CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- sharethis dashboard for google analyticsShareThis Dashboard for Google Analytics <= 3.2.4 - Unauthenticated Google Analytics Data Exposure4.7 Medium
- hclsoftware bigfix ivr, hcltech bigfix insights for vulnerability remediation +1 moreHCL BigFix IVR is impacted by an improper service binding configuration2.2 Low
- moneyspace money spaceMoney Space <= 2.13.9 - Unauthenticated Sensitive Information Exposure8.6 High
- qualcomm ar8035 firmware, csra6620 firmware, csra6640 firmware +173 more +175 moreInformation Exposure in Computer Vision5.5 Medium
- averta shortcodes and extra features for phlox themeShortcodes and extra features for Phlox theme <= 2.17.13 - Unauthenticated Draft Posts Information Exposure5.3 Medium
- aio-libs aiohttpAIOHTTP allows for a brute-force leak of internal static filepath components6.3 Medium
- difyDify Vulnerable to Plaintext API Key Exposure via Model Provider Configuration Endpoint8.4 High
- craftcms cms, craft cms +1 moreCraft CMS vulnerable to potential information disclosure via unchecked asset relocation4.9 Medium
- signalk signal k server, signalk-server +1 moreSignal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints5.3 Medium
- delta electronics dvp-12se11t, deltaww dvp-12se11t firmware +1 moreDVP-12SE11T - Authentication Bypass via Partial Password Disclosure8.1 High
- pixelyoursite – your smart pixel (tag) & api managerPixelYourSite <= 11.1.5 - Sensitive Information Exposure via Log File5.3 Medium
- gmission web faxData Exposure in Gmission Web FAX6.8 Medium
- kings information & network co. kess enterpriseData Exposure in Kings Information & Network KESS Enterprise8.6 High
- haloHalo Configuration actuator information disclosure2.3 Low
- jeecg bootJeecgBoot getDeptRoleByUserId information disclosure4.8 Medium
- terrainformatica sciterAn issue in Terra Informatica Software, Inc Sciter v.4.4.7.0 allows a local attacker to obtain...5.5 Medium
- tozed zlt m30s, gztozed zlt m30s firmware +1 moreTOZED ZLT M30s Web Management proc_post information disclosure6.9 Medium
- senstar symphonySenstar Symphony FetchStoredLicense Information Disclosure Vulnerability7.5 High
- automattic woocommerceWooCommerce - Subscriber/Customer+ Order Data Disclosure6.5 Medium
- checkpoint identity awarenessInformation Disclosure in Identity Agent Debug Files6.5 Medium
- checkpoint identity agentInformation Disclosure in Identity Agent Registry Keys6.5 Medium
- gtedge gt edge aiInsecure permissions in the /api/v1/agents API of GT Edge AI Platform before v2.0.10-dev allows...7.5 High
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership pluginUltimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.11.0 - Unauthenticated Sensitive Information Exposure5.3 Medium
- perforce delphix continuous compliancePII Leak Due to Change in EOR Handling5.3 Medium
- weblateWeblate has an arbitrary file read via symbolic links7.7 High
- storybookStorybook manager bundle may expose environment variables during build7.3 High
- churchcrm, churchcrm crm +1 moreChurchCRM discloses database information on error message10.0 Critical
- apple macosThe issue was addressed with improved handling of caches. This issue is fixed in macOS Tahoe 26.2...5.5 Medium
- apple macosThe issue was addressed with improved handling of caches. This issue is fixed in macOS Tahoe 26.2...5.5 Medium
- apple ipados, macos, tvos +4 more +6 moreA permissions issue was addressed with additional restrictions. This issue is fixed in watchOS 26...3.3 Low
- apple macosA logic issue was addressed with improved validation. This issue is fixed in macOS Tahoe 26.2. An...5.5 Medium
- tp-link systems inc. tapo appPassword Hash Leak Could Lead to Unauthorized Access on Tapo App via Local Network7.0 High
- claris filemaker serverTo enhance security, the FileMaker Server 22.0.4 installer now includes an option to disable IIS...5.3 Medium
- radykal fancy product designerFancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Information Disclosure and PHAR Deserialization via 'url' Parameter5.9 Medium
- zohocorp manageengine admanager plusNTLM Hash Exposure Vulnerability6.4 Medium
- hitrontech hi3120 firmwareAn issue in Hitron HI3120 v.7.2.4.5.2b1 allows a local attacker to obtain sensitive information...5.5 Medium
- recorp export wordpress pages to static html & pdf — static site exportExport WP Page to Static HTML & PDF <= 4.3.4 - Unauthenticated Cookie Exposure via Log File9.8 Critical
- edge22 generateblocksGenerateBlocks <= 2.1.2 - Authenticated (Contributor+) Information Exposure via Metadata4.3 Medium
- apple macos, visionos, watchos +1 more +3 moreA logging issue was addressed with improved data redaction. This issue is fixed in macOS Sonoma...5.5 Medium
- apple macos, visionos, ios and ipados +2 moreThis issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15...7.5 High
- apple macosA permissions issue was addressed with additional restrictions. This issue is fixed in macOS...5.5 Medium
- apple ipados, ios and ipados, iphone os +2 moreAn information disclosure issue was addressed with improved privacy controls. This issue is fixed...3.3 Low
- apple macosThis issue was addressed with improved data protection. This issue is fixed in macOS Sonoma 14.8...5.5 Medium
- apple macos, ios and ipados +1 moreThis issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.8.3, macOS...5.5 Medium
- apple macosThis issue was addressed with improved state management. This issue is fixed in macOS Tahoe 26.1....5.5 Medium
- netweblogic events manager – calendar, bookings, tickets, and more!Events Manager <= 7.2.2.2 - Unauthenticated Information Exposure5.3 Medium
- rcatheme guest supportGuest Support <= 1.2.3 - Unauthenticated User Email Disclosure in guest_support_handler AJAX Endpoint5.3 Medium
- d-link dir-803, dlink dir-803 firmware +1 moreD-Link DIR-803 Configuration getcfg.php information disclosure6.9 Medium
- formioFormio improperly authorized permission elevation through specially crafted request path8.7 High
- meatmeetAn issue was discovered in Meatmeet Android Mobile Application 1.1.2.0. An exported activity can...9.8 Critical
- Show moreLoading…