CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft graphMicrosoft Graph Information Disclosure Vulnerability6.5 Medium
- runzero platform, shopware +1 moreShopware: Admin Account Takeover via User Recovery Hash Exposure6.8 Medium
- axios, red hat cryostat 4, gatekeeper 3 +63 more +65 moreAxios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection7.5 High
- mispMISP Dashboard widget field selection may expose restricted user and organisation data5.3 Medium
- mispUnauthorized exposure of private galaxies in MISP event template creation5.3 Medium
- acer connect m6e 5g portable wifi router, connect m6e 5g firmware +1 moreUnauthenticated IPv6 WAN Management Exposure6.9 Medium
- acer connect m6e 5g portable wifi router, connect m6e 5g firmware +1 moreWeak Static Cryptographic Initialization Vectors6.9 Medium
- acer connect m6e 5g portable wifi router, connect m6e 5g firmware +1 morePublicly Readable AWS S3 Telemetry Buckets8.7 High
- acer connect m6e 5g portable wifi router, connect m6e 5g firmware +1 moreHard-coded APK Resource Credentials & Scepters8.7 High
- No product listedAn issue in Neterbit NW-431F Router vNW-431F-20241014-IR03 allows a remote attacker to obtain...8.2 High
- fossbillingFOSSBilling version exposed via asset cache buster6.9 Medium
- phoenix contact charx sec-3000, charx sec-3050, charx sec-3100 +1 more +3 morePhoenix Contact: Unauthenticated log download vulnerability in the firmware of CHARX SEC-3xxx charging controllers7.5 High
- No product listedMercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 responds to version.bind CHAOS TXT...4.3 Medium
- No product listedMercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 exposes an undocumented ...4.3 Medium
- No product listedMercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized...7.3 High
- No product listedMercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 discloses kernel memory layout...4.3 Medium
- danny-avila librechatLibreChat Exfiltrates Server Secrets via MCP Server URL Injection9.6 Critical
- aiven-open klawKlaw: Improper Access Control Allows Disclosure of Password Hash6.9 Medium
- ditec a.s. d.launcher 2Improper URL Handler Processing in D.Launcher 2 enables NTLM Credential Disclosure and SSRF attacks6.5 Medium
- elabftwelabftw has entry title leakage through autocompletion search4.3 Medium
- cloud foundry foundation cf deployment, uaa release +1 moreCloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure....10.0 Critical
- nextcloud calendar, kiteworks security-advisories +1 moreNextcloud: Calendar app leaked user identifiers via attendee suggestion endpoint4.3 Medium
- nextcloud approval, kiteworks security-advisories +1 moreNextcloud: Information disclosure in Nextcloud Approval app via fileId parameter reveals workflow associations3.3 Low
- kiteworks security-advisoriesNextcloud: Missing permission check for from submissions6.5 Medium
- sourcecodester pet grooming management softwareSourceCodester Pet Grooming Management Software admin file information disclosure6.9 Medium
- apache airflowApache Airflow: Rendered template truncation bypasses nested sensitive-key masking6.5 Medium
- apache airflowApache Airflow: Variable masker depth-limit bypass returns cleartext nested secrets6.5 Medium
- apache airflowApache Airflow: Incomplete Redaction of Sensitive Fields in Connection Extra API Response6.5 Medium
- otrsBypass DedicatedAgentToCustomerGroups Setting5.7 Medium
- otrsPossible information disclosure via External Interface5.7 Medium
- mervinpraison praisonaiPraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate8.7 High
- mervinpraison praisonai, praisonaiagents +1 morePraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context5.5 Medium
- admidioAdmidio writes session IDs and auto-login cookie values to application logs4.4 Medium
- cloudways breeze cacheBreeze Cache <= 2.5.2 - Unauthenticated Exposure of Sensitive Information to an Unauthorized Actor via Crafted Login Cookie5.3 Medium
- ays-pro poll maker by ays – versus polls, anonymous polls, image pollsPoll Maker by AYS <= 6.3.7 - Authenticated (Subscriber+) Sensitive Information Exposure in 'ays_poll_get_user_information' AJAX Action4.3 Medium
- google chromeInappropriate implementation in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote...3.1 Low
- google chromeInappropriate implementation in Media in Google Chrome on Windows prior to 148.0.7778.216 allowed...3.1 Low
- google chromeInappropriate implementation in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote...6.5 Medium
- google chromeInappropriate implementation in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a...4.3 Medium
- google chromeInappropriate implementation in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed...4.3 Medium
- google chromeInappropriate implementation in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a...6.5 Medium
- oracle rest data servicesVulnerability in Oracle REST Data Services (component: General). Supported versions that are...5.3 Medium
- oracle rest data servicesVulnerability in Oracle REST Data Services (component: Mongoapi). Supported versions that are...5.3 Medium
- rustfsRustFS: Unauthenticated RustFS console license endpoint exposes license metadata6.9 Medium
- smub pdf embedder – pdf viewer & embed pdf files for wordpressPDF Embedder <= 4.9.3 - Authenticated (Contributor+) Information Exposure via Block Editor Page4.3 Medium
- struktur libheiflibheif Vulnerable to Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation7.5 High
- marcantondahmen automadAutomad Broken Access Control: unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpoint7.5 High
- budibaseBudibase: Snowflake private key returned unmasked from datasource API to BASIC users7.7 High
- error311 fileriseFileRise: TOTP Bypass via Setup Endpoint Disclosing Existing Secret7.4 High
- ibm guardium data protectionIBM Guardium Data Protection is affected by Exposure of Sensitive Information vulnerability6.5 Medium
- Show moreLoading…