CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- google chromeInformation leak in Frames in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to...6.5 Medium
- google chromeInformation leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to...6.5 Medium
- google chromeInformation leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to...6.5 Medium
- google chromeInformation leak in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to...6.5 Medium
- google chromeInformation leak in Select in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to...6.5 Medium
- google chromeInformation leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to...6.5 Medium
- google chromeInformation leak in Omnibox in Google Chrome on on Android prior to 157.0.8103.38 allowed a...6.5 Medium
- google chromeInformation leak in PrivateTokens in Google Chrome prior to 157.0.8103.38 allowed a remote...6.5 Medium
- google chromeInformation leak in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote...6.5 Medium
- google chromeInformation leak in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to...6.5 Medium
- google chromeInformation leak in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker...6.5 Medium
- No product listedHeadless CMS Plugin REST API post get_required_post_data information disclosure6.9 Medium
- hewlett packard enterprise (hpe) virtual intranet access (via)Authenticated Sensitive Information Disclosure in VIA6.5 Medium
- hewlett packard enterprise (hpe) fabric composerAuthenticