CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- apache software foundation syncopeApache Syncope: JWT Access Token takeover7.5 High
- mispMISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection8.4 High
- regularlabs.com advanced module manager (free, pro) extension for joomla, conditional content (free, pro) extension for joomla, content templater (pro) extension for joomla +1 more +3 moreJoomla Extension - regularlabs.com - Database data disclosure in Advanced Module Manager (Free, Pro) < 12.1.0, Conditional Content (Free, Pro) < 8.0.0, Content Templater (Pro) < 14.2.0, ReReplacer (Pr…6.9 Medium
- chengdu qilu technology ludashiChengdu Qilu Technology Ludashi ComputerZ_x64.sys sub_11008 information disclosure4.6 Medium
- stellarwp bookit — booking & appointment calendarBookit < 2.6.0.1 - Unauthenticated Appointment PII Disclosure via Availability Check5.3 Medium
- unknown user registration & membershipUser Registration & Membership < 5.2.8 - Unauthenticated User Data Disclosure via Membership Thank You Page3.7 Low
- unknown contact form to chat apps | click to chat to orderSocial Contact Form (FormyChat) < 2.15.8 - Unauthenticated Gravity Forms Entry Disclosure via formychat_get_gf_entry5.3 Medium
- wwbn avideoWWBN AVideo Missing Authorization via mediaSession.json.php6.9 Medium
- wwbn avideoWWBN AVideo Missing Authorization via videosAndroid.json.php Endpoint6.9 Medium
- wwbn avideoWWBN AVideo Missing Authorization in ImageGallery list.json.php6.9 Medium
- wwbn avideoWWBN AVideo Unauthenticated Information Disclosure via menus.json.php6.9 Medium
- wwbn avideoWWBN AVideo Missing Authentication via menuItems.json.php6.9 Medium
- wwbn avideoWWBN AVideo Missing Authorization via playlistsFromUser.json.php6.9 Medium
- wwbn avideoWWBN AVideo Missing Authorization via adsInfo API Endpoint6.9 Medium
- wproyal royal addons for elementor – addons and templates kit for elementorRoyal Addons for Elementor <= 1.7.1066 - Unauthenticated Sensitive Information Exposure via Unfiltered meta_query LIKE Oracle in 'wpr_keyword' Parameter5.3 Medium
- unknown wpbotWPBot 8.4.9 - 8.5.9 - Unauthenticated Chat Visitor PII Disclosure5.3 Medium
- unknown zonifyZonify < 1.0.5 - Unauthenticated Account Login Token Disclosure7.5 High
- unknown surerank seoSureRank 1.6.2 - 1.10.0 - Unauthenticated Author Email Disclosure via Person Schema5.3 Medium
- t-mart mouseholeMousehole: Unauthenticated HTTP/WebSocket boundary exposes and mutates MAM cookie state6.9 Medium
- nl-portal nl.nl-portal:appnl.nl-portal:app has GraphiQL UI and GraphQL schema introspection enabled by default5.3 Medium
- red hat build of keycloak 26.6.8, single sign-on 7 +1 moreKeycloak-services: keycloak-services: confidential client secret disclosed to view-clients role via client registration get4.9 Medium
- wwbn avideoAVideo WebRTC Plugin Information Disclosure via status.json.php6.9 Medium
- unknown teddy-bear-customize-addonTeddy Bear Customize Addon <= 1.0.5 - Unauthenticated Order Data Disclosure5.3 Medium
- angularAngular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`4.0 Medium
- rclonerclone: http backend forwards custom/auth headers to a different host on redirect3.7 Low
- openpanel-dev openpanelOpenPanel through 2.3.0 Unauthenticated Share Lookup Information Disclosure8.7 High
- wwbn avideoAVideo PlayerSkins seo.php Missing Authorization Password-Protected VOD8.7 High
- wwbn avideoAVideo through c3edcc274c389816d434acadac07ee78eaf330c1 Authentication Bypass8.7 High
- unknown ultimate gift cards for woocommerceUltimate Gift Cards for WooCommerce 3.0.3 - 3.2.9 - Unauthenticated Gift Card Code and Customer PII Disclosure via wps_uwgc_report_details7.5 High
- palo alto networks prisma access agentPrisma Access Agent: Information Disclosure Vulnerability on Linux4.3 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends4.3 Medium
- smithyhq sqladminSQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`5.3 Medium
- grokability snipe-itSnipe-IT before 8.7.0 Cross-Company Read via requested-assets5.3 Medium
- cyberpanelCyberPanel 2.4.3 through 2.4.5 Information Disclosure via AI Scanner6.9 Medium
- gitpython-developers gitpythonGitPython 3.1.59 Local File Content Oracle via --no-index7.1 High
- siyuan-note siyuanSiyuan before v3.8.2 Information Disclosure via fullTextSearchBlock6.9 Medium
- themeum kirkiKirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter5.3 Medium
- psm plugins supportcandySupportCandy 3.3.6 - 3.5.2 - Unauthenticated Ticket Content Disclosure via Auth Code Leak5.3 Medium
- psm plugins supportcandySupportCandy 3.2.9 - 3.5.2 - Unauthenticated Ticket Attachment Disclosure5.3 Medium
- payment plugins for paypal woocommerce, unknown payment plugins for paypal woocommerce +1 morePayment Plugins for PayPal WooCommerce < 2.0.26 - Unauthenticated Customer PII Disclosure via order-pay5.3 Medium
- paymentplugins payment plugins for stripe woocommercePayment Plugins for Stripe WooCommerce < 4.0.12 - Unauthenticated Customer PII Disclosure via order-pay5.3 Medium
- team tangible loops & logicLoops & Logic < 4.3.0 - Unauthenticated User Data and Site Option Disclosure7.5 High
- tanium serverTanium addressed an information disclosure vulnerability in Tanium Server.4.3 Medium
- tanium complyTanium addressed an information disclosure vulnerability in Comply.4.3 Medium
- google chromeInformation leak in Editing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to...6.5 Medium
- google chromeInformation leak in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to...6.5 Medium
- google chromeInformation leak in Frames in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to...6.5 Medium
- google chromeInformation leak in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to...4.3 Medium
- google chromeInformation leak in Transactions Platform in Google Chrome prior to 153.0.8010.36 allowed a...6.5 Medium
- google chromeInformation leak in Passwords in Google Chrome on on Android prior to 153.0.8010.36 allowed a...6.5 Medium
- Show moreLoading…