CWE-459 · Incomplete Cleanup (page 2)
Page 2 of 2 — CVEs classified under CWE-459, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-20862 | Medium | 6.3 | 2023-04-19 | In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean… |
CVE-2023-0836 | High | 7.5 | 2023-03-29 | An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7… |
CVE-2023-28859 | Medium | 6.5 | 2023-03-26 | redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data… |
CVE-2022-45455 | High | 7.8 | 2023-02-13 | Local privilege escalation due to incomplete uninstallation cleanup. The following products are affected: Acronis Cyber Protect Home Office (Windows) before bu… |
CVE-2023-22407 | Medium | 6.5 | 2023-01-13 | An Incomplete Cleanup vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated… |
CVE-2022-45347 | Critical | 9.8 | 2022-12-22 | Apache ShardingSphere-Proxy prior to 5.3.0 when using MySQL as database backend didn't cleanup the database session completely after client authentication fail… |
CVE-2022-3238 | High | 7.8 | 2022-11-14 | A double-free flaw was found in the Linux kernel’s NTFS3 subsystem in how a user triggers remount and umount simultaneously. This flaw allows a local user to c… |
CVE-2022-28764 | Low | 3.3 | 2022-11-14 | The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.12.6 is susceptible to a local information exposure vulnerability… |
CVE-2022-27639 | Medium | 5.4 | 2022-11-11 | Incomplete cleanup in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privileged user to potentially enable escalatio… |
CVE-2022-39368 | High | 8.2 | 2022-11-10 | Eclipse Californium is a Java implementation of RFC7252 - Constrained Application Protocol for IoT Cloud services. In versions prior to 3.7.0, and 2.7.4, Calif… |
CVE-2022-44546 | High | 7.5 | 2022-11-09 | The kernel module has the vulnerability that the mapping is not cleared after the memory is automatically released. Successful exploitation of this vulnerabili… |
CVE-2022-42320 | High | 7.0 | 2022-11-01 | Xenstore: Guests can get access to Xenstore nodes of deleted domains Access rights of Xenstore nodes are per domid. When a domain is gone, there might be Xenst… |
CVE-2022-42310 | Medium | 5.5 | 2022-11-01 | Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes inside a transaction resulting in an error, a malicious guest can create orphane… |
CVE-2022-25664 | Medium | 6.2 | 2022-10-19 | Information disclosure due to exposure of information while GPU reads the data in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Cons… |
CVE-2022-1552 | High | 8.8 | 2022-08-31 | A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The A… |
CVE-2022-0171 | Medium | 5.5 | 2022-08-26 | A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root (host) user-level application to crash the host kerne… |
CVE-2022-37428 | Medium | 6.5 | 2022-08-23 | PowerDNS Recursor up to and including 4.5.9, 4.6.2 and 4.7.1, when protobuf logging is enabled, has Improper Cleanup upon a Thrown Exception, leading to a deni… |
CVE-2022-26074 | Medium | 4.4 | 2022-08-18 | Incomplete cleanup in a firmware subsystem for Intel(R) SPS before versions SPS_E3_04.08.04.330.0 and SPS_E3_04.01.04.530.0 may allow a privileged user to pote… |
CVE-2022-2307 | Low | 3.5 | 2022-08-05 | A lack of cascading deletes in GitLab CE/EE affecting all versions starting from 13.0 before 15.0.5, all versions starting from 15.1 before 15.1.4, all version… |
CVE-2022-21166 | Medium | 5.5 | 2022-06-15 | Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an authenticated user to potentially enable information… |
CVE-2022-21127 | Medium | 5.5 | 2022-06-15 | Incomplete cleanup in specific special register read operations for some Intel(R) Processors may allow an authenticated user to potentially enable information… |
CVE-2022-21125 | Medium | 5.5 | 2022-06-15 | Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure… |
CVE-2022-21123 | Medium | 5.5 | 2022-06-15 | Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via l… |
CVE-2022-29160 | Low | 2.8 | 2022-05-20 | Nextcloud Android is the Android client for Nextcloud, a self-hosted productivity platform. Prior to version 3.19.0, sensitive tokens, images, and user related… |
CVE-2022-1473 | High | 7.5 | 2022-05-03 | The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This f… |
CVE-2021-36205 | High | 8.1 | 2022-04-15 | Under certain circumstances the session token is not cleared on logout. |
CVE-2021-4002 | Medium | 4.4 | 2022-03-03 | A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memory twice using shmget() which are aligne… |
