Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CVEs (11,928)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-27424 1Ge 19Multilin B30 Firmware Multilin B90 FirmwareMultilin C30 Firmware+16 more Jun 17, 2026 Mar 23, 2022 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 GE UR firmware versions prior to version 8.1x shares MODBUS memory map as part of the communications guide. GE was made aware a “Last-key pressed” MODBUS register can be used to gain unauthorized information.
CVE-2021-27422 1Ge 19Multilin B30 Firmware Multilin B90 FirmwareMultilin C30 Firmware+16 more Jun 17, 2026 Mar 23, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 GE UR firmware versions prior to version 8.1x web server interface is supported on UR over HTTP protocol. It allows sensitive information exposure without authentication.
CVE-2022-1004 1Otrs 1Otrs Jun 17, 2026 Mar 21, 2022 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 Accounted time is shown in the Ticket Detail View (External Interface), even if ExternalFrontend::TicketDetailView###AccountedTimeDisplay is disabled.
CVE-2022-25602 1Expresstech 1Responsive Menu Jun 17, 2026 Mar 18, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Nonce token leak vulnerability leading to arbitrary file upload, theme deletion, plugin settings change discovered in Responsive Menu WordPress plugin (versions <= 4.1.7).
CVE-2022-25248 1Ptc 2Axeda Agent Axeda Desktop Server Jun 17, 2026 Mar 16, 2022 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) supplies the event log of the specific service.
CVE-2022-0430 1Httpie 1Httpie Jun 17, 2026 Mar 15, 2022 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository httpie/httpie prior to 3.1.0.
CVE-2022-24762 1Sysend.js Project 1Sysend.js Jun 17, 2026 Mar 14, 2022 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 sysend.js is a library that allows a user to send messages between pages that are open in the same browser. Users that use cross-origin communication may have their communications intercepted. Impact is limited by the co...Show more sysend.js is a library that allows a user to send messages between pages that are open in the same browser. Users that use cross-origin communication may have their communications intercepted. Impact is limited by the communication occurring in the same browser. This issue has been patched in sysend.js version 1.10.0. The only currently known workaround is to avoid sending communications that a user does not want to have intercepted via sysend messages.Show less
CVE-2022-24742 1Sylius 1Sylius Jun 17, 2026 Mar 14, 2022 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab remains unclosed after log out. The issue is fixed in versions 1.9.10, 1.10.11,...Show more Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab remains unclosed after log out. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. A workaround is available. The application must strictly redirect to login page even browser back button is pressed. Another possibility is to set more strict cache policies for restricted content.Show less
CVE-2021-41850 3Bluproducts LunaWikomobile 5G90 Firmware G9 FirmwareSimo Firmware+2 more Jun 17, 2026 Mar 11, 2022 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 An issue was discovered in Luna Simo PPR1.180610.011/202001031830. A pre-installed app with a package name of com.skyroam.silverhelper writes three IMEI values to system properties at system startup. The system property...Show more An issue was discovered in Luna Simo PPR1.180610.011/202001031830. A pre-installed app with a package name of com.skyroam.silverhelper writes three IMEI values to system properties at system startup. The system property values can be obtained via getprop by all third-party applications co-located on the device, even those with no permissions granted, exposing the IMEI values to processes without enforcing any access control.Show less
CVE-2021-41849 3Bluproducts LunaWikomobile 5G90 Firmware G9 FirmwareSimo Firmware+2 more Jun 17, 2026 Mar 11, 2022 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 An issue was discovered in Luna Simo PPR1.180610.011/202001031830. It sends the following Personally Identifiable Information (PII) in plaintext using HTTP to servers located in China: user's list of installed apps and d...Show more An issue was discovered in Luna Simo PPR1.180610.011/202001031830. It sends the following Personally Identifiable Information (PII) in plaintext using HTTP to servers located in China: user's list of installed apps and device International Mobile Equipment Identity (IMEI). This PII is transmitted to log.skyroam.com.cn using HTTP, independent of whether the user uses the Simo software.Show less
CVE-2021-32477 1Moodle 1Moodle Jun 17, 2026 Mar 11, 2022 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 The last time a user accessed the mobile app is displayed on their profile page, but should be restricted to users with the relevant capability (site administrators by default). Moodle versions 3.10 to 3.10.3 are affecte...Show more The last time a user accessed the mobile app is displayed on their profile page, but should be restricted to users with the relevant capability (site administrators by default). Moodle versions 3.10 to 3.10.3 are affected.Show less
CVE-2021-32473 1Moodle 1Moodle Jun 17, 2026 Mar 11, 2022 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 It was possible for a student to view their quiz grade before it had been released, using a quiz web service. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected
CVE-2022-25512 1Freetakserver Ui Project 1Freetakserver Ui Jun 17, 2026 Mar 11, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 FreeTAKServer-UI v1.9.8 was discovered to leak sensitive API and Websocket keys.
CVE-2022-26847 2Debian Spip 2Debian Linux Spip Jun 17, 2026 Mar 10, 2022 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 SPIP before 3.2.14 and 4.x before 4.0.5 allows unauthenticated access to information about editorial objects.
CVE-2022-25830 1Samsung 1Galaxy Watch 3 Plugin Jun 17, 2026 Mar 10, 2022 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 Information Exposure vulnerability in Galaxy Watch3 Plugin prior to version 2.2.09.22012751 allows attacker to access password information of connected WiFiAp in the log
CVE-2022-25829 1Samsung 1Watch Active2 Plugin Jun 17, 2026 Mar 10, 2022 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 Information Exposure vulnerability in Watch Active2 Plugin prior to version 2.2.08.22012751 allows attacker to access password information of connected WiFiAp in the log
CVE-2022-25828 1Samsung 1Watch Active Plugin Jun 17, 2026 Mar 10, 2022 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 Information Exposure vulnerability in Watch Active Plugin prior to version 2.2.07.22012751 allows attacker to access password information of connected WiFiAp in the log
CVE-2022-25827 1Samsung 1Galaxy Watch Plugin Jun 17, 2026 Mar 10, 2022 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 Information Exposure vulnerability in Galaxy Watch Plugin prior to version 2.2.05.22012751 allows attacker to access password information of connected WiFiAp in the log
CVE-2022-25826 1Samsung 1Galaxy Watch 3 Plugin Jun 17, 2026 Mar 10, 2022 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 Information Exposure vulnerability in Galaxy S3 Plugin prior to version 2.2.03.22012751 allows attacker to access password information of connected WiFiAp in the log
CVE-2022-25823 1Samsung 1Galaxy Watch Plugin Jun 17, 2026 Mar 10, 2022 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 Information Exposure vulnerability in Galaxy Watch Plugin prior to version 2.2.05.220126741 allows attackers to access user information in log.

Previous 1...254255256...597 Next