Weakness (CWE)
CWE-540: Inclusion of Sensitive Information in Source Code
The product (such as a web server or repository) provides access to source code is not intended to be accessible to users but contains sensitive information.
How to prevent it (1 mitigation)
-
Architecture and Design, System Configuration
Recommendations include removing the script from the web server and moving it to a location not accessible from the Internet.
Source: MITRE CWE-540
12 results · Clear filters · Feed
-
High 7.5
WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default index page
WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default index page. WebDyne's wrapper scripts, such as webdyne.psgi, enable the built-in index page by default. Its source viewer re…
-
High 7.5
GV-Eye Relay Payment API Key Vulnerability
An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.
-
High 7.5
GV-Eye Hardcoded API Key Vulnerability
API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.
-
High 7.5
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of Sensitive Info…
-
High 7.5
Algernon: Single-file mode unconditionally enables debug mode
Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is invoked with a single file path instead of a directory, singleFileMode is set to true and debugMode is forcibly enabled. debugMode activates the PrettyError renderer, whi…
-
High 7.5
ChargePoint Home Flex Inclusion of Sensitive Information in Source Code Information Disclosure Vulnerability
ChargePoint Home Flex Inclusion of Sensitive Information in Source Code Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of ChargePoint Home Flex charging stations. Au…
-
High 7.5
Credential disclosure
Files in the source code contain login credentials for the admin user and the property configuration password, allowing an attacker to get full access to the application.
-
High 8.2
An issue in Loggrove v.1.0 allows a remote attacker to obtain sensitive information via the read.py component.
-
High 7.9
QNAP AI Core
An exposure of sensitive information vulnerability has been reported to affect QNAP AI Core. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following versio…
-
High 7.5
Information Disclosure to Source Code in TNB Mobile Solutions' Cockpit Software
Inclusion of Sensitive Information in Source Code vulnerability in TNB Mobile Solutions Cockpit Software allows Retrieve Embedded Sensitive Data. This issue affects Cockpit Software: before v0.251.1.
-
High 7.8
Dell Storage Integration Tools for VMware (DSITV) and Dell Storage vSphere Client Plugin (DSVCP) versions prior to 6.1.…
-
High 7.8
Inclusion of Sensitive Information in QSS
Inclusion of sensitive information in the source code has been reported to affect certain QNAP switches running QSS. If exploited, this vulnerability allows attackers to read application data. This issue affects: QNAP Systems Inc. QSS versions prior to 1.0.3 …