Invocation of Process Using Visible Sensitive Information

A process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system.

CVEs (24)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-1753 3Debian FedoraprojectRedhat 4Ansible Engine Ansible TowerDebian Linux+1 more Jun 17, 2026 Mar 16, 2020 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s mo...Show more A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters such as passwords and tokens are passed to kubectl from the command line, not using an environment variable or an input configuration file. This will disclose passwords and tokens from process list and no_log directive from debug module would not have any effect making these secrets being disclosed on stdout and log files.Show less
CVE-2019-3869 1Redhat 1Ansible Tower Jun 17, 2026 Mar 28, 2019 N/A· v4 7.2 HIGH· v3 4.0 MEDIUM· v2 When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability to write playbooks could use this to gain...Show more When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability to write playbooks could use this to gain administrative privileges.Show less
CVE-2018-17957 1Suse 1Repository Mirroring Tool Nov 21, 2024 Dec 26, 2018 N/A· v4 7.8 HIGH· v3 2.1 LOW· v2 The YaST2 RMT module for configuring the SUSE Repository Mirroring Tool (RMT) before 1.1.2 exposed MySQL database passwords on process commandline, allowing local attackers to access or corrupt the RMT database.
CVE-2018-16837 3Debian RedhatSuse 4Ansible Engine Ansible TowerDebian Linux+1 more Nov 21, 2024 Oct 23, 2018 N/A· v4 7.8 HIGH· v3 2.1 LOW· v2 Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen executable. Showing...Show more Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen executable. Showing those credentials in clear text form for every user which have access just to the process list.Show less

Previous 12