CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- hcl software mycloud, hcltech dryice mycloud +1 moreHCL MyCloud was affected with Exposure of Sensitive Information to an Unauthorized Actor.3.1 Low
- hcl software mycloud, hcltech dryice mycloud +1 moreHCL MyCloud was affected by Server Version Disclosure2.2 Low
- atlassian confluence data centerThis High severity Information Disclosure vulnerability was introduced in versions 7.17.0, 7.19.0...8.2 High
- hclsoftware intelliops event managementHCL IEM was affected with the Information disclosure nginx server3.7 Low
- mozilla firefox, thunderbird +1 moreInformation disclosure in the Networking: WebSockets component7.5 High
- mozilla firefox, thunderbird +1 moreInformation disclosure in the DOM: Security component7.5 High
- mozilla firefox, thunderbird +1 moreSite isolation issue in the Graphics component7.5 High
- mozilla firefox, thunderbird +1 moreInformation disclosure in the Storage: IndexedDB component7.5 High
- mozilla firefox, thunderbird +1 moreSite isolation issue in the Networking component9.8 Critical
- mozilla firefox, thunderbird +1 moreInformation disclosure in the Framework component in DevTools7.5 High
- mozilla firefox, firefox mobile +1 moreInformation disclosure in the Privacy component in Firefox for Android7.5 High
- mozilla firefox, thunderbird +1 moreInformation disclosure in the Graphics: ImageLib component7.5 High
- openremoteOpenRemote before 1.26.2 Information Disclosure via Syslog REST API5.3 Medium
- No product listedAn issue in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the...7.5 High
- axiosaxios before 0.33.0 Prototype Pollution via Node HTTP adapter8.3 High
- filebrowserFile Browser: Share API exposes the password hash and bypass token2.7 Low
- guzzleguzzlehttp/guzzle before 7.14.2 Proxy-Authorization Header Disclosure6.9 Medium
- themexpert.com quix page builder pro extension for joomlaJoomla Extension - themexpert.com - Information disclosure in Quix Page Builder < 6.2.16.9 Medium
- elementor website builder, unknown elementor website builder +1 moreElementor < 4.1.4 - Contributor+ Sensitive Information Disclosure via REST API4.9 Medium
- libgit2libgit2: HTTP transport can leak credentials to an offsite redirect target6.5 Medium
- No product listedAn issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the...9.9 Critical
- zevorn rt-clawzevorn rt-claw http_request net.c claw_net_post information disclosure6.9 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.7, data grid 8 +3 more +5 moreKeycloak-services: keycloak-services: realm default-group reads disclose hidden groups under fgap v24.3 Medium
- joomdonation.com events booking extension for joomlaJoomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.05.3 Medium
- hcl software aftermarket epcHCL Aftermarket EPC is affected by clickjacking vulnerability Cross-Frame Scripting is an attack...4.3 Medium
- hcl software aftermarket epcHCL Aftermarket EPC is vulnerable to attacks since the server software version used by the...5.3 Medium
- hubspotdev hubspot all-in-one marketing – forms, popups, live chatHubSpot All-In-One Marketing <= 11.3.62 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor Localized Script4.3 Medium
- unknown royal addons for elementorRoyal Elementor Addons < 1.7.1063 - Unauthenticated Private Mega Menu Template Disclosure5.3 Medium
- ploudapp pcloud wp backuppCloud WP Backup <= 2.0.3 - Missing Authorization on the 'start_backup' AJAX Method to Authenticated (Subscriber+) Arbitrary File Read6.5 Medium
- No product listedAn issue in MCMS v.6.1.1 allows a remote attacker to obtain sensitive information via the source...7.5 High
- arcadedata arcadedbArcadeDB before 26.7.2 Authorization Bypass via Database Handlers9.3 Critical
- anthropics buffaBuffa: Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref5.9 Medium
- microsoft simplechatSimpleChat: Authenticated users can access other users' profile metadata through user IDOR endpoints4.3 Medium
- microsoft promptyPrompty: Arbitrary File Read via ${file:path} Reference Expansion7.5 High
- hcl dfxanalyticsHCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability.5.3 Medium
- hcl dfxanalyticsHCL DFXAnalytics is affected by a Missing HTTP Strict-Transport-Security Header vulnerability.3.1 Low
- hcl dfxanalyticsHCL DFXAnalytics is affected by a Missing SameSite Attribute vulnerability.3.0 Low
- hcl dfxanalyticsHCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability.2.6 Low
- hcl dfxanalyticsHCL DFXAnalytics is affected by a Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability3.0 Low
- No product listedAn issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote...5.7 Medium
- No product listedAn issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote...4.3 Medium
- cyberdrop-dlCyberdrop-DL: Pixeldrain API key shared with unverified thirdparty sites5.9 Medium
- nocobaseNocoBase: Sensitive Data Exposure via SQL Blacklist Bypass6.8 Medium
- absolute secure accessMemory disclosure in Secure Access Clients2.1 Low
- splunk, splunk cloud platform, enterprise +2 moreSensitive Information Disclosure through the storage/passwords REST Endpoint in Splunk Enterprise5.3 Medium
- huawei emui, harmonyos +1 morePermission control vulnerability in the Settings module. Impact: Successful exploitation of this...6.6 Medium
- mervinpraison praisonaiPraisonAI before 1.6.78 DNS Rebinding SSRF via web_crawl8.4 High
- tp-link systems inc. kasa ec70 v4, tp-link kasa ec70 firmware, kasa ec71 firmware +1 more +3 moreInformation Disclosure Vulnerability in Local Discovery Response in TP-Link Kasa EC70 and EC715.3 Medium
- czlonkowski n8n-mcpn8n-MCP: Incorrect authorization can expose default-scope workflow version backups in multi-tenant HTTP mode4.2 Medium
Umbraco.AINuGetUmbraco.AI discloses sensitive application configuration values4.9 Medium- Show moreLoading…