CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- go-vikunja vikunja Vikunja 0.22.0 before 2.7.1 Webhook URL Credential Exposure to Read-Only Members 5.3 Medium
- kodezen ablocks – gutenberg blocks, user dashboard builder, popup builder, form builder & animation builder aBlocks <= 2.18.0 - Authenticated (Contributor+) Sensitive Information Exposure in 'ablocks_template' Shortcode 4.3 Medium
- paystack woocommerce payment gateway Paystack WooCommerce Payment Gateway <= 5.8.5 - Unauthenticated Sensitive Information Exposure in 'key' Parameter on order-pay Endpoint 5.3 Medium
- tournamatch Tournamatch < 4.7.1 - Unauthenticated Team Invitation Email Disclosure via REST API 5.3 Medium
- unknown advanced custom fields (acf®) Advanced Custom Fields < 6.8.11 - Contributor+ Unpublished Post Title and Status Disclosure via Relational Fields 2.7 Low
- ibm api connect Multiple Vulnerabilities in IBM API Connect 5.8 Medium
- ibm api connect Multiple Vulnerabilities in IBM API Connect 4.3 Medium
- wpsoul greenshift – animation and page builder blocks Greenshift <= 13.2.2 - Unauthenticated Sensitive Information Exposure in Nested {{COOKIE:}} Placeholder via {{GET:}} Parameter 5.3 Medium
- nexmoe vidbee nexmoe VidBee Local HTTP Service local-api.ts information disclosure 5.3 Medium
- freescout-help-desk freescout FreeScout: Missing Authorization and Exposure of Sensitive Information to an Unauthorized Actor and Authorization Bypass Through User-Controlled Key 6.5 Medium
- freescout-help-desk freescout FreeScout: Cross-mailbox conversation existence / internal-id disclosure via the search-by-number (`#`) shortcut (missing mailbox authorization) 4.3 Medium
- freescout-help-desk freescout FreeScout: Cross-User Notification Data Disclosure via LIKE Wildcard Injection in Polycast Channel Query 7.7 High
- hcl aion HCL AION is affected by multiple security vulnerabilities. 3.1 Low
- hcl aion HCL AION is affected by multiple security vulnerabilities. 4.2 Medium
- hcl aion HCL AION is affected by multiple security vulnerabilities. 4.8 Medium
- hcl aion HCL AION is affected by multiple security vulnerabilities. 4.8 Medium
- hcl aion HCL AION is affected by multiple security vulnerabilities. 3.7 Low
- hcl aion HCL AION is affected by multiple security vulnerabilities. 3.7 Low
- kevinb publishpress revisions: duplicate posts, submit, approve and schedule content changes PublishPress Revisions 3.9.0 - 4.2.0 - Subscriber+ Unpublished Content Disclosure 4.3 Medium
- undici undici vulnerable to cross-origin credential disclosure via array-of-tuples headers bypassing redirect stripping 5.9 Medium
- open-emr openemr OpenEMR: Username Enumeration via Pre-Authentication User Settings Loading 5.3 Medium
- open-emr openemr OpenEMR: Unauthenticated Information Disclosure in admin.php Exposes Database Names and Versions 5.3 Medium
- open-emr openemr OpenEMR FaxSMS module: insecure staging of decrypted patient documents in webroot 7.5 High
- signalwire freeswitch FreeSWITCH: Heap out-of-bounds read in FreeSWITCH core variable expansion via `${variable:offset}` slicing 2.7 Low
- tinyhumansai openhuman OpenHuman: Bearer token leaked via approval gate session_id (SQLite plaintext + debug log + RPC response) 8.8 High
- tinyhumansai openhuman OpenHuman: Unauthenticated server-sent events endpoint leaks user-facing event data 6.2 Medium
- apache software foundation ofbiz Apache OFBiz: Unauthenticated HR organization and employee disclosure No score
- apache software foundation ofbiz Apache OFBiz: Unauthenticated disclosure through HR, Catalog, and Order Manager helpers No score
- unknown car dealer (dealership) and vehicle sales Car Dealer <= 4.73 - Unauthenticated Private/Draft/Pending Post Content Disclosure via cardealer_single_car_ajax 5.3 Medium
- g5theme essential real estate Essential Real Estate < 5.3.5 - Unauthenticated Unpublished Property Listing and Agent Contact Disclosure via property_print_ajax 5.3 Medium
- themeum tutor lms Tutor LMS 1.6.4 - 4.1.3 - Subscriber+ Quiz Answer Key Disclosure 4.3 Medium
- litespeedtech litespeed cache LiteSpeed Cache <= 7.9.1 - Unauthenticated Sensitive Information Disclosure (WooCommerce Store API Cart/Checkout PII + Cart-Token) via Public REST Caching 8.2 High
- parse-community parse-server Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 Information Disclosure via Object Create Response 2.3 Low
- purocean yank note purocean Yank Note Settings Endpoint index.ts config.getAll information disclosure 6.9 Medium
- nst labs tech nstbrowser NST Labs Tech Nstbrowser Local Agent API info information disclosure 5.3 Medium
- nvm-sh nvm nvm prints the contents of any readable file through a symlinked .nvmrc 6.7 Medium
- traccar Traccar: Authentication bypass via path parameters exposes protected device media 7.5 High
- vtenext vtenext before 25.02.2 Session Identifier Disclosure via Touch Web Service 5.9 Medium
- mra13 simple download monitor Simple Download Monitor < 4.1.3 - Contributor+ Private Download Item Title and Description Disclosure via [sdm_show_download_info] Shortcode 2.7 Low
- metagauss eventprime EventPrime < 4.3.6.1 - Unauthenticated Pending Post Disclosure via Public Post Status Override 5.3 Medium
- shahjada premium packages Premium Packages < 7.3.1 - Unauthenticated Cross-User Saved Cart Disclosure via IDOR 5.3 Medium
- frogerme wp remote users sync WP Remote Users Sync < 2.2.0 - Unauthenticated Sensitive Data Disclosure via Public User Export File 3.7 Low
- metaphor creations post duplicator Post Duplicator < 3.0.17 - Contributor+ Draft and Private Post Title Disclosure 2.7 Low
- unknown erp: complete hr, accounting & crm suite built for woocommerce WP ERP < 1.17.11 - Subscriber+ Sensitive Data Disclosure via Audit Log 4.3 Medium
- linksys e5600 Linksys E5600 Factory Quality Control fqc.cgi information disclosure 6.9 Medium
- sensiolabs symfony Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References 8.2 High
- tanium discover Tanium addressed an information disclosure vulnerability in Discover. 4.3 Medium
- tanium discover Tanium addressed an information disclosure vulnerability in Discover. 4.3 Medium
- google chrome Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to... 6.5 Medium
- google chrome Information leak in ServiceWorker in Google Chrome prior to 157.0.8103.38 allowed a remote... 5.3 Medium
- Show olderLoading…