CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- curlTFTP direction confusion8.1 High
- themefusion avada (fusion) builderAvada (Fusion) Builder <= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data Token5.3 Medium
- google chromeInformation leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker...6.5 Medium
- microsoft azure hdinsightAzure HDInsight Information Disclosure Vulnerability7.5 High
- lenve vhrvhr through commit 03abbd3 Information Disclosure of Operator Password Hashes via GET /chat/hrs7.1 High
- cfug dioDio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter`7.5 High
- php frankenphpFrankenPHP: Docker images serve phpinfo() as the default index.php, leaking environment variables5.3 Medium
- makeplane planePlane: Unauthenticated Workspace Invitation Token Leakage6.5 Medium
- hbai-ltd toonflow-appHBAI-Ltd Toonflow-app exportData Endpoint information disclosure4.8 Medium
- the-40-thieves obsidian-tcobsidian-tc bridge tools expose data outside the read ACL4.3 Medium
- wazuh wazuh-managerWazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpoint7.1 High
- espocrmEspoCRM 4.0.0 before 10.0.7 Field-Level Security Bypass via Note Read Endpoint5.3 Medium
- espocrmEspoCRM 4.0.0 before 10.0.7 Field-Level Access Bypass via Address-Book Search5.3 Medium
- freerdpFreeRDP 3.0.0 before 3.32.0 Memory Disclosure via SCardTransmit Smartcard Redirection5.3 Medium
- mozilla firefox, thunderbird +1 moreInformation disclosure in the WebRTC: Networking component4.3 Medium
- mozilla firefox, thunderbird +1 moreInformation disclosure in the Networking: Cache component4.3 Medium
- spacetime ad inserter – ad manager & adsense adsAd Inserter <= 2.8.18 - Authenticated (Subscriber+) Sensitive Information Disclosure in 'ai-debug-processing-fe' & 'ai-debug-meta' URL Parameters4.3 Medium
- mozilla firefox, thunderbird +1 moreInformation disclosure in the Storage: IndexedDB component4.3 Medium
- mozilla firefox, thunderbird +1 moreInformation disclosure in the Networking component4.3 Medium
- mozilla firefox, thunderbird +1 moreInformation disclosure in the Networking component4.3 Medium
- mozilla firefox, thunderbird +1 moreInformation disclosure in the PDF Viewer component4.3 Medium
- mozilla firefox, thunderbird +1 moreInformation disclosure, privilege escalation in the Security: Process Sandboxing component8.8 High
- ibm iIBM i is Information Disclosure5.3 Medium
- ibm iIBM i is Information Disclosure5.3 Medium
- ibm aspera enterprise webappsIBM Aspera Enterprise Webapps Information Disclosure4.3 Medium
- ibm tririga application platformSecurity Vulnerability identified in IBM TRIRIGA - Information Disclosure in Admin Console8.1 High
- code-projects online ticket reservation systemcode-projects Online Ticket Reservation System medallion.sql file information disclosure6.9 Medium
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data Information Disclosure9.6 Critical
- netcore nr268Netcore NR268 DDNS ddns_wan_list_show.cgi ddns_wan_list_show information disclosure5.1 Medium
- the-40-thieves obsidian-tcobsidian-tc fail-open default ACL exposes Obsidian control-directory secrets6.5 Medium
- progress software corporation marklogic serverExposure of sensitive information in Progress MarkLogic Server7.7 High
- surrealdbSurrealDB before 3.3.0 Field Permission Bypass via PATCH copy/move/test Operations7.1 High
- surrealdbSurrealDB 3.0.0 before 3.3.0 Information Disclosure via COMPUTED Fields7.1 High
- getgrav gravGrav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy8.7 High
- getgrav gravGrav 2.0.22 before 2.1.7 Clockwork Debugger Token Disclosure via Twig Sandbox7.1 High
- getgrav grav-plugin-loginGrav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset Page8.5 High
- craftcms cmsCraft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocument6.9 Medium
- open-webuiOpen WebUI 0.11.0 before 0.11.4 Tool Source Disclosure via Tool Export Endpoint7.1 High
- open-webuiOpen WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections7.6 High
- imagemagickImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure in TGA Decoder6.9 Medium
- No product listedWMCMS index.php information disclosure5.3 Medium
- tsi-coop tsi-dpdp-cmstsi-coop tsi-dpdp-cms JSON Schema Validation information disclosure6.9 Medium
- erpipe-org odoo mcpOdoo MCP 1.0.0 through 1.3.2 Information Disclosure via execute_method Tool5.3 Medium
- neterbit nw-431fNeterbit NW-431F Embedded Web Server sms.json information disclosure6.9 Medium
- unknown wp-invoiceWP-Invoice <= 4.3.1 - Subscriber+ User PII Disclosure via Unprotected AJAX Handlers4.3 Medium
- unknown simple membershipSimple Membership < 4.8.3 - Newly Registered Member Password Disclosure via URL Query String4.7 Medium
- unknown dokan: ai powered woocommerce multivendor marketplace solutionDokan < 5.2.0 - Vendor+ Cross-Vendor Commission Settings Disclosure via Commission REST Endpoint2.7 Low
- unknown envira galleryEnvira Gallery < 1.16.2 - Author+ Non-Public Post Title and Excerpt Disclosure via Gallery REST Field2.7 Low
- masaakitanaka booking packageBooking Package < 1.7.30 - Unauthenticated Booking Customer PII Disclosure5.3 Medium
- unknown accept paypal payments using contact form 7Accept PayPal Payments Using Contact Form 7 < 4.0.7 - Unauthenticated PII Disclosure via CSV Export5.3 Medium
- Show moreLoading…