CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- No product listedAn issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information via the tcp_actions() function7.5 High
- mattermost, mattermost desktop +1 morePlaintext pre-auth secret exposure via Desktop App diagnostics report3.6 Low
- apple ipados, macos, tvos +4 more +6 moreAn information leakage was addressed with additional validation. This issue is fixed in iOS 18.7...5.5 Medium
- apple ipados, macos, safari +5 more +7 moreThe issue was addressed with improved checks. This issue is fixed in iOS 18.7.10 and iPadOS 18.7...6.5 Medium
- onyx-dot-app onyxOnyx: Cross-user OAuth-token leak via /api/mcp/servers* for per-user MCP servers9.6 Critical
- stirling-tools stirling-pdfStirling-PDF: Internal Service Account API Key Disclosure via Pipeline Endpoint8.5 High
- patriksimek vm2vm2 before 3.11.6 Process-wide State Exposure via os and dns10.0 Critical
- nicolargo glancesGlances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config5.3 Medium
- quantumnous new-apiNew API: User List API Leaks Root User Access Token Leading to Privilege Escalation9.1 Critical
- huawei emui, harmonyos +1 morePermission control vulnerability in the Gallery module. Impact: Successful exploitation of this...6.2 Medium
- huawei harmonyosPermission control vulnerability in the notification service module. Impact: Successful...6.2 Medium
- huawei harmonyosPermission control vulnerability in the multi-mode input module. Impact: Successful exploitation...6.2 Medium
- orange view limited dualsafe password manager & digital vault extensionOrange View Limited DualSafe Password Manager & Digital Vault Extension postMessage-based Bridge information disclosure2.3 Low
- No product listedMahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a...9.8 Critical
- unknown catfolders document gallery & pdf libraryCatFolders Document Gallery < 2.0.7 - Unauthenticated Attachment Disclosure via REST API7.5 High
- dell ecsECS < 4.3.10 - Contributor+ Arbitrary Post Meta Disclosure via Dynamic Repeater ACF Source6.5 Medium
- ericcornelissen shescapeShescape before 2.1.15 and 3.0.2 Home Directory Disclosure via BusyBox6.3 Medium
- siyuan-note siyuansiyuan before v3.7.4 Server-Side Template Injection via attribute-view8.6 High
- unknown product feed pro for woocommerce by adtribesProduct Feed PRO for WooCommerce < 13.5.7 - Unauthenticated Feed Configuration Disclosure7.5 High
- nsquared simply schedule appointmentsSimply Schedule Appointments < 1.6.12.17 - Team Member+ User Email Disclosure via Users and Customers REST Endpoints6.5 Medium
- linuxdm: avoid leaking the caller's thread keyring via the table device file7.3 High
- webkul bagistoWebkul Bagisto Customer Search search information disclosure5.1 Medium
- dell wyse management suite (wms), wyse management suite +1 moreDell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Missing Authentication...5.3 Medium
- filebrowserfilebrowser before 2.63.19 Permission Bypass via checksum5.3 Medium
- spring for graphql, vmware spring for graphql +1 moreSpring for GraphQL Information Exposure in GraphiQL support7.4 High
- ibm iIBM i is Affected By Multiple Vulnerabilities in Java Secure Sockets Extension4.3 Medium
- elastic kibanaExposure of Sensitive Information to an Unauthorized Actor in Kibana Leading to Disclosure of Fleet Proxy Credentials7.7 High
- ether etherpadEtherpad: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token6.8 Medium
- nodejs undiciundici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches6.5 Medium
- priority portal generator addon to priority erp (developed by soft solutions)Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-359: Exposure of Private Personal Information to an Unauthorized Actor9.1 Critical
- priority portal generator addon to priority erp (developed by soft solutions).Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor8.6 High
- siyuan-note siyuanSiYuan before v3.7.4 Authentication Bypass via Graph Endpoints9.2 Critical
- kong inc. meshKong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authentication5.3 Medium
- apache airflowApache Airflow: Airflow Variables were not masked in the UI for authenticated users4.3 Medium
- apache airflowApache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass)6.5 Medium
- fleetdm fleetFleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint6.5 Medium
- thorsten phpmyfaqphpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration5.4 Medium
- unknown order sync with zendesk for woocommerceOrder Sync with Zendesk for WooCommerce < 2.2.3 - Unauthenticated Customer Order Data Disclosure5.3 Medium
- unknown wpc admin columnsWPC Admin Columns < 2.3.4 - Subscriber+ Arbitrary User/Post/Term Meta Disclosure6.5 Medium
- opajaap wp photo album plusWP Photo Album Plus < 9.2.07.002 - Unauthenticated Option Disclosure via gettogo7.5 High
- boldgrid total upkeepTotal Upkeep < 1.17.3 - Unauthenticated Sensitive Data Disclosure and Forced Site Restore via Predictable cron_secret7.5 High
- unknown import wpImport WP < 2.14.23 - Unauthenticated Sensitive Information Exposure via Export File Download7.5 High
- arraytics eventinEventin < 4.1.20 - Contributor+ Customer PII Disclosure via REST API6.5 Medium
- thimpress learnpressLearnPress < 4.4.4 - Subscriber+ Sensitive Information Exposure via AI Assistant6.5 Medium
- kestra-io kestraKestra: Unauthenticated management `/worker` endpoint exposes live task configuration and plaintext credentials7.5 High
- enteEnte: 2of3 cards v1 contain a checksum that enables offline guessing of low-entropy secrets5.9 Medium
- encode django-rest-frameworkDjango REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests4.3 Medium
- ishankjha740 ishankportfolioishankportfolio: Stored Contact Form Submission Exposure via Public Client-Side Database Configuration8.2 High
- baptistearno typebot.ioGoogle Sheets OAuth access token disclosure to guest members via getAccessToken7.6 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 moreWindows Remote Desktop Client Information Disclosure Vulnerability6.5 Medium
- Show moreLoading…