Exposure of Sensitive Information Due to Incompatible Policies

The product's intended functionality exposes information to certain actors in accordance with the developer's security policy, but this information is regarded as sensitive according to the intended security policies of other stakeholders such as the product's administrator, users, or others whose information is being processed.

CVEs (31)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-33694 1Google 1Android Jun 17, 2026 Jul 12, 2022 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 Exposure of Sensitive Information in CSC application prior to SMR Jul-2022 Release 1 allows local attacker to access wifi information via unprotected intent broadcasting.
CVE-2022-33692 1Google 1Android Jun 17, 2026 Jul 12, 2022 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 Exposure of Sensitive Information in Messaging application prior to SMR Jul-2022 Release 1 allows local attacker to access imsi and iccid via log.
CVE-2022-30728 1Google 1Android Jun 17, 2026 Jun 7, 2022 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 Information exposure vulnerability in ScanPool prior to SMR Jun-2022 Release 1 allows local attackers to get MAC address information.
CVE-2022-30714 1Google 1Android Jun 17, 2026 Jun 7, 2022 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 Information exposure vulnerability in SemIWCMonitor prior to SMR Jun-2022 Release 1 allows local attackers to get MAC address information.
CVE-2022-28794 1Google 1Android Jun 17, 2026 Jun 7, 2022 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 Sensitive information exposure in low-battery dumpstate log prior to SMR Jun-2022 Release 1 allows local attackers to get SIM card information.
CVE-2022-22541 1Sap 1Businessobjects Business Intelligence Platform Jun 17, 2026 Apr 12, 2022 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 SAP BusinessObjects Business Intelligence Platform - versions 420, 430, may allow legitimate users to access information they shouldn't see through relational or OLAP connections. The main impact is the disclosure of com...Show more SAP BusinessObjects Business Intelligence Platform - versions 420, 430, may allow legitimate users to access information they shouldn't see through relational or OLAP connections. The main impact is the disclosure of company data to people that shouldn't or don't need to have access.Show less
CVE-2020-1652 1Opennms 1Opennms Jun 17, 2026 Jul 17, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 OpenNMS is accessible via port 9443
CVE-2017-3211 1Yopify 1Yopify Nov 21, 2024 Jan 15, 2020 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Yopify, an e-commerce notification plugin, up to April 06, 2017, leaks the first name, last initial, city, and recent purchase data of customers, all without user authorization.
CVE-2019-1010283 1Univention 1Univention Corporate Server Jun 17, 2026 Jul 17, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Univention Corporate Server univention-directory-notifier 12.0.1-3 and earlier is affected by: CWE-213: Intentional Information Exposure. The impact is: Loss of Confidentiality. The component is: function data_on_connect...Show more Univention Corporate Server univention-directory-notifier 12.0.1-3 and earlier is affected by: CWE-213: Intentional Information Exposure. The impact is: Loss of Confidentiality. The component is: function data_on_connection() in src/callback.c. The attack vector is: network connectivity. The fixed version is: 12.0.1-4 and later.Show less
CVE-2019-10247 4Debian EclipseNetapp+1 more 26Autovue Communications AnalyticsCommunications Element Manager+23 more Jun 17, 2026 Apr 22, 2019 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource l...Show more In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context.Show less
CVE-2019-10246 3Eclipse NetappOracle 25Autovue Communications AnalyticsCommunications Element Manager+22 more Jun 17, 2026 Apr 22, 2019 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for sho...Show more In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.Show less

Previous 12