# CWE-598.

Every Advisory and CVE whose sources give the weakness CWE-598, newest first.

## Records, newest first (an older page)

- [Sensitive Data in URL](https://agentprime.io/advisories/CVE-2025-49188.md)
  `CVE-2025-49188` · CVE record: SICK AG SICK Field Analytics · CVSS 5.3 Medium · Not analysed yet · Published 12 Jun 2025 · Tags: CWE-598
- [Use of GET Request Method With sensitive Query Strings](https://agentprime.io/advisories/CVE-2025-3943.md)
  `CVE-2025-3943` · CVE record: Tridium Niagara Framework and 1 more · CVSS 4.1 Medium · EPSS 0.11 · Not analysed yet · Published 22 May 2025 · Tags: CWE-598
- [Sensitive information submitted using GET method](https://agentprime.io/advisories/CVE-2024-9877.md)
  `CVE-2024-9877` · CVE record: ABB ANC and 2 more · CVSS 5.3 Medium · Not analysed yet · Published 30 Apr 2025 · Tags: CWE-598
- [Moodle's mod_data edit/delete pages pass CSRF token in GET parameter](https://agentprime.io/advisories/GHSA-9vc3-vm42-fjhm.md)
  `GHSA-9vc3-vm42-fjhm`, `BIT-moodle-2025-3637`, `CVE-2025-3637`, `PKSA-fvfh-pt1s-3tmx` · Packagist `moodle/moodle`: affected `<4.3.12 || >=4.3.0-beta, <4.3.12 || >=4.4.0-beta, <4.4.8 || >=4.5.0-beta, <4.5.4`, fixed in `4.3.12`, `4.4.8`, `4.5.4` · CVSS 3.1 Low · Not analysed yet · Published 25 Apr 2025 · Tags: CWE-598
- [Weblate is a web based localization tool. Prior to version 5.11, when creating a new component from an existing component that has a source code repository URL specified in settings, this URL is in...](https://agentprime.io/advisories/GHSA-m67m-3p5g-cw9j.md)
  `GHSA-m67m-3p5g-cw9j`, `CVE-2025-32021`, `PYSEC-2025-35` · PyPI `weblate`: affected `<5.11`, fixed in `5.11` · CVSS 2.2 Low · Not analysed yet · Published 15 Apr 2025 · Tags: CWE-598
- [In JotUrl 2.0, passwords are sent via HTTP GET-type requests, potentially exposing credentials to eavesdropping or insecure records.](https://agentprime.io/advisories/CVE-2025-24948.md)
  `CVE-2025-24948` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 15 Apr 2025 · Tags: CWE-598
- [BlackVue App API deviceDelete get request method with sensitive query strings](https://agentprime.io/advisories/CVE-2025-2356.md)
  `CVE-2025-2356` · CVE record: BlackVue App · CVSS 6.3 Medium · Not analysed yet · Published 17 Mar 2025 · Tags: CWE-598
- [Maharashtra State Electricity Distribution Company Limited Mahavitran IOS Application 16.1 application till version 16.1 communicates using the GET method to process requests that contain sensitive i…](https://agentprime.io/advisories/CVE-2021-41719.md)
  `CVE-2021-41719` · CVE record · CVSS 7.5 High · Not analysed yet · Published 4 Mar 2025 · Tags: CWE-598
- [Multiple vulnerabilities in Trivision Camera NC227WF](https://agentprime.io/advisories/CVE-2025-1738.md)
  `CVE-2025-1738` · CVE record: Trivision Camera NC227WF · CVSS 6.2 Medium · Not analysed yet · Published 27 Feb 2025 · Tags: CWE-598
- [Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection.](https://agentprime.io/advisories/CVE-2025-26058.md)
  `CVE-2025-26058` · CVE record · CVSS 4.2 Medium · Not analysed yet · Published 18 Feb 2025 · Tags: CWE-598
- [Outback Power Mojave Inverter Use of GET Request Method With Sensitive Query Strings](https://agentprime.io/advisories/CVE-2025-26473.md)
