Weakness (CWE)
CWE-223: Omission of Security-relevant Information
The product does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is safe.
Source: MITRE CWE-223
12 results · Feed
-
Medium 5.3
MISP Access Log Entry Overwritten by Error Controller's Second beforeFilter Pass
Affected versions of MISP can record incorrect access-log data for requests that terminate in an exception. Because CakeErrorController extends AppController, exception rendering runs the application startup path a second time. As a result, __accessMonitor() …
-
Medium 4.6
MISP CLI Shell Audit Logs Lose User Identity and CLI Marker After First Lazy Model Load
Affected versions of MISP’s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging. The shell is designed to run actions as a supplied MISP user ID. However, the legacy SysLogLogable behavior stored that…
-
Low 3.3
Incorrect audit records for ptrace(2) syscall requests
When auditing a system call executed via ptrace(PT_SC_REMOTE), the kernel passed the return value of an internal setup function to AUDIT_SYSCALL_EXIT() rather than the actual result of the executed system call. As a result, committed audit records for system …
-
Medium 4.3
Omission of security-relevant information for some Intel(R) Software Guard Extensions Data Center Attestation Primitive…
-
Medium 4.8
Inspektor Gadget: Tracing Denial of Service via Event Flooding
Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. Prior to 0.50.1, in a situation where the ring-buffer of a gadget is – incidentally or maliciously – already full, th…
-
Low 2.7
spytrap-adb Omission of Security-relevant Information
In scan.rs in spytrap-adb before 0.3.5, matches for known stalkerware are not rendered in the interactive user interface.
-
Medium 4.3
matrix-sdk-crypto missing facility to signal rotation of a verified cryptographic identity
matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. Versions of the matrix-sdk-crypto Rust crate before 0.8.0 lack a dedicated mechanism to notify that a user's cryptographic identity has changed from a verified to an unverified on…
-
Critical 9.3
Denial of Service due to loss of information in DroneScout ds230 Remote ID receiver from BlueMark Innovations
DroneScout ds230 Remote ID receiver from BlueMark Innovations is affected by an information loss vulnerability through traffic injection. An attacker can exploit this vulnerability by injecting, on carefully selected channels, high power spoofed Open Drone ID…
-
Medium 4.7
Denial of Service due to loss of information in DroneScout ds230 Remote ID receiver from BlueMark Innovations
DroneScout ds230 Remote ID receiver from BlueMark Innovations is affected by an information loss vulnerability through traffic injection. An attacker can exploit this vulnerability by injecting, at the right times, spoofed Open Drone ID (ODID) messages which …
-
Medium 4.3
An omission of security-relevant information vulnerability exists in Brave desktop prior to version 1.48.171 when a use…
-
Low 2.2
In JetBrains TeamCity version before 2022.10, no audit items were added upon editing a user's settings
-
Medium 4.4
Dell EMC Powerscale OneFS 8.2.x - 9.2.x omit security-relevant information in /etc/master.passwd. A high-privileged use…