CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- wpdevelop booking calendarBooking Calendar <= 11.4.3 - Unauthenticated Sensitive Information Exposure in 'WPBC_FLEXTIMELINE_NAV' AJAX Action5.3 Medium
- codename065 download managerDownload Manager <= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension Email4.3 Medium
- ladela online scheduling and appointment booking system – booklyOnline Scheduling and Appointment Booking System <= 28.4 - Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_details5.3 Medium
code.vikunja.io/apiGoVikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint5.3 Mediumcode.vikunja.io/apiGoVikunja: Cross-project task disclosure through subtask expansion6.0 Medium- contaoContao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled5.3 Medium
- 0xjacky nginx-ui, nginxui nginx ui +1 more0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser8.8 High
- unknown sendpress newslettersSendPress <= 1.26.1.20 - Unauthenticated Newsletter Sending Log Disclosure via Hardcoded Token5.3 Medium
- No product listedAn issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114...7.5 High
- microsoft azure api centerAzure API Center Information Disclosure Vulnerability8.7 High
- python-mechanize mechanizeMechanize sends credential headers to another host after an HTTP redirect6.8 Medium
- python-mechanize mechanizeMechanize sends credential headers to a different scheme or port after a redirect5.9 Medium
- python-mechanize mechanizeMechanize sends credential headers to another origin after a meta refresh6.8 Medium
- ibm guardium data protectionIBM Guardium Data Protection Information Disclosure6.5 Medium
- docker sandboxesDocker Sandboxes egress proxy could forward unrecognized client credentials to managed hosts5.9 Medium
- mariadb-corporation mariadb-connector-nodejsMariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters7.5 High
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: view-clients role allows retrieval of active client secrets via installation provider endpoints4.9 Medium
- broadcom brocade active support connectivity gateway, brocade active support connectivity gateway +1 moreAn unauthenticated network-based attacker can query specific internal management endpoints on...5.3 Medium
- unknown track orders for woocommerceTrack Orders for WooCommerce < 1.2.7 - Unauthenticated PII Disclosure via 'email' Parameter5.3 Medium
- unknown sms alertSMS Alert 3.6.4 - 4.0.0 - Admin+ Network User Billing Phone Disclosure via Bulk User Actions2.7 Low
- unknown wallet system for woocommerceWallet System for WooCommerce < 2.8.0 - Subscriber+ Store-Wide Wallet Transaction Disclosure via Export4.3 Medium
- unknown backwpupBackWPup < 5.7.7 - Unauthenticated Sensitive Data Disclosure via Restore Working Directory on NGINX5.9 Medium
- unknown booking calendarBooking Calendar 10.15 - 11.8.2 - Editor+ Arbitrary Option Disclosure2.7 Low
- easy digital downloads digital downloads, unknown easy digital downloads +1 moreEasy Digital Downloads < 3.7.1 - Subscriber+ Sensitive Information Disclosure via User Downloads Block4.3 Medium
- @backstage plugin-kubernetes-backend, backstage, linuxfoundation backstage\/plugin-kubernetes-backend +2 moreBackstage: Sensitive information disclosure in Kubernetes resource queries5.0 Medium
- unknown user private filesUser Private Files < 2.1.9 - Subscriber+ User Email Address Disclosure via dpk_upvf_rmv_access4.3 Medium
- optimoleOptimole 4.0.0 - 4.2.14 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget6.5 Medium
- arraytics wpcafeWPCafe < 3.0.21 - Unauthenticated Product Data Disclosure via REST API5.3 Medium
- unknown geliver akıllı kargo pazaryeriGeliver Akıllı Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated API Key Disclosure via Public Log File6.5 Medium
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities7.7 High
- No product listedAn issue in iTerm2 macOS before 3.6.12 allows a local attacker to obtain sensitive information.5.5 Medium
- giteaGitea profile feed disclosure bypassing user visibility4.3 Medium
- @backstage plugin-scaffolder-backend, backstage, linuxfoundation backstage\/plugin-scaffolder-backend +2 moreBackstage: Sensitive information exposure in Scaffolder9.6 Critical
- @backstage plugin-scaffolder-backend-module-sentry, backstage, linuxfoundation backstage\/plugin-scaffolder-backend-module-sentry +2 moreBackstage: Improper input validation in Sentry scaffolder actions8.5 High
- hewlett packard enterprise (hpe) clearpass policy manager (cppm)Local Disclosure of Sensitive Information in HPE Networking ClearPass Policy Manager Client Software5.5 Medium
- hewlett packard enterprise (hpe) aos-switch (aos-s)Unauthenticated Sensitive Information Disclosure in AOS-S6.5 Medium
- google chromeInformation leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker...8.8 High
- google chromeInformation leak in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a...8.8 High
- google chromeInformation leak in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker...9.6 Critical
- google chromeInformation leak in Passwords in Google Chrome prior to 155.0.8059.39 allowed a remote attacker...8.8 High
- google chromeInformation leak in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a local...4.6 Medium
- google chromeInformation leak in Editing in Google Chrome prior to 155.0.8059.39 allowed a remote attacker...4.3 Medium
- google chromeInformation leak in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local...5.1 Medium
- google chromeInformation leak in Paint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to...4.3 Medium
- google chromeInformation leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to...4.3 Medium
- google chromeInformation leak in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker...6.5 Medium
- google chromeInformation leak in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker...4.3 Medium
- google chromeInformation leak in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to...4.3 Medium
- google chromeInformation leak in Audio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who...4.0 Medium
- google chromeInformation leak in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to...8.8 High
- Show moreLoading…