozitifIK Pik Online allows Account Footprinting, Session Hijacking. This issue affects Pik Online: befor…

  21. 3.9CVE-2025-1939EPSS 0.2%

    Android apps can load web pages using the Custom Tabs feature. This feature supports a transition animation that could have been used to trick a user into granting sensitive permissions by hiding what the user was actually clicking. This v…

  22. 8.7CVE-2025-20060EPSS 0.4%

    An attacker could expose cross-user personal identifiable information (PII) and personal health information transmitted to the Android device via the Dario Health application database.

  23. 4.3CVE-2024-13217EPSS 0.4%

    The Jeg Elementor Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.11 via the 'expired_data' and 'build_content' functions. This makes it possible for authenticated attacker…

  24. 6.6CVE-2025-20615EPSS 0.2%

    The Qardio Arm iOS application exposes sensitive data such as usernames and passwords in a plist file. This allows an attacker to log in to production-level development accounts and access an engineering backdoor in the application. The…

  25. 5.3CVE-2024-12041EPSS 0.4%

    The Directorist: AI-Powered WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 8.0.12 via the /wp-json/directorist/v1/users/ end…

  26. 4.3CVE-2024-13216EPSS 0.3%

    The HT Event – WordPress Event Manager Plugin for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.7 via the 'render' function in /includes/widgets/htevent_sponsor.php…

  27. 8.2CVE-2025-0683EPSS 0.8%

    In its default configuration, Contec Health CMS8000 Patient Monitor transmits plain-text patient data to a hard-coded public IP address when a patient is hooked up to the monitor. This could lead to a leakage of confidential patient dat…

  28. 7.1CVE-2025-24355EPSS 0.2%

    Updatecli is a tool used to apply file update strategies. Prior to version 0.93.0, private maven repository credentials may be leaked in application logs in case of unsuccessful retrieval operation. During the execution of an updatecli pip…

  29. 4.3CVE-2024-13215EPSS 0.5%

    The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.10 via the 'render' function in modules/modal-popup/widgets/modal-popup.php. This makes it possibl…

  30. 5.3CVE-2024-11396ExploitEPSS 2.1%

    The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.3 via the Visitors List Export file. During the export, a CSV file i…

  31. 4.6CVE-2024-41780EPSS 0.2%

    IBM Jazz Foundation 7.0.2, 7.0.3, and 7.1.0 could could allow a physical user to obtain sensitive information due to not masking passwords during entry.

  32. 9.1CVE-2024-49765EPSS 0.4%

    Discourse is an open source platform for community discussion. Sites that are using discourse connect but still have local logins enabled could allow attackers to bypass discourse connect to create accounts and login. This problem is patch…

  33. 5.3CVE-2024-11712EPSS 0.5%

    The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getResumeFileDownloadById() function in all versi…

  34. 7.1CVE-2024-42494EPSS 0.4%

    Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a a feature that could enable sub accounts or attackers to view and exfiltrate sensitive information from all cloud accounts registered to Ruijie's services

  35. 7.1CVE-2024-53258EPSS 0.5%

    Autolab is a course management service that enables auto-graded programming assignments. From Autolab versions v.3.0.0 onward students can download all assignments from another student, as long as they are logged in, using the download_all…

  36. 4.3CVE-2024-49025EPSS 0.5%

    Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

  37. 7.5CVE-2024-11206EPSS 0.4%

    Unauthorized access vulnerability in the mobile application (com.transsion.phoenix) can lead to the leakage of user information.

  38. 4.1CVE-2023-44255EPSS 0.6%

    An exposure of sensitive information to an unauthorized actor [CWE-200] in Fortinet FortiManager before 7.4.2, FortiAnalyzer before 7.4.2 and FortiAnalyzer-BigData before 7.2.5 may allow a privileged attacker with administrative read permi…

  39. 5.7CVE-2024-49386EPSS 0.2%

    Sensitive information disclosure due to spell-jacking. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24.

  40. 8.7CVE-2024-47087EPSS 0.4%

    This vulnerability exists in Apex Softcell LD Geo due to improper validation of the certain parameters (Client ID, DPID or BOID) in the API endpoint. An authenticated remote attacker could exploit this vulnerability by manipulating paramet…

  41. 8.7CVE-2024-47085EPSS 0.4%

    This vulnerability exists in Apex Softcell LD DP Back Office due to improper validation of certain parameters (cCdslClicentcode and cLdClientCode) in the API endpoint. An authenticated remote attacker could exploit this vulnerability by ma…

  42. 5.3CVE-2024-46979EPSS 0.5%

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to get access to notification filters of any user by using a URL such as `<hostname>xwiki/bin/get/XWiki/Notifications/Co…

  43. 5.3CVE-2024-8891EPSS 0.3%

    An attacker with no knowledge of the current users in the web application, could build a dictionary of potential users and check the server responses as it indicates whether or not the user is present in CIRCUTOR Q-SMT in its firmware vers…

  44. 8.7CVE-2024-45787EPSS 0.4%

    This vulnerability exists in Reedos aiM-Star version 2.0.1 due to transmission of sensitive information in plain text in certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating a parameter t…

  45. 5.3CVE-2024-45591ExploitEPSS 3.4%

    XWiki Platform is a generic wiki platform. The REST API exposes the history of any page in XWiki of which the attacker knows the name. The exposed information includes for each modification of the page the time of the modification, the ver…

  46. 4.3CVE-2024-44113EPSS 0.3%

    Due to missing authorization checks, SAP Business Warehouse (BEx Analyzer) allows an authenticated attacker to access information over the network which is otherwise restricted. On successful exploitation the attacker can enumerate informa…

  47. 4.3CVE-2024-41729EPSS 0.3%

    Due to missing authorization checks, SAP BEx Analyzer allows an authenticated attacker to access information over the network which is otherwise restricted. On successful exploitation the attacker can enumerate information causing a limite…

  48. 4.9CVE-2024-37136EPSS 0.4%

    Dell Path to PowerProtect, versions 1.1, 1.2, contains an Exposure of Private Personal Information to an Unauthorized Actor vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to informati…

  49. 4.3CVE-2024-6053EPSS 0.4%

    Improper access control in the clipboard synchronization feature in TeamViewer Full Client prior version 15.57 and TeamViewer Meeting prior version 15.55.3 can lead to unintentional sharing of the clipboard with the current presenter of a …

  50. 7.5CVE-2024-7697EPSS 0.6%

    Logical vulnerability in the mobile application (com.transsion.carlcare) may lead to user information leakage risks.