Exposure of Sensitive Information Due to Incompatible Policies

The product's intended functionality exposes information to certain actors in accordance with the developer's security policy, but this information is regarded as sensitive according to the intended security policies of other stakeholders such as the product's administrator, users, or others whose information is being processed.

CVEs (35)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-27465 1Siemens 13Simotion C240 Firmware Simotion C240 Pn FirmwareSimotion D410 2 Dp/pn Firmware+10 more Jun 17, 2026 Jun 13, 2023 N/A· v4 4.6 MEDIUM· v3 N/A· v2 A vulnerability has been identified in SIMOTION C240 (All versions >= V5.4 < V5.5 SP1), SIMOTION C240 PN (All versions >= V5.4 < V5.5 SP1), SIMOTION D410-2 DP (All versions >= V5.4 < V5.5 SP1), SIMOTION D410-2 DP/PN (All...Show more A vulnerability has been identified in SIMOTION C240 (All versions >= V5.4 < V5.5 SP1), SIMOTION C240 PN (All versions >= V5.4 < V5.5 SP1), SIMOTION D410-2 DP (All versions >= V5.4 < V5.5 SP1), SIMOTION D410-2 DP/PN (All versions >= V5.4 < V5.5 SP1), SIMOTION D425-2 DP (All versions >= V5.4 < V5.5 SP1), SIMOTION D425-2 DP/PN (All versions >= V5.4 < V5.5 SP1), SIMOTION D435-2 DP (All versions >= V5.4 < V5.5 SP1), SIMOTION D435-2 DP/PN (All versions >= V5.4 < V5.5 SP1), SIMOTION D445-2 DP/PN (All versions >= V5.4), SIMOTION D445-2 DP/PN (All versions >= V5.4 < V5.5 SP1), SIMOTION D455-2 DP/PN (All versions >= V5.4 < V5.5 SP1), SIMOTION P320-4 E (All versions >= V5.4), SIMOTION P320-4 S (All versions >= V5.4). When operated with Security Level Low the device does not protect access to certain services relevant for debugging. This could allow an unauthenticated attacker to extract confidential technology object (TO) configuration from the device.Show less
CVE-2022-30350 1Avanquest 1Pdfescape Jun 17, 2026 Mar 30, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Avanquest Software RAD PDF (PDFEscape Online) 3.19.2.2 is vulnerable to Information Leak / Disclosure. The PDFEscape Online tool provides users with a "white out" functionality for redacting images, text, and other graph...Show more Avanquest Software RAD PDF (PDFEscape Online) 3.19.2.2 is vulnerable to Information Leak / Disclosure. The PDFEscape Online tool provides users with a "white out" functionality for redacting images, text, and other graphics from a PDF document. However, this mechanism does not remove underlying text or PDF object specification information from the PDF. As a result, for example, redacted text may be copy-pasted by a PDF reader.Show less
CVE-2022-39848 1Google 1Android Jun 17, 2026 Oct 7, 2022 N/A· v4 3.3 LOW· v3 N/A· v2 Exposure of sensitive information in AT_Distributor prior to SMR Oct-2022 Release 1 allows local attacker to access SerialNo via log.
CVE-2022-33696 1Google 1Android Jun 17, 2026 Jul 12, 2022 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 Exposure of Sensitive Information in Telephony service prior to SMR Jul-2022 Release 1 allows local attacker to access imsi and iccid via log.
CVE-2022-33694 1Google 1Android Jun 17, 2026 Jul 12, 2022 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 Exposure of Sensitive Information in CSC application prior to SMR Jul-2022 Release 1 allows local attacker to access wifi information via unprotected intent broadcasting.
CVE-2022-33692 1Google 1Android Jun 17, 2026 Jul 12, 2022 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 Exposure of Sensitive Information in Messaging application prior to SMR Jul-2022 Release 1 allows local attacker to access imsi and iccid via log.
CVE-2022-30728 1Google 1Android Jun 17, 2026 Jun 7, 2022 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 Information exposure vulnerability in ScanPool prior to SMR Jun-2022 Release 1 allows local attackers to get MAC address information.
CVE-2022-30714 1Google 1Android Jun 17, 2026 Jun 7, 2022 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 Information exposure vulnerability in SemIWCMonitor prior to SMR Jun-2022 Release 1 allows local attackers to get MAC address information.
CVE-2022-28794 1Google 1Android Jun 17, 2026 Jun 7, 2022 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 Sensitive information exposure in low-battery dumpstate log prior to SMR Jun-2022 Release 1 allows local attackers to get SIM card information.
CVE-2022-22541 1Sap 1Businessobjects Business Intelligence Platform Jun 17, 2026 Apr 12, 2022 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 SAP BusinessObjects Business Intelligence Platform - versions 420, 430, may allow legitimate users to access information they shouldn't see through relational or OLAP connections. The main impact is the disclosure of com...Show more SAP BusinessObjects Business Intelligence Platform - versions 420, 430, may allow legitimate users to access information they shouldn't see through relational or OLAP connections. The main impact is the disclosure of company data to people that shouldn't or don't need to have access.Show less
CVE-2020-1652 1Opennms 1Opennms Jun 17, 2026 Jul 17, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 OpenNMS is accessible via port 9443
CVE-2017-3211 1Yopify 1Yopify Nov 21, 2024 Jan 15, 2020 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Yopify, an e-commerce notification plugin, up to April 06, 2017, leaks the first name, last initial, city, and recent purchase data of customers, all without user authorization.
CVE-2019-1010283 1Univention 1Univention Corporate Server Jun 17, 2026 Jul 17, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Univention Corporate Server univention-directory-notifier 12.0.1-3 and earlier is affected by: CWE-213: Intentional Information Exposure. The impact is: Loss of Confidentiality. The component is: function data_on_connect...Show more Univention Corporate Server univention-directory-notifier 12.0.1-3 and earlier is affected by: CWE-213: Intentional Information Exposure. The impact is: Loss of Confidentiality. The component is: function data_on_connection() in src/callback.c. The attack vector is: network connectivity. The fixed version is: 12.0.1-4 and later.Show less
CVE-2019-10247 4Debian EclipseNetapp+1 more 26Autovue Communications AnalyticsCommunications Element Manager+23 more Jun 17, 2026 Apr 22, 2019 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource l...Show more In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context.Show less
CVE-2019-10246 3Eclipse NetappOracle 25Autovue Communications AnalyticsCommunications Element Manager+22 more Jun 17, 2026 Apr 22, 2019 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for sho...Show more In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.Show less

Previous 12