CVE-2022-0646 | High | 7.8 | 2022-02-18 | A flaw use after free in the Linux kernel Management Component Transport Protocol (MCTP) subsystem was found in the way user triggers cancel_work_sync after th… |
CVE-2021-45330 | Critical | 9.8 | 2022-02-09 | An issue exsits in Gitea through 1.15.7, which could let a malicious user gain privileges due to client side cookies not being deleted and the session remains… |
CVE-2022-23035 | Medium | 4.6 | 2022-01-25 | Insufficient cleanup of passed-through device IRQs The management of IRQs associated with physical devices exposed to x86 HVM guests involves an iterative oper… |
CVE-2021-4032 | Medium | 4.4 | 2022-01-21 | A vulnerability was found in the Linux kernel's KVM subsystem in arch/x86/kvm/lapic.c kvm_free_lapic when a failure allocation was detected. In this flaw the K… |
CVE-2021-45706 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the zeroize_derive crate before 1.1.1 for Rust. Dropped memory is not zeroed out for an enum. |
CVE-2021-37092 | High | 7.5 | 2021-12-08 | There is a Incomplete Cleanup vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to availability affected. |
CVE-2021-37089 | High | 7.5 | 2021-12-07 | There is a Incomplete Cleanup vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to kernel restart. |
CVE-2021-37080 | High | 7.5 | 2021-12-07 | There is a Incomplete Cleanup vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to availability affected. |
CVE-2021-34421 | Low | 3.7 | 2021-11-11 | The Keybase Client for Android before version 5.8.0 and the Keybase Client for iOS before version 5.8.0 fails to properly remove exploded messages initiated by… |
CVE-2021-22450 | Medium | 5.5 | 2021-10-28 | A component of the HarmonyOS has a Incomplete Cleanup vulnerability. Local attackers may exploit this vulnerability to cause memory exhaustion. |
CVE-2021-32571 | Medium | 4.9 | 2021-10-14 | In OSS-RC systems of the release 18B and older during data migration procedures certain files containing usernames and passwords are left in the system undelet… |
CVE-2021-39327 | Medium | 5.3 | 2021-09-17 | The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backu… |
CVE-2021-22428 | High | 8.1 | 2021-08-02 | There is an Incomplete Cleanup Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to authentication bypass. |
CVE-2021-32928 | Critical | 9.8 | 2021-06-16 | The Sentinel LDK Run-Time Environment installer (Versions 7.6 and prior) adds a firewall rule named “Sentinel License Manager” that allows incoming connections… |
CVE-2020-24489 | High | 8.8 | 2021-06-09 | Incomplete cleanup in some Intel(R) VT-d products may allow an authenticated user to potentially enable escalation of privilege via local access. |
CVE-2020-36322 | Medium | 5.5 | 2021-04-14 | An issue was discovered in the FUSE filesystem implementation in the Linux kernel before 5.10.6, aka CID-5d069dbe8aaf. fuse_do_getattr() calls make_bad_inode()… |
CVE-2021-26833 | Medium | 5.9 | 2021-04-06 | Cleartext Storage in a File or on Disk in TimelyBills <= 1.7.0 for iOS and versions <= 1.21.115 for Android allows attacker who can locally read user's files o… |
CVE-2020-24458 | Medium | 5.2 | 2021-02-17 | Incomplete cleanup in some Intel(R) PROSet/Wireless WiFi and Killer (TM) drivers before version 22.0 may allow a privileged user to potentially enable informat… |
CVE-2019-25016 | High | 8.8 | 2021-01-28 | In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execut… |
CVE-2020-13451 | Critical | 9.8 | 2021-01-07 | An incomplete-cleanup vulnerability in the Office rendering engine of Gotenberg through 6.2.1 allows an attacker to overwrite LibreOffice configuration files a… |
CVE-2020-27888 | High | 7.5 | 2020-10-27 | An issue was discovered on Ubiquiti UniFi Meshing Access Point UAP-AC-M 4.3.21.11325 and UniFi Controller 6.0.28 devices. Cached credentials are not erased fro… |
CVE-2019-8732 | Low | 2.4 | 2020-10-27 | The issue was addressed with improved data deletion. This issue is fixed in iOS 13. Deleted calls remained visible on the device. |
CVE-2020-13346 | Medium | 6.5 | 2020-10-07 | Membership changes are not reflected in ToDo subscriptions in GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, allowing guest users to access confidential… |
CVE-2020-5987 | High | 7.8 | 2020-10-02 | NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin in which guest-supplied parameters remain writable by the guest after the plugin has val… |
