CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- unknown wpc smart compare for woocommerceWPC Smart Compare for WooCommerce < 6.6.1 - Unauthenticated Password-Protected Product Description Disclosure via woosc_load5.3 Medium
- mahmudul hasan arif fluentboardsFluentBoards 1.95 - 2.0.15 - Unauthenticated Board Member Email Address Disclosure via Public Board Endpoints5.3 Medium
- unknown product badge, label, countdown timer for woocommerceSale Booster 7.0.0 - 7.5.1 - Unauthenticated Non-Public Product Disclosure5.3 Medium
- unknown post grid gutenberg blocksPostX < 5.0.41 - Unauthenticated Custom Field Key Disclosure via REST API5.3 Medium
- brechtvds wp recipe makerWP Recipe Maker < 10.8.2 - Subscriber+ Non-Public List Title Disclosure via wprm_search_lists4.3 Medium
- brechtvds wp recipe makerWP Recipe Maker 10.3.0 - 10.8.1 - Subscriber+ Draft and Private Recipe Content Disclosure via wprm_shortcode_preview4.3 Medium
- stellarwp the events calendarThe Events Calendar 4.5 - 6.17.4.1 - Unauthenticated Non-Public Venue and Organizer Disclosure via REST API5.3 Medium
- arshid easy hide loginEasy Hide Login < 1.7 - Login Page Protection Bypass / Hidden URL Disclosure5.3 Medium
- unknown directorist: ai-powered business directory, listings & classified adsDirectorist 8.1 - 8.9.4 - Unauthenticated Sensitive Data Disclosure via REST Users Endpoint5.3 Medium
- unknown zportalsZportals < 6.4.2 - Subscriber+ User Email Disclosure4.3 Medium
- weblateorg wlcwlc may disclose API tokens to project-configured URLs2.3 Low
- arubanetworks analytics and location engine, hewlett packard enterprise (hpe) ale +1 moreUnauthenticated Remote Sensitive Information Disclosure Vulnerability in HPE Networking Analytics and Location Engine (ALE)5.3 Medium
- arubanetworks analytics and location engine, hewlett packard enterprise (hpe) ale +1 moreUnauthenticated Remote Unauthorized Access, Information Disclosure, and Denial of Service Vulnerabilities in HPE Networking Analytics and Location Engine (ALE)7.3 High
- arubanetworks analytics and location engine, hewlett packard enterprise (hpe) ale +1 moreUnauthenticated Remote Sensitive Information Disclosure Vulnerability in HPE Networking Analytics and Location Engine (ALE)7.5 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path7.4 High
- projectdiscovery nucleiNuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode5.3 Medium
- dokployDokploy: Git Provider Credential Exposure via Unprotected .one Endpoints and application.one9.6 Critical
- darkreaderDark Reader: Ability to request icon-like bitmap data from certain local web servers3.4 Low
- twentyhq twentyTwenty: Field-level read bypass7.1 High
- mispMISP OrganisationsController File Existence and Image-Type Oracle via Forged Upload tmp_name5.1 Medium
- mispMISP Information Disclosure via Forged Upload Path5.3 Medium
- the document foundation libreofficePackage URLs can be used to exfiltrate arbitrary INI file values and environment variables6.7 Medium
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint8.2 High
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Federation and Shovel Gen-Servers Lack format_status Callback — Plaintext Credentials Exposed in Crash Dumps and sys:get_status4.6 Medium
- nofearinc wp-crm system – manage clients and projectsWP-CRM System <= 3.4.6 - Authenticated (Contributor+) Exposure of Sensitive Information via 'contact_id' Parameter4.3 Medium
- laurent22 joplinJoplin: KaTeX `trust:true` enables URL-allowlist bypass leading to NTLMv2 credential theft via UNC path on Windows2.5 Low
- inventreeInvenTree: Plugin-settings GET endpoints are readable without authentication5.3 Medium
- inventreeInvenTree: Administrative staff users can trigger Arbitrary File Read leading to Credential Disclosure6.5 Medium
- jishenghua jsherpjshERP through 3.6 Password Hash Disclosure via /user/info7.1 High
- ntop ntopngntopng: Missing Authorization on System Configuration Backup Download and Listing8.8 High
- gocdGoCD is vulnerable to credential exposure when admins insecurely configure material URLs2.3 Low
- apache airflowApache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter4.3 Medium
- scadabrScadaBR Export Project Endpoint export_project.htm EmportDwr.createExportJSON information disclosure6.9 Medium
- nvm-sh nvmnvm alias resolution follows `..` and discloses files outside $NVM_DIR/alias6.7 Medium
- No product listedStencil core 4.43.5 is vulnerable to Incorrect Access Control.5.3 Medium
- No product listedAn issue in Matter Standard Specification-Implementation gap v1.5.1 Matter Project Chip V1.5.1...5.5 Medium
- d-link dir-x1860zD-Link DIR-X1860Z ubus JSON-RPC interface routerd.get_rand_key information disclosure5.3 Medium
- aiyiyi121 sxdevopsaiyiyi121 SxDevOps settings.py information disclosure6.9 Medium
- jordy meow meow galleryMeow Gallery < 5.5.5 - Author+ Draft and Private Post Disclosure via fetch_posts2.7 Low
- unknown wordlift – ai powered seo – schema, wordlift – ai powered seo – schema +1 moreWordLift <= 3.54.10 - Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints5.3 Medium
- ysinnovations ys leadgen – popup builder, popup maker & form builder for wordpress | lead generation, email marketing, sales, conversions, opt-ins & subscribersYS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Unauthenticated Information Disclosure in 'ysleadgen_get_captured_data' AJAX Action7.5 High
- unknown mgosyncMgoSync 2.1.5 - 2.1.6 - Unauthenticated WooCommerce API Credential Disclosure7.5 High
- unknown nimble page builderNimble Builder <= 3.3.8 - Subscriber+ Non-Public Content Disclosure via sek_get_nimble_content_for_seo_plugins4.3 Medium
- sveltejs devaluedevalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers7.5 High
- 1panel-dev cordyscrmCordysCRM MCP Form Configuration Endpoint Exposed to Anonymous Users6.9 Medium
- red hat advanced cluster management for kubernetes 2Multicluster-observability-addon: multicluster-observability-addon: possible unauthenticated debug/metrics endpoint via cmdfactory.newcontrollercommandconfig (confirmed exposed by engineering)5.4 Medium
- hcl software bigfix service managementHCL BigFix Service Management is affected by multiple security vulnerabilities.3.1 Low
- hcl software bigfix service managementHCL BigFix Service Management is affected by multiple security vulnerabilities.9.8 Critical
- john-dagelmore gptranslate – multilingual ai translation agent for wordpress: translate your site with aiGPTranslate <= 2.34.6 - Unauthenticated Sensitive Information Exposure in Public Frontend Inline Script5.3 Medium
- stellarwp bookit — booking & appointment calendarBookit < 2.6.0.5 - Bookit Staff+ Appointment PII Disclosure2.7 Low
- Show moreLoading…