CWE-497 · Exposure of Sensitive System Information to an Unauthorized Control Sphere (page 4)
Page 4 of 4 — CVEs classified under CWE-497, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-0055 | Medium | 6.0 | 2025-01-14 | SAP GUI for Windows stores user input on the client PC to improve usability. Under very specific circumstances an attacker with administrative privileges or ac… |
CVE-2024-45640 | Medium | 5.3 | 2025-01-07 | IBM Security ReaQta 3.12 returns sensitive information in an HTTP response that could be used in further attacks against the system. |
CVE-2024-52367 | Medium | 5.3 | 2025-01-07 | IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3 could disclose sensitive system information to an unauthorized actor that could be used in further… |
CVE-2024-12993 | | 2024-12-30 | Infinix devices contain a pre-loaded "com.rlk.weathers" application, that exposes an unsecured content provider. An attacker can communicate with the provider… | |
CVE-2024-52321 | Medium | 5.9 | 2024-12-23 | Multiple SHARP routers contain an improper authentication vulnerability in the configuration backup function. The product's backup files containing sensitive i… |
CVE-2024-54279 | High | 7.5 | 2024-12-16 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Tobias Keller WP-NERD Toolkit wp-nerd-toolkit.This issue affects WP… |
CVE-2023-23472 | Low | 3.1 | 2024-12-11 | IBM InfoSphere DataStage Flow Designer (InfoSphere Information Server 11.7) could allow an authenticated user to obtain sensitive information that could aid in… |
CVE-2024-32732 | Medium | 5.3 | 2024-12-10 | Under certain conditions SAP BusinessObjects Business Intelligence platform allows an attacker to access information which would otherwise be restricted.This h… |
CVE-2024-53814 | Medium | 6.5 | 2024-12-09 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Adnan Analytify wp-analytify.This issue affects Analytify: from n/a… |
CVE-2024-53867 | Medium | 4.3 | 2024-12-03 | Synapse is an open-source Matrix homeserver. The Sliding Sync feature on Synapse versions between 1.113.0rc1 and 1.120.0 can leak partial room state changes to… |
CVE-2024-25035 | Medium | 5.3 | 2024-12-03 | IBM Cognos Controller 11.0.0 and 11.0.1 exposes server details that could allow an attacker to obtain information of the application environment to conduct… |
CVE-2024-53768 | Medium | 5.3 | 2024-11-30 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ideinteractive Content Audit Exporter content-audit-exporter allows… |
CVE-2024-22037 | Medium | 5.5 | 2024-11-28 | The uyuni-server-attestation systemd service needs a database_password environment variable. This file has 640 permission, and cannot be shown users, but the e… |
CVE-2024-10240 | Medium | 5.3 | 2024-11-26 | An issue has been discovered in GitLab EE affecting all versions starting from 17.3 before 17.3.7, all versions starting from 17.4 before 17.4.4, all versions… |
CVE-2024-9929 | Medium | 4.3 | 2024-11-26 | A vulnerability exists in NSD570 that allows any authenticated user to access all device logs disclosing login information with timestamps. |
CVE-2024-41781 | Medium | 5.1 | 2024-11-22 | IBM PowerVM Platform KeyStore (IBM PowerVM Hypervisor FW950.00 through FW950.90, FW1030.00 through FW1030.60, FW1050.00 through FW1050.20, and FW1060.00 throug… |
CVE-2024-52033 | Medium | 5.3 | 2024-11-20 | Exposure of sensitive system information to an unauthorized control sphere issue exists in Rakuten Turbo 5G firmware version V1.3.18 and earlier. If this vulne… |
CVE-2024-37070 | Medium | 4.3 | 2024-11-19 | IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to obtain sensitive information that could aid in further attacks again… |
CVE-2024-52582 | Medium | 4.7 | 2024-11-19 | Cachi2 is a command-line interface tool that pre-fetches a project's dependencies to aid in making the project's build process network-isolated. Prior to versi… |
CVE-2021-1234 | Medium | 5.3 | 2024-11-18 | A vulnerability in the cluster management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to view sensitive inf… |
CVE-2024-36509 | Medium | 4.2 | 2024-11-12 | An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiWeb version 7.6.0, version 7.4.3 and below, versi… |
CVE-2024-47799 | Low | 3.5 | 2024-11-12 | Exposure of sensitive system information to an unauthorized control sphere issue exists in Mesh Wi-Fi router RP562B firmware version v1.0.2 and earlier. If thi… |
CVE-2024-50528 | High | 7.5 | 2024-11-04 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Stacks Stacks Mobile App Builder stacks-mobile-app-builder allows R… |
CVE-2024-50425 | Medium | 6.5 | 2024-10-29 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Roland Murg WP Booking System wp-booking-system.This issue affects… |
CVE-2024-48024 | High | 7.5 | 2024-10-17 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Fahad Mahmood Keep Backup Daily keep-backup-daily allows Retrieve E… |
