cve.bz

CWE-359: Exposure of Private Personal Information to an Unauthorized Actor, page 5

Filter

The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.

What the weakness is: CWE-359 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

Related attack patterns (CAPEC): 4

The attack patterns MITRE's CAPEC relates to CWE-359, as MITRE names them. Credits.

Ask an AI about CWE-359

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-359: Exposure of Private Personal Information to an Unauthorized Actor and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/359.html and https://cve.bz/cve/cwe/359?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.9CVE-2021-46687EPSS 0.9%

    JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Administrator REST API. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.31.10 versions prio…

  2. 4.3CVE-2022-24890EPSS 0.9%

    Nextcloud Talk is a video and audio conferencing app for Nextcloud. In versions prior to 13.0.5 and 14.0.0, a call moderator can indirectly enable user webcams by granting permissions, if they were enabled before removing the permissions. …

  3. 6.5CVE-2022-1365EPSS 1.2%

    Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository lquixada/cross-fetch prior to 3.1.5.

  4. 5.3CVE-2022-24820EPSS 1.0%

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to view pages of the wiki can still list documents by rendering some velocity documents. The problem ha…

  5. 5.3CVE-2022-24819ExploitEPSS 3.2%

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to view pages of the wiki can still list documents related to users of the wiki. The problem has been p…

  6. 9.1CVE-2022-0482ExploitEPSS 44%

    Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3.

  7. 6.1CVE-2022-24719EPSS 0.8%

    Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Using `followRedirects` or `followRedirectsWith` with any of the redirection strategies built into fluture-node 4.0.0 or 4.0.1, paired with a request that inclu…

  8. 6.5CVE-2022-0155EPSS 2.6%

    follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

  9. 7.5CVE-2021-36723EPSS 0.5%

    Emuse - eServices / eNvoice Exposure Of Private Personal Information due to lack of identification mechanisms and predictable IDs an attacker can scrape all the files on the service.

  10. 7.5CVE-2021-3980EPSS 1.6%

    elgg is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

  11. 5.3CVE-2021-28559EPSS 1.6%

    Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by an Information Exposure vulnerability. An unauthenticated attacker could leverage this vulnerab…

  12. 7.5CVE-2021-21823EPSS 0.9%

    An information disclosure vulnerability exists in the Friend finder functionality of GmbH Komoot version 10.26.9 up to 11.1.11. A specially crafted series of network requests can lead to the disclosure of sensitive information.

  13. 5.3CVE-2021-22876EPSS 5.3%

    curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when au…

  14. 6.5CVE-2020-1688EPSS 0.3%

    On Juniper Networks SRX Series and NFX Series, a local authenticated user with access to the shell may obtain the Web API service private key that is used to provide encrypted communication between the Juniper device and the authenticator …

  15. 5.3CVE-2019-15623EPSS 1.9%

    Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled.

  16. 5.3CVE-2017-16769EPSS 1.9%

    Exposure of private information vulnerability in Photo Viewer in Synology Photo Station 6.8.1-3458 allows remote attackers to obtain metadata from password-protected photographs via the map viewer mode.