CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- google chromeInformation leak in Enterprise in Google Chrome prior to 155.0.8059.39 allowed a remote attacker...4.3 Medium
- google chromeInformation leak in Omnibox in Google Chrome on on Android prior to 155.0.8059.39 allowed a...6.5 Medium
- google chromeInformation leak in Proxy in Google Chrome on on Windows prior to 155.0.8059.39 allowed an...5.3 Medium
- harttle liquidjsLiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration6.0 Medium
- payloadcms payloadPayload external upload trust validation issue7.2 High
- payloadcms payloadPayload: Token refresh and password reset responses may expose restricted user fields7.1 High
- payloadcms payloadPayload: Polymorphic join queries could disclose hidden fields7.1 High
- payloadcms payloadPayload: Sort queries could expose protected field information6.9 Medium
- bqworks slider proSlider Pro <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via sliderpro_multiple_images5.3 Medium
- No product listeduptrace user_handler.go Login information exposure6.9 Medium
- No product listedAn issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive information via the ...4.9 Medium
- vllmvLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle3.1 Low
- docling, docling-project docling-slim +1 moreDocling: Crafted DoclingDocument JSON embeds local image files into converted output4.3 Medium
- penpotPenpot: Share-link page-scope escape — comment RPCs leak comment content, author identity, and all page-ids for pages outside the share scope4.3 Medium
- makeplane planePlane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane9.8 Critical
- makeplane planePlane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token7.4 High
- makeplane planePlane: Workspace cycle and module endpoints missing project-membership filter expose private project metadata to any workspace member4.3 Medium
- the document foundation libreofficeEnvironment/ini-file leaks6.7 Medium
- the document foundation libreofficeLFI and GET SSRF via GStreamer and HLS playlists6.7 Medium
- the document foundation libreofficeLFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db href6.7 Medium
- the document foundation libreofficeLFI and GET SSRF via calcext:data-mappings and csv provider6.7 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: user session note mapper exposes upstream idp access tokens5.7 Medium
- zitadelZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode9.2 Critical
- siyuan-note siyuanSiYuan before 3.8.5 Information Disclosure via /api/block/getDocInfo and getDocsInfo6.9 Medium
- verint verbaWeaviate Verba generate_stream Endpoint util.py get_environment information disclosure6.9 Medium
- unknown five star business profile and schemaFive Star Business Profile and Schema 2.3.20 - 2.3.21 - Author+ Sensitive Data Disclosure via Schema Field Default Callback4.9 Medium
- omega solution coinex cryptoOmega Solution CoinEx Crypto Support Ticket API customer information disclosure5.3 Medium
- openidentityplatform openamOpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint6.9 Medium
- legion of the bouncy castle inc. bc-lts-javaNative AES packet cipher returns the raw AES key on an alias8.2 High
- genetech products pie registerPie Register < 3.8.4.14 - Unauthenticated User Email Disclosure via Invitation Code3.7 Low
- unknown metformMetForm 2.2.1 - 4.3.0 - Unauthenticated Debug File Disclosure via HubSpot Forms Integration3.7 Low
- unknown metformMetForm < 4.3.1 - Unauthenticated Form Entry Data Disclosure via REST API5.3 Medium
- unknown wp ultimate csv importerWP Ultimate CSV Importer < 9.2 - Unauthenticated Imported Data Disclosure via Predictable Log Path3.7 Low
- wpzoom connect: ai chat, click to chat, social icons & share buttonsWPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons <= 4.7.3 - Unauthenticated Sensitive Information Disclosure via HMAC Signature Collision (Missing Domain Separation) in HMAC Signat…5.3 Medium
- rajnandan1 kenerKener 4.0.0 before 4.1.6 Hidden Monitor Data Disclosure via Dashboard API6.9 Medium
- backdropBackdrop CMS before 1.35.1 Information Disclosure via Configuration Export Archive8.2 High
- hkuds vibe-tradingHKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE9.3 Critical
- hkuds vibe-tradingHKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via read_document and safe_user_path8.7 High
- triggerdotdev trigger.devTrigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IO8.3 High
- canonical maasRPC secret disclosure via vendor data endpoint in Canonical MAAS5.3 Medium
- google chromeInformation leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to...6.5 Medium
- yeswikiYesWiki before 4.6.7 Read-ACL Bypass via recentchangesrssplus RSS Action6.9 Medium
- siyuan-note siyuanSiYuan before v3.8.5 Information Disclosure via /api/notebook/getNotebookInfo6.9 Medium
- themeisle otter blocks – gutenberg blocks, page builder for gutenberg editor & fseOtter Blocks <= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget3.1 Low
- syed balkhi giveaways and contests by rafflepressGiveaways and Contests by RafflePress < 1.12.27 - Unauthenticated reCAPTCHA Secret Key Disclosure via Giveaway Page5.3 Medium
- emarket-design request a quoteRequest a Quote <= 2.5.6 - Unauthenticated Quote Request Contact Record Disclosure via emd_get_std_pagenum5.3 Medium
- johnson controls easy io neo- Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo allows Collect...6.3 Medium
- hcl software bigfix service managementHCL BigFix Service Management is affected by multiple security vulnerabilities.3.7 Low
- hcl software bigfix service managementHCL BigFix Service Management is affected by multiple security vulnerabilities.5.3 Medium
- apache http serverApache HTTP Server: mod_session: Session cookie not removed during internal redirect7.5 High
- Show moreLoading…