CVE-2020-0286 | High | 7.5 | 2020-09-18 | In Bluetooth AVRCP, there is a possible leak of audio metadata due to residual data. This could lead to remote information disclosure with no additional execut… |
CVE-2020-15024 | Medium | 5.5 | 2020-09-10 | An issue was discovered in the Login Password feature of the Password Manager component in Avast Antivirus 20.1.5069.562. An entered password continues to be s… |
CVE-2019-14115 | Medium | 5.5 | 2020-09-08 | u'Information disclosure issue occurs as in current logic as secure touch is released without clearing the display session which can result in user reading the… |
CVE-2020-0258 | Medium | 5.5 | 2020-08-11 | In stopZygoteLocked of AppZygote.java, there is an insufficient cleanup. This could lead to local information disclosure in the application that is started nex… |
CVE-2020-12414 | Medium | 6.5 | 2020-07-09 | IndexedDB should be cleared when leaving private browsing mode and it is not, the API for WKWebViewConfiguration was being used incorrectly and requires the pr… |
CVE-2020-14451 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Mobile Apps before 1.29.0. The iOS app allowed Single Sign-On cookies and Local Storage to remain after a logout, aka MMS… |
CVE-2019-20850 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Mobile Apps before 1.26.0. A view cache can persist on a device after a logout. |
CVE-2019-20849 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Mobile Apps before 1.26.0. Cookie data can persist on a device after a logout. |
CVE-2020-12494 | Medium | 5.3 | 2020-06-16 | Beckhoff's TwinCAT RT network driver for Intel 8254x and 8255x is providing EtherCAT functionality. The driver implements real-time features. Except for Ethern… |
CVE-2020-0543 | Medium | 5.5 | 2020-06-15 | Incomplete cleanup from specific special register read operations in some Intel(R) Processors may allow an authenticated user to potentially enable information… |
CVE-2020-0183 | High | 7.8 | 2020-06-11 | In handleMessage of BluetoothManagerService, there is an incomplete reset. This could lead to local escalation of privilege with no additional execution privil… |
CVE-2020-12857 | High | 7.5 | 2020-05-18 | Caching of GATT characteristic values (TempID) in COVIDSafe v1.0.15 and v1.0.16 allows a remote attacker to long-term re-identify an Android device running COV… |
CVE-2020-10685 | Medium | 5.0 | 2020-05-11 | A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Towe… |
CVE-2020-12624 | Medium | 6.5 | 2020-05-03 | The League application before 2020-05-02 on Android sends a bearer token in an HTTP Authorization header to an arbitrary web site that hosts an external image… |
CVE-2020-5961 | Medium | 5.5 | 2020-03-12 | NVIDIA vGPU graphics driver for guest OS contains a vulnerability in which an incorrect resource clean up on a failure path can impact the guest VM, leading to… |
CVE-2020-6794 | Medium | 6.5 | 2020-03-02 | If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is becau… |
CVE-2012-5663 | High | 7.5 | 2019-12-30 | The isearch package (textproc/isearch) before 1.47.01nb1 uses the tempnam() function to create insecure temporary files into a publicly-writable area (/tmp). |
CVE-2019-8768 | Medium | 5.3 | 2019-12-18 | "Clear History and Website Data" did not clear the history. The issue was addressed with improved data deletion. This issue is fixed in macOS Catalina 10.15. A… |
CVE-2019-8730 | Low | 3.3 | 2019-12-18 | The contents of locked notes sometimes appeared in search results. This issue was addressed with improved data cleanup. This issue is fixed in macOS Catalina 1… |
CVE-2019-8550 | Medium | 4.3 | 2019-12-18 | An issue existed in the pausing of FaceTime video. The issue was resolved with improved logic. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, watchOS 5… |
CVE-2019-8548 | Low | 2.4 | 2019-12-18 | An issue existed where partially entered passcodes may not clear when the device went to sleep. This issue was addressed by clearing the passcode when a locked… |
CVE-2019-18191 | High | 8.8 | 2019-12-16 | A privilege escalation vulnerability in the Trend Micro Deep Security as a Service Quick Setup cloud formation template could allow an authenticated entity wit… |
CVE-2019-17420 | Medium | 5.3 | 2019-10-10 | In OISF LibHTP before 0.5.31, as used in Suricata 4.1.4 and other products, an HTTP protocol parsing error causes the http_header signature to not alert on a r… |
CVE-2019-3733 | Medium | 4.9 | 2019-09-30 | RSA BSAFE Crypto-C Micro Edition, all versions prior to 4.1.4, is vulnerable to three (3) different Improper Clearing of Heap Memory Before Release vulnerabili… |
