CWE-201 · Insertion of Sensitive Information into Sent Data (page 4)
Page 4 of 4 — CVEs classified under CWE-201, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-43814 | Medium | 4.3 | 2024-09-26 | The goTenna Pro ATAK Plugin's default settings are to share Automatic Position, Location, and Information (PLI) updates every 60 seconds once the plugin is a… |
CVE-2024-41931 | Medium | 4.3 | 2024-09-26 | The goTenna Pro ATAK Plugin encryption key name is always sent unencrypted when the key is sent over RF through a broadcast message. It is advised to share t… |
CVE-2024-8890 | High | 8.0 | 2024-09-18 | An attacker with access to the network where the CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could obtain legitimate credentials or steal sessions… |
CVE-2024-7698 | Medium | 5.7 | 2024-09-10 | A low privileged remote attacker can get access to CSRF tokens of higher privileged users which can be abused to mount CSRF attacks. |
CVE-2024-6586 | High | 7.3 | 2024-08-30 | Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that conta… |
CVE-2024-43264 | Medium | 5.3 | 2024-08-26 | Insertion of Sensitive Information Into Sent Data vulnerability in mischiefmarmot Create by Mediavine mediavine-create.This issue affects Create by Mediavine… |
CVE-2024-43259 | Medium | 5.3 | 2024-08-26 | Insertion of Sensitive Information Into Sent Data vulnerability in WebFactory Order Export for WooCommerce order-export-and-more-for-woocommerce.This issue aff… |
CVE-2024-43230 | Medium | 5.3 | 2024-08-26 | Insertion of Sensitive Information Into Sent Data vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through <=… |
CVE-2024-43283 | Medium | 5.3 | 2024-08-26 | Insertion of Sensitive Information Into Sent Data vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery.This issue affec… |
CVE-2024-38787 | High | 7.5 | 2024-08-13 | Insertion of Sensitive Information Into Sent Data vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta.This iss… |
CVE-2024-31200 | Medium | 4.2 | 2024-07-31 | A “CWE-201: Insertion of Sensitive Information Into Sent Data” affecting the administrative account allows an attacker with physical access to the machine to r… |
CVE-2024-7205 | | 2024-07-31 | When the device is shared, the homepage module are before 2.19.0 in eWeLink Cloud Service allows Secondary user to take over devices as primary user via shari… | |
CVE-2024-38372 | Low | 2.0 | 2024-07-08 | Undici is an HTTP/1.1 client, written from scratch for Node.js. Depending on network and process conditions of a `fetch()` request, `response.arrayBuffer()` mi… |
CVE-2024-39315 | Medium | 5.7 | 2024-07-02 | Pomerium is an identity and context-aware access proxy. Prior to version 0.26.1, the Pomerium user info page (at `/.pomerium`) unintentionally included seriali… |
CVE-2024-5213 | Medium | 6.5 | 2024-06-20 | In mintplex-labs/anything-llm versions up to and including 1.5.3, an issue was discovered where the password hash of a user is returned in the response after l… |
CVE-2024-37881 | Medium | 5.3 | 2024-06-19 | SiteGuard WP Plugin provides a functionality to customize the path to the login page wp-login.php and implements a measure to avoid redirection from other URLs… |
CVE-2024-35189 | Medium | 6.5 | 2024-05-30 | Fides is an open-source privacy engineering platform. The Fides webserver has a number of endpoints that retrieve `ConnectionConfiguration` records and their a… |
CVE-2024-34812 | Medium | 5.3 | 2024-05-14 | Insertion of Sensitive Information Into Sent Data vulnerability in RadiusTheme ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder.This issue affect… |
CVE-2024-34556 | Medium | 5.3 | 2024-05-14 | Insertion of Sensitive Information Into Sent Data vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-sca… |
CVE-2024-4536 | Medium | 6.8 | 2024-05-07 | In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component ( https://github.com/eclipse-edc/Connector ), an attacker might obt… |
CVE-2024-32825 | High | 7.5 | 2024-04-24 | Insertion of Sensitive Information Into Sent Data vulnerability in Simply Static Simply Static simply-static.This issue affects Simply Static: from n/a through… |
CVE-2024-32796 | Medium | 4.3 | 2024-04-24 | Insertion of Sensitive Information Into Sent Data vulnerability in Jack Arturo WP Fusion Lite wp-fusion-lite allows Retrieve Embedded Sensitive Data.This issue… |
CVE-2024-32782 | Medium | 4.3 | 2024-04-24 | Insertion of Sensitive Information Into Sent Data vulnerability in DevItems HT Mega ht-mega-for-elementor.This issue affects HT Mega: from n/a through <= 2.4.7. |
CVE-2024-32028 | Medium | 4.1 | 2024-04-12 | OpenTelemetry dotnet is a dotnet telemetry framework. In affected versions of `OpenTelemetry.Instrumentation.Http` and `OpenTelemetry.Instrumentation.AspNetCor… |
CVE-2024-31278 | Medium | 4.3 | 2024-04-10 | Insertion of Sensitive Information Into Sent Data vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor.This issue affects Premium… |
