CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- google chromeUse after free in PerformanceAPIs in Google Chrome on on Android prior to 156.0.8078.47 allowed a...8.8 High
- google chromeInformation leak in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote...6.5 Medium
- google chromeMemory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...8.8 High
- google chromeMemory corruption in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...8.8 High
- google chromeOut of bounds read in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a...6.5 Medium
- google chromeMissing authorization in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote...8.8 High
- google chromeMemory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...8.8 High
- google chromeUse after free in ContextualSearch in Google Chrome prior to 156.0.8078.47 allowed a remote...8.8 High
- google chromeMemory corruption in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...8.8 High
- google chromeMemory corruption in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...8.8 High
- @modelcontextprotocol client, sdk, modelcontextprotocol typescript-sdk +2 moreModel Context Protocol TypeScript SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies6.5 Medium
- follow-redirectsfollow-redirects array-form headers bypass cross-origin credential stripping8.2 High
- apostrophecms apostropheApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)5.3 Medium
- apostrophecms apostrophe, uploadfs +1 moreApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)5.6 Medium
- solarwinds patch managerSolarWinds Patch Manager Sensitive Information Exposure Vulnerability4.4 Medium
- apostrophecms apostropheApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API5.3 Medium
- @apostrophecms import-export, apostrophecms apostrophe +1 moreApostropheCMS: Exposure of Sensitive Information via predictable export filenames6.0 Medium
- apostrophecms apostropheApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user4.3 Medium
- apache software foundation couchdbApache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs6.0 Medium
- @vitest browser, ui, vitest-dev vitest +1 more +3 moreVitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file6.5 Medium
- vitejs vite, vite-plus +1 moreVite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`6.3 Medium
- merv barrett easy property listingsEasy Property Listings < 3.5.27 - Subscriber+ Sensitive Data Disclosure via Contact CRM AJAX Handlers4.3 Medium
- merv barrett easy property listingsEasy Property Listings < 3.5.28 - Unauthenticated Hidden Listing Details Disclosure via REST API5.3 Medium
- apple macosA privacy issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27....5.5 Medium
- apple macosThis issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden...5.5 Medium
- apple macosAn information disclosure issue was addressed with improved state management. This issue is fixed...5.5 Medium
- apple macosThe issue was addressed with improved handling of secure input state. This issue is fixed in...5.5 Medium
- getgrav gravGrav 2.0.0 before 2.2.2 Information Disclosure via Form config-*@ Directives8.7 High
- craftcms cmsCraft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters7.1 High
- follow-redirectsfollow-redirects sensitiveHeaders regex escaping can expose credential headers8.2 High
- eptura archibusEptura Archibus Workflow Rule Enables Unauthenticated Database Read of Sensitive Tables8.5 High
- webkul aureus erpWebkul Aureus ERP composer.json insertion of sensitive information into debugging code6.9 Medium
- fossbillingFOSSBilling: Unauthenticated client account enumeration via guest signup endpoint6.9 Medium
- fossbillingFOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_exists6.9 Medium
- ai-genius-automations octoallyai-genius-automations octoally index.ts information disclosure6.9 Medium
- apache camelApache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets7.5 High
- apache software foundation camelApache Camel: HTTP producers resolve property placeholders in message-supplied URI override headers8.2 High
- apache software foundation camelApache Camel: Camel-Docling Unvalidated Message Body Input Source Enables Server-Side Request Forgery and Local File Disclosure5.9 Medium
- apache software foundation answerApache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles7.5 High
- mispMISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings5.3 Medium
- mispMISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution7.1 High
- apache software foundation kylinApache Kylin: Potential unauthenticated job metadata replacement7.5 High
- mispMISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances5.3 Medium
- dav-ee dairy-management-systemDav-ee dairy-management-system AJAX Endpoint checkfarmer.json.php information disclosure6.9 Medium
- unknown formflow for gohighlevel (ghl)FormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via Log File5.3 Medium
- google samInsecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)9.3 Critical
- light0011 cmslight0011 cms Uploadify check-exists.php file_exists file information disclosure6.9 Medium
- giteaGitea private profile information disclosure through POST request6.5 Medium
- giteaGitea draft release creation disclosing attachment metadata4.3 Medium
- unknown modern events calendar liteModern Events Calendar Lite < 7.37.0 - Subscriber+ Sensitive Data Disclosure via mec_event_bookings and mec_attendees AJAX Actions4.3 Medium
- Show moreLoading…