CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- wger-project wgerwger IDOR: Authenticated Users Can Read Others' Private Workout Session Data via Template Routine API7.5 High
- flowiseai flowiseFlowise: Credential Data Leak7.0 High
- strapiStrapi may leak sensitive data via relational filtering due to lack of query sanitization9.2 Critical
- palo alto networks prisma access agentPrisma Access Agent: Information Disclosure Vulnerabilities4.3 Medium
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +21 more +23 moreiControl REST and tmsh vulnerability6.9 Medium
- broadstreetads broadstreetBroadstreet <= 1.53.1 - Authenticated (Subscriber+) Information Disclosure5.3 Medium
- microsoft visual studio codeVisual Studio Code Security Feature Bypass Vulnerability6.3 Medium
- microsoft power automate for desktopMicrosoft Power Automate Desktop Information Disclosure Vulnerability6.5 Medium
- microsoft entra id, entra +1 moreAzure Entra ID Spoofing Vulnerability9.3 Critical
- dragonmonk111 junoclawJunoClaw: MCP write tools exposed raw BIP-39 mnemonic as a tool-call parameter9.8 Critical
- apache tomcatApache Tomcat: WebSocket authentication header exposure7.3 High
- davidalmeidac sealed-envsealed-env: TOTP secret embedded in unseal token payload (enterprise mode)9.1 Critical
- qqqjus slek gateway for woocommerceSlek Gateway for WooCommerce <= 1.0 - Unauthenticated Insufficiently Protected Credentials via Payment Redirect Form Hidden Fields5.3 Medium
- fccview jottyjotty·page: Unauthenticated Path Traversal leads to sensitive file disclosure and session-token reuse impact8.2 High
- apple macosAn information leakage was addressed with additional validation. This issue is fixed in macOS...7.5 High
- apple ipados, macos, tvos +4 more +6 moreAn information leakage was addressed with additional validation. This issue is fixed in iOS 18.7...6.5 Medium
- apple ipados, macos, safari +3 more +5 moreThis issue was addressed with improved data protection. This issue is fixed in iOS 26.5 and...5.5 Medium
- apple ipados, macos, safari +3 more +5 moreThis issue was addressed with improved access restrictions. This issue is fixed in iOS 18.7.9 and...7.5 High
- apple macosThis issue was addressed through improved state management. This issue is fixed in macOS Sequoia...6.5 Medium
- mantisbtMantisBT Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked5.3 Medium
- mantisbtMantisBT authorization bypass allows continued access to self-uploaded attachments on private issues5.3 Medium
- mantisbtMantisBT has an authorization bypass via private issue monitoring5.3 Medium
- labredescefetrj wegiaWeGIA: Error Handling Upload DocDependente0.0 None
- labredescefetrj wegiaWeGIA: Error Handling familiar_docfamiliar6.9 Medium
- getinboxzero inbox zero, elie222 inbox-zero +1 moreInbox Zero: Cross-account cleaner email stream exposure2.3 Low
- wikimedia foundation echoExposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation...2.3 Low
- mediawikiSpecial:UserRights allows viewing user rights from private wiki1.1 Low
- getgrav gravGrav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()7.7 High
- mediawikiBlock UI elements in 'tools'-sidebar shows presence of an autoblocked IP2.1 Low
- mediawikiUser localization leaked by AbuseFilter + EventStream5.5 Medium
- python urllib3urllib3: Sensitive headers forwarded across origins in proxied low-level redirects8.2 High
- mediawikiRecentChanges entries expose suppressed content via generated log page html1.3 Low
- wikimedia foundation oathauth, mediawiki +1 moreUsers API leaks whether privileged users have their user groups disabled for lack of 2FA5.1 Medium
- logtivity activity logs, user activity tracking, multisite activity log from logtivityActivity Logs, User Activity Tracking, Multisite Activity Log from Logtivity <= 3.3.6 - Unauthenticated Information Disclosure via REST API5.3 Medium
- mintplexlabs anythingllm, mintplex-labs anything-llm +1 moreAnythingLLM: Cross-User TTS Audio Disclosure via Chat ID (IDOR)4.3 Medium
- anzory solidcam-gppl-ideSolidCAM-GPPL-IDE: Path traversal in `inc` directive enables file probing and NTLM-hash leak5.1 Medium
- jgraph drawioUnvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host3.4 Low
- openwebui open webui, open-webui +1 moreOpen WebUI: Global Knowledge Base Enumeration via knowledge-bases Meta-Collection4.3 Medium
n8n-mcpnpmn8n-mcp affected by path traversal, redirect-following SSRF, and telemetry payload exposure8.3 High- apache cloudstackApache CloudStack: Proxmox Extension Allows Unauthorized Cross-Tenant Instance Access9.1 Critical
- electermelecterm: Full process.env exposed to renderer via window.pre.env in electerm5.5 Medium
- lin-snow ech0Ech0 before 4.7.3 Email Disclosure via Public API6.9 Medium
- microsoft azure devopsAzure DevOps Information Disclosure Vulnerability10.0 Critical
- neorazorx facturascriptsFacturaScripts: Unauthenticated phpinfo() Disclosure via Installer Endpoint in FacturaScripts5.3 Medium
- neorazorx facturascriptsFacturaScripts: Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download6.5 Medium
- vercelVercel: Non-interactive mode includes CLI arguments in suggested command output5.5 Medium
github.com/getaxonflow/axonflowGoAxonflow fixed bugs by implementing multi-tenant isolation and access-control hardening9.1 Critical- nitro, nitrojs nitropack +1 moreNitro: Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules5.3 Medium
rpasswordcrates.iorpassword affected by partial password reveal when input is interrupted3.8 Low- picotronica e-clinic healthcare system echsPicoTronica e-Clinic Healthcare System ECHS Response Header v2 information disclosure6.9 Medium
- Show moreLoading…