Weakness (CWE)
CWE-213: Exposure of Sensitive Information Due to Incompatible Policies
The product's intended functionality exposes
information to certain actors in accordance with the
developer's security policy, but this information is regarded
as sensitive according to the intended security policies of
other stakeholders such as the product's administrator,
users, or others whose information is being
processed.
How to prevent it (1 mitigation)
-
Requirements, Architecture and Design
When handling information, the developer must
consider whether the information is regarded as sensitive
by different stakeholders, such as users or administrators.
Each stakeholder effectively has its own intended security
policy that the product is expected to uphold.When a developer does not treat that information
as sensitive, this can introduce a vulnerability that
violates the expectations of the product's users.
Source: MITRE CWE-213
4 results · Clear filters · Feed
-
High 8.6
NATS has MQTT plaintext password disclosure
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating identity st…
-
High 7.1
Internal infrastructure data leak in EZD RP
Exposure of Sensitive Information vulnerability in Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy EZD RP allows logged-in user to retrieve information about IP infrastructure and credentials. This issue affects EZD RP all versions before …
-
High 7.5
Seeing the SMS Verification Code in Mia Technology's Mia-Med
Exposure of Sensitive Information Due to Incompatible Policies vulnerability in Mia Technology Inc. MİA-MED allows Collect Data as Provided by Users. This issue affects MİA-MED: before 1.0.7.
-
High 7.5
Avanquest Software RAD PDF (PDFEscape Online) 3.19.2.2 is vulnerable to Information Leak / Disclosure. The PDFEscape On…