CVE-2023-6916 | High | 7.2 | 2024-04-10 | Audit records for OpenAPI requests may include sensitive information. This could lead to unauthorized accesses and privilege escalation. |
CVE-2024-28173 | Medium | 4.3 | 2024-03-06 | In JetBrains TeamCity between 2023.11 and 2023.11.4 custom build parameters of the "password" type could be disclosed |
CVE-2024-1435 | Medium | 5.3 | 2024-02-29 | Insertion of Sensitive Information Into Sent Data vulnerability in tainacan Tainacan tainacan.This issue affects Tainacan: from n/a through <= 0.20.6. |
CVE-2024-26270 | Medium | 6.5 | 2024-02-20 | The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s h… |
CVE-2024-25150 | Medium | 4.3 | 2024-02-20 | Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before upd… |
CVE-2024-25148 | Medium | 5.4 | 2024-02-08 | In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported… |
CVE-2024-23506 | High | 7.7 | 2024-01-27 | Insertion of Sensitive Information Into Sent Data vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through… |
CVE-2023-49261 | High | 7.5 | 2024-01-12 | The "tokenKey" value used in user authorization is visible in the HTML source of the login page. |
CVE-2023-49594 | Medium | 4.5 | 2023-12-23 | An information disclosure vulnerability exists in the challenge functionality of instipod DuoUniversalKeycloakAuthenticator 1.0.7 plugin. A specially crafted H… |
CVE-2023-3949 | Medium | 5.3 | 2023-12-01 | An issue has been discovered in GitLab affecting all versions starting from 11.3 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions sta… |
CVE-2023-48240 | Critical | 9.0 | 2023-11-20 | XWiki Platform is a generic wiki platform. The rendered diff in XWiki embeds images to be able to compare the contents and not display a difference for an actu… |
CVE-2023-3399 | High | 8.5 | 2023-11-06 | An issue has been discovered in GitLab EE affecting all versions starting from 11.6 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions… |
CVE-2023-5831 | Low | 3.7 | 2023-11-06 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.0 before 16.3.6, all versions starting from 16.4 before 16.4.2, and all ve… |
CVE-2023-32275 | Medium | 5.5 | 2023-10-12 | An information disclosure vulnerability exists in the CtEnumCa() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. Specially crafted network packets… |
CVE-2023-3413 | Medium | 6.5 | 2023-09-29 | An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions sta… |
CVE-2023-4378 | Medium | 5.5 | 2023-09-01 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versio… |
CVE-2023-4002 | Medium | 5.3 | 2023-08-04 | An issue has been discovered in GitLab EE affecting all versions starting from 14.1 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions… |
CVE-2023-1401 | Medium | 5.0 | 2023-07-26 | An issue has been discovered in GitLab DAST scanner affecting all versions starting from 3.0.29 before 4.0.5, in which the DAST scanner leak cross site cookies… |
CVE-2023-3102 | Medium | 5.3 | 2023-07-21 | A sensitive information leak issue has been discovered in GitLab EE affecting all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 be… |
CVE-2023-34968 | Medium | 5.3 | 2023-07-20 | A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the server-side absolute path of shares, files, and dire… |
CVE-2023-3299 | Low | 3.4 | 2023-07-20 | HashiCorp Nomad Enterprise 1.2.11 up to 1.5.6, and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1… |
CVE-2023-2620 | Medium | 5.5 | 2023-07-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.1 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, all versions… |
CVE-2023-1825 | Low | 3.1 | 2023-06-07 | An issue has been discovered in GitLab EE affecting all versions starting from 15.7 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versio… |
CVE-2023-1975 | Medium | 6.5 | 2023-04-11 | Insertion of Sensitive Information Into Sent Data in GitHub repository answerdev/answer prior to 1.0.8. |
CVE-2023-28117 | High | 7.6 | 2023-03-22 | Sentry SDK is the official Python SDK for Sentry, real-time crash reporting software. When using the Django integration of versions prior to 1.14.0 of the Sent… |
CVE-2022-45428 | Low | 2.7 | 2022-12-27 | Some Dahua software products have a vulnerability of sensitive information leakage. After obtaining the permissions of administrators, by sending a specific cr… |
CVE-2022-23488 | Medium | 6.5 | 2022-12-17 | BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are vulnerable to Insertion of Sensitive Information Into Sent Data. The mo… |
CVE-2020-8975 | High | 7.5 | 2022-10-17 | ZGR TPS200 NG in its 2.00 firmware version and 1.01 hardware version, allows a remote attacker with access to the web application and knowledge of the routes (… |
CVE-2020-27784 | Medium | 5.5 | 2022-09-01 | A vulnerability was found in the Linux kernel, where accessing a deallocated instance in printer_ioctl() printer_ioctl() tries to access of a printer_dev insta… |