CVE-2024-49252 | Medium | 5.3 | 2024-10-16 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in VaultDweller Leyka leyka.This issue affects Leyka: from n/a through… |
CVE-2024-9470 | | 2024-10-09 | A vulnerability in Cortex XSOAR allows the disclosure of incident data to users who do not have the privilege to view the data. | |
CVE-2024-6389 | Medium | 4.3 | 2024-09-12 | An issue was discovered in GitLab-CE/EE affecting all versions starting with 17.0 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. An attacker as a g… |
CVE-2024-8687 | High | 7.1 | 2024-09-11 | An information exposure vulnerability exists in Palo Alto Networks PAN-OS software that enables a GlobalProtect end user to learn both the configured GlobalPro… |
CVE-2023-42010 | Low | 3.1 | 2024-07-17 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.2 could disclose sensitive information in the HTTP response usin… |
CVE-2024-39740 | Medium | 4.3 | 2024-07-15 | IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 displays version information in HTTP requests that could allow an attacker to gather information fo… |
CVE-2024-39675 | High | 8.8 | 2024-07-09 | A vulnerability has been identified in RUGGEDCOM RMC30 (All versions < V4.3.10), RUGGEDCOM RMC30NC (All versions < V4.3.10), RUGGEDCOM RP110 (All versions < V4… |
CVE-2024-31223 | Medium | 5.3 | 2024-07-03 | Fides is an open-source privacy engineering platform, and `SERVER_SIDE_FIDES_API_URL` is a server-side configuration environment variable used by the Fides Pri… |
CVE-2024-5735 | High | 7.5 | 2024-06-28 | Full Path Disclosure vulnerability in AdmirorFrames Joomla! extension in afHelper.php script allows an unauthorised attacker to retrieve location of web root f… |
CVE-2024-6388 | Medium | 5.9 | 2024-06-27 | Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an a… |
CVE-2022-4968 | Medium | 6.5 | 2024-06-07 | netplan leaks the private key of wireguard to local users. Versions after 1.0 are not affected. |
CVE-2024-4008 | Critical | 9.6 | 2024-06-05 | FDSK Leak in ABB, Busch-Jaeger, FTS Display (version 1.00) and BCU (version 1.3.0.33) allows attacker to take control via access to local KNX Bus-System |
CVE-2024-36070 | High | 7.5 | 2024-05-19 | tine before 2023.11.8, when an LDAP backend is used, allows anonymous remote attackers to obtain sensitive authentication information via setup.php because of… |
CVE-2023-50180 | Medium | 5.5 | 2024-05-14 | An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiADC version 7.4.1 and below, version 7.2.3 and be… |
CVE-2024-1809 | Medium | 5.4 | 2024-05-02 | The Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) plugin for WordPress is vulnerable to unauthorized access of data due to a m… |
CVE-2024-31887 | High | 7.5 | 2024-04-16 | IBM Security Verify Privilege 11.6.25 could allow an unauthenticated actor to obtain sensitive information from the SOAP API. IBM X-Force ID: 287651. |
CVE-2024-3774 | Medium | 5.3 | 2024-04-15 | aEnrich Technology a+HRD's functionality for front-end retrieval of system configuration values lacks proper restrictions on a specific parameter, allowing att… |
CVE-2023-4605 | Medium | 6.5 | 2024-04-05 | A valid authenticated Lenovo XClarity Administrator (LXCA) user can potentially leverage an unauthenticated API endpoint to retrieve system event information… |
CVE-2024-31419 | Medium | 4.3 | 2024-04-03 | An information disclosure flaw was found in OpenShift Virtualization. The DownwardMetrics feature was introduced to expose host metrics to virtual machine gues… |
CVE-2023-50959 | Medium | 5.3 | 2024-03-31 | IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2,19.0.1, 19.0.2, 19.0.3,20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1,2 2.0.2, 23.0.1, and… |
CVE-2024-0053 | Low | 3.3 | 2024-03-11 | In getCustomPrinterIcon of PrintManagerService.java, there is a possible way to view other user's images due to a confused deputy. This could lead to local inf… |
CVE-2024-25634 | High | 7.2 | 2024-02-19 | alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, an attacker can access data from other organizers. The attacker can use a spe… |
CVE-2023-5081 | Low | 3.3 | 2024-01-19 | An information disclosure vulnerability was reported in the Lenovo Tab M8 HD that could allow a local application to gather a non-resettable device identifier. |
CVE-2024-22125 | High | 7.4 | 2024-01-09 | Under certain conditions the Microsoft Edge browser extension (SAP GUI connector for Microsoft Edge) - version 1.0, allows an attacker to access highly sensiti… |
CVE-2024-22124 | Medium | 4.1 | 2024-01-09 | Under certain conditions, Internet Communication Manager (ICM) or SAP Web Dispatcher - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KRNL64UC 7.22, KRNL64UC… |
