TYPE DE FAIBLESSE

CWE-359

26 CVE, des plus récentes aux plus anciennes. Définition MITRE de CWE-359 (en anglais) →

CVE-2026-21827Les installations HCL Connections sont sensibles à une faille qui permet à des utilisateurs non autorisés de consulter des informations confidentielles auxquelles ils ne devraient … 3.1 FAIBLE

CVE-2026-3911Les installations de Keycloak sont affectées par une faille qui permet à un utilisateur authentifié, disposant des permissions administratives « view-users », de voir des attributs… 2.7 FAIBLE

CVE-2026-0102Les navigateurs web utilisant des fonctionnalités de remplissage automatique sont concernés par cette faille. Un attaquant peut voler des informations personnelles enregistrées, te… 3.1 FAIBLE

CVE-2025-66605Yokogawa FAST/TOOLS (versions R9.01 à R10.04) présente une faille où certains champs de saisie web ont l'autocomplétion activée. Cela permet aux informations sensibles saisies dans… 2.1 FAIBLE

CVE-2025-11598Les utilisateurs de l'application iOS mObywatel pourraient voir leurs informations personnelles s'afficher dans la fenêtre miniaturisée du sélecteur d'applications, même après l'ex… 1.0 FAIBLE

CVE-2025-3950Les installations GitLab CE/EE (versions 10.3 à 18.7) sont affectées par une faille dans la protection du proxy d'actifs. Un utilisateur authentifié peut divulguer de petites quant… 3.5 FAIBLE

CVE-2025-5009In Gemini iOS, when a user shared a snippet of a conversation, it would share the entire conversation via a sharable public link that contained the entire conversation history and … 1.0 FAIBLE

CVE-2025-43357This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Sequoia 15.7, macOS Sonoma 1… 3.3 FAIBLE

CVE-2025-43301A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able… 3.3 FAIBLE

CVE-2025-51586An issue was discoverd in file controllers/admin/AdminLoginController.php in PrestaShop before 8.2.1 allowing attackers to gain sensitive information via the reset password feature… 3.7 FAIBLE

CVE-2025-53374Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated low-privileged account can ret… 1.3 FAIBLE

CVE-2025-49134Weblate is a web based localization tool. Prior to version 5.12, the audit log notifications included the full IP address of the acting user. This could be obtained by third-party … 2.1 FAIBLE

CVE-2024-42325Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc. 2.1 FAIBLE

CVE-2025-1939Android apps can load web pages using the Custom Tabs feature. This feature supports a transition animation that could have been used to trick a user into granting sensitive permis… 3.9 FAIBLE

CVE-2024-37533IBM InfoSphere Information Server 11.7 could disclose sensitive user information to another user with physical access to the machine. IBM X-Force ID: 294727. 2.4 FAIBLE

CVE-2024-23211A privacy issue was addressed with improved handling of user preferences. This issue is fixed in Safari 17.3, iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3, macOS Sonoma 1… 3.3 FAIBLE

CVE-2023-42830A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4. An app may be able to read … 3.3 FAIBLE

CVE-2023-34085When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request 2.6 FAIBLE

CVE-2023-1936An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16… 3.5 FAIBLE

CVE-2023-28303Windows Snipping Tool Information Disclosure Vulnerability 3.3 FAIBLE

CVE-2023-29203XWiki Commons are technical libraries common to several other top level XWiki projects. It's possible to list some users who are normally not viewable from subwiki by requesting us… 3.7 FAIBLE

CVE-2023-26041Nextcloud Talk is a fully on-premises audio/video and chat communication service. When cron jobs were misconfigured and therefore messages are not expired, the API would still retu… 2.6 FAIBLE

CVE-2022-46168Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta15 on the `beta` and `tests-passed` branches, recipients of … 3.5 FAIBLE

CVE-2022-35932Nextcloud Talk is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected conversations are susceptible to brute force at… 3.5 FAIBLE

CVE-2022-24890Nextcloud Talk is a video and audio conferencing app for Nextcloud. In versions prior to 13.0.5 and 14.0.0, a call moderator can indirectly enable user webcams by granting permissi… 2.4 FAIBLE

CVE-2022-24719Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Using `followRedirects` or `followRedirectsWith` with any of the redirection strategies built into fl… 2.6 FAIBLE