Weakness (CWE)
CWE-1258: Exposure of Sensitive System Information Due to Uncleared Debug Information
The hardware product enters debug mode but does not fully clear security-sensitive values, such as keys and intermediate values in cryptographic operations.
More detail
Security sensitive values, keys, intermediate steps of cryptographic operations, etc. are stored in temporary registers in the hardware.
How to prevent it (1 mitigation)
-
Architecture and Design
Whenever debug mode is enabled, all registers containing sensitive assets must be cleared.
Source: MITRE CWE-1258
16 results · Feed
-
Medium 4.1
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause exposure of sensitive…
-
Low 3.3
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains…
-
Low 2.4
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains…
-
High 7.5
WordPress WPJAM Basic plugin <= 7.0.2.1 - Sensitive Data Exposure vulnerability
Subscriber Sensitive Data Exposure in WPJAM Basic <= 7.0.2.1 versions.
-
High 7.5
WordPress JetBlog plugin <= 2.4.8 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in JetBlog <= 2.4.8 versions.
-
Low 2.7
Senstive information disclosure was affecting subiquity
In Ubuntu, Subiquity version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, Subiquity could include certain user credentials, such as the user's plaintext Wi-Fi p…
-
Low 2.7
Senstive information disclosure was affecting ubuntu-desktop-provision
In Ubuntu, ubuntu-desktop-provision version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, ubuntu-desktop-provision could include the user's password hash in the …
-
Medium 4.9
Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.174, 15G and 16G versions prior to 7.10.…
-
Medium 4.9
Dell PowerEdge Server BIOS and Dell iDRAC9, all versions, contains an Information Disclosure vulnerability. A high priv…
-
Medium 5.3
WordPress 1 Click WordPress Migration plugin <= 2.5.7 - Sensitive Data Exposure vulnerability
Exposure of Sensitive System Information Due to Uncleared Debug Information vulnerability in 1clickmigration 1 Click WordPress Migration 1-click-migration allows Retrieve Embedded Sensitive Data.This issue affects 1 Click WordPress Migration: from n/a through…
-
Critical 9.3
Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an…
-
Critical 9.6
Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an erro…
-
Low 3.5
Calendar app returns full stacktrace when an error happens while editing appointment
Nextcloud/Cloud is a calendar app for Nextcloud. An attacker can gain access to stacktrace and internal paths of the server when generating an exception while editing a calendar appointment. It is recommended that the Nextcloud Calendar app is upgraded to 4.5…
-
Low 3.3
Exposure of sensitive system information due to uncleared debug information for some Intel Unison software may allow an…
-
High 7.5
Exposure of sensitive Slack webhook URLs in debug logs and traces
Slack Morphism is a modern client library for Slack Web/Events API/Socket Mode and Block Kit. Debug logs expose sensitive URLs for Slack webhooks that contain private information. The problem is fixed in version 1.3.2 which redacts sensitive URLs for webhooks…
-
High 7.5
Slack Morphism for Rust before 0.41.0 can accidentally leak Slack OAuth client information in application debug logs
Slack Morphism is an async client library for Rust. Prior to 0.41.0, it was possible for Slack OAuth client information to leak in application debug logs. Stricter and more secure debug formatting was introduced in v0.41.0 for OAuth secret types to reduce the…