  `CVE-2025-26473` · CVE record: Outback Power Mojave Inverter · CVSS 8.7 High · Not analysed yet · Published 13 Feb 2025 · Tags: CWE-598
- [Zettler 130.8005: A CWE-598 “Use of GET Request Method with Sensitive Query Strings” was discovered…](https://agentprime.io/advisories/CVE-2024-12012.md)
  `CVE-2024-12012` · CVE record: Zettler 130.8005 · CVSS 5.7 Medium · Not analysed yet · Published 13 Feb 2025 · Tags: CWE-598
- [TP-Link TL-SG108E HTTP GET Request usr_account_set.cgi get request method with sensitive query strings](https://agentprime.io/advisories/CVE-2025-0730.md)
  `CVE-2025-0730` · CVE record: TP-Link TL-SG108E · CVSS 6.3 Medium · Not analysed yet · Published 27 Jan 2025 · Tags: CWE-598
- [An issue was discovered in Optimizely Configured Commerce before 5.2.2408.](https://agentprime.io/advisories/CVE-2025-22387.md)
  `CVE-2025-22387` · CVE record · CVSS 7.5 High · Not analysed yet · Published 4 Jan 2025 · Tags: CWE-598
- [IBM TXSeries for Multiplatforms information disclosure](https://agentprime.io/advisories/CVE-2024-41738.md)
  `CVE-2024-41738` · CVE record: IBM TXSeries for Multiplatforms · CVSS 5.9 Medium · Not analysed yet · Published 1 Nov 2024 · Tags: CWE-598
- [CSRF token leaked in URL parameters](https://agentprime.io/advisories/CVE-2024-38863.md)
  `CVE-2024-38863` · CVE record: Checkmk GmbH Checkmk · CVSS 2.0 Low · Not analysed yet · Published 14 Oct 2024 · Tags: CWE-598
- [exacqVison - Token Disclosed in URL](https://agentprime.io/advisories/CVE-2024-32931.md)
  `CVE-2024-32931` · CVE record: Johnson Controls exacqVision · CVSS 5.7 Medium · Not analysed yet · Published 1 Aug 2024 · Tags: CWE-598
- [IBM InfoSphere Information Server information disclosure](https://agentprime.io/advisories/CVE-2023-50954.md)
  `CVE-2023-50954` · CVE record: IBM InfoSphere Information Server · CVSS 4.3 Medium · Not analysed yet · Published 30 Jun 2024 · Tags: CWE-598
- [An issue was discovered on HMS Anybus X-Gateway AB7832-F 3 devices.](https://agentprime.io/advisories/CVE-2024-23766.md)
  `CVE-2024-23766` · CVE record · CVSS 7.5 High · Not analysed yet · Published 26 Jun 2024 · Tags: CWE-598
- [dectalk-tts Uses Unencrypted HTTP Request](https://agentprime.io/advisories/GHSA-6cf6-8hvr-r68w.md)
  `GHSA-6cf6-8hvr-r68w`, `CVE-2024-31206` · npm `dectalk-tts`: affected `>=1.0.0, <1.0.1`, fixed in `1.0.1` · CVSS 8.2 High · Not analysed yet · Published 4 Apr 2024 · Tags: Weak cryptography or TLS, CWE-300, CWE-598
- [Rapid7 InsightVM Sensitive Information Exposure via URL](https://agentprime.io/advisories/CVE-2024-2745.md)
  `CVE-2024-2745` · CVE record: Rapid7 InsightVM · CVSS 3.3 Low · Not analysed yet · Published 2 Apr 2024 · Tags: CWE-598
- [IBM Maximo Application Suite information disclosure](https://agentprime.io/advisories/CVE-2023-32335.md)
  `CVE-2023-32335` · CVE record: IBM Maximo Application Suite and 1 more · CVSS 3.7 Low · Not analysed yet · Published 13 Mar 2024 · Tags: CWE-598
- [Session Token in URL in directus](https://agentprime.io/advisories/GHSA-2ccr-g2rv-h677.md)
  `GHSA-2ccr-g2rv-h677`, `CVE-2024-28238` · npm `directus`: affected `<10.10.0`, fixed in `10.10.0` · CVSS 2.3 Low · Not analysed yet · Published 12 Mar 2024 · Tags: Information disclosure, CWE-598
