Skip to content
OpenAdvisories

Weakness (CWE)

CWE-214: Invocation of Process Using Visible Sensitive Information

Base Incomplete

A process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system.

Source: MITRE CWE-214

All Critical High Medium Low Exploited only Public exploit

46 results · Feed

  • Medium 4.4
    CVE-2021-32638

    CodeQL runner: Command-line options that make GitHub access tokens visible to other processes are now deprecated

    Github's CodeQL action is provided to run CodeQL-based code scanning on non-GitHub CI/CD systems and requires a GitHub access token to connect to a GitHub repository. The runner and its documentation previously suggested passing the GitHub token as a command-…

    GitHub codeql-action
  • Unscored —
    CVE-2020-5422

    UAA password may appear in BOSH System Metrics Server process arguments

    BOSH System Metrics Server releases prior to 0.1.0 exposed the UAA password as a flag to a process running on the BOSH director. It exposed the password to any user or process with access to the same VM (through ps or looking at process details).

    Cloud Foundry BOSH System Metrics Server
  • Medium 5.0
    CVE-2020-1753

    Insertion of Sensitive Information into Log File, Invocation of Process Using Visible Sensitive Information, and Exposure of Sensitive Information to an Unauthorized Actor in Ansible

    A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters such as pass…

    Red Hat Ansible ansible ansible Debian Ubuntu PyPI
  • High 7.2
    CVE-2019-3869

    When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs vi…

    Red Hat Tower
  • Low 3.4
    CVE-2018-17957

    yast2-rmt leaks database passwords in process list

    The YaST2 RMT module for configuring the SUSE Repository Mirroring Tool (RMT) before 1.1.2 exposed MySQL database passwords on process commandline, allowing local attackers to access or corrupt the RMT database.

    SUSE yast2-rmt
  • High 7.8
    CVE-2018-16837

    Ansible Leaks Data Passed to ssh-keygen

    Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen executable. Showing those credentials in clear text form f…

    [UNKNOWN] ansible ansible ansible Debian Ubuntu Alpine PyPI