CWE-212 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-212/ Sun, 26 Feb 2023 06:44:56 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png CWE-212 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-212/ 32 32 CVE-2018-1062 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-1062/ Sun, 26 Feb 2023 06:44:56 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-1062/ A vulnerability was discovered in oVirt 4.1.x before 4.1.9, where the combination of Enable Discard and Wipe After Delete flags for VM disks managed by oVirt, could cause a disk to be incompletely zeroed when removed from a VM. If the same storage blocks happen to be later allocated to a new disk attached to […]

The post CVE-2018-1062 appeared first on CVE Vulnerability.

]]> A vulnerability was discovered in oVirt 4.1.x before 4.1.9, where the combination of Enable Discard and Wipe After Delete flags for VM disks managed by oVirt, could cause a disk to be incompletely zeroed when removed from a VM. If the same storage blocks happen to be later allocated to a new disk attached to another VM, potentially sensitive data could be revealed to privileged users of that VM.

The post CVE-2018-1062 appeared first on CVE Vulnerability.

]]> CVE-2020-9780 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-9780/ Sun, 26 Feb 2023 06:43:53 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-9780/ The issue was resolved by clearing application previews when content is deleted. This issue is fixed in iOS 13.4 and iPadOS 13.4. A local user may be able to view deleted content in the app switcher.

The post CVE-2020-9780 appeared first on CVE Vulnerability.

]]> The issue was resolved by clearing application previews when content is deleted. This issue is fixed in iOS 13.4 and iPadOS 13.4. A local user may be able to view deleted content in the app switcher.

The post CVE-2020-9780 appeared first on CVE Vulnerability.

]]> CVE-2020-8696 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-8696/ Sun, 26 Feb 2023 06:43:29 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-8696/ Improper removal of sensitive information before storage or transfer in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

The post CVE-2020-8696 appeared first on CVE Vulnerability.

]]> Improper removal of sensitive information before storage or transfer in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

The post CVE-2020-8696 appeared first on CVE Vulnerability.

]]> CVE-2020-3874 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-3874/ Sun, 26 Feb 2023 06:41:49 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-3874/ An issued existed in the naming of screenshots. The issue was corrected with improved naming. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. Screenshots of the Messages app may reveal additional message content.

The post CVE-2020-3874 appeared first on CVE Vulnerability.

]]> An issued existed in the naming of screenshots. The issue was corrected with improved naming. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. Screenshots of the Messages app may reveal additional message content.

The post CVE-2020-3874 appeared first on CVE Vulnerability.

]]> CVE-2020-36476 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-36476/ Sun, 26 Feb 2023 06:41:40 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-36476/ An issue was discovered in Mbed TLS before 2.24.0 (and before 2.16.8 LTS and before 2.7.17 LTS). There is missing zeroization of plaintext buffers in mbedtls_ssl_read to erase unused application data from memory.

The post CVE-2020-36476 appeared first on CVE Vulnerability.

]]> An issue was discovered in Mbed TLS before 2.24.0 (and before 2.16.8 LTS and before 2.7.17 LTS). There is missing zeroization of plaintext buffers in mbedtls_ssl_read to erase unused application data from memory.

The post CVE-2020-36476 appeared first on CVE Vulnerability.

]]> CVE-2020-26965 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-26965/ Sun, 26 Feb 2023 06:40:11 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-26965/ Some websites have a feature “Show Password” where clicking a button will change a password field into a textbook field, revealing the typed password. If, when using a software keyboard that remembers user input, a user typed their password and used that feature, the type of the password field was changed, resulting in a keyboard […]

The post CVE-2020-26965 appeared first on CVE Vulnerability.

]]> Some websites have a feature “Show Password” where clicking a button will change a password field into a textbook field, revealing the typed password. If, when using a software keyboard that remembers user input, a user typed their password and used that feature, the type of the password field was changed, resulting in a keyboard layout change and the possibility for the software keyboard to remember the typed password. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.

The post CVE-2020-26965 appeared first on CVE Vulnerability.

]]> CVE-2020-25635 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-25635/ Sun, 26 Feb 2023 06:39:46 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-25635/ A flaw was found in Ansible Base when using the aws_ssm connection plugin as garbage collector is not happening after playbook run is completed. Files would remain in the bucket exposing the data. This issue affects directly data confidentiality.

The post CVE-2020-25635 appeared first on CVE Vulnerability.

]]> A flaw was found in Ansible Base when using the aws_ssm connection plugin as garbage collector is not happening after playbook run is completed. Files would remain in the bucket exposing the data. This issue affects directly data confidentiality.

The post CVE-2020-25635 appeared first on CVE Vulnerability.

]]> CVE-2020-1940 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-1940/ Sun, 26 Feb 2023 06:38:44 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-1940/ The optional initial password change and password expiration features present in Apache Jackrabbit Oak 1.2.0 to 1.22.0 are prone to a sensitive information disclosure vulnerability. The code mandates the changed password to be passed as an additional attribute to the credentials object but does not remove it upon processing during the first phase of the […]

The post CVE-2020-1940 appeared first on CVE Vulnerability.

]]> The optional initial password change and password expiration features present in Apache Jackrabbit Oak 1.2.0 to 1.22.0 are prone to a sensitive information disclosure vulnerability. The code mandates the changed password to be passed as an additional attribute to the credentials object but does not remove it upon processing during the first phase of the authentication. In combination with additional, independent authentication mechanisms, this may lead to the new password being disclosed.

The post CVE-2020-1940 appeared first on CVE Vulnerability.

]]> CVE-2020-15094 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-15094/ Sun, 26 Feb 2023 06:37:41 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-15094/ In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests. HttpCache uses internal headers like X-Body-Eval and X-Body-File to control the restoration of cached responses. The class was initially written with surrogate caching and ESI support in mind (all HTTP calls come […]

The post CVE-2020-15094 appeared first on CVE Vulnerability.

]]> In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests. HttpCache uses internal headers like X-Body-Eval and X-Body-File to control the restoration of cached responses. The class was initially written with surrogate caching and ESI support in mind (all HTTP calls come from a trusted backend in that scenario). But when used by CachingHttpClient and if an attacker can control the response for a request being made by the CachingHttpClient, remote code execution is possible. This has been fixed in versions 4.4.13 and 5.1.5.

The post CVE-2020-15094 appeared first on CVE Vulnerability.

]]> CVE-2020-15024 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-15024/ Sun, 26 Feb 2023 06:37:39 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-15024/ An issue was discovered in the Login Password feature of the Password Manager component in Avast Antivirus 20.1.5069.562. An entered password continues to be stored in Windows main memory after a logout, and after a Lock Vault operation.

The post CVE-2020-15024 appeared first on CVE Vulnerability.

]]> An issue was discovered in the Login Password feature of the Password Manager component in Avast Antivirus 20.1.5069.562. An entered password continues to be stored in Windows main memory after a logout, and after a Lock Vault operation.

The post CVE-2020-15024 appeared first on CVE Vulnerability.

]]>