CWE-1295.

Apache JSPWiki: Error Handling - Reveals Error Details

• Apache Software Foundation Apache JSPWiki
• CWE-1295

Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication

• Broken access control
• CWE-358

>=1.1.0, <1.2.0 · fixed in 1.2.0

UART Leaking Sensitive Data in dormakaba registration unit 9002

• dormakaba registration unit 9002
• CWE-1295

Fortinet FortiExtender: A debug messages revealing unnecessary information vulnerability in Fortinet…

• Fortinet FortiExtender
• CWE-1295

Google Chrome: Inappropriate implementation in Passkeys in Google Chrome prior to 140.0.7339.80 allowed…

• Google Chrome
• CWE-1295

Medical Informatics Engineering Enterprise Health includes session token in debug output

• Medical Informatics Engineering Enterprise Health
• CWE-1295

Detailed Error Response Vulnerability in Meon KYC solutions

• Meon KYC solutions
• CWE-1295

Debug Messages Revealing Unnecessary Information in GitLab

• GitLab
• CWE-1295

WordPress GTM Kit plugin <= 2.4.0 - Sensitive Data Exposure vulnerability

• TLA Media GTM Kit
• CWE-1295

Event-driven-ansible: exposure inventory passwords in plain text when starting a rulebook activation with verbosity set to debug in eda

• Red Hat Ansible Automation Platform 2.4 for RHEL 8
• Red Hat Ansible Automation Platform 2.4 for RHEL 9
• CWE-1295

In DA, there is a possible out of bounds read due to a missing bounds check.

• MediaTek, Inc. MT6739, MT6761, MT6765, MT6768, MT6771, MT6779, MT6781, MT6785, MT6833, MT6853, MT6873, MT6877, MT6885, MT6893, MT8167, MT8167S, MT8175, MT8185, MT8195, MT8321, MT8362A, MT8365, MT8385, MT8395, MT8666, MT8667, MT8673, MT8675, MT8678, MT8765, MT8766, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788, MT8789, MT8791T, MT8795T, MT8797, MT8798, MT8893
• CWE-1295

Oauth-server-container: oauth-server-container logs client secret in debug level

• Red Hat OpenShift Container Platform 4
• CWE-1295

Apache Airflow: Sensitive configuration values are not masked in the logs by default

• CWE-1295

<2.10.3 · fixed in 2.10.3

Aimeos HTML client may potentially reveal sensitive information in error log

• CWE-1295

>=2021.10.1, <2021.10.22 || >=2022.04.1, <2022.10.13 || >=2023.04.1, <2023.10.15 || >=2024.04.1, <2024.04.7 · fixed in 2021.10.22, 2022.10.13, 2023.10.15, 2024.04.7

Session disclosure inside the log files

• Toshiba Tec Corporation Toshiba Tec e-Studio multi-function peripheral (MFP)
• CWE-1295

Honeywell C300: C300 information leak due to an analysis feature which allows extracting more memory over…

• Honeywell C300
• CWE-1295

Dell BSAFE SSL-J: Dell BSAFE SSL-J, versions prior to 6.5…

• Dell BSAFE SSL-J
• CWE-1295

Advantech WebAccess Debug Messages Revealing Unnecessary Information

• Advantech WebAccess
• CWE-1295

Vaadin vulnerable to possible information disclosure of class and method names in RPC response

• Information disclosure
• CWE-1295

>=1.0.0, <1.0.21 || >=1.1.0, <2.9.3 || >=3.0.0, <9.1.2 || >=23.0.0, <23.3.13 || >=24.0.0, <24.0.9 || >=24.1.alpha1, <24.1.0 · fixed in 1.0.21, 2.9.3, 9.1.2, 23.3.13, 24.0.9, 24.1.0

QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances)

• QNAP Systems Inc. QTS
• QNAP Systems Inc. QuTS hero
• Memory corruption
• CWE-489

Dell BSAFE SSL-J: Dell BSAFE SSL-J, versions before 6.5 and version 7.0 contain a debug message revealing…

• Dell BSAFE SSL-J
• CWE-1295

An information disclosure vulnerability in Widevine TA log prior to SMR Oct-2021 Release 1 allows attackers to bypass the ASLR protection mechanism in TEE.

• Samsung Mobile Devices
• CWE-1295

Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19

• Information disclosure
• CWE-20

>=10.0.0, <10.0.19 || >=11.0.0, <14.6.2 || >=15.0.0, <19.0.9 · fixed in 10.0.19, 14.6.2, 19.0.9