CWE-402.

Myhoard logs backup encryption key in plain text

• Aiven-Open myhoard
• CWE-402

Due to a firewall misconfiguration, Kerlink devices running KerOS prior to 5.12 incorrectly accept specially crafted UDP packets.

• CWE-402
• CWE-940

trytond allows remote attackers to obtain sensitive trace-back (server setup) information

• CWE-402

<6.0.70 || >=7.0.0, <7.0.40 || >=7.1.0, <7.4.21 || >=7.5.0, <7.6.11 · fixed in 6.0.70, 7.0.40, 7.4.21, 7.6.11

StarDict: The YouDao plugin for StarDict, as used in stardict 3.0.7+git20220909+dfsg-6 in Debian…

• StarDict
• CWE-402

Plesk Obsidian: In Plesk Obsidian 18.0.69, unauthenticated requests to /login_up.php can reveal an AWS…

• Plesk Obsidian
• CWE-402

OneLogin Active Directory Connector: In One Identity OneLogin Active Directory Connector before 6.1.5…

• OneLogin Active Directory Connector
• CWE-402

Django-Select2 Vulnerable to Widget Instance Secret Cache Key Leaking

• Server-side request forgery (SSRF)
• CWE-402

<8.4.1 · fixed in 8.4.1

In Zammad 6.4.x before 6.4.2, there is information exposure.

• Zammad
• CWE-402

XWiki allows unregistered users to access private pages information through REST endpoint

• CWE-402

>=1.9M1, <15.10.14 || >=16.0.0-rc-1, <16.4.6 || >=16.5.0-rc-1, <16.10.0-rc-1 · fixed in 15.10.14, 16.4.6, 16.10.0-rc-1

Transmission of Private Resources into a New Sphere in Crafter Engine

• CrafterCMS
• CWE-402

Ruijie Reyee OS Resource Leak

• Ruijie Reyee OS
• CWE-402

@electron/packager's build process memory potentially leaked into final executable

• CWE-402

>=18.3.0, <18.3.1 · fixed in 18.3.1

Kernel: blkio memory leakage due to blkcg and some blkgs are not freed after they are made offline.

• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9.2 Extended Update Support
• CWE-402

Instack-undercloud: rsync leaks information to undercloud

• Red Hat OpenStack Platform 13.0 - ELS
• Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS
• CWE-402

Kernel: information leak in nft_set_catchall_flush in net/netfilter/nf_tables_api.c

• Kernel
• Red Hat Enterprise Linux 6
• CWE-402

Obfuscated email addresses should not be sorted

• CWE-402

>=3.5-milestone-1, <14.10.9 || >=15.0, <15.3-rc-1 · fixed in 14.10.9, 15.3-rc-1

XWiki Platform may retrieve email addresses of all users

• Information disclosure
• CWE-402

>=3.5-milestone-1, <14.4.8 || >=14.5, <14.10.4 · fixed in 14.4.8, 14.10.4

A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6).

• Siemens SICAM GridEdge (Classic)
• CWE-402

Exposure of Resource to Wrong Sphere in org.craftercms:crafter-search

• Information disclosure
• CWE-402

>=3.1.0, <3.1.15 · fixed in 3.1.15

Transmission of Private Resources into a New Sphere ('Resource Leak') in Crafter Engine

• Crafter Software Crafter CMS
• CWE-402

Project sources exposure in Vaadin Designer

• Vaadin Designer
• CWE-402

OSGi applications using Vaadin 12-14 and 19 vulnerable to server classes and resources exposure

• Information disclosure
• CWE-402

>=1.2.0, <2.4.8 || >=6.0.0, <6.0.1 · fixed in 2.4.8, 6.0.1

Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19

• CWE-402

>=12.0.0, <14.4.10 || >=19.0.0, <19.0.1 · fixed in 14.4.10, 19.0.1

Elasticsearch X-Pack Security: Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled…

• Elasticsearch X-Pack Security
• CWE-402