CVE-2022-28224 | Medium | 5.5 | 2022-06-06 | Clusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with the floating IP featu… |
CVE-2022-27779 | Medium | 5.3 | 2022-06-02 | libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cook… |
CVE-2022-27671 | Medium | 6.5 | 2022-04-12 | A CSRF token visible in the URL may possibly lead to information disclosure vulnerability. |
CVE-2022-0018 | Medium | 6.1 | 2022-02-10 | An information exposure vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows and MacOS where the credentials of the local user account a… |
CVE-2021-34771 | Medium | 5.5 | 2021-09-09 | A vulnerability in the Cisco IOS XR Software CLI could allow an authenticated, local attacker to view more information than their privileges allow. This vulner… |
CVE-2021-32653 | Low | 2.7 | 2021-06-01 | Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server versions prior to 19.0.11, 20.0.10, or 21.0.2 send user IDs to the lookup s… |
CVE-2020-27748 | Medium | 6.5 | 2021-06-01 | A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added v… |
CVE-2021-23019 | High | 7.8 | 2021-06-01 | The NGINX Controller 2.0.0 thru 2.9.0 and 3.x before 3.15.0 Administrator password may be exposed in the systemd.txt file that is included in the NGINX support… |
CVE-2021-26566 | High | 8.3 | 2021-02-26 | Insertion of sensitive information into sent data vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-midd… |
CVE-2021-1128 | Medium | 5.5 | 2021-02-04 | A vulnerability in the CLI parser of Cisco IOS XR Software could allow an authenticated, local attacker to view more information than their privileges allow. T… |
CVE-2021-1129 | Medium | 5.3 | 2021-01-20 | A vulnerability in the authentication for the general purpose APIs implementation of Cisco Email Security Appliance (ESA), Cisco Content Security Management Ap… |
CVE-2020-26085 | Critical | 9.9 | 2021-01-07 | Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an attacker to execute arbitrary programs o… |
CVE-2020-27134 | Critical | 9.9 | 2020-12-11 | Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an attacker to execute arbitrary programs o… |
CVE-2020-27133 | Critical | 9.9 | 2020-12-11 | Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an attacker to execute arbitrary programs o… |
CVE-2020-27132 | Critical | 9.9 | 2020-12-11 | Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an attacker to execute arbitrary programs o… |
CVE-2020-27127 | Critical | 9.9 | 2020-12-11 | Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an attacker to execute arbitrary programs o… |
CVE-2020-25703 | Medium | 5.3 | 2020-11-19 | The participants table download in Moodle always included user emails, but should have only done so when users' emails are not hidden. Versions affected: 3.9 t… |
CVE-2020-14514 | Medium | 4.3 | 2020-09-01 | All trailer Power Line Communications are affected. PLC bus traffic can be sniffed reliably via an active antenna up to 6 feet away. Further distances are also… |
CVE-2020-13597 | Medium | 6.0 | 2020-06-03 | Clusters using Calico (version 3.14.0 and below), Calico Enterprise (version 2.8.2 and below), may be vulnerable to information disclosure if IPv6 is enabled b… |
CVE-2020-5364 | Medium | 5.3 | 2020-05-20 | Dell EMC Isilon OneFS versions 8.2.2 and earlier contain an SNMPv2 vulnerability. The SNMPv2 services is enabled, by default, with a pre-configured community s… |
CVE-2020-1774 | Medium | 4.5 | 2020-04-28 | When user downloads PGP or S/MIME keys/certificates, exported file has same name for private and public keys. Therefore it's possible to mix them and to send p… |
CVE-2020-1770 | Low | 2.4 | 2020-03-27 | Support bundle generated files could contain sensitive information that might be unwanted to be disclosed. This issue affects: ((OTRS)) Community Edition: 5.0… |
CVE-2019-15580 | Medium | 6.5 | 2019-12-18 | An information exposure vulnerability exists in gitlab.com <v12.3.2, <v12.2.6, and <v12.1.10 when using the blocking merge request feature, it was possible for… |
CVE-2019-14849 | Medium | 5.4 | 2019-12-12 | A vulnerability was found in 3scale before version 2.6, did not set the HTTPOnly attribute on the user session cookie. An attacker could use this to conduct cr… |
CVE-2018-17245 | Critical | 9.8 | 2018-12-20 | Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are used when generating PDF reports. If a re… |
CVE-2017-2582 | Medium | 6.5 | 2018-07-26 | It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values wit… |
CVE-2017-16026 | Medium | 5.9 | 2018-06-04 | Request is an http client. If a request is made using ```multipart```, and the body type is a ```number```, then the specified number of non-zero memory is pas… |
CVE-2016-10519 | High | 7.5 | 2018-05-31 | A security issue was found in bittorrent-dht before 5.1.3 that allows someone to send a specific series of messages to a listening peer and get it to reveal in… |
CVE-2016-10518 | High | 7.5 | 2018-05-31 | A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a ping frame. The ping fu… |