CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- easyappointments easy appointmentsEasy Appointments < 3.12.28 - Subscriber+ Sensitive Information Disclosure via REST Appointments Listing4.3 Medium
- easyappointments easy appointmentsEasy Appointments < 3.12.28 - Contributor+ Customer Data Disclosure2.7 Low
- google chromeInappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72...2.4 Low
- google chromeInappropriate implementation in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote...6.5 Medium
- google chromeInappropriate implementation in WebGL in Google Chrome prior to 151.0.7922.72 allowed a remote...6.5 Medium
- google chromeInappropriate implementation in IME in Google Chrome on Mac prior to 151.0.7922.72 allowed a...6.5 Medium
- google chromeInappropriate implementation in Views in Google Chrome on Mac prior to 151.0.7922.72 allowed a...5.5 Medium
- google chromeInappropriate implementation in Views in Google Chrome on Mac prior to 151.0.7922.72 allowed a...6.2 Medium
- google chromeInappropriate implementation in DataTransfer in Google Chrome prior to 151.0.7922.72 allowed a...4.3 Medium
- google chromeInappropriate implementation in Editing in Google Chrome on Linux prior to 151.0.7922.72 allowed...3.5 Low
- google chromeInappropriate implementation in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote...6.5 Medium
- google chromeInappropriate implementation in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote...6.5 Medium
- linuxfabrik monitoring-pluginsLinuxfabrik monitoring-plugins: SSRF and auth-token disclosure via unvalidated @odata.id link in redfish-* plugins8.3 High
- linuxfabrik monitoring-pluginslinuxfabrik-lib: fetch() forwards credential headers across a cross-origin redirect6.0 Medium
- nodejs undiciundici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives7.4 High
- acacode swagger-typescript-apiswagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`7.4 High
- balbooa gridbox, balbooa.com gridbox extension for joomla +1 moreJoomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.25.3 Medium
- apache traffic serverApache Traffic Server: Improper server-session reuse can expose data across client connections6.9 Medium
- an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lmsInformation disclosure vulnerability4.3 Medium
- unknown shinystat analyticsShinyStat Analytics < 1.0.17 - Unauthenticated Non-Published Product Information Disclosure5.3 Medium
- ddnexus pagyPagy I18n locale option is not validated before being used in a file path6.9 Medium
- koxudaxi datamodel-code-generatordatamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`7.5 High
- koxudaxi datamodel-code-generatordatamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas3.7 Low
- koxudaxi datamodel-code-generatorArbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate7.5 High
- ruby-oauth oauth2OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host8.6 High
- cordea oauthOAuth: Cross-origin token-request redirects can expose signed request metadata7.2 High
- ibm openbmc, power system e1050 \(9043-mrx\) firmware, power system e1150 \(9043-mru\) firmware +13 more +15 moreThis Power System update is being released to address a sensitive information disclosure4.5 Medium
- nextlevelbuilder goclawnextlevelbuilder GoClaw jq Handler tools_invoke.go ExecTool.Execute information disclosure5.3 Medium
- joomdle.com joomdle component for joomlaJoomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle < 3.1.17.5 High
- quantumcloud wpbot – ai chatbot for live support, lead generation, ai servicesWPBot <= 8.5.9 - Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Action5.3 Medium
- deveasel demi – one click demo import, backup & site migrationDemi <= 0.0.8 - Unauthenticated Information Exposure to Arbitrary Directory Copy5.3 Medium
- apple macosThis issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.8, macOS...5.5 Medium
- apple macosAn information disclosure issue was addressed with improved privacy controls. This issue is fixed...5.5 Medium
- apple ipados, tvos, visionos +3 more +5 moreA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.6...5.5 Medium
- apple macosA logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.8...5.5 Medium
- apple ipados, macos, tvos +4 more +6 moreA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.6...9.8 Critical
- apple macosA privacy issue was addressed by removing sensitive data. This issue is fixed in macOS Sequoia 15...5.5 Medium
- apple macos, ios and ipados +1 moreAn information leakage was addressed with additional validation. This issue is fixed in macOS...5.5 Medium
- apple ipados, macos, tvos +4 more +6 moreThis issue was addressed with improved checks. This issue is fixed in iOS 26.6 and iPadOS 26.6,...5.5 Medium
- apple ipados, macos, tvos +4 more +6 moreThis issue was addressed with improved data protection. This issue is fixed in iOS 26.6 and...9.8 Critical
- apple ipados, macos, tvos +4 more +6 moreThe issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS...5.5 Medium
- apple ipados, macos, tvos +3 more +5 moreAn information disclosure issue was addressed by removing the vulnerable code. This issue is...5.5 Medium
- apple ipados, macos, tvos +4 more +6 moreThis issue was addressed with improved data protection. This issue is fixed in iOS 26.6 and...5.5 Medium
- apple macos, watchos +1 moreAn authorization issue was addressed with improved state management. This issue is fixed in macOS...5.5 Medium
- apple ipados, ios and ipados, iphone os +2 moreAn authorization issue was addressed with improved state management. This issue is fixed in iOS...5.5 Medium
- apple macos, watchos +1 moreAn authorization issue was addressed with improved state management. This issue is fixed in macOS...5.5 Medium
- apple macos, ios and ipados +1 moreThis issue was addressed with improved redaction of sensitive information. This issue is fixed in...5.5 Medium
- apple ipados, macos, visionos +3 more +5 moreThe issue was addressed with improved checks. This issue is fixed in iOS 26.6 and iPadOS 26.6,...5.5 Medium
- apple ipados, macos, ios and ipados +1 more +3 moreThis issue was addressed with improved checks. This issue is fixed in iOS 26.6 and iPadOS 26.6,...5.5 Medium
- jfrog artifactoryJFrog Artifactory build environment properties exposure6.5 Medium
- Show moreLoading…