CWE-1258
Exposure of Sensitive System Information Due to Uncleared Debug Information
Monthly
Sensitive data exposure in WPJAM Basic (WordPress plugin, versions ≤ 7.0.2.1) allows unauthenticated remote attackers to retrieve subscriber private information without credentials or user interaction. Classified under CWE-1258, the root cause is a failure to restrict access to private user data at the plugin level, exposing information that should be gated by authentication. No public exploit code has been identified at time of analysis, though the absence of any authentication or complexity barrier makes this straightforward to abuse once the vulnerable endpoint is known.
Sensitive data exposure in the JetBlog WordPress plugin (versions 2.4.8 and earlier) allows remote unauthenticated attackers to retrieve confidential information from affected sites over the network with no user interaction. The flaw is reported by Patchstack with a CVSS 3.1 base score of 7.5 (high confidentiality impact only). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided in the input.
Ubuntu Subiquity 24.04.4 leaks sensitive user credentials in crash report logs submitted to Launchpad during installation failures, potentially exposing plaintext Wi-Fi passwords and other credentials to unauthorized third parties. The vulnerability affects multiple Ubuntu versions (24.04.4, 25.04, and 25.10) and requires user interaction (submission of a crash report) but carries low real-world exploitation risk due to a CVSS score of 2.7 and absence of active exploitation signals. No public exploit code is known; vendor-released patches are available.
ubuntu-desktop-provision version 24.04.4 leaks user password hashes in crash report logs submitted to Launchpad during installation failures. An unauthenticated remote attacker can obtain sensitive credentials if a user opts to report the installation failure, requiring user interaction to trigger the vulnerability but resulting in direct exposure of authentication material. Patch available from Canonical via GitHub pull requests; EPSS and KEV status not actively exploited at time of analysis.
Dell Integrated Dell Remote Access Controller (iDRAC) versions 9, 14G (prior to 7.00.00.174), 15G, and 16G (prior to 7.10.90.00) contain an exposure of sensitive system information vulnerability caused by uncleared debug information in memory or logs. A remote attacker with high privileges can exploit this to disclose confidential system details without modifying or disrupting service availability. While the CVSS score is moderate at 4.9 due to high privilege requirements, the confidentiality impact is rated high, making this relevant for organizations where insider threats or compromised administrator accounts are a concern.
Dell PowerEdge Server BIOS and Dell iDRAC9, all versions, contains an Information Disclosure vulnerability. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Exposure of Sensitive System Information Due to Uncleared Debug Information vulnerability in 1clickmigration 1 Click WordPress Migration allows Retrieve Embedded Sensitive Data.2. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information exposure in the Linux kernel Hyper-V VMBus driver affects Confidential Computing (CoCo) guest VMs where a malicious hypervisor can force set_memory_encrypted()/set_memory_decrypted() to fail; the driver previously freed the still-shared (decrypted) pages back to the page allocator, potentially leaking confidential guest data to the untrusted host or causing memory corruption. The fix intentionally leaks (does not free) the affected pages when re-encryption fails, trading a small memory leak for guest confidentiality integrity. Fixed in stable kernel commits with no public exploit identified and no CISA KEV listing, though the assigned CVSS base score is 9.3 due to the confidential-computing trust boundary being crossed.
Memory-safety hardening gap in the Linux kernel's Hyper-V VMBus GPADL handling (Drivers: hv: vmbus) lets an untrusted hypervisor host force set_memory_encrypted()/set_memory_decrypted() to fail inside Confidential Computing (CoCo) guests, so decrypted (shared) pages can be returned to the page allocator on error. The fix adds a decrypted-status field to struct vmbus_gpadl so callers of vmbus_establish_gpadl()/vmbus_teardown_gpadl() can decide to free or deliberately leak affected pages. This is a defense-in-depth fix for the CoCo threat model rather than a conventional remotely exploitable flaw; no public exploit identified at time of analysis and EPSS is low (0.92%, 56th percentile).