- [HCL Sametime is impacted by a sensitive information disclosure](https://agentprime.io/advisories/CVE-2023-45716.md)
  `CVE-2023-45716` · CVE record: HCL Software HCL Sametime · CVSS 1.7 Low · Not analysed yet · Published 9 Feb 2024 · Tags: CWE-598
- [IBM PowerSC information disclosure](https://agentprime.io/advisories/CVE-2023-50328.md)
  `CVE-2023-50328` · CVE record: IBM PowerSC · CVSS 3.7 Low · Not analysed yet · Published 2 Feb 2024 · Tags: CWE-598
- [Backup password in GET parameter](https://agentprime.io/advisories/CVE-2023-6287.md)
  `CVE-2023-6287` · CVE record: Checkmk GmbH Checkmk Appliance · CVSS 3.3 Low · Not analysed yet · Published 27 Nov 2023 · Tags: CWE-598
- [Ray Missing Authorization vulnerability](https://agentprime.io/advisories/GHSA-6cxr-8q3m-jwrr.md)
  `GHSA-6cxr-8q3m-jwrr`, `CVE-2023-6020`, `PYSEC-2026-516` · PyPI `ray`: affected `<2.8.1`, fixed in `2.8.1` · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.15 · Not analysed yet · Published 16 Nov 2023 · Tags: Broken access control, CWE-598
- [Fortinet FortiOS: A use of GET request method with sensitive query strings vulnerability in Fortinet…](https://agentprime.io/advisories/CVE-2023-37935.md)
  `CVE-2023-37935` · CVE record: Fortinet FortiOS · CVSS 6.5 Medium · Not analysed yet · Published 10 Oct 2023 · Tags: CWE-598
- [NVIDIA Omniverse Workstation Launcher: NVIDIA Omniverse Workstation Launcher for Windows and Linux contains a vulnerability in…](https://agentprime.io/advisories/CVE-2023-25524.md)
  `CVE-2023-25524` · CVE record: NVIDIA Omniverse Workstation Launcher · CVSS 4.0 Medium · Not analysed yet · Published 3 Aug 2023 · Tags: CWE-598
- [Site-Passwords in GET parameters](https://agentprime.io/advisories/CVE-2023-22307.md)
  `CVE-2023-22307` · CVE record: Tribe29 Checkmk Appliance · CVSS 5.5 Medium · Not analysed yet · Published 18 Apr 2023 · Tags: Information disclosure, CWE-598
- [Dell PowerPath Management Appliance: PowerPath Management Appliance with versions 3.3, 3.2\*…](https://agentprime.io/advisories/CVE-2022-34452.md)
  `CVE-2022-34452` · CVE record: Dell PowerPath Management Appliance · CVSS 2.7 Low · Not analysed yet · Published 10 Feb 2023 · Tags: CWE-598
- [Dell EMC CloudLink 7.1.3 and all earlier versions, Auth Token is exposed in GET requests.](https://agentprime.io/advisories/CVE-2022-24414.md)
  `CVE-2022-24414` · CVE record: Dell CloudLink · CVSS 7.6 High · Not analysed yet · Published 26 May 2022 · Tags: CWE-598
- [GTA URLs issued by LMM WEB API may leak information](https://agentprime.io/advisories/CVE-2022-25787.md)
  `CVE-2022-25787` · CVE record: Secomea GateManager · CVSS 7.5 High · Not analysed yet · Published 4 May 2022 · Tags: CWE-598
- [DELL EMC AppSync versions 3.9 to 4.3 use GET request method with sensitive query strings.](https://agentprime.io/advisories/CVE-2022-22551.md)
  `CVE-2022-22551` · CVE record: Dell AppSync · CVSS 8.3 High · Not analysed yet · Published 21 Jan 2022 · Tags: CWE-598
- [Dell EMC Streaming Data Platform versions before 1.3 contain a SQL Injection Vulnerability.](https://agentprime.io/advisories/CVE-2021-36328.md)
