CWE-1258
Exposure of Sensitive System Information Due to Uncleared Debug Information
Monthly
Sensitive data exposure in WPJAM Basic (WordPress plugin, versions ≤ 7.0.2.1) allows unauthenticated remote attackers to retrieve subscriber private information without credentials or user interaction. Classified under CWE-1258, the root cause is a failure to restrict access to private user data at the plugin level, exposing information that should be gated by authentication. No public exploit code has been identified at time of analysis, though the absence of any authentication or complexity barrier makes this straightforward to abuse once the vulnerable endpoint is known.
Sensitive data exposure in the JetBlog WordPress plugin (versions 2.4.8 and earlier) allows remote unauthenticated attackers to retrieve confidential information from affected sites over the network with no user interaction. The flaw is reported by Patchstack with a CVSS 3.1 base score of 7.5 (high confidentiality impact only). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided in the input.
Information disclosure in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets a locally authenticated attacker who already holds high privileges read sensitive system information that remains in memory or logs because debug data was not cleared. The assessed vector is CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N (4.1), meaning the attacker must already have local access and high privileges, and exploitation additionally depends on uncleared debug artifacts actually being present - a condition outside the attacker's direct control. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS signal provided, so this is best treated as a post-compromise information-gathering weakness rather than an initial-access threat.
Dell Secure Connect Gateway (SCG) 5.0 exposes sensitive system information through uncleared debug artifacts accessible to local low-privileged users, affecting both the Appliance variant (prior to 5.36.00.16) and the Application variant (prior to 5.36.00.00). The root cause is CWE-1258: debug data containing sensitive system details is not purged and remains readable on the local filesystem. No public exploit code has been identified and exploitation requires local authenticated access, making real-world impact limited to insider threat scenarios or post-compromise reconnaissance.
Uncleared debug information in Dell Secure Connect Gateway (SCG) 5.0 exposes sensitive system data to physically present unauthenticated attackers. Both the Appliance variant (versions prior to 5.36.00.16) and the Application variant (versions prior to 5.36.00.00) are affected, per CPE data and the Dell advisory DSA-2026-382. The CVSS vector (AV:P) confirms exploitation is constrained to physical access, yielding a low overall severity of 2.4, and no public exploit or active exploitation has been identified at time of analysis.
Ubuntu Subiquity 24.04.4 leaks sensitive user credentials in crash report logs submitted to Launchpad during installation failures, potentially exposing plaintext Wi-Fi passwords and other credentials to unauthorized third parties. The vulnerability affects multiple Ubuntu versions (24.04.4, 25.04, and 25.10) and requires user interaction (submission of a crash report) but carries low real-world exploitation risk due to a CVSS score of 2.7 and absence of active exploitation signals. No public exploit code is known; vendor-released patches are available.
ubuntu-desktop-provision version 24.04.4 leaks user password hashes in crash report logs submitted to Launchpad during installation failures. An unauthenticated remote attacker can obtain sensitive credentials if a user opts to report the installation failure, requiring user interaction to trigger the vulnerability but resulting in direct exposure of authentication material. Patch available from Canonical via GitHub pull requests; EPSS and KEV status not actively exploited at time of analysis.
Dell Integrated Dell Remote Access Controller (iDRAC) versions 9, 14G (prior to 7.00.00.174), 15G, and 16G (prior to 7.10.90.00) contain an exposure of sensitive system information vulnerability caused by uncleared debug information in memory or logs. A remote attacker with high privileges can exploit this to disclose confidential system details without modifying or disrupting service availability. While the CVSS score is moderate at 4.9 due to high privilege requirements, the confidentiality impact is rated high, making this relevant for organizations where insider threats or compromised administrator accounts are a concern.
