CWE-359 · Exposure of Private Personal Information to an Unauthorized Actor (page 2)
Page 2 of 3 — CVEs classified under CWE-359, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-53625 | | 2025-07-10 | The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with various formats and details. Several #dpl par… | |
CVE-2025-53374 | Medium | 4.3 | 2025-07-07 | Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated low-privi… |
CVE-2025-6017 | Medium | 5.5 | 2025-07-02 | A flaw was found in Red Hat Advanced Cluster Management through versions 2.10, before 2.10.7, 2.11, before 2.11.4, and 2.12, before 2.12.4. This vulnerability… |
CVE-2025-49715 | High | 7.5 | 2025-06-20 | Exposure of private personal information to an unauthorized actor in Dynamics 365 FastTrack Implementation Assets allows an unauthorized attacker to disclose i… |
CVE-2025-49134 | Medium | 5.3 | 2025-06-16 | Weblate is a web based localization tool. Prior to version 5.12, the audit log notifications included the full IP address of the acting user. This could be obt… |
CVE-2025-5334 | High | 7.5 | 2025-05-29 | Exposure of private personal information to an unauthorized actor in the user vaults component of Devolutions Remote Desktop Manager allows an authenticated us… |
CVE-2024-13953 | Medium | 4.9 | 2025-05-22 | Sensitive device logger information in ASPECT may be exposed if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*… |
CVE-2025-0679 | Medium | 4.3 | 2025-05-22 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.1 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Under certain condi… |
CVE-2023-45721 | Medium | 5.3 | 2025-04-30 | Insufficient default configuration in HCL Leap allows anonymous access to directory information. |
CVE-2023-45720 | Medium | 5.3 | 2025-04-24 | Insufficient default configuration in HCL Leap allows anonymous access to directory information. |
CVE-2024-42325 | Low | 3.5 | 2025-04-02 | Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc. |
CVE-2025-3035 | Medium | 5.3 | 2025-04-01 | By first using the AI chatbot in one tab and later activating it in another tab, the document title of the previous tab would leak into the chat prompt. This v… |
CVE-2024-10267 | High | 7.5 | 2025-03-20 | An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. An attacker can leak sensitive user information, including… |
CVE-2025-26816 | Medium | 6.5 | 2025-03-19 | A vulnerability in Intrexx Portal Server 12.0.2 and earlier which was classified as problematic potentially allows users with particular permissions under cert… |
CVE-2025-27080 | Medium | 6.0 | 2025-03-18 | Vulnerabilities in the command line interface of AOS-CX could allow an authenticated remote attacker to expose sensitive information. Successful exploitation c… |
CVE-2025-25042 | Medium | 4.3 | 2025-03-18 | A vulnerability in the AOS-CX REST interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploit… |
CVE-2024-13228 | Medium | 4.3 | 2025-03-11 | The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.13 via th… |
CVE-2024-11216 | High | 7.6 | 2025-03-05 | Authorization Bypass Through User-Controlled Key, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in PozitifIK Pik Online allow… |
CVE-2025-1939 | Low | 3.9 | 2025-03-04 | Android apps can load web pages using the Custom Tabs feature. This feature supports a transition animation that could have been used to trick a user into gran… |
CVE-2025-20060 | High | 7.5 | 2025-02-28 | An attacker could expose cross-user personal identifiable information (PII) and personal health information transmitted to the Android device via the Dario Hea… |
CVE-2024-13217 | Medium | 4.3 | 2025-02-27 | The Jeg Elementor Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.11 via the 'expired_data'… |
CVE-2025-20615 | Medium | 6.2 | 2025-02-13 | The Qardio Arm iOS application exposes sensitive data such as usernames and passwords in a plist file. This allows an attacker to log in to production-level… |
CVE-2024-12041 | Medium | 5.3 | 2025-02-01 | The Directorist: AI-Powered WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to Information Exposure in all… |
CVE-2024-13216 | Medium | 4.3 | 2025-01-31 | The HT Event – WordPress Event Manager Plugin for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inc… |
