CWEweakness

CWE-214 Invocation of Process Using Visible Sensitive Information

Official page ↗
Abstraction
Base
Structure
Simple
Status
Incomplete
Languages
Not Language-Specific
CWE version
5.0

Description

A process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system.

Common consequences

• Confidentiality: Read Application Data — When this data contains sensitive information such as credentials, it might allow other users to launch an attack against the product or related resources.

Observed examples

• CVE-2023-38994: IAM product includes LDAP password in a process call, allowing local users to obtain the password • CVE-2005-1387: password passed on command line • CVE-2005-2291: password passed on command line • CVE-2001-1565: username/password on command line allows local users to view via "ps" or other process listing programs • CVE-2004-1948: Username/password on command line allows local users to view via "ps" or other process listing programs. • CVE-1999-1270: PGP passphrase provided as command line argument. • CVE-2004-1058: Kernel race condition allows reading of environment variables of a process that is still spawning. • CVE-2021-32638: Code analysis product passes access tokens as a command-line parameter or through an environment variable, making them visible to other processes via the ps command.

Related

Observed example · CVE (8)

  • CVE-2023-38994 The 'check_univention_joinstatus' prometheus monitoring script (and other scripts) in UCS 5.0-5 revealed the LDAP plaintext password of the… vulnerability
  • CVE-2021-32638 Github's CodeQL action is provided to run CodeQL-based code scanning on non-GitHub CI/CD systems and requires a GitHub access token to… vulnerability
  • CVE-2005-2291 Oracle JDeveloper 9.0.4, 9.0.5, and 10.1.2 passes the cleartext password as a parameter when starting sqlplus, which allows local users to… vulnerability
  • CVE-2005-1387 Cocktail 3.5.4 and possibly earlier in Mac OS X passes the administrative password on the command line to sudo in cleartext, which allows… vulnerability
  • CVE-2004-1058 Race condition in Linux kernel 2.6 allows local users to read the environment variables of another process that is still spawning via… vulnerability
  • CVE-2004-1948 NcFTP client 3.1.6 and 3.1.7, when the username and password are included in an FTP URL that is provided on the command line, allows local… vulnerability
  • CVE-2001-1565 Point to Point Protocol daemon (pppd) in MacOS x 10.0 and 10.1 through 10.1.5 provides the username and password on the command line, which… vulnerability
  • CVE-1999-1270 KMail in KDE 1.0 provides a PGP passphrase as a command line argument to other programs, which could allow local users to obtain the… vulnerability

Child of · CWE (1)

  • CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere weakness

Referenced by CVE · weakness (39)

  • CVE-2026-92171 A flaw was found in the Infinispan Operator for Red Hat Data Grid. vulnerability
  • CVE-2026-113495 A flaw was found in cockpit-machines. vulnerability
  • CVE-2026-113496 A flaw was found in cockpit-machines. vulnerability
  • CVE-2026-109971 A flaw was found in the clevis PKCS#11 pin. vulnerability
  • CVE-2026-102371 In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu… vulnerability
  • CVE-2026-61670 microsandbox is an easy, fast, local-first microVM runtime and library. vulnerability
  • CVE-2026-92745 A flaw was found in cockpit-machines. vulnerability
  • CVE-2026-92747 A flaw was found in `cockpit-machines`. vulnerability
  • CVE-2026-92768 A flaw was found in cockpit-machines. vulnerability
  • CVE-2026-81684 In openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8, the desktop GUI passes the steganography password to the CLI child… vulnerability
  • CVE-2026-80158 A flaw was found in the ipa_getkeytab module of the community.general Ansible collection. vulnerability
  • CVE-2026-65088 NVIDIA NemoClaw contains a vulnerability where an attacker could cause invocation of process using visible sensitive information. vulnerability
  • CVE-2026-76054 Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to… vulnerability
  • CVE-2026-74873 openssl_encrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system… vulnerability
  • CVE-2026-18915 Invocation of process using visible sensitive information vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute… vulnerability
  • CVE-2026-12139 Tanium addressed an information disclosure vulnerability in Connect. vulnerability
  • CVE-2026-9494 An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). vulnerability
  • CVE-2026-12250 Invocation of process using visible sensitive information vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus… vulnerability
  • CVE-2026-41357 OpenClaw before 2026.3.31 contains an environment variable leakage vulnerability in SSH-based sandbox backends that pass unsanitized… vulnerability
  • CVE-2026-40159 PraisonAI is a multi-agent teams system. vulnerability
  • CVE-2026-33247 NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. vulnerability
  • CVE-2025-59955 Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. vulnerability
  • CVE-2025-5452 A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to… vulnerability
  • CVE-2025-53860 A vulnerability exists in F5OS-A software that allows a highly privileged authenticated attacker to access sensitive FIPS hardware security… vulnerability
  • CVE-2025-48709 BMC Control-M/Server 9.0.21.300 displays cleartext database credentials in process lists and logs. vulnerability
  • CVE-2025-1333 IBM MQ Container when used with the IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0,… vulnerability
  • CVE-2025-32987 Arctera eDiscovery Platform before 10.3.2, when Enterprise Vault Collection Module is used, places a cleartext password on a command line… vulnerability
  • CVE-2024-28799 IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 displays sensitive data… vulnerability
  • CVE-2024-39314 toy-blog is a headless content management system implementation. vulnerability
  • CVE-2024-4254 The 'deploy-website.yml' workflow in the gradio-app/gradio repository, specifically in the 'main' branch, is vulnerable to secrets… vulnerability
Show all 39 ›

Referenced by CWE · peer of (1)

  • CWE-526 Cleartext Storage of Sensitive Information in an Environment Variable weakness