CVE-2019-13014 | Medium | 5.5 | 2019-08-23 | Little Snitch versions 4.4.0 fixes a vulnerability in a privileged helper tool. However, the operating system may have made a copy of the privileged helper whi… |
CVE-2019-12902 | Medium | 6.5 | 2019-06-20 | Pydio Cells before 1.5.0 does incomplete cleanup of a user's data upon deletion. This allows a new user, holding the same User ID as a deleted user, to restore… |
CVE-2019-1586 | Medium | 4.6 | 2019-05-03 | A vulnerability in Cisco Application Policy Infrastructure Controller (APIC) Software could allow an unauthenticated, local attacker with physical access to ob… |
CVE-2019-11514 | High | 7.5 | 2019-04-25 | User/Command/ConfirmEmailHandler.php in Flarum before 0.1.0-beta.8 mishandles invalidation of user email tokens. |
CVE-2019-5011 | Medium | 5.5 | 2019-03-21 | An exploitable privilege escalation vulnerability exists in the helper service CleanMyMac X, version 4.20, due to improper updating. The application failed to… |
CVE-2019-5595 | Medium | 5.5 | 2019-02-12 | In FreeBSD before 11.2-STABLE(r343782), 11.2-RELEASE-p9, 12.0-STABLE(r343781), and 12.0-RELEASE-p3, kernel callee-save registers are not properly sanitized bef… |
CVE-2018-19961 | High | 7.8 | 2018-12-08 | An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because TLB flushes do not alwa… |
CVE-2018-17467 | Medium | 4.3 | 2018-11-14 | Insufficiently quick clearing of stale rendered content in Navigation in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of… |
CVE-2018-18924 | High | 8.8 | 2018-11-04 | The image-upload feature in ProjeQtOr 7.2.5 allows remote attackers to execute arbitrary code by uploading a .shtml file with "#exec cmd" because rejected file… |
CVE-2018-18281 | High | 7.8 | 2018-10-30 | Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate() removes entries from… |
CVE-2018-15407 | Medium | 5.5 | 2018-10-05 | A vulnerability in the installation process of Cisco HyperFlex Software could allow an authenticated, local attacker to read sensitive information. The vulnera… |
CVE-2018-11068 | Medium | 4.6 | 2018-09-11 | RSA BSAFE SSL-J versions prior to 6.2.4 contain a Heap Inspection vulnerability that could allow an attacker with physical access to the system to recover sens… |
CVE-2018-12332 | Medium | 4.2 | 2018-06-17 | Incomplete Cleanup vulnerability in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows an attacker to compromise authentication and encryption keys via a compromise… |
CVE-2017-17090 | High | 7.5 | 2017-12-02 | An issue was discovered in chan_skinny.c in Asterisk Open Source 13.18.2 and older, 14.7.2 and older, and 15.1.2 and older, and Certified Asterisk 13.13-cert7… |
CVE-2017-0303 | High | 7.5 | 2017-10-27 | In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software version 13.0.0, 12.0.0 to 12.1.2 and 11.5.1 to 11.6.1, und… |
CVE-2005-2293 | Medium | 5.5 | 2005-07-18 | Oracle Formsbuilder 9.0.4 stores database usernames and passwords in a temporary file, which is not deleted after it is used, which allows local users to obtai… |
CVE-2005-1744 | Critical | 9.8 | 2005-05-24 | BEA WebLogic Server and WebLogic Express 7.0 through Service Pack 5 does not log out users when an application is redeployed, which allows those users to conti… |
CVE-2002-2070 | High | 7.5 | 2002-12-31 | SecureClean 3 build 2.0 does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers to recover sensit… |
CVE-2002-2069 | High | 7.5 | 2002-12-31 | PGP 6.x and 7.x does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers to recover sensitive info… |
CVE-2002-2068 | High | 7.5 | 2002-12-31 | Eraser 5.3 does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers to recover sensitive informati… |
CVE-2002-2067 | High | 7.5 | 2002-12-31 | East-Tec Eraser 2002 does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers to recover sensitive… |
CVE-2002-2066 | High | 7.5 | 2002-12-31 | BestCrypt BCWipe 1.0.7 and 2.0 through 2.35.1 does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attac… |
CVE-2002-0788 | Medium | 5.5 | 2002-08-12 | An interaction between PGP 7.0.3 with the "wipe deleted files" option, when used on Windows Encrypted File System (EFS), creates a cleartext temporary files th… |
CVE-2000-0552 | Medium | 5.5 | 2000-06-06 | ICQwebmail client for ICQ 2000A creates a world readable temporary file during login and does not delete it, which allows local users to obtain sensitive infor… |