CWE-212 · Information Disclosure
Improper Removal of Sensitive Information Before Storage or Transfer
109CVEs
0exploited
0with a public check
0likely (EPSS 10%+)
SortMost likely exploited
109 CVEs with CWE-212 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2020-1940The optional initial password change and password expiration features present in Apache Jackrabbit Oak 1.2.0 to 1.22.0 are prone to a sensitive information disclosure vulnerabilit…Apache Software Foundation · Apache Jackrabbit Oak · 2020-01-28 | – | 4.5% | 2020-01-28 |
| CVE-2022-29900Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions.AMD · AMD Processors · 2022-07-12 | – | 3.9% | 2022-07-12 |
| CVE-2002-0704The Network Address Translation (NAT) capability for Netfilter ("iptables") 1.2.6a and earlier leaks translated IP addresses in ICMP error messages.Linux · Linux Kernel · 2003-04-02 | – | 3.2% | 2003-04-02 |
| CVE-2020-15094RCE in Symfonysymfony · symfony · CVSS 8 · 2020-09-02 | 8.0 | 3.0% | 2020-09-02 |
| CVE-2021-0340In parseNextBox of IsoInterface.java, there is a possible leak of unredacted location information due to improper input validation. This could lead to remote information disclosur…Google · Android · 2021-02-10 | – | 2.2% | 2021-02-10 |
| CVE-2019-19362An issue was discovered in the Chat functionality of the TeamViewer desktop application 14.3.4730 on Windows. (The vendor states that it was later fixed.) Upon login, every commun…Teamviewer · Teamviewer · CVSS 4.3 · 2019-12-02 | 4.3 | 2.1% | 2019-12-02 |
| CVE-2022-0355Improper Removal of Sensitive Information Before Storage or Transfer in feross/simple-getfeross · feross/simple-get · CVSS 8.8 · 2022-01-26 | 8.8 | 2.0% | 2022-01-26 |
| CVE-2022-1650Improper Removal of Sensitive Information Before Storage or Transfer in eventsource/eventsourceeventsource · eventsource/eventsource · CVSS 8.1 · 2022-05-12 | 8.1 | 1.9% | 2022-05-12 |
| CVE-2019-20637An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before 6.3.1. It does not clear a pointer between the handling of one client req…Varnish-Cache · Varnish Cache · 2020-04-08 | – | 1.8% | 2020-04-08 |
| CVE-2018-6337folly::secureRandom will re-use a buffer between parent and child processes when fork() is called. That will result in multiple forked children producing repeat (or similar) resul…Facebook · HHVM · CVSS 7.5 · 2018-12-31 | 7.5 | 1.8% | 2018-12-31 |
| CVE-2022-2818Improper Removal of Sensitive Information Before Storage or Transfer in cockpit-hq/cockpitcockpit-hq · cockpit-hq/cockpit · CVSS 9.8 · 2022-08-15 | 9.8 | 1.7% | 2022-08-15 |
| CVE-2020-36476An issue was discovered in Mbed TLS before 2.24.0 (and before 2.16.8 LTS and before 2.7.17 LTS). There is missing zeroization of plaintext buffers in mbedtls_ssl_read to erase unu…Arm · Mbed Tls · 2021-08-23 | – | 1.6% | 2021-08-23 |
| CVE-2019-13402/usr/sbin/default.sh and /usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi on Dynacolor FCM-MB40 v1.2.0.0 devices implement an incomplete factory-reset process. A backdoor c…Fortinet · Fcm-Mb40 Firmware · 2019-07-08 | – | 1.5% | 2019-07-08 |
| CVE-2022-30617An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel users that have a r…Strapi · Strapi · 2022-05-19 | – | 1.5% | 2022-05-19 |
| CVE-2022-24798Insufficient password hash filtering in some IRRd queries and exportsirrdnet · irrd · CVSS 7.5 · 2022-03-31 | 7.5 | 1.4% | 2022-03-31 |
