CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- wazuhWazuh discloses cleartext cluster key to low-privilege API users via GET /cluster/local/config6.5 Medium
- adobe dimensionWatchGuard Dimension Session Hijack via Exposed Session Tokens in Diagnostic Logs9.3 Critical
- wazuhWazuh: RBAC permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key7.0 High
- triliumnext triliumTrilium unauthenticated share-search discloses password-protected and hidden shared notes7.5 High
- openremoteOpenRemote before 1.28.0 Cross-Realm Information Disclosure via Notification API8.3 High
- airtable airtable-mcp-cliAirtable MCP CLI before 0.2.5 Credential Disclosure via Unvalidated Configured Endpoint6.9 Medium
- daman jeet finale liteFinale Lite < 2.21.0 - Subscriber+ Campaign Configuration Disclosure via wcct_quick_view_html4.3 Medium
- thimpress learnpressLearnPress – Sepay Payment < 4.0.3 - Unauthenticated Order Status Disclosure5.3 Medium
- unknown workeeraWorkeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Read via Candidate Profile Mass Assignment7.7 High
- unknown wp oauth server ( login with wordpress )WP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log File7.5 High
- No product listedAbsolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1...5.3 Medium
- No product listedAn issue in EcoOnline EHS (com.airsweb.v10) application for Android, version 0.2.499 allows a...9.8 Critical
- weblateorg weblateWeblate: Object-scoped RSS feeds disclose private change history to unauthorized users5.3 Medium
- weblateorg weblateWeblate: Restricted-component change history leaked to non-member project users through the nested `GET /api/projects/{slug}/changes/` endpoint4.3 Medium
- jowilf starlette-adminStarlette-Admin: Unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS5.4 Medium
- unknown simple newsletter pluginNoptin < 4.3.3 - Unauthenticated Subscriber PII and confirm_key Disclosure via Actions Page6.5 Medium
- unknown stripe payment forms by wp full payStripe Payment Forms by WP Full Pay < 8.5.1 - Unauthenticated Customer Portal Subscription and Billing Data Disclosure via Unconfirmed Session5.3 Medium
- themeum kirkiKirki < 6.0.14 - Unauthenticated User and Comment Author Email Disclosure via kirki_get_apis5.3 Medium
- No product listedCohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint.7.5 High
- kimaiKimai before 2.64.0 Missing Authorization via ProjectViewController export8.7 High
- baptistearno typebot.ioTypeBot: Arbitrary server file read via Send Email block attachment path8.7 High
- google chromeInformation leak in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a local...6.5 Medium
- google chromeInformation leak in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a local...5.5 Medium
- google chromeInformation leak in Passwords in Google Chrome on on iOS prior to 152.0.7977.65 allowed a local...6.5 Medium
- google chromeInformation leak in XR in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to...6.5 Medium
- google chromeInformation leak in DataTransfer in Google Chrome prior to 152.0.7977.65 allowed a remote...6.5 Medium
- google chromeInformation leak in FoldableAPIs in Google Chrome prior to 152.0.7977.65 allowed a remote...6.5 Medium
- google chromeInformation leak in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote...4.3 Medium
- google chromeInformation leak in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who...5.3 Medium
- google chromeInformation leak in Intents in Google Chrome on on Android prior to 152.0.7977.65 allowed a...6.5 Medium
- google chromeInformation leak in Bluetooth in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote...5.3 Medium
- google chromeInformation leak in Sharing in Google Chrome on on Android prior to 152.0.7977.65 allowed a local...5.1 Medium
- google chromeInformation leak in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to...4.3 Medium
- google chromeInformation leak in Geolocation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker...6.5 Medium
- google chromeInformation leak in CORS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who...3.1 Low
- google chromeInformation leak in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker...6.5 Medium
- google chromeInformation leak in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote...4.3 Medium
- google chromeInformation leak in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who...5.3 Medium
- google chromeInformation leak in BFCache in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who...3.1 Low
- google chromeInformation leak in CSS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to...6.5 Medium
- google chromeInformation leak in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a...5.5 Medium
- google chromeInformation leak in Animation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker...6.5 Medium
- google chromeInformation leak in Canvas in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to...4.3 Medium
- google chromeInformation leak in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote...6.5 Medium
- google chromeInformation leak in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who...5.3 Medium
- google chromeInformation leak in SignIn in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to...5.9 Medium
- google chromeInformation leak in Payments in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to...4.3 Medium
- google chromeInformation leak in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker...6.5 Medium
- google chromeInformation leak in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to...4.3 Medium
- google chromeInformation leak in Canvas in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to...4.3 Medium
- Show moreLoading…