CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- No product listedAn information disclosure vulnerability in the opcua-configuration method of /cgi-bin/wwwugw.cgi...6.5 Medium
- No product listedAn issue in Invoice Ninja v5.13.24 allows a remote attacker to obtain sensitive information via...7.5 High
- medplumMedplum - Exposure of OAuth client secret via dynamic registration endpoint in self-hosted configurations8.2 High
- wwbn avideoWWBN AVideo Broken Access Control via feed/index.php program_id6.9 Medium
- wwbn avideoWWBN AVideo Broken Access Control via Channel Page6.9 Medium
- jenkins script security, jenkins project script security plugin +1 moreJenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor`...4.3 Medium
- unknown masterstudy lms wordpress pluginMasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure via student/stats REST Route5.3 Medium
- unknown masterstudy lms wordpress pluginMasterStudy LMS < 3.7.46 - Unauthenticated Unpublished Course Title Disclosure via course-list REST Route5.3 Medium
- unknown masterstudy lms wordpress pluginMasterStudy LMS < 3.7.46 - Unauthenticated Student Enrollment Disclosure via student-courses REST Route5.3 Medium
- softaculous formlayerFormLayer < 1.0.9 - Unauthenticated Form Configuration Disclosure via Form Submission Response5.3 Medium
- rank math seo math seo, unknown rank math seo +1 moreRank Math SEO < 1.0.277.1 - Unauthenticated Password-Protected Post Content Disclosure via Post Metadata and llms.txt5.3 Medium
- ultimate member member, unknown ultimate member +1 moreUltimate Member < 2.13.0 - Unauthenticated Unapproved Comment Disclosure via Profile Activity5.3 Medium
- gutentorGutentor < 4.0.6 - Subscriber+ Password Protected Post Password Disclosure via REST API4.3 Medium
- solacewp solace extraSolace Extra < 1.7.0 - Unauthenticated Draft/Private Site Builder Content Disclosure via get_elementor_content5.3 Medium
- google chromeInformation leak in MediaCapture in Google Chrome prior to 152.0.7977.75 allowed a remote...6.5 Medium
- google chromeInformation leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who...3.1 Low
- wwbn avideoWWBN AVideo through 30.0 Information Disclosure via MobileManager6.9 Medium
- hewlett packard enterprise (hpe) aos-cx, hpe arubaos-cx +1 moreAuthenticated Sensitive Information Disclosure Vulnerabilities in AOS-CX7.7 High
- arubanetworks fabric composerAuthenticated Sensitive Information Disclosure in HPE Networking Fabric Composer API4.4 Medium
- arubanetworks fabric composerAuthenticated Sensitive Information Disclosure in HPE Networking Fabric Composer4.7 Medium
- arubanetworks fabric composerLocal Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer5.6 Medium
- arubanetworks fabric composerUnauthenticated Limited Information Disclosure allows Data Exposure in the API of HPE Networking Fabric Composer3.1 Low
- red hat certificate system 9, enterprise linux 10, enterprise linux 6 +3 more +5 morePki-core: dogtag-pki: unauthenticated dogtag ca rest api exposes security domain hosts5.3 Medium
- mozilla firefox, thunderbird +1 moreInternally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.159.8 Critical
- mozilla firefox, thunderbird +1 moreInternally found bugs fixed in Thunderbird 1559.8 Critical
- mozilla firefox, thunderbird +1 moreOther issue in the DOM: Navigation component6.1 Medium
- mozilla firefox, firefox mobile +1 moreOther issue in Firefox Focus for Android9.8 Critical
- mozilla firefox, thunderbird +1 moreOther issue in the Profile Backup component9.8 Critical
- mozilla firefox, thunderbird +1 moreInformation disclosure in the Networking: HTTP component7.5 High
- mozilla firefox, thunderbird +1 moreInformation disclosure in the Graphics: WebGPU component7.5 High
- mozilla firefox, firefox mobile +1 moreInformation disclosure in the WebExtensions component in Firefox for Android4.3 Medium
- iqonic design kivicareKiviCare – Clinic & Patient Management System (EHR) < 4.5.5 - Unauthenticated Patient Data Disclosure5.3 Medium
- google androidIn Cellular Modem, there is a possible information disclosure due to a logic error in the code....8.8 High
- google androidIn VPU, there is a possible information dislclosure due to a logic error in the code. This could...4.4 Medium
- oasdiff oasdiff-actionoasdiff actions resolve external $refs by default, enabling SSRF and disclosure of structured files on pull-request runs8.3 High
- extension.vn 2fa authenticator extensionextension.vn 2FA Authenticator Extension Background Service Worker chrome.runtime.onMessageExternal.addListener information disclosure4.8 Medium
- vidiq vision for youtube extensionvidIQ Vision for YouTube Extension postMessage window.addEventListener information disclosure5.3 Medium
- code-projects simple inventory systemcode-projects Simple Inventory System Database Backup File inventorymanagement.sql information disclosure6.9 Medium
- ash-project ash cloakCloaked plaintext leaks through a non-sensitive action argument in AshCloak2.1 Low
- linux foundation magmaLinux Foundation Magma InitialUEMessage information disclosure6.9 Medium
- admidioAdmidio before 5.0.12 Authentication Bypass via RSS feeds8.7 High
- siyuan-note siyuanSiYuan before v3.8.1 Missing Authorization via /history and /repo/diff6.9 Medium
- higheredlab hel online classroom: ai-powered online classroomsHEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated BigBlueButton API Secret Disclosure7.5 High
- piccolo-orm piccolo adminPiccolo Admin: Privilege escalation - admin to superuser via session-token disclosure in GET /api/tables/sessions/.8.8 High
- starrocksStarRocks Query Detail Endpoint Returns Every User's Query History6.5 Medium
- wwbn avideoWWBN AVideo through 30.0 Information Disclosure via report4.json.php6.9 Medium
- unknown user frontendWP User Frontend < 4.3.10 - Unauthenticated User Email and Phone Disclosure via User Directory5.3 Medium
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreThe comparison used for the doveadm password and API key is not fully timing safe and can reveal...3.1 Low
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreAn attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes...4.3 Medium
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreWhen IMAP compression is enabled, the same compression state is reused across responses in a...3.7 Low
- Show moreLoading…