CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- oracle agile product lifecycle management for processVulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle...4.3 Medium
- oracle goldengateVulnerability in Oracle GoldenGate (component: Libraries). Supported versions that are affected...5.3 Medium
- oracle graalvm, graalvm for jdk, jdk +3 more +5 moreVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...2.9 Low
- oracle graalvm, graalvm for jdk, jdk +33 more +35 moreVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...7.5 High
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema)...4.3 Medium
- oracle graalvm, graalvm for jdk, jdk +3 more +5 moreVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...2.9 Low
- oracle peoplesoft enterprise hcm human resourcesVulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft ...5.4 Medium
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema)...2.7 Low
- oracle xml database, oracle corporation database server +1 moreVulnerability in the XML Database component of Oracle Database Server. Supported versions that...5.3 Medium
- ransomlookRansomLook - Improper Filtering of Private Location Entries in API Endpoints Leads to Information Exposure6.9 Medium
- freescout-help-desk freescoutFreeScout allows non-folder conversation queries to disclose assigned-only hidden conversations4.3 Medium
- octobercms octoberOctober: Safe Mode Bypass via CSS Preprocessor Compilers4.9 Medium
- freescoutFreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron8.9 High
- mozilla firefox, thunderbird +1 moreInformation disclosure in the IP Protection component7.5 High
- mozilla firefox, thunderbird +1 moreOther issue in the Storage: IndexedDB component6.5 Medium
- mozilla firefoxMitigation bypass in Firefox for Android7.5 High
- honor eInformation Leak Vulnerability in Honor E6.3 Medium
- nicolargo glancesGlances Vulnerable to Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS7.7 High
- netapp storagegrid, storagegrid (formerly storagegrid webscale) +1 moreStorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.13 and 12.0.0.6 are...2.3 Low
- easyappointments easy appointmentsEasy Appointments <= 3.12.21 - Unauthenticated Sensitive Information Exposure via REST API7.5 High
- flowiseai flowiseFlowise: Public chatflow endpoints return unsanitized flowData including plaintext API keys, passwords, and credential IDs8.7 High
- firebirdsql firebirdFirebird: Information leak vulnerability in firebird3 client when used with newer server7.9 High
- arnobt78 hotel booking management systemarnobt78 Hotel Booking Management System Health Check Endpoint detailed information disclosure6.9 Medium
- dell data domain operating system, powerprotect data domain +1 moreDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release...4.3 Medium
- sparx systems pty ltd. pro cloud serverUnauthenticated execution of arbitrary SQL queries in Sparx Pro Cloud Server9.5 Critical
- flowiseai flowiseFlowise: Sensitive Data Leak in public-chatbotConfig7.7 High
- kyvernoKyverno before 1.16.4 Credential Leak via apiCall8.3 High
- kyvernoKyverno: ServiceAccount token leaked to external servers via apiCall service URL8.1 High
- langchain-ai langsmith-sdkLangSmith SDK: Streaming token events bypass output redaction5.3 Medium
- dgraphDgraph: Unauthenticated pprof endpoint leaks admin auth token9.4 Critical
- apostrophecms apostrophe, apostrophecms +1 moreInformation Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjection Field Restrictions5.3 Medium
- apostrophecms apostrophe, apostrophecms +1 moreApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST API5.3 Medium
- grafana pyroscope, red hat multicluster global hub, multicluster global hub 1.7.0 +5 more +7 moreSensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protection9.1 Critical
- weblateWeblate: SSRF via Project-Level Machinery Configuration5.0 Medium
- weblateWeblate: Arbitrary File Read via Symlink7.7 High
- weblateWeblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository6.8 Medium
- git-for-windows gitGit for Windows: `git clone` from manipulated repositories can leak NTLM hashes to arbitrary servers7.4 High
- grafana, grafana alerting +1 moreGrafana Alerting Editors can edit destination of webhooks they did not create1.3 Low
- apache airflowApache Airflow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access6.5 Medium
- wwbn avideoWWBN AVideo has an Unauthenticated Information Disclosure via git.json.php that Exposes Developer Emails and Deployed Version5.3 Medium
- goshsgoshs: Public collaborator feed leaks .goshs ACL credentials and enables unauthorized access7.7 High
- octobercms octoberOctober CMS: Environment Variable Exfiltration via INI Parser Interpolation4.9 Medium
- free5gcFree5GC: UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authentication7.5 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreWindows Snipping Tool Spoofing Vulnerability4.3 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreWindows Shell Information Disclosure Vulnerability6.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreWindows Print Spooler Information Disclosure Vulnerability5.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreWeb Account Manager Information Disclosure Vulnerability5.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreRemote Procedure Call Information Disclosure Vulnerability5.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 morePackage Catalog Information Disclosure Vulnerability5.5 Medium
- fortinet fortindr, fortivoice +1 moreAn exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiNDR...5.4 Medium
- Show moreLoading…