  `CVE-2021-36328` · CVE record: Dell Dell EMC Streaming Data Platform · CVSS 8.8 High · Not analysed yet · Published 30 Nov 2021 · Tags: CWE-598
- [Dell PowerScale OneFS: Dell PowerScale OneFS versions 8.2.2…](https://agentprime.io/advisories/CVE-2021-21594.md)
  `CVE-2021-21594` · CVE record: Dell PowerScale OneFS · CVSS 8.2 High · Not analysed yet · Published 16 Aug 2021 · Tags: CWE-598
- [RSA Archer, versions prior to 6.7 P3 (6.7.0.3), contain an information exposure vulnerability.](https://agentprime.io/advisories/CVE-2020-5331.md)
  `CVE-2020-5331` · CVE record: Dell RSA Archer · CVSS 8.8 High · Not analysed yet · Published 4 May 2020 · Tags: CWE-598
- [The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a Session Fixation vulnerability.](https://agentprime.io/advisories/CVE-2019-18573.md)
  `CVE-2019-18573` · CVE record: Dell RSA Identity Governance & Lifecycle · CVSS 8.7 High · Not analysed yet · Published 18 Dec 2019 · Tags: CWE-598
- [Kunbus PR100088 Modbus gateway: An attacker could retrieve passwords from a HTTP GET request from the Kunbus PR100088…](https://agentprime.io/advisories/CVE-2019-6531.md)
  `CVE-2019-6531` · CVE record: Kunbus PR100088 Modbus gateway · No CVSS score · Not analysed yet · Published 2 Apr 2019 · Tags: CWE-598
- [Entes EMG12: Entes EMG12 versions 2.57 and prior an information exposure through query strings…](https://agentprime.io/advisories/CVE-2018-14822.md)
  `CVE-2018-14822` · CVE record: Entes EMG12 · No CVSS score · Not analysed yet · Published 2 Oct 2018 · Tags: CWE-598
- [An Information Exposure Through Query Strings in GET Request issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches.](https://agentprime.io/advisories/CVE-2018-5467.md)
  `CVE-2018-5467` · CVE record: Hirschmann Automation and Control GmbH Classic Platform Switches · No CVSS score · Not analysed yet · Published 6 Mar 2018 · Tags: CWE-598
- [Novell Identity Manager User Application get request url contains the session token.](https://agentprime.io/advisories/CVE-2017-9280.md)
  `CVE-2017-9280` · CVE record: NetIQ Identity Manager Applications · CVSS 4.3 Medium · Not analysed yet · Published 2 Mar 2018 · Tags: CWE-598
- [ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC have a web application that uses the GET method to process requests that contain sensitive information such…](https://agentprime.io/advisories/CVE-2017-3185.md)
  `CVE-2017-3185` · CVE record: ACTi Corporation ACTi D, B, I, and E series cameras · No CVSS score · Not analysed yet · Published 15 Dec 2017 · Tags: CWE-598
- [Elastic Kibana X-Pack Security: In Kibana X-Pack security versions prior to 5.4.3 if a Kibana user opens a crafted Kibana…](https://agentprime.io/advisories/CVE-2017-8443.md)
  `CVE-2017-8443` · CVE record: Elastic Kibana X-Pack Security · No CVSS score · Not analysed yet · Published 30 Jun 2017 · Tags: CWE-598

Newest: <https://agentprime.io/advisories/tag/cwe-598.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-598&cursor=WyIyMDI1LTA3LTA4VDEwOjM1OjAyLjA5NTAwMFoiLCJDVkUtMjAyNS00MDc0MiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-598/?cursor=WyIyMDI1LTA3LTA4VDEwOjM1OjAyLjA5NTAwMFoiLCJDVkUtMjAyNS00MDc0MiJd>. Everything for agents: <https://agentprime.io/llms.txt>.