CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 moreWindows Remote Desktop Client Information Disclosure Vulnerability6.5 Medium
- microsoft dynamics 365, dynamics 365 (on-premises) version 9.1 +1 moreMicrosoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability6.5 Medium
- microsoft teams, teams for ios +1 moreMicrosoft Teams iOS Information Disclosure Vulnerability6.5 Medium
- microsoft defender for endpoint, defender for endpoint for mac +1 moreMicrosoft Defender for Endpoint for Mac Information Disclosure Vulnerability5.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 moreWindows Remote Desktop Client Information Disclosure Vulnerability6.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +23 more +25 moreAMD Zen Information Disclosure Vulnerability5.6 Medium
- activepiecesActivepieces: Server-side request forgery in MCP tool validation endpoint5.3 Medium
- intel proset\/wireless wifiExposure of sensitive information to an unauthorized actor for some Intel(R) PROSet/Wireless WiFi...6.3 Medium
- baptistearno typebot.ioTypeBot vulnerable to OpenAI API key exfiltration in listModels via attacker-controlled baseUrl7.6 High
- opensignlabs opensignOpenSignLabs OpenSign - Information Disclosure5.3 Medium
- opensignlabs opensignOpenSignLabs OpenSign - Information Disclosure7.5 High
- windmill labs windmillWindmill Labs Windmill - Information Disclosure6.5 Medium
- zephyrproject zephyrCross-thread FPU register leak on ARM when FPU enabled without register sharing3.6 Low
- mastodonMastodon: Personally-identifying information disclosure due to incorrect access control validation7.5 High
- dokployDokploy: Cross-tenant Git provider secrets are disclosed to low-privileged service readers via `application.one`6.5 Medium
- discourseDiscourse: Unauthorized eavesdropping on private AI bot conversations.6.5 Medium
- misp cti-transmutecti-transmute Following List Exposes User Email Addresses to Authenticated Users5.3 Medium
- apache tapestryApache Tapestry: Possible classpath file download through URL manipulation7.5 High
- pluginsware advanced classifieds & directory proAdvanced Classifieds & Directory Pro < 3.4.3 - Unauthenticated Non-Public Listing Custom Field Disclosure5.3 Medium
- dimitri grassi salon booking systemSalon Booking System – Free Version < 10.30.34 - Unauthenticated Booking Information Disclosure via Booking Wizard7.5 High
- it path solutions pvt ltd contact form to any apiContact Form to Any API < 3.0.7 - Unauthenticated Sensitive File Disclosure via Predictable Filename7.5 High
- unknown ht contact formHT Contact Form < 2.9.3 - Unauthenticated Saved Form Draft Data Disclosure7.5 High
- unknown login & register formsLogin & Register Forms < 4.0.2 - Unauthenticated Registered User Email Address Disclosure via Lost Password Response7.5 High
- mndpsingh287 file managerBit File Manager < 6.9.1 - Subscriber+ Sensitive Data Disclosure via bitapps_fm_connector7.5 High
- mndpsingh287 file managerBit File Manager < 6.9.1 - Unauthenticated File Activity Log Disclosure7.5 High
- lmammino oidc-authorizerlmammino oidc-authorizer Lambda Authorizer handler.rs log file6.9 Medium
- mingsoft mcmsMingSoft MCMS ms-mdiy get information disclosure6.9 Medium
- mingsoft mcmsMingSoft MCMS ms-mdiy list information disclosure6.9 Medium
- unknown wpc order tip for woocommerceWPC Order Tip for WooCommerce < 3.3.1 - Unauthenticated Order Data Disclosure7.5 High
- passionate programmer peter wp data accessWP Data Access < 5.5.79 - Unauthenticated Sensitive Data Disclosure via Autocomplete Column Authorization Bypass7.5 High
- paolo geodirectoryGeoDirectory < 2.8.169 - Unauthenticated Pending/Draft Listing Disclosure via markers REST Endpoint7.5 High
- unknown wp directory kitWP Directory Kit < 1.5.5 - Subscriber+ User and Unpublished Listing Disclosure6.5 Medium
- unknown wp directory kitWP Directory Kit < 1.5.5 - Subscriber+ Plugin Settings and API Key Disclosure7.5 High
- unknown wp directory kitWP Directory Kit < 1.5.5 - Subscriber+ Contact Message and User Data Disclosure6.5 Medium
- unknown admin safety guard — login security, limit logins, 2fa & brute force protectionAdmin Safety Guard < 1.4.0 - Unauthenticated User Data Disclosure via 2fa/app/users REST Route7.5 High
- unknown wp statisticsWP Statistics < 14.16.10 - Subscriber+ Sensitive Data Disclosure via Metabox AJAX Handlers6.5 Medium
- hkuds nanobotHKUDS nanobot Login-shell Environment shell.py ExecTool._prepare_command information disclosure4.8 Medium
- honojs honoHono: Proxy Helper does not remove response headers listed in the `Connection` header3.7 Low
- datadog android appOn every successful login, the Datadog Android application calls FirebaseCrashlytics.setUserId...6.5 Medium
- sourcecodester online clothing storeSourceCodester Online Clothing Store Dreamweaver Metadata Files _notes file information disclosure6.9 Medium
- @clerk nuxtNuxt before 4.5.1 Information Disclosure via Chrome DevTools6.9 Medium
- gitpython-developers gitpythonGitPython before 3.1.58 Arbitrary File Read via pathspec-from-file7.1 High
- tobit laboratories ag teamdavidTeamDavid: Memory Leak leaking sensitive information9.2 Critical
- saadiqbal password protected — lock entire site, pages, posts, categories, and partial contentPassword Protected < 2.8.4 - Unauthenticated Sensitive Information Exposure via REST API7.5 High
- open-reception appointment-booking-softwareOpenReception's schedule endpoint discloses isPublic=false channels and slot availability to unauthenticated callers5.3 Medium
- statamic cmsStatamic: Missing authorization on Control Panel endpoint allows disclosure of user existence4.3 Medium
- langchain-ai langgraph, langgraph-checkpoint-postgres, langgraph-checkpoint-sqlite +2 moreLangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores5.3 Medium
- open-reception appointment-booking-softwareOpenReception's tenant detail endpoint discloses live PostgreSQL connection string, superuser-scoped in the tested official deployment8.0 High
- unknown datapress (dataverse integration)Dataverse Integration < 2.91 - Contributor+ Server-Side Template Injection (SSTI) to Information Disclosure6.8 Medium
- dell virtual storage integrator for vmware vsphere client, virtual storage integrator +1 moreDell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s...9.1 Critical
- Show moreLoading…