CVE-2025-0683 | Medium | 5.9 | 2025-01-30 | In its default configuration, Contec Health CMS8000 Patient Monitor transmits plain-text patient data to a hard-coded public IP address when a patient is hook… |
CVE-2025-24355 | High | 7.1 | 2025-01-24 | Updatecli is a tool used to apply file update strategies. Prior to version 0.93.0, private maven repository credentials may be leaked in application logs in ca… |
CVE-2024-13215 | Medium | 4.3 | 2025-01-15 | The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.10 via the 'render… |
CVE-2024-11396 | Medium | 5.3 | 2025-01-14 | The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Information Exposure in all versions up to, and inc… |
CVE-2024-41780 | Medium | 4.2 | 2025-01-03 | IBM Jazz Foundation 7.0.2, 7.0.3, and 7.1.0 could could allow a physical user to obtain sensitive information due to not masking passwords during entry. |
CVE-2024-49765 | Medium | 5.3 | 2024-12-19 | Discourse is an open source platform for community discussion. Sites that are using discourse connect but still have local logins enabled could allow attackers… |
CVE-2024-11712 | Medium | 5.3 | 2024-12-14 | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized access of data due to a m… |
CVE-2024-42494 | Medium | 6.5 | 2024-12-06 | Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a a feature that could enable sub accounts or attackers to view and exfiltrate sensit… |
CVE-2024-53258 | Medium | 5.3 | 2024-11-25 | Autolab is a course management service that enables auto-graded programming assignments. From Autolab versions v.3.0.0 onward students can download all assignm… |
CVE-2024-49025 | Medium | 5.4 | 2024-11-14 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability |
CVE-2024-11206 | High | 7.5 | 2024-11-14 | Unauthorized access vulnerability in the mobile application (com.transsion.phoenix) can lead to the leakage of user information. |
CVE-2023-44255 | Medium | 4.1 | 2024-11-12 | An exposure of sensitive information to an unauthorized actor [CWE-200] in Fortinet FortiManager before 7.4.2, FortiAnalyzer before 7.4.2 and FortiAnalyzer-Big… |
CVE-2024-49386 | Medium | 5.7 | 2024-10-17 | Sensitive information disclosure due to spell-jacking. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24. |
CVE-2024-47087 | Medium | 6.5 | 2024-09-19 | This vulnerability exists in Apex Softcell LD Geo due to improper validation of the certain parameters (Client ID, DPID or BOID) in the API endpoint. An authen… |
CVE-2024-47085 | Medium | 6.5 | 2024-09-19 | This vulnerability exists in Apex Softcell LD DP Back Office due to improper validation of certain parameters (cCdslClicentcode and cLdClientCode) in the API e… |
CVE-2024-46979 | Medium | 5.3 | 2024-09-18 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to get access to notification filters of… |
CVE-2024-8891 | Medium | 5.3 | 2024-09-18 | An attacker with no knowledge of the current users in the web application, could build a dictionary of potential users and check the server responses as it ind… |
CVE-2024-45787 | Medium | 6.5 | 2024-09-11 | This vulnerability exists in Reedos aiM-Star version 2.0.1 due to transmission of sensitive information in plain text in certain API endpoints. An authenticate… |
CVE-2024-45591 | Medium | 5.3 | 2024-09-10 | XWiki Platform is a generic wiki platform. The REST API exposes the history of any page in XWiki of which the attacker knows the name. The exposed information… |
CVE-2024-44113 | Medium | 4.3 | 2024-09-10 | Due to missing authorization checks, SAP Business Warehouse (BEx Analyzer) allows an authenticated attacker to access information over the network which is oth… |
CVE-2024-41729 | Medium | 4.3 | 2024-09-10 | Due to missing authorization checks, SAP BEx Analyzer allows an authenticated attacker to access information over the network which is otherwise restricted. On… |
CVE-2024-37136 | Medium | 6.8 | 2024-09-03 | Dell Path to PowerProtect, versions 1.1, 1.2, contains an Exposure of Private Personal Information to an Unauthorized Actor vulnerability. A remote high privil… |
CVE-2024-6053 | Medium | 4.3 | 2024-08-28 | Improper access control in the clipboard synchronization feature in TeamViewer Full Client prior version 15.57 and TeamViewer Meeting prior version 15.55.3 can… |
