CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- anthropic claude code, anthropics claude-code +1 moreClaude Code: Insecure Temporary File in /copy Command Enables Response Disclosure and Symlink-Based File Write4.4 Medium
- gnu sed, rapid7 insightconnect sed plugin +1 moreArbitrary File Read in Rapid7 InsightConnect Sed Plugin6.5 Medium
- msi centerInsecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote...7.5 High
- msi centerInsecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote...7.5 High
- No product listedInsecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote...7.5 High
- mastodonMastodon: SSRF protection bypass on older Ruby versions8.6 High
- tryghost ghostGhost Content API filter bypass reveals private fields5.3 Medium
- cap-go capgoCapgo - Information Disclosure via Unauthenticated RPC Function exist_app_v26.9 Medium
- cap-go capgoCapgo - Webhook Signing Secret Disclosure via Non-Admin API Key7.1 High
- curlsending old referer7.5 High
- curlexposing HTTP/3 early data7.5 High
- yapacdev whatsorder – instant checkout for woocommerceWhatsOrder <= 1.0.1 - Unauthenticated Sensitive Information Exposure via Predictable Invoice File URLs5.3 Medium
- 24liveblog – live blog tool24liveblog <= 2.2 - Authenticated (Contributor+) Exposure of Sensitive Information via Block Editor Script Localization4.3 Medium
- No product listedApple M1 GPUs retain register file data between compute shader dispatches from different...8.6 High
- openidentityplatform openamOpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC8.5 High
- gogsGogs: Unauthenticated Organization Teams Information Disclosure via API5.5 Medium
- fossbillingFOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Privileged Admin Functions10.0 Critical
- cap-go capgoCapgo - Information Disclosure via Unauthenticated /updates defaultChannel Parameter8.7 High
- cap-go capgoCapgo - Unauthenticated Channel Enumeration and App Oracle via GET /channel_self8.7 High
- motioneye-project motioneyemotionEye: World-Readable Configuration File Exposes Admin Password Hash5.5 Medium
- gaudire assassin gameMultiple vulnerabilities in the Assassin game by Gaudire6.9 Medium
- gaudire assassin gameMultiple vulnerabilities in the Assassin game by Gaudire9.2 Critical
- craftcms cmsCraft CMS - Missing Authorization in assets/preview-thumb Endpoint5.3 Medium
- cap-go capgoCapgo - Unauthenticated API Key Validity Oracle and User Identity Disclosure via get_identity_apikey_only RPC8.7 High
- cap-go capgoCapgo - Information Disclosure via Unauthenticated /replication Endpoint6.9 Medium
- cap-go capgoCapgo - Unauthenticated Cross-Tenant Metrics Disclosure via RPC Functions6.9 Medium
- cap-go capgoCapgo - EXIF Metadata Exposure via Image Upload6.9 Medium
- cap-go capgoCapgo - Unauthenticated Organization Enumeration and Billing Status Disclosure via Supabase RPC8.7 High
- surrealdbSurrealDB < 3.1.5 Information Disclosure via ORDER BY5.3 Medium
- parse-community parse-serverParse Server: LiveQuery discloses object data to a subscriber across an ACL read-access change2.3 Low
- cap-go capgoCapgo - Cross-Tenant Authorization Bypass via PostgREST Webhook Access7.1 High
- langflowLangflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit9.6 Critical
- http4khttp4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage8.3 High
- dbt-labs dbt-mcpdbt-mcp: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens6.8 Medium
- home-assistant core, home-assistant +1 moreHome Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN7.6 High
- symfony uxSymfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtil6.9 Medium
- microsoft kiota-typescript@microsoft/kiota-http-fetchlibrary: Bearer token and Cookie leak across origin on redirect due to case-mismatched scrub in fetchRequestAdapter5.5 Medium
- statamic cmsStatamic CMS missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources4.3 Medium
- microchip gridtime 3000, gridtime 3000 firmware +1 moreAccess Token Exposure in URL Parameters in GridTime™ 3000 GNSS Time Server4.6 Medium
- tilt-dev tiltTilt: Unauthenticated pprof debug endpoints on the Tilt HUD server8.3 High
- microsoft cost managementMicrosoft Cost Management Information Disclosure Vulnerability7.5 High
- mervinpraison praisonaiPraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default7.5 High
- mervinpraison praisonaiPraisonAI Code agent tools fail open without a workspace boundary7.3 High
- mervinpraison praisonaiPraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation9.8 Critical
- mervinpraison praisonaiPraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage7.5 High
- mervinpraison praisonaiPraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal7.5 High
- codepeople appointment booking calendarAppointment Booking Calendar <= 1.4.01 - Authenticated (Contributor+) Sensitive Information Exposure via 'id' Parameter4.3 Medium
- stellarwp kadence blocks — page builder toolkit for gutenberg editorKadence Blocks <= 3.7.5 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData Localization4.3 Medium
- fireplugins firebox popups – increase sales and grow your email listFireBox Popups <= 3.1.7 - Unauthenticated Sensitive Information Exposure in 'form_id' Parameter5.3 Medium
- steeltoeoss steeltoe.management.endpoint, steeltoe.management.endpointcore +1 moreSteeltoe's env sanitizer misses connection strings — leaks embedded DB passwords7.5 High
- Show moreLoading…