CVE-2023-41366 | Medium | 5.3 | 2023-11-14 | Under certain condition SAP NetWeaver Application Server ABAP - versions KERNEL 722, KERNEL 7.53, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7… |
CVE-2023-34209 | Medium | 5.0 | 2023-10-17 | Exposure of Sensitive System Information to an Unauthorized Control Sphere in create template function in EasyUse MailHunter Ultimate 2023 and earlier allow re… |
CVE-2023-4237 | High | 7.3 | 2023-10-04 | A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2_key module prints out the private key directly to the standard output… |
CVE-2023-20111 | Medium | 6.5 | 2023-08-16 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access sensitive… |
CVE-2023-37487 | Medium | 5.3 | 2023-08-08 | SAP Business One (Service Layer) - version 10.0, allows an authenticated attacker with deep knowledge perform certain operation to access unintended data over… |
CVE-2023-0342 | Low | 3.1 | 2023-06-09 | MongoDB Ops Manager Diagnostics Archive may not redact sensitive PEM key file password app settings. Archives do not include the PEM files themselves. This iss… |
CVE-2023-2541 | Medium | 5.3 | 2023-06-07 | The Web Frontend of KNIME Business Hub before 1.4.0 allows an unauthenticated remote attacker to access internals about the application such as versions, host… |
CVE-2023-32550 | Critical | 9.3 | 2023-06-06 | Landscape's server-status page exposed sensitive system information. This data leak included GET requests which contain information to attack and leak further… |
CVE-2023-0005 | Medium | 4.1 | 2023-04-12 | A vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to expose the plaintext values of secrets stored in the device con… |
CVE-2022-34458 | Medium | 6.6 | 2023-02-01 | Dell Command | Update, Dell Update, and Alienware Update versions prior to 4.7 contain a Exposure of Sensitive System Information to an Unauthorized Control S… |
CVE-2022-38710 | Medium | 5.3 | 2022-11-03 | IBM Robotic Process Automation 21.0.1 and 21.0.2 could disclose sensitive version to an unauthorized control sphere information that could aid in further attac… |
CVE-2022-2403 | Medium | 6.5 | 2022-09-01 | A credentials leak was found in the OpenShift Container Platform. The private key for the external cluster certificate was stored incorrectly in the oauth-serv… |
CVE-2022-1902 | High | 8.8 | 2022-09-01 | A flaw was found in the Red Hat Advanced Cluster Security for Kubernetes. Notifier secrets were not properly sanitized in the GraphQL API. This flaw allows aut… |
CVE-2022-20664 | High | 7.7 | 2022-06-15 | A vulnerability in the web management interface of Cisco Secure Email and Web Manager, formerly Cisco Security Management Appliance (SMA), and Cisco Email Secu… |
CVE-2022-20734 | Medium | 4.4 | 2022-05-04 | A vulnerability in Cisco SD-WAN vManage Software could allow an authenticated, local attacker to view sensitive information on an affected system. This vulnera… |
CVE-2022-28651 | High | 8.4 | 2022-04-05 | In JetBrains IntelliJ IDEA before 2021.3.3 it was possible to get passwords from protected fields |
CVE-2021-0291 | Medium | 6.5 | 2021-07-15 | An Exposure of System Data vulnerability in Juniper Networks Junos OS and Junos OS Evolved, where a sensitive system-level resource is not being sufficiently p… |
CVE-2021-31955 | Medium | 5.5 | 2021-06-08 | Windows Kernel Information Disclosure Vulnerability |
CVE-2021-1544 | Medium | 5.5 | 2021-06-04 | A vulnerability in logging mechanisms of Cisco Webex Meetings client software could allow an authenticated, local attacker to gain access to sensitive informat… |
CVE-2021-23135 | Medium | 5.9 | 2021-05-12 | Exposure of System Data to an Unauthorized Control Sphere vulnerability in web UI of Argo CD allows attacker to cause leaked secret data into web UI error mess… |
CVE-2021-1535 | Medium | 5.3 | 2021-05-06 | A vulnerability in the cluster management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to view sensitive informat… |
CVE-2021-0260 | High | 7.3 | 2021-04-22 | An improper authorization vulnerability in the Simple Network Management Protocol daemon (snmpd) service of Juniper Networks Junos OS leads an unauthenticated… |
CVE-2021-1235 | Medium | 5.5 | 2021-01-20 | A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to read sensitive database files on an affected system… |
CVE-2020-25179 | Critical | 9.8 | 2020-12-14 | GE Healthcare Imaging and Ultrasound Products may allow specific credentials to be exposed during transport over the network. |
CVE-2020-26076 | High | 7.5 | 2020-11-18 | A vulnerability in Cisco IoT Field Network Director (FND) could allow an unauthenticated, remote attacker to view sensitive database information on an affected… |
CVE-2019-10243 | Medium | 5.3 | 2019-04-09 | In Eclipse Kura versions up to 4.0.0, Kura exposes the underlying Ui Web server version in its replies. This can be used as a hint by an attacker to specifical… |