Dell PowerEdge Server BIOS and Dell iDRAC9, all versions, contains an Information Disclosure vulnerability. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Exposure of Sensitive System Information Due to Uncleared Debug Information vulnerability in 1clickmigration 1 Click WordPress Migration allows Retrieve Embedded Sensitive Data.2. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Sensitive data exposure in WPJAM Basic (WordPress plugin, versions ≤ 7.0.2.1) allows unauthenticated remote attackers to retrieve subscriber private information without credentials or user interaction. Classified under CWE-1258, the root cause is a failure to restrict access to private user data at the plugin level, exposing information that should be gated by authentication. No public exploit code has been identified at time of analysis, though the absence of any authentication or complexity barrier makes this straightforward to abuse once the vulnerable endpoint is known.
Sensitive data exposure in the JetBlog WordPress plugin (versions 2.4.8 and earlier) allows remote unauthenticated attackers to retrieve confidential information from affected sites over the network with no user interaction. The flaw is reported by Patchstack with a CVSS 3.1 base score of 7.5 (high confidentiality impact only). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided in the input.
Information disclosure in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets a locally authenticated attacker who already holds high privileges read sensitive system information that remains in memory or logs because debug data was not cleared. The assessed vector is CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N (4.1), meaning the attacker must already have local access and high privileges, and exploitation additionally depends on uncleared debug artifacts actually being present - a condition outside the attacker's direct control. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS signal provided, so this is best treated as a post-compromise information-gathering weakness rather than an initial-access threat.
Dell Secure Connect Gateway (SCG) 5.0 exposes sensitive system information through uncleared debug artifacts accessible to local low-privileged users, affecting both the Appliance variant (prior to 5.36.00.16) and the Application variant (prior to 5.36.00.00). The root cause is CWE-1258: debug data containing sensitive system details is not purged and remains readable on the local filesystem. No public exploit code has been identified and exploitation requires local authenticated access, making real-world impact limited to insider threat scenarios or post-compromise reconnaissance.
Uncleared debug information in Dell Secure Connect Gateway (SCG) 5.0 exposes sensitive system data to physically present unauthenticated attackers. Both the Appliance variant (versions prior to 5.36.00.16) and the Application variant (versions prior to 5.36.00.00) are affected, per CPE data and the Dell advisory DSA-2026-382. The CVSS vector (AV:P) confirms exploitation is constrained to physical access, yielding a low overall severity of 2.4, and no public exploit or active exploitation has been identified at time of analysis.
Ubuntu Subiquity 24.04.4 leaks sensitive user credentials in crash report logs submitted to Launchpad during installation failures, potentially exposing plaintext Wi-Fi passwords and other credentials to unauthorized third parties. The vulnerability affects multiple Ubuntu versions (24.04.4, 25.04, and 25.10) and requires user interaction (submission of a crash report) but carries low real-world exploitation risk due to a CVSS score of 2.7 and absence of active exploitation signals. No public exploit code is known; vendor-released patches are available.
ubuntu-desktop-provision version 24.04.4 leaks user password hashes in crash report logs submitted to Launchpad during installation failures. An unauthenticated remote attacker can obtain sensitive credentials if a user opts to report the installation failure, requiring user interaction to trigger the vulnerability but resulting in direct exposure of authentication material. Patch available from Canonical via GitHub pull requests; EPSS and KEV status not actively exploited at time of analysis.
Dell Integrated Dell Remote Access Controller (iDRAC) versions 9, 14G (prior to 7.00.00.174), 15G, and 16G (prior to 7.10.90.00) contain an exposure of sensitive system information vulnerability caused by uncleared debug information in memory or logs. A remote attacker with high privileges can exploit this to disclose confidential system details without modifying or disrupting service availability. While the CVSS score is moderate at 4.9 due to high privilege requirements, the confidentiality impact is rated high, making this relevant for organizations where insider threats or compromised administrator accounts are a concern.
Dell PowerEdge Server BIOS and Dell iDRAC9, all versions, contains an Information Disclosure vulnerability. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Exposure of Sensitive System Information Due to Uncleared Debug Information vulnerability in 1clickmigration 1 Click WordPress Migration allows Retrieve Embedded Sensitive Data.2. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.