CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- hapijs wreck@hapi/wreck : Sensitive `Proxy-Authorization` header leaked across cross-hostname redirects6.3 Medium
- No product listedNetis AC1200 Router NC21 V4.0.1.4296 exposes a CGI endpoint /cgi-bin/skk_get.cgi that returns the...7.3 High
- sourcecodester cet automated grading system with ai predictive analyticsSourceCodester CET Automated Grading System with AI Predictive Analytics SQL index.php information exposure5.3 Medium
- nvidia geforce, rtx, quadro, nvs, tesla +2 moreNVIDIA GPU Display Driver for Linux contains a vulnerability where an advanced attacker could...5.6 Medium
- nousresearch hermes-agentNousResearch hermes-agent Messaging Gateway local.py _make_run_env information disclosure6.9 Medium
- calcom cal.diycalcom cal.diy Generic React API bookings-single-view.getServerSideProps.tsx getServerSideProps information disclosure6.9 Medium
- nezhahq nezhaNezha WebSocket server stream discloses cross-tenant server telemetry to authenticated members6.5 Medium
- goauthentik authentikauthentik: Non-admin user can retrieve confidential OAuth client_secret via /api/v3/oauth2/access_tokens/7.1 High
- imagemagickImageMagick: Information Disclosure in distributed pixel cache server because it is not using a challenge–response authentication model4.1 Medium
- mattermost, mattermost server +1 moreSanitize team member data returned by API4.3 Medium
- smub slider by soliloquy – responsive image slider for wordpressSlider by Soliloquy <= 2.8.1 - Authenticated (Subscriber+) Information Disclosure via REST API Endpoint4.3 Medium
- zte mu5250, mu5250 firmware +1 moreInformation disclosure vulnerability in ZTE MU52505.7 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete 9.5.0 and below has file usage disclosure via missing permission check in Usage controller6.9 Medium
- svelte sveltekit, sveltejs kit +1 moreSvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch5.9 Medium
- bestpractical rt, request tracker +1 moreRT: Privilege escalation and information disclosure via REST 2.0 user collection endpoint9.1 Critical
- altium enterprise serverPath Traversal in Altium Enterprise Server Viewer StorageController Allows Arbitrary File Read9.4 Critical
- hcl bigfix service management (sm), hcltech bigfix service management +1 moreHCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header3.7 Low
- revolution slider slider revolutionSlider Revolution <= 7.0.9 - Unauthenticated Sensitive Information Exposure via 'sliders/stream'5.3 Medium
- smub all in one seo – powerful seo plugin to boost seo rankings & increase trafficAll in One SEO <= 4.9.7 - Authenticated (Contributor+) Sensitive Information Exposure via 'internalOptions' Localized Script Data4.3 Medium
- laurent22 joplinJoplin Server delta API returns note content after share access is revoked5.7 Medium
- gtsteffaniak filebrowserFileBrowser Quantum: unauthenticated user share share info8.7 High
- strukturag libheiflibheif: Uninitialized Heap Memory Information Leak via Failed Grid Tiles6.5 Medium
github.com/kong/kubernetes-ingress-controllerGo,github.com/kong/kubernetes-ingress-controller/v2Go,github.com/kong/kubernetes-ingress-controller/v3Go +2 moreKong Ingress Controller for Kubernetes (KIC): Cross-namespace TLS Secret Exfiltration in Gateways with GatewayClass missing `konghq.com/gatewayclass-unmanaged: 'true'` annotation5.6 Medium- composerComposer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs7.5 High
- strawberry graphql, strawberry-graphql strawberry +1 moreStrawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs3.1 Low
- argoproj argo cd, argo-cd +1 moreArgo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations6.3 Medium
- @clerk nuxt, nuxt nuxt\/rspack-builder, nuxt\/webpack-builder +2 moreNuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)5.9 Medium
- haxtheweb haxcms-nodejsHAX CMS Vulnerable to Private Key Disclosure via Broken HMAC Implementation9.3 Critical
github.com/xyproto/algernonGoAlgernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: * and no authentication5.3 Medium- mozilla firefox, firefox for ios +1 moreSensitive user data could be leaked to other applications through Reader mode6.5 Medium
- mozilla firefox, thunderbird +1 moreInformation disclosure in the Graphics: WebGPU component7.5 High
- mozilla firefox, thunderbird +1 moreInformation disclosure in the IP Protection component7.5 High
- mozilla firefox, thunderbird +1 moreInformation disclosure in the DOM: Security component7.5 High
- apache ofbizApache OFBiz: Unauthenticated Shipment Label Image Disclosure7.5 High
- zte mu5250Unauthorized access vulnerability in ZTE MU52506.3 Medium
- discourseDiscourse: Cached outdated summaries can leak removed content5.3 Medium
- zauberzeug niceguiNiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()7.5 High
- opentelemetry ebpf instrumentation, open-telemetry opentelemetry-ebpf-instrumentation +1 moreOpenTelemetry eBPF Instrumentation: Java TLS ioctl kprobe allows kernel memory disclosure3.8 Low
- asynchttpclient async-http-clientasync-http-client: Cookie header not stripped on cross-origin redirect7.4 High
- mattermost, mattermost server +1 moreSensitive credentials exposed in plaintext in Mattermost support packets8.7 High
- mattermost, mattermost server +1 moreMattermost Calls plugin exposes TURN server credentials in plaintext in support packets7.6 High
- No product listedAn issue in prestashop upsshipping all versions through at least 2.4.0 allows a remote attacker...7.5 High
- kilo-org kilocode, kilo code cli +1 moreKilo-Org kilocode Environment Variable config.ts load information disclosure5.3 Medium
- h2o, h2oai h2o-3 +1 moreh2oai h2o-3 ImportFile API PersistNFS.java importFiles information disclosure6.9 Medium
- microsoft apmMicrosoft APM: Symlinks under `.apm/prompts/` and `.apm/agents/` are dereferenced during `apm install`, copying host-local file contents into the project tree7.4 High
- huawei emui, harmonyos +1 morePermission control vulnerability in calls. Impact: Successful exploitation of this vulnerability...5.8 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Sharing models for others to use (read permission) also exposes model details (system prompt leakage)4.3 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Exposure of System Prompt to Regular User [Non-Admin]6.5 Medium
- microsoft authenticator, authenticator for android, authenticator for ios +2 moreMicrosoft Authenticator Information Disclosure Vulnerability9.6 Critical
- portainerPortainer: Arbitrary File Read via Git Symlink Injection in Stack Auto-Update8.5 High
- Show moreLoading…