Weakness (CWE)
CWE-540: Inclusion of Sensitive Information in Source Code
Base Incomplete
The product (such as a web server or repository) provides access to source code is not intended to be accessible to users but contains sensitive information.
How to prevent it (1 mitigation)
-
Architecture and Design, System Configuration
Recommendations include removing the script from the web server and moving it to a location not accessible from the Internet.
Source: MITRE CWE-540
2 results · Clear filters · Feed
-
Critical 9.6
A inclusion of sensitive information in source code vulnerability in Fortinet FortiMonitorOnSight 7.2.4 through 7.2.7, …
-
Critical 9.3
PMD Designer's release key passphrase (GPG) available on Maven Central in cleartext
PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in jar published to Maven Central. The private key itself is not known to have been compromised itself, but given its passph…