CWE-223
AllowedOmission of Security-relevant Information
Abstraction: Base · Status: Draft
The product does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is safe.
16 vulnerabilities reference this CWE, most recent first.
GHSA-5F99-WCH4-5W2C
Vulnerability from github – Published: 2023-07-11 09:30 – Updated: 2024-09-30 12:30DroneScout ds230 Remote ID receiver from BlueMark Innovations is affected by an information loss vulnerability through traffic injection.
An attacker can exploit this vulnerability by injecting, on carefully selected channels, high power spoofed Open Drone ID (ODID) messages which force the DroneScout ds230 Remote ID receiver to drop real Remote ID (RID) information and, instead, generate and transmit JSON encoded MQTT messages containing crafted RID information. Consequently, the MQTT broker, typically operated by a system integrator, will have no access to the drones’ real RID information.
This issue affects the adjacent channel suppression algorithm present in DroneScout ds230 firmware from version 20211210-1627 through 20230329-1042.
{
"affected": [],
"aliases": [
"CVE-2023-31191"
],
"database_specific": {
"cwe_ids": [
"CWE-221",
"CWE-223"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-11T09:15:09Z",
"severity": "HIGH"
},
"details": "DroneScout ds230 Remote ID receiver from BlueMark Innovations is affected by an information loss vulnerability through traffic injection.\n\nAn attacker can exploit this vulnerability by injecting, on carefully selected channels, high power spoofed Open Drone ID (ODID) messages which force the DroneScout ds230 Remote ID receiver to drop real Remote ID (RID) information and, instead, generate and transmit JSON encoded MQTT messages containing crafted RID information. Consequently, the MQTT broker, typically operated by a system integrator, will have no access to the drones\u2019 real RID information.\n\nThis issue affects the adjacent channel suppression algorithm present in DroneScout ds230 firmware from version 20211210-1627 through 20230329-1042.",
"id": "GHSA-5f99-wch4-5w2c",
"modified": "2024-09-30T12:30:31Z",
"published": "2023-07-11T09:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31191"
},
{
"type": "WEB",
"url": "https://download.bluemark.io/dronescout/firmware/history.txt"
},
{
"type": "WEB",
"url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-31191"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5P2P-6G2C-HF7M
Vulnerability from github – Published: 2025-06-23 03:30 – Updated: 2025-06-23 21:24In scan.rs in spytrap-adb before 0.3.5, matches for known stalkerware are not rendered in the interactive user interface.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "spytrap-adb"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.3.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-52926"
],
"database_specific": {
"cwe_ids": [
"CWE-223"
],
"github_reviewed": true,
"github_reviewed_at": "2025-06-23T21:24:20Z",
"nvd_published_at": "2025-06-23T01:15:21Z",
"severity": "LOW"
},
"details": "In scan.rs in spytrap-adb before 0.3.5, matches for known stalkerware are not rendered in the interactive user interface.",
"id": "GHSA-5p2p-6g2c-hf7m",
"modified": "2025-06-23T21:24:20Z",
"published": "2025-06-23T03:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52926"
},
{
"type": "WEB",
"url": "https://github.com/spytrap-org/spytrap-adb/pull/65"
},
{
"type": "WEB",
"url": "https://github.com/spytrap-org/spytrap-adb/commit/277cec542466b75cf5a8c532581243fd4b7b9713"
},
{
"type": "PACKAGE",
"url": "https://github.com/spytrap-org/spytrap-adb"
},
{
"type": "WEB",
"url": "https://github.com/spytrap-org/spytrap-adb/releases/tag/v0.3.5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "spytrap-adb Omission of Security-relevant Information"
}
GHSA-MCPC-4W6J-6XPQ
Vulnerability from github – Published: 2023-05-12 00:30 – Updated: 2024-04-04 04:03An omission of security-relevant information vulnerability exists in Brave desktop prior to version 1.48.171 when a user was saving a file there was no download safety check dialog presented to the user.
{
"affected": [],
"aliases": [
"CVE-2023-28360"
],
"database_specific": {
"cwe_ids": [
"CWE-223"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-11T22:15:10Z",
"severity": "MODERATE"
},
"details": "An omission of security-relevant information vulnerability exists in Brave desktop prior to version 1.48.171 when a user was saving a file there was no download safety check dialog presented to the user.",
"id": "GHSA-mcpc-4w6j-6xpq",
"modified": "2024-04-04T04:03:03Z",
"published": "2023-05-12T00:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28360"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/1848062"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PGGP-WPFC-2W3C
Vulnerability from github – Published: 2023-07-11 09:30 – Updated: 2024-09-30 12:30DroneScout ds230 Remote ID receiver from BlueMark Innovations is affected by an information loss vulnerability through traffic injection. An attacker can exploit this vulnerability by injecting, at the right times, spoofed Open Drone ID (ODID) messages which force the DroneScout ds230 Remote ID receiver to drop real Remote ID (RID) information and, instead, generate and transmit JSON encoded MQTT messages containing crafted RID information. Consequently, the MQTT broker, typically operated by a system integrator, will have no access to the drones’ real RID information.
