CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- splunk, splunk enterprise, secure gateway +2 moreInformation Exposure through REST API Endpoints in Splunk Secure Gateway4.3 Medium
- leantime json-rpc apiLeantime JSON-RPC API contains a missing authorization vulnerability8.8 High
- ihor-sokoliuk mcp-searxngmcp-searxng hardened-mode SSRF bypasses permit internal URL access6.3 Medium
geolensPyPIGeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)No scoreclaude-faf-mcpnpmclaude-faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools7.5 Highfaf-mcpnpmfaf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools7.5 Highgrok-faf-mcpnpmgrok-faf-mcp has an arbitrary local file read via unconfined `path` argument in FAF tools7.5 High- sgoudelis ground-stationGround Station: Unauthenticated out-of-containment file read via `sigmfplayback` `recordingPath`5.3 Medium
- phpmyfaqphpMyFAQ before 4.1.7 Information Disclosure via PDF Export6.9 Medium
- phpmyfaqphpMyFAQ before 4.1.7 Authentication Bypass via Tracking File8.7 High
- nicolaskulka wps bidouilleWPS Bidouille < 1.33.5 - Subscriber+ User Email Disclosure via wps_get_users5.4 Medium
- easyappointments easy appointmentsEasy Appointments < 4.0.1 - Contributor+ Sensitive Information Disclosure via REST Appointments Listing2.7 Low
- themetechmount truebookerTrueBooker Appointment Booking < 1.2.7 - Unauthenticated Customer PII Disclosure via Multiple AJAX Actions5.3 Medium
- unknown wp directory kitWP Directory Kit < 1.5.7 - Unauthenticated User Email Disclosure via select_2_ajax_user5.3 Medium
- rargames 4gaboards4gaBoards: Mass Information Disclosure (Internal PII Leakage) on /api/users to any authenticated user6.5 Medium
- oracle helidonVulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web...7.5 High
- oracle helidonVulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web...7.5 High
- oracle helidonVulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web...7.5 High
- oracle agile plm mcad connectorVulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component:...5.3 Medium
- oracle hyperion financial managementVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component:...4.9 Medium
- oracle commerce experience manager, commerce guided search, oracle corporation commerce guided search / oracle commerce experience manager +2 moreVulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product...6.8 Medium
- oracle hyperion financial managementVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component:...6.5 Medium
- oracle hyperion financial managementVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component:...5.3 Medium
- oracle hyperion financial managementVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component:...8.1 High
- oracle hyperion financial managementVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component:...7.7 High
- oracle hyperion financial managementVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component:...4.0 Medium
- oracle hyperion financial managementVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component:...4.0 Medium
- oracle hyperion financial managementVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component:...5.3 Medium
- oracle unified directoryVulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD...7.7 High
- oracle helidonVulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web...3.7 Low
- oracle corporation java se, oracle graalvm for jdk, oracle graalvm enterprise editionVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...3.7 Low
- oracle weblogic serverVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)...8.1 High
- oracle outside in technologyVulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component:...7.8 High
- oracle outside in technologyVulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component:...7.8 High
- oracle hyperion infrastructure technologyVulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion ...7.5 High
- google chromeInformation leak in Skia in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to...4.3 Medium
- froxlorFroxlor: Credential and 2FA secret disclosure via Froxlor API endpoints9.0 Critical
- geolens-io geolensGeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data7.5 High
- magicmirrororg magicmirrorMagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables4.3 Medium
- hmbown codewhaleCodeWhale before 0.8.64 Environment Variable Leak via js_execution8.7 High
- hmbown codewhaleCodeWhale before 0.8.64 Argument Injection via git_blame8.3 High
- hmbown codewhaleCodeWhale before 0.8.64 Arbitrary File Read via instructions8.7 High
- hoppscotchHoppscotch: Cross-user private data exposure and UserHistory IDOR via team GraphQL resolvers7.6 High
- mozilla firefox, thunderbird +1 moreSite isolation issue in the CSS Parsing and Computation component9.1 Critical
- mozilla firefox, thunderbird +1 moreInformation disclosure in the DOM: Push Subscriptions component4.3 Medium
- mozilla firefox, thunderbird +1 moreInformation disclosure in the DOM: UI Events & Focus Handling component4.3 Medium
- mozilla firefox, thunderbird +1 moreInformation disclosure in the Graphics component6.5 Medium
- mozilla firefox, thunderbird +1 moreInformation disclosure in the Graphics: Text component6.5 Medium
- mozilla firefox, thunderbird +1 moreSite isolation issue in the Graphics: CanvasWebGL component7.5 High
- arcadedata arcadedbArcadeDB before 26.8.1 Information Disclosure via Cluster Endpoints5.3 Medium
- Show moreLoading…