Nextcloud/Cloud is a calendar app for Nextcloud. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Sensitive data exposure in WPJAM Basic (WordPress plugin, versions ≤ 7.0.2.1) allows unauthenticated remote attackers to retrieve subscriber private information without credentials or user interaction. Classified under CWE-1258, the root cause is a failure to restrict access to private user data at the plugin level, exposing information that should be gated by authentication. No public exploit code has been identified at time of analysis, though the absence of any authentication or complexity barrier makes this straightforward to abuse once the vulnerable endpoint is known.
Sensitive data exposure in the JetBlog WordPress plugin (versions 2.4.8 and earlier) allows remote unauthenticated attackers to retrieve confidential information from affected sites over the network with no user interaction. The flaw is reported by Patchstack with a CVSS 3.1 base score of 7.5 (high confidentiality impact only). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided in the input.
Ubuntu Subiquity 24.04.4 leaks sensitive user credentials in crash report logs submitted to Launchpad during installation failures, potentially exposing plaintext Wi-Fi passwords and other credentials to unauthorized third parties. The vulnerability affects multiple Ubuntu versions (24.04.4, 25.04, and 25.10) and requires user interaction (submission of a crash report) but carries low real-world exploitation risk due to a CVSS score of 2.7 and absence of active exploitation signals. No public exploit code is known; vendor-released patches are available.
ubuntu-desktop-provision version 24.04.4 leaks user password hashes in crash report logs submitted to Launchpad during installation failures. An unauthenticated remote attacker can obtain sensitive credentials if a user opts to report the installation failure, requiring user interaction to trigger the vulnerability but resulting in direct exposure of authentication material. Patch available from Canonical via GitHub pull requests; EPSS and KEV status not actively exploited at time of analysis.
Dell Integrated Dell Remote Access Controller (iDRAC) versions 9, 14G (prior to 7.00.00.174), 15G, and 16G (prior to 7.10.90.00) contain an exposure of sensitive system information vulnerability caused by uncleared debug information in memory or logs. A remote attacker with high privileges can exploit this to disclose confidential system details without modifying or disrupting service availability. While the CVSS score is moderate at 4.9 due to high privilege requirements, the confidentiality impact is rated high, making this relevant for organizations where insider threats or compromised administrator accounts are a concern.
Dell PowerEdge Server BIOS and Dell iDRAC9, all versions, contains an Information Disclosure vulnerability. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Exposure of Sensitive System Information Due to Uncleared Debug Information vulnerability in 1clickmigration 1 Click WordPress Migration allows Retrieve Embedded Sensitive Data.2. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information exposure in the Linux kernel Hyper-V VMBus driver affects Confidential Computing (CoCo) guest VMs where a malicious hypervisor can force set_memory_encrypted()/set_memory_decrypted() to fail; the driver previously freed the still-shared (decrypted) pages back to the page allocator, potentially leaking confidential guest data to the untrusted host or causing memory corruption. The fix intentionally leaks (does not free) the affected pages when re-encryption fails, trading a small memory leak for guest confidentiality integrity. Fixed in stable kernel commits with no public exploit identified and no CISA KEV listing, though the assigned CVSS base score is 9.3 due to the confidential-computing trust boundary being crossed.
Memory-safety hardening gap in the Linux kernel's Hyper-V VMBus GPADL handling (Drivers: hv: vmbus) lets an untrusted hypervisor host force set_memory_encrypted()/set_memory_decrypted() to fail inside Confidential Computing (CoCo) guests, so decrypted (shared) pages can be returned to the page allocator on error. The fix adds a decrypted-status field to struct vmbus_gpadl so callers of vmbus_establish_gpadl()/vmbus_teardown_gpadl() can decide to free or deliberately leak affected pages. This is a defense-in-depth fix for the CoCo threat model rather than a conventional remotely exploitable flaw; no public exploit identified at time of analysis and EPSS is low (0.92%, 56th percentile).
Nextcloud/Cloud is a calendar app for Nextcloud. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.