This issue affects DroneScout ds230 in default configuration from firmware version 20211210-1627 through 20230329-1042.
{
"affected": [],
"aliases": [
"CVE-2023-29156"
],
"database_specific": {
"cwe_ids": [
"CWE-221",
"CWE-223"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-11T09:15:09Z",
"severity": "MODERATE"
},
"details": "DroneScout ds230 Remote ID receiver from BlueMark Innovations\u00a0is affected by an information loss vulnerability through\u00a0traffic injection.\nAn attacker can exploit this vulnerability by injecting, at the right times, spoofed Open Drone ID (ODID) messages which force the DroneScout ds230 Remote ID receiver to drop real Remote ID (RID) information and, instead, generate and transmit JSON encoded MQTT messages containing crafted RID information.\u00a0Consequently, the\u00a0MQTT broker, typically operated by a system integrator,\u00a0will have no access to the drones\u2019 real RID information.\n\nThis issue affects DroneScout ds230 in default configuration from firmware version 20211210-1627 through 20230329-1042.\n",
"id": "GHSA-pggp-wpfc-2w3c",
"modified": "2024-09-30T12:30:31Z",
"published": "2023-07-11T09:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29156"
},
{
"type": "WEB",
"url": "https://download.bluemark.io/dronescout/firmware/history.txt"
},
{
"type": "WEB",
"url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-29156"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-R5VF-WF4H-82GG
Vulnerability from github – Published: 2025-01-07 15:25 – Updated: 2025-01-22 17:37Impact
Versions of the matrix-sdk-crypto Rust crate before 0.8.0 lack a dedicated mechanism to notify that a user's cryptographic identity has changed from a verified to an unverified one, which could cause client applications relying on the SDK to overlook such changes.
Patches
matrix-sdk-crypto 0.8.0 adds a new VerificationLevel::VerificationViolation enum variant which indicates that a previously verified identity has been changed.
References
- Patch: https://github.com/matrix-org/matrix-rust-sdk/pull/3795
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "matrix-sdk-crypto"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.8.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-52813"
],
"database_specific": {
"cwe_ids": [
"CWE-223",
"CWE-347"
],
"github_reviewed": true,
"github_reviewed_at": "2025-01-07T15:25:52Z",
"nvd_published_at": "2025-01-07T16:15:35Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nVersions of the matrix-sdk-crypto Rust crate before 0.8.0 lack a dedicated mechanism to notify that a user\u0027s cryptographic identity has changed from a verified to an unverified one, which could cause client applications relying on the SDK to overlook such changes.\n\n### Patches\n\nmatrix-sdk-crypto 0.8.0 adds a new `VerificationLevel::VerificationViolation` enum variant which indicates that a previously verified identity has been changed.\n\n### References\n\n- Patch: https://github.com/matrix-org/matrix-rust-sdk/pull/3795\n",
"id": "GHSA-r5vf-wf4h-82gg",
"modified": "2025-01-22T17:37:49Z",
"published": "2025-01-07T15:25:52Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-r5vf-wf4h-82gg"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52813"
},
{
"type": "WEB",
"url": "https://github.com/matrix-org/matrix-rust-sdk/pull/3795"
},
{
"type": "PACKAGE",
"url": "https://github.com/matrix-org/matrix-rust-sdk"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2024-0434.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "matrix-sdk-crypto missing facility to signal rotation of a verified cryptographic identity"
}
GHSA-XQM6-X399-JG2R
Vulnerability from github – Published: 2026-08-11 18:30 – Updated: 2026-08-11 18:30Omission of security-relevant information for some Intel(R) Software Guard Extensions Data Center Attestation Primitives within Ring 0: Kernel may allow a denial of service. Authorized adversary with a privileged user combined with a high complexity attack may enable data alteration. This result may potentially occur via local access when attack requirements are present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (high) and availability (low) impacts.
{
"affected": [],
"aliases": [
"CVE-2025-35987"
],
"database_specific": {
"cwe_ids": [
"CWE-223"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-11T17:17:43Z",
"severity": "MODERATE"
},
"details": "Omission of security-relevant information for some Intel(R) Software Guard Extensions Data Center Attestation Primitives within Ring 0: Kernel may allow a denial of service. Authorized adversary with a privileged user combined with a high complexity attack may enable data alteration. This result may potentially occur via local access when attack requirements are present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (high) and availability (low) impacts.",
"id": "GHSA-xqm6-x399-jg2r",
"modified": "2026-08-11T18:30:50Z",
"published": "2026-08-11T18:30:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-35987"
},
{
"type": "WEB",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01421.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.