CVE-2024-7697 | High | 7.5 | 2024-08-12 | Logical vulnerability in the mobile application (com.transsion.carlcare) may lead to user information leakage risks. |
CVE-2024-42347 | High | 7.7 | 2024-08-06 | matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. A malicious homeserver could manipulate a user's account data t… |
CVE-2024-40796 | Medium | 5.3 | 2024-07-29 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, macOS Monterey 12.7.6… |
CVE-2024-27881 | Medium | 5.3 | 2024-07-29 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Vent… |
CVE-2024-38103 | Medium | 5.9 | 2024-07-25 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability |
CVE-2024-37533 | Low | 2.4 | 2024-07-24 | IBM InfoSphere Information Server 11.7 could disclose sensitive user information to another user with physical access to the machine. IBM X-Force ID: 294727. |
CVE-2024-30321 | Medium | 5.9 | 2024-07-09 | A vulnerability has been identified in SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC WinCC Runtime Professional V18 (All versions < V18 Update 5)… |
CVE-2024-36682 | High | 7.5 | 2024-06-24 | In the module "Theme settings" (pk_themesettings) <= 1.8.8 from Promokit.eu for PrestaShop, a guest can download all email collected while SHOP is in maintenan… |
CVE-2024-36677 | High | 7.5 | 2024-06-19 | In the module "Login as customer PRO" (loginascustomerpro) <1.2.7 from Weblir for PrestaShop, a guest can access direct link to connect to each customer accoun… |
CVE-2024-27850 | Medium | 6.5 | 2024-06-10 | This issue was addressed with improvements to the noise injection algorithm. This issue is fixed in Safari 17.5, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, v… |
CVE-2024-30056 | High | 7.1 | 2024-05-25 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability |
CVE-2024-4767 | Medium | 4.3 | 2024-05-14 | If the `browser.privatebrowsing.autostart` preference is enabled, IndexedDB files were not properly deleted when the window was closed. This preference is disa… |
CVE-2023-50053 | High | 7.6 | 2024-04-30 | An issue in Foundation.app Foundation platform 1.0 allows a remote attacker to obtain sensitive information via the Web3 authentication process of Foundation… |
CVE-2024-33271 | High | 7.5 | 2024-04-29 | An issue in FME Modules eventsmanager before 4.4.0 allows an attacker to obtain sensitive information from the ps_customer component. |
CVE-2024-29987 | Medium | 6.5 | 2024-04-18 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability |
CVE-2024-29986 | Medium | 5.4 | 2024-04-18 | Microsoft Edge for Android (Chromium-based) Information Disclosure Vulnerability |
CVE-2023-6695 | Medium | 6.5 | 2024-04-09 | The Beaver Themer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.9 via the 'wpbb' shortcode. Th… |
CVE-2024-29888 | Medium | 4.2 | 2024-03-27 | Saleor is an e-commerce platform that serves high-volume companies. When using `Pickup: Local stock only` click-and-collect as a delivery method in specific co… |
CVE-2024-28387 | High | 7.5 | 2024-03-25 | An issue in axonaut v.3.1.23 and before allows a remote attacker to obtain sensitive information via the log.txt component. |
CVE-2023-48680 | Medium | 5.5 | 2024-02-27 | Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Cyber Protect 16 (macOS, Windo… |
CVE-2024-26192 | High | 8.2 | 2024-02-23 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability |
CVE-2023-7014 | Medium | 5.3 | 2024-02-05 | The Author Box, Guest Author and Co-Authors for Your Posts – Molongui plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up t… |
CVE-2024-23211 | Low | 3.3 | 2024-01-23 | A privacy issue was addressed with improved handling of user preferences. This issue is fixed in Safari 17.3, iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS… |
CVE-2023-6630 | Medium | 4.3 | 2024-01-11 | The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0… |
CVE-2023-42830 | Low | 3.3 | 2024-01-10 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4. An app… |
CVE-2023-50719 | High | 7.5 | 2023-12-15 | XWiki Platform is a generic wiki platform. Starting in 7.2-milestone-2 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki di… |
CVE-2023-25632 | Medium | 5.5 | 2023-11-27 | The Android Mobile Whale browser app before 3.0.1.2 allows the attacker to bypass its browser unlock function via 'Open in Whale' feature. |