| CVE-2020-14370An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multip…Podman Project · podman · 2020-09-23 | – | 1.4% | 2020-09-23 |
| CVE-2018-1062A vulnerability was discovered in oVirt 4.1.x before 4.1.9, where the combination of Enable Discard and Wipe After Delete flags for VM disks managed by oVirt, could cause a disk t…oVirt · oVirt · 2018-03-06 | – | 1.4% | 2018-03-06 |
| CVE-2012-5625Openstack nova: information leak in libvirt lvm-backed instancesRed Hat · OpenStack Folsom for RHEL 6 · CVSS 6.5 · 2012-12-26 | 6.5 | 1.3% | 2012-12-26 |
| CVE-2022-0536Improper Removal of Sensitive Information Before Storage or Transfer in follow-redirects/follow-redirectsfollow-redirects · follow-redirects/follow-redirects · CVSS 2.6 · 2022-02-09 | 2.6 | 1.3% | 2022-02-09 |
| CVE-2020-26965Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field, revealing the typed password. If, when using a software ke…Mozilla · Firefox · 2020-12-09 | – | 1.3% | 2020-12-09 |
| CVE-2020-14301An information disclosure vulnerability was found in libvirt in versions before 6.3.0. HTTP cookies used to access network-based disks were saved in the XML dump of the guest doma…Redhat · libvirt · 2021-05-27 | – | 1.2% | 2021-05-27 |
| CVE-2021-31780In app/Model/MispObject.php in MISP 2.4.141, an incorrect sharing group association could lead to information disclosure on an event edit. When an object has a sharing group assoc…Misp-Project · Misp · 2021-04-23 | – | 1.2% | 2021-04-23 |
| CVE-2017-15113ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can change the log level and only administr…Red Hat · ovirt-engine · CVSS 7.2 · 2018-07-27 | 7.2 | 1.1% | 2018-07-27 |
| CVE-2023-45289Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/httpGo standard library · net/http · CVSS 4.3 · 2024-03-05 | 4.3 | 1.1% | 2024-03-05 |
| CVE-2020-11684AT91bootstrap before 3.9.2 does not properly wipe encryption and authentication keys from memory before passing control to a less privileged software component. This can be exploi…Linux4sam · At91bootstrap · 2020-09-14 | – | 1.1% | 2020-09-14 |
| CVE-2024-49997net: ethernet: lantiq_etop: fix memory disclosureLinux · Linux · 2024-10-21 | – | 1.1% | 2024-10-21 |
| CVE-2021-39891In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the end of impersonation which may lead to u…GitLab · GitLab · CVSS 5.9 · 2021-10-05 | 5.9 | 1.0% | 2021-10-05 |
| CVE-2022-25187Jenkins Support Core Plugin 2.79 and earlier does not redact some sensitive information in the support bundle.Jenkins project · Jenkins Support Core Plugin · 2022-02-15 | – | 1.0% | 2022-02-15 |
| CVE-2022-30618An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if content types accessible…Strapi · Strapi · 2022-05-19 | – | 1.0% | 2022-05-19 |
| CVE-2021-38554HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8.0 and pending 1.7.4 / 1.6.6…Hashicorp · Vault · 2021-08-13 | – | 0.9% | 2021-08-13 |
| CVE-2022-1893Improper Removal of Sensitive Information Before Storage or Transfer in polonel/trudeskpolonel · polonel/trudesk · CVSS 4.6 · 2022-05-31 | 4.6 | 0.8% | 2022-05-31 |
| CVE-2022-4734Improper Removal of Sensitive Information Before Storage or Transfer in usememos/memosusememos · usememos/memos · CVSS 8.1 · 2022-12-25 | 8.1 | 0.8% | 2022-12-25 |
| CVE-2023-28834Full path of data directory exposed to Nextcloud server usersnextcloud · security-advisories · CVSS 3.5 · 2023-04-03 | 3.5 | 0.8% | 2023-04-03 |
