Inclusion of Sensitive Information in Source Code
CWE-540
The product (such as a web server or repository) provides access to source code is not intended to be accessible to users but contains sensitive information.
We track 13 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.2.
How this weakness is prevented
- Architecture and Design System Configuration: Recommendations include removing the script from the web server and moving it to a location not accessible from the Internet.
Latest Inclusion of Sensitive Information in Source Code vulnerabilities
- 7.5 High severity
GV-Eye: Cleartext Storage of Sensitive Information
An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.
- 7.5 High severity
GV-Eye: Cleartext Storage of Sensitive Information
API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.
- 7.5 High severity
Secure Connect Gateway (SCG) Policy Manager: Inclusion of Sensitive Information in Source Code
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of Sensitive Information in Source Code vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to
- 9.8 Critical severity
FortiMonitorOnSight: Inclusion of Sensitive Information in Source Code
A inclusion of sensitive information in source code vulnerability in Fortinet FortiMonitorOnSight 7.2.4 through 7.2.7, FortiMonitorOnSight 7.2.0 through 7.2.2 may allow attacker to improper access control via <insert attack vector here>
- 7.5 High severity
algernon: Generation of Error Message Containing Sensitive Information
Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is invoked with a single file path instead of a directory, singleFileMode is set to true and debugMode is forcibly enabled. debugMode activates the PrettyError renderer, whic
- 7.5 High severity
Home Flex: Inclusion of Sensitive Information in Source Code
ChargePoint Home Flex Inclusion of Sensitive Information in Source Code Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of ChargePoint Home Flex charging stations. Aut
- 9.8 Critical severity
Analytics Content Hub: Inclusion of Sensitive Information in Source Code
IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 is vulnerable to information exposure and further attacks due to an exposed JavaScript source map which could assist an attacker to read and debug JavaScript used in the application's API.
- 9.8 Critical severity
SICK Media Server: Inclusion of Sensitive Information in Source Code
Files in the source code contain login credentials for the admin user and the property configuration password, allowing an attacker to get full access to the application.
- 9.3 Critical severity
pmd: Exposure of Sensitive Information to an Unauthorized Actor
PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in jar published to Maven Central. The private key itself is not known to have been compromised itself, but given its passphr
- 7.5 High severity
QNAP AI Core: Exposure of Sensitive Information to an Unauthorized Actor
An exposure of sensitive information vulnerability has been reported to affect QNAP AI Core. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version
- 8.1 High severity
yunke_online_school_system: Inclusion of Sensitive Information in Source Code
A vulnerability was found in 云课网络科技有限公司 Yunke Online School System up to 1.5.5. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/educloud/videobind.html. The manipulation leads to inclusion of sensitive informatio
- 7.5 High severity
Cockpit Software: Inclusion of Sensitive Information in Source Code
Inclusion of Sensitive Information in Source Code vulnerability in TNB Mobile Solutions Cockpit Software allows Retrieve Embedded Sensitive Data. This issue affects Cockpit Software: before v0.251.1.
- 7.5 High severity
PHP-MYSQL-User-Login-System: Inclusion of Sensitive Information in Source Code
A vulnerability, which was classified as problematic, was found in keerti1924 PHP-MYSQL-User-Login-System 1.0. This affects an unknown part of the file login.sql. The manipulation leads to inclusion of sensitive information in source code. It is possible to in