Exposure of Private Personal Information to an Unauthorized Actor
CWE-359
The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.
We track 56 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.6.
How this weakness is prevented
- Requirements: Identify and consult all relevant regulations for personal privacy. An organization may be required to comply with certain federal and state regulations, depending on its location, the type of business it conducts, and the nature of any private data it handles. Regulations may include Safe Harbor Privacy Framework, Gramm-Leach Bliley Act (GLBA), Health Insurance Portability and Accountability Act (HIPAA), General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and others.
Latest Exposure of Private Personal Information to an Unauthorized Actor vulnerabilities
- 7.5 High severity
USB-C Blood Glucose Monitoring System Starter…: Exposure of Private Personal Information to an Unauthorized Actor
An attacker could expose cross-user personal identifiable information (PII) and personal health information transmitted to the Android device via the Dario Health application database.
- 7.1 High severity
updatecli: Exposure of Private Personal Information to an Unauthorized Actor
Updatecli is a tool used to apply file update strategies. Prior to version 0.93.0, private maven repository credentials may be leaked in application logs in case of unsuccessful retrieval operation. During the execution of an updatecli pipeline which contains
- 9.1 Critical severity
discourse: Exposure of Private Personal Information to an Unauthorized Actor
Discourse is an open source platform for community discussion. Sites that are using discourse connect but still have local logins enabled could allow attackers to bypass discourse connect to create accounts and login. This problem is patched in the latest vers
- 7.5 High severity
Reyee OS: Exposure of Private Personal Information to an Unauthorized Actor
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a a feature that could enable sub accounts or attackers to view and exfiltrate sensitive information from all cloud accounts registered to Ruijie's services
- 7.5 High severity
themesettings: Exposure of Private Personal Information to an Unauthorized Actor
In the module "Theme settings" (pk_themesettings) <= 1.8.8 from Promokit.eu for PrestaShop, a guest can download all email collected while SHOP is in maintenance mode. Due to a lack of permissions control, a guest can access the txt file which collect email wh
- 7.5 High severity
loginascustomerpro: Exposure of Private Personal Information to an Unauthorized Actor
In the module "Login as customer PRO" (loginascustomerpro) <1.2.7 from Weblir for PrestaShop, a guest can access direct link to connect to each customer account of the Shop if the module is not installed OR if a secret accessible to administrator is stolen.
- 7.6 High severity
foundation_app: Exposure of Private Personal Information to an Unauthorized Actor
An issue in Foundation.app Foundation platform 1.0 allows a remote attacker to obtain sensitive information via the Web3 authentication process of Foundation, the signed message lacks a nonce (random number)
- 7.5 High severity
Molongui Authorship – Author Boxes, Guest…: Exposure of Resource to Wrong Sphere
The Author Box, Guest Author and Co-Authors for Your Posts – Molongui plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.7.4 via the 'ma_debu' parameter. This makes it possible for unauthenticated attac
- 7.5 High severity
xwiki-platform: Cleartext Storage of Sensitive Information
XWiki Platform is a generic wiki platform. Starting in 7.2-milestone-2 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the password hashes of all users to anyone with view right on the respective user profiles. B
- 7.5 High severity
Pharmacy Automation: Exposure of Private Personal Information to an Unauthorized Actor
Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Botanik Software Pharmacy Automation allows Retrieve Embedded Sensitive Data. This issue affects Pharmacy Automation: before 2.1.133.0.
- 7.5 High severity
Acronis Cyber Protect 15: Exposure of Private Personal Information to an Unauthorized Actor
Sensitive information disclosure due to spell-jacking. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 35979.
- 7.5 High severity
xwiki-platform: Exposure of Resource to Wrong Sphere
XWiki Platform is a generic wiki platform. Starting in version 7.3-milestone-1 and prior to versions 14.4.8, 14.10.6, and 15.1, ny user can call a REST endpoint and obtain the obfuscated passwords, even when the mail obfuscation is activated. The issue has bee
- 7.5 High severity
Competition Management System: Exposure of Resource to Wrong Sphere
Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Finex Media Competition Management System allows Retrieve Embedded Sensitive Data, Collect Data as Provided by Users. This issue affects Competition Management System: before 23
- 7.5 High severity
xwiki-platform: Exposure of Private Personal Information to an Unauthorized Actor
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The `modifications` rest endpoint does not filter out entries according to the user's rights. Therefore, information hidden from unauthorized users are exp
- 7.5 High severity
xwiki-platform: Missing Authorization
XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. Through the suggestion feature, string and list properties of objects the user shouldn't have access to can be accessed in versions prior to 13.10.4 and 14.2. This includes
- 8.8 High severity
notrinos/notrinoserp: Exposure of Private Personal Information to an Unauthorized Actor
Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository notrinos/notrinoserp prior to v0.7. This results in privilege escalation to a system administrator account. An attacker can gain access to protected functionality such as cr