cve.bz

CWE-359: Exposure of Private Personal Information to an Unauthorized Actor, page 4

Filter

The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.

What the weakness is: CWE-359 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

Related attack patterns (CAPEC): 4

The attack patterns MITRE's CAPEC relates to CWE-359, as MITRE names them. Credits.

Ask an AI about CWE-359

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-359: Exposure of Private Personal Information to an Unauthorized Actor and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/359.html and https://cve.bz/cve/cwe/359?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2024-42347EPSS 0.4%

    matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. A malicious homeserver could manipulate a user's account data to cause the client to enable URL previews in end-to-end encrypted rooms, in whic…

  2. 5.3CVE-2024-40796EPSS 0.9%

    A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. Private browsing may leak some browsin…

  3. 5.3CVE-2024-27881EPSS 0.8%

    A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. An app may be able to access information about a user’s contacts.

  4. 5.9CVE-2024-38103EPSS 0.5%

    Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

  5. 4.6CVE-2024-37533EPSS 0.2%

    IBM InfoSphere Information Server 11.7 could disclose sensitive user information to another user with physical access to the machine. IBM X-Force ID: 294727.

  6. 8.2CVE-2024-30321EPSS 0.5%

    A vulnerability has been identified in SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC WinCC Runtime Professional V18 (All versions < V18 Update 5), SIMATIC WinCC Runtime Professional V19 (All versions < V19 Update 2), SIMATIC W…

  7. 7.5CVE-2024-36682EPSS 0.4%

    In the module "Theme settings" (pk_themesettings) <= 1.8.8 from Promokit.eu for PrestaShop, a guest can download all email collected while SHOP is in maintenance mode. Due to a lack of permissions control, a guest can access the txt file w…

  8. 7.5CVE-2024-36677EPSS 0.4%

    In the module "Login as customer PRO" (loginascustomerpro) <1.2.7 from Weblir for PrestaShop, a guest can access direct link to connect to each customer account of the Shop if the module is not installed OR if a secret accessible to admini…

  9. 6.5CVE-2024-27850EPSS 0.7%

    This issue was addressed with improvements to the noise injection algorithm. This issue is fixed in Safari 17.5, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, visionOS 1.2. A maliciously crafted webpage may be able to fingerprint the user.

  10. 5.4CVE-2024-30056EPSS 1.6%

    Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

  11. 4.3CVE-2024-4767EPSS 0.5%

    If the `browser.privatebrowsing.autostart` preference is enabled, IndexedDB files were not properly deleted when the window was closed. This preference is disabled by default in Firefox. This vulnerability affects Firefox < 126, Firefox ES…

  12. 7.6CVE-2023-50053EPSS 0.5%

    An issue in Foundation.app Foundation platform 1.0 allows a remote attacker to obtain sensitive information via the Web3 authentication process of Foundation, the signed message lacks a nonce (random number)

  13. 7.5CVE-2024-33271EPSS 0.5%

    An issue in FME Modules eventsmanager before 4.4.0 allows an attacker to obtain sensitive information from the ps_customer component.

  14. 6.5CVE-2024-29987EPSS 1.2%

    Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

  15. 5.4CVE-2024-29986EPSS 0.5%

    Microsoft Edge for Android (Chromium-based) Information Disclosure Vulnerability

  16. 6.5CVE-2023-6695EPSS 0.5%

    The Beaver Themer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.9 via the 'wpbb' shortcode. This makes it possible for authenticated attackers, with contributor access and ab…

  17. 5.4CVE-2024-29888EPSS 0.5%

    Saleor is an e-commerce platform that serves high-volume companies. When using `Pickup: Local stock only` click-and-collect as a delivery method in specific conditions the customer could overwrite the warehouse address with its own, which …

  18. 7.5CVE-2024-28387EPSS 0.4%

    An issue in axonaut v.3.1.23 and before allows a remote attacker to obtain sensitive information via the log.txt component.

  19. 5.5CVE-2023-48680EPSS 0.2%

    Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Cyber Protect 16 (macOS, Windows) before build 37391.

  20. 8.2CVE-2024-26192EPSS 1.5%

    Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

  21. 7.5CVE-2023-7014EPSS 0.7%

    The Author Box, Guest Author and Co-Authors for Your Posts – Molongui plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.7.4 via the 'ma_debu' parameter. This makes it possible for …

  22. 3.3CVE-2024-23211EPSS 0.4%

    A privacy issue was addressed with improved handling of user preferences. This issue is fixed in Safari 17.3, iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, watchOS 10.3. A user's private browsing activity may b…

  23. 4.3CVE-2023-6630EPSS 0.3%

    The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the CF7_get_custom_field and CF7_get_current_user shortcodes due to missing …

  24. 3.3CVE-2023-42830EPSS 0.2%

    A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4. An app may be able to read sensitive location information.

