CWE-212 · Improper Removal of Sensitive Information Before Storage or Transfer
117 CVEs classified under CWE-212 (Improper Removal of Sensitive Information Before Storage or Transfer). Browse by severity and year.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-2818 | Critical | 9.8 | 2022-08-15 | Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository cockpit-hq/cockpit prior to 2.2.2. |
CVE-2026-42880 | Critical | 9.6 | 2026-05-07 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing au… |
CVE-2020-11684 | Critical | 9.1 | 2020-09-14 | AT91bootstrap before 3.9.2 does not properly wipe encryption and authentication keys from memory before passing control to a less privileged software component… |
CVE-2026-32891 | Critical | 9.0 | 2026-03-20 | Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. Versions 1.4.1 and below contai… |
CVE-2022-30617 | High | 8.8 | 2022-05-19 | An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel… |
CVE-2022-0355 | High | 8.8 | 2022-01-26 | Improper Removal of Sensitive Information Before Storage or Transfer in NPM simple-get prior to 4.0.1. |
CVE-2021-0340 | High | 8.8 | 2021-02-10 | In parseNextBox of IsoInterface.java, there is a possible leak of unredacted location information due to improper input validation. This could lead to remote i… |
CVE-2019-13402 | High | 8.8 | 2019-07-08 | /usr/sbin/default.sh and /usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi on Dynacolor FCM-MB40 v1.2.0.0 devices implement an incomplete factory-reset p… |
CVE-2022-39393 | High | 8.6 | 2022-11-10 | Wasmtime is a standalone runtime for WebAssembly. Prior to versions 2.0.2 and 1.0.2, there is a bug in Wasmtime's implementation of its pooling instance alloca… |
CVE-2022-31112 | High | 8.2 | 2022-06-30 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions parse Server LiveQuery does not re… |
CVE-2022-4734 | High | 8.1 | 2022-12-27 | Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-1650 | High | 8.1 | 2022-05-12 | Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository eventsource/eventsource prior to v2.0.2. |
CVE-2019-11243 | High | 8.1 | 2019-04-22 | In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials removed (bearer toke… |
CVE-2024-43384 | High | 8.0 | 2026-05-07 | A low privileged remote attacker can gain the root password due to improper removal of sensitive information before storage or transfer. |
CVE-2020-15094 | High | 8.0 | 2020-09-02 | In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests… |
CVE-2026-43824 | High | 7.7 | 2026-05-02 | In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data. |
CVE-2026-34214 | High | 7.7 | 2026-03-31 | Trino is a distributed SQL query engine for big data analytics. From version 439 to before version 480, Iceberg connector REST catalog static credentials (acce… |
CVE-2022-31090 | High | 7.7 | 2022-06-27 | Guzzle, an extensible PHP HTTP client. `Authorization` headers on requests are sensitive information. In affected versions when using our Curl handler, it is p… |
CVE-2026-42186 | High | 7.5 | 2026-05-14 | OpenBao is an open source identity-based secrets management system. Prior to 2.5.3, when OpenBao's initial namespace deletion fails, subsequent retries fail to… |
CVE-2026-40895 | High | 7.5 | 2026-04-21 | follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HT… |