CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- xiangshanXiangShan Nanhu V2 and XiangShan Kunmighu V3 were discovered to use speculative execution and...7.5 High
- pagerduty runbook automationPagerDuty Runbook through 2025-06-12 exposes stored secrets directly in the webpage DOM at the...6.5 Medium
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 22h3 +13 more +15 moreWindows DirectX Information Disclosure Vulnerability6.5 Medium
- containernetworking plugins, linuxfoundation cni network plugins +1 moreCNI Plugins Portmap nftables backend intercepts non-local traffic6.6 Medium
- umbraco cms, umbraco-cms +1 moreUmbraco Vulnerable to Improper File Access and Credential Exposure through Dictionary Import Functionality4.9 Medium
- tianocore edk2Uncleared password keystrokes in circular queue can lead to information disclosure or escalation of privilege5.8 Medium
- fastlinemedia beaver builder, beaverbuilder beaver builder page builder – drag and drop website builder +1 moreBeaver Builder – WordPress Page Builder <= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure4.3 Medium
- siemens simatic cn 4100, simatic cn 4100 firmware +1 moreA vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected...5.3 Medium
- siemens simatic cn 4100, simatic cn 4100 firmware +1 moreA vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected...6.9 Medium
- tenda ac9, ac9 firmware +1 moreTenda AC9 Configuration File DownloadCfg.jpg information disclosure6.9 Medium
- huawei harmonyosApp lock verification bypass vulnerability in the file management app. Impact: Successful...4.9 Medium
- huawei harmonyosPermission control vulnerability in the media library module. Impact: Successful exploitation of...4.4 Medium
- verysync, verysync 微力同步 +1 moreVerysync 微力同步 Web Administration download information disclosure6.9 Medium
- verysync 微力同步Verysync 微力同步 Web Administration f96956469e7be39d information disclosure6.9 Medium
- linuxfoundation strimzi, strimzi strimzi-kafka-operator +1 moreStrimzi allows unrestricted access to all Secrets in the same Kubernetes namespace from Kafka Connect and MirrorMaker 2 operands7.4 High
- wpeka-club surveyfunnel – survey plugin for wordpressSurveyFunnel – Survey Plugin for WordPress <= 1.1.5 - Unauthenticated Information Exposure5.3 Medium
- jimmyredline80 ssp debugSSP Debug <= 1.0.0 - Unauthenticated Sensitive Information Exposure5.3 Medium
- silabs.com simplicity studio v6Simplcity Device Manager exposes NTLMv2 hash7.4 High
libcrux-intrinsicscrates.io,libcrux-ml-dsacrates.io,libcrux-ml-kemcrates.io +2 morelibcrux incorrectly calculates on aarch648.8 High- ansible-collections ansible community general collection, red hat ceph storage 5, ceph storage 6 +5 more +7 moreAnsible-collection-community-general: ansible-collection-community-general: keycloak user module leaks credentials in verbose output5.5 Medium
- roselldk webp expressWebP Express <= 0.25.9 - Unauthenticated Information Exposure5.3 Medium
- composioComposioHQ has a directory traversal vulnerability7.5 High
- thermofisher ion torrent onetouch 2 firmwareAn issue was discovered on Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices. When they are...9.8 Critical
- splunk, splunk cloud platform, enterprise +1 more +3 moreImproper access control through push notifications for reports and alerts in Splunk Secure Gateway app4.3 Medium
- mxchat – ai chatbot & content generation for wordpressMxChat – AI Chatbot for WordPress <= 2.5.5 - Unauthenticated Information Exposure5.3 Medium
- horde groupwareDisclosure of sensitive information in Horde Groupware6.9 Medium
- tcman gimUser Enumeration vulnerability in TCMAN GIM6.9 Medium
- tcman gimUser Enumeration vulnerability in TCMAN GIM6.9 Medium
- softdiscover zigaform – price calculator & cost estimation form builder liteZigaform <= 7.6.5 - Unauthenticated Form Submission Data Disclosure in rocket_front_payment_seesummary AJAX Endpoint5.3 Medium
- getgrav gravGrav Exposes Password Hashes Leading to privilege escalation6.2 Medium
- floragunn search guard flxUnauthorized access to documents in data streams with specially crafted requests4.3 Medium
- arm 5th gen gpu architecture kernel driver, valhall gpu kernel driver +1 moreMali GPU Kernel Driver allows improper GPU processing operations5.1 Medium
- nutzam nutzbootnutzam NutzBoot Ethereum Wallet EthModule.java information disclosure5.3 Medium
- yungifez skuul, skuul school management system +1 moreyungifez Skuul School Management System Image profile information disclosure5.3 Medium
- orangehrmOrangeHRM is Vulnerable to Improper Authorization Allowing Unauthorized Access to Interview Attachments5.3 Medium
- orangehrmOrangeHRM is Vulnerable to Improper Authorization Allowing Unauthorized Access to Candidate Attachments5.3 Medium
- lukevella ralllyRallly Information Disclosure Vulnerability in Participant API Leaks Names and Emails Despite Pro Privacy Settings7.1 High
- devolutions server, remote desktop manager +1 moreExposure of credentials in unintended requests in Devolutions Server, Remote Desktop Manager on...6.5 Medium
- huawei harmonyosPermission control vulnerability in the file management module. Impact: Successful exploitation...4.9 Medium
- huawei harmonyosIdentity authentication bypass vulnerability in the Gallery app. Impact: Successful exploitation...6.2 Medium
- huawei harmonyosPermission control vulnerability in the Notepad module. Impact: Successful exploitation of this...5.1 Medium
- mattermost, mattermost server +1 moreInformation Disclosure in Common Teams API4.3 Medium
- devolutions serverExposure of credentials in unintended requests in Devolutions Server.This issue affects Server:...3.5 Low
- devolutions serverExposure of email service credentials to users without administrative rights in Devolutions...4.3 Medium
- apache cloudstackApache CloudStack: Lack of user permission validation leading to data leak for few APIs4.3 Medium
- shapedplugin quick view for woocommerceQuick View for WooCommerce <= 2.2.17 - Unauthenticated Private Product Disclosure5.3 Medium
- komal97 grocerymartAn issue was discovered in file users.json in GroceryMart commit 21934e6 (2020-10-23) allowing...7.5 High
- intercore-productions core-botCore Bot is Leaking Sensitive Credentials in Logs, Errors, and Messages8.8 High
- appglut locker contentLocker Content <= 1.0.0 - Unauthenticated Information Exposure5.3 Medium
- mescuwa entropy-derbyInside Track / Entropy Derby Timelock Encryption Bypassed via Pre-Computed VDF Output Leakage8.7 High
- Show moreLoading…