| CVE-2020-3874An issued existed in the naming of screenshots. The issue was corrected with improved naming. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. Screenshots of the Messages app…Apple · iOS · 2020-02-27 | – | 0.8% | 2020-02-27 |
| CVE-2022-22779Retained exploded messages in Keybase clients for macOS and WindowsZoom Video Communications Inc · Keybase Client for macOS · CVSS 3.7 · 2022-02-09 | 3.7 | 0.8% | 2022-02-09 |
| CVE-2026-62900.NET Information Disclosure VulnerabilityMicrosoft · .NET 10.0 runtime · CVSS 5.9 · 2026-08-11 | 5.9 | 0.7% | 2026-08-11 |
| CVE-2021-46813Vulnerability of residual files not being deleted after an update in the ChinaDRM module. Successful exploitation of this vulnerability may affect availability.Huawei · EMUI · 2022-06-13 | – | 0.7% | 2022-06-13 |
| CVE-2024-43554Windows Kernel-Mode Driver Information Disclosure VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 5.5 · 2024-10-08 | 5.5 | 0.6% | 2024-10-08 |
| CVE-2026-107291Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`pydantic · pydantic-ai · CVSS 2.3 · 2026-10-08 | 2.3 | 0.6% | 2026-10-08 |
| CVE-2018-5559In Rapid7 Komand version 0.41.0 and prior, certain endpoints that are able to list the always encrypted-at-rest connection data could return some configurations of connection data…Rapid7 · Komand · CVSS 3.4 · 2018-11-28 | 3.4 | 0.6% | 2018-11-28 |
| CVE-2024-8474OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, which an unauthorized actor can use to…OpenVPN · OpenVPN Connect · CVSS 7.5 · 2025-01-06 | 7.5 | 0.5% | 2025-01-06 |
| CVE-2024-31493An improper removal of sensitive information before storage or transfer vulnerability [CWE-212] in FortiSOAR version 7.3.0, version 7.2.2 and below, version 7.0.3 and below may al…Fortinet · FortiSOAR · CVSS 6 · 2024-06-03 | 6.0 | 0.5% | 2024-06-03 |
| CVE-2025-27221In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained…ruby-lang · URI · CVSS 3.2 · 2025-03-03 | 3.2 | 0.5% | 2025-03-03 |
| CVE-2024-6055Improper removal of sensitive information in data source export feature in Devolutions Remote Desktop Manager 2024.1.32.0 and earlier on Windows allows an attacker that obtains th…Devolutions · Remote Desktop Manager · CVSS 4.7 · 2024-06-17 | 4.7 | 0.5% | 2024-06-17 |
| CVE-2005-0406A design flaw in image processing software that modifies JPEG images might not modify the original EXIF thumbnail, which could lead to an information leak of potentially sensitive…Image Processing Project · Image Processing · 2005-02-16 | – | 0.5% | 2005-02-16 |
| CVE-2025-68131CBORDecoder reuse can leak shareable values across decode callsagronholm · cbor2 · CVSS 5.5 · 2025-12-31 | 5.5 | 0.5% | 2025-12-31 |
| CVE-2025-53886Directus doesn't redact tokens in Flow logsdirectus · directus · CVSS 4.5 · 2025-07-14 | 4.5 | 0.5% | 2025-07-14 |
| CVE-2026-16104Keycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only adminsRed Hat · Red Hat build of Keycloak 26.6 · CVSS 4.3 · 2026-07-17 | 4.3 | 0.5% | 2026-07-17 |
| CVE-2026-20928Windows Recovery Environment Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 4.6 · 2026-04-14 | 4.6 | 0.4% | 2026-04-14 |
| CVE-2020-8696Improper removal of sensitive information before storage or transfer in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via l…Intel · Intel(R) Processors · 2020-11-12 | – | 0.4% | 2020-11-12 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.