CVE-2023-5983 | High | 7.5 | 2023-11-22 | Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Botanik Software Pharmacy Automation allows Retrieve Embedded Sensitive Data… |
CVE-2023-36052 | High | 8.6 | 2023-11-14 | Azure CLI REST Command Information Disclosure Vulnerability |
CVE-2023-36018 | High | 7.8 | 2023-11-14 | Visual Studio Code Jupyter Extension Spoofing Vulnerability |
CVE-2023-34085 | Low | 2.6 | 2023-10-25 | When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request |
CVE-2023-44213 | Medium | 5.5 | 2023-10-05 | Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Cyber Protect Cloud Agent (Win… |
CVE-2023-44156 | High | 7.5 | 2023-09-27 | Sensitive information disclosure due to spell-jacking. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 35979. |
CVE-2023-1936 | Low | 3.5 | 2023-07-11 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 before 15.11.10, all versions starting from 16.0 before 16.0.6, all vers… |
CVE-2023-35151 | High | 7.5 | 2023-06-23 | XWiki Platform is a generic wiki platform. Starting in version 7.3-milestone-1 and prior to versions 14.4.8, 14.10.6, and 15.1, ny user can call a REST endpoin… |
CVE-2023-28303 | Low | 3.3 | 2023-06-13 | Windows Snipping Tool Information Disclosure Vulnerability |
CVE-2023-2703 | High | 7.5 | 2023-05-23 | Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Finex Media Competition Management System allows Retrieve Embedded Sensitive… |
CVE-2023-22918 | Medium | 6.5 | 2023-04-24 | A post-authentication information exposure vulnerability in the CGI program of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware v… |
CVE-2023-2239 | Medium | 6.5 | 2023-04-22 | Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository microweber/microweber prior to 1.3.4. |
CVE-2023-29203 | Low | 3.7 | 2023-04-15 | XWiki Commons are technical libraries common to several other top level XWiki projects. It's possible to list some users who are normally not viewable from sub… |
CVE-2023-25819 | Medium | 5.3 | 2023-03-04 | Discourse is an open source platform for community discussion. Tags that are normally private are showing in metadata. This affects any site running the `tests… |
CVE-2023-26041 | Low | 2.6 | 2023-02-27 | Nextcloud Talk is a fully on-premises audio/video and chat communication service. When cron jobs were misconfigured and therefore messages are not expired, the… |
CVE-2022-46168 | Low | 3.5 | 2023-01-05 | Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta15 on the `beta` and `tests-passed` bra… |
CVE-2022-41971 | Medium | 4.8 | 2022-12-01 | Nextcould Talk android is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.8, 13.0.10, 14.0.6, and 15.0.0, guests can continue to recei… |
CVE-2022-41936 | Medium | 5.3 | 2022-11-22 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The `modifications` rest endpoint does not filter out… |
CVE-2022-20942 | Medium | 6.5 | 2022-11-04 | A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA), Cisco Secure Email and Web Manager, and Cisco Secure Web Applian… |
CVE-2022-2720 | Medium | 5.3 | 2022-10-12 | In affected versions of Octopus Server it was identified that when a sensitive value is a substring of another value, sensitive value masking will only partial… |
CVE-2022-36091 | High | 7.5 | 2022-09-08 | XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. Through the suggestion feature, string and list properties of objects t… |
CVE-2022-0852 | Medium | 5.5 | 2022-08-29 | There is a flaw in convert2rhel. convert2rhel passes the Red Hat account password to subscription-manager via the command line, which could allow unauthorized… |
CVE-2022-2921 | High | 8.8 | 2022-08-21 | Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository notrinos/notrinoserp prior to v0.7. This results in privilege escalation… |
CVE-2022-35932 | Low | 3.5 | 2022-08-12 | Nextcloud Talk is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected conversations are suscepti… |
CVE-2021-46687 | Medium | 4.9 | 2022-07-06 | JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Administrator REST API. This issue affects… |
CVE-2022-24890 | Low | 2.4 | 2022-05-17 | Nextcloud Talk is a video and audio conferencing app for Nextcloud. In versions prior to 13.0.5 and 14.0.0, a call moderator can indirectly enable user webcams… |