  25. 7.5CVE-2023-50719ExploitEPSS 84%

    XWiki Platform is a generic wiki platform. Starting in 7.2-milestone-2 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the password hashes of all users to anyone with view right on the respec…

  26. 5.5CVE-2023-25632EPSS 0.2%

    The Android Mobile Whale browser app before 3.0.1.2 allows the attacker to bypass its browser unlock function via 'Open in Whale' feature.

  27. 7.5CVE-2023-5983EPSS 0.6%

    Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Botanik Software Pharmacy Automation allows Retrieve Embedded Sensitive Data. This issue affects Pharmacy Automation: before 2.1.133.0.

  28. 8.6CVE-2023-36052EPSS 21%

    Azure CLI REST Command Information Disclosure Vulnerability

  29. 9.8CVE-2023-36018EPSS 1.5%

    Visual Studio Code Jupyter Extension Spoofing Vulnerability

  30. 4.3CVE-2023-34085EPSS 0.6%

    When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request

  31. 5.5CVE-2023-44213EPSS 0.2%

    Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 35739, Acronis Cyber Protect 16 (Windows) before build 37391.

  32. 7.5CVE-2023-44156EPSS 1.0%

    Sensitive information disclosure due to spell-jacking. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 35979.

  33. 4.3CVE-2023-1936EPSS 0.6%

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to leak the emai…

  34. 7.5CVE-2023-35151EPSS 0.7%

    XWiki Platform is a generic wiki platform. Starting in version 7.3-milestone-1 and prior to versions 14.4.8, 14.10.6, and 15.1, ny user can call a REST endpoint and obtain the obfuscated passwords, even when the mail obfuscation is activat…

  35. 3.3CVE-2023-28303EPSS 2.0%

    Windows Snipping Tool Information Disclosure Vulnerability

  36. 7.5CVE-2023-2703EPSS 0.6%

    Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Finex Media Competition Management System allows Retrieve Embedded Sensitive Data, Collect Data as Provided by Users. This issue affects Competition Manage…

  37. 6.5CVE-2023-22918EPSS 0.8%

    A post-authentication information exposure vulnerability in the CGI program of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, U…

  38. 6.5CVE-2023-2239EPSS 0.5%

    Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository microweber/microweber prior to 1.3.4.

  39. 5.3CVE-2023-29203EPSS 0.7%

    XWiki Commons are technical libraries common to several other top level XWiki projects. It's possible to list some users who are normally not viewable from subwiki by requesting users on a subwiki which allows only global users with `uorgs…

  40. 5.3CVE-2023-25819EPSS 0.5%

    Discourse is an open source platform for community discussion. Tags that are normally private are showing in metadata. This affects any site running the `tests-passed` or `beta` branches >= 3.1.0.beta2. The issue is patched in the latest `…

  41. 4.3CVE-2023-26041EPSS 0.8%

    Nextcloud Talk is a fully on-premises audio/video and chat communication service. When cron jobs were misconfigured and therefore messages are not expired, the API would still return them while they were then hidden by the frontend code. I…

  42. 3.5CVE-2022-46168EPSS 0.5%

    Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta15 on the `beta` and `tests-passed` branches, recipients of a group SMTP email could see the email addresses of all oth…

  43. 6.5CVE-2022-41971EPSS 0.8%

    Nextcould Talk android is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.8, 13.0.10, 14.0.6, and 15.0.0, guests can continue to receive video streams from a call after being removed from a conversation. An attacke…

  44. 7.5CVE-2022-41936EPSS 0.8%

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The `modifications` rest endpoint does not filter out entries according to the user's rights. Therefore, information hidden from unaut…

  45. 6.5CVE-2022-20942EPSS 1.1%

    A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA), Cisco Secure Email and Web Manager, and Cisco Secure Web Appliance, formerly known as Cisco Web Security Appliance (WSA), could allow an authent…

  46. 5.3CVE-2022-2720EPSS 0.6%

    In affected versions of Octopus Server it was identified that when a sensitive value is a substring of another value, sensitive value masking will only partially work.

  47. 7.5CVE-2022-36091EPSS 0.9%

    XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. Through the suggestion feature, string and list properties of objects the user shouldn't have access to can be accessed in versions prior to 13.10.4 an…

  48. 5.5CVE-2022-0852EPSS 0.4%

    There is a flaw in convert2rhel. convert2rhel passes the Red Hat account password to subscription-manager via the command line, which could allow unauthorized users locally on the machine to view the password via the process command line v…

  49. 8.8CVE-2022-2921EPSS 1.4%

    Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository notrinos/notrinoserp prior to v0.7. This results in privilege escalation to a system administrator account. An attacker can gain access to protected fun…

  50. 5.3CVE-2022-35932EPSS 1.4%

    Nextcloud Talk is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected conversations are susceptible to brute force attacks if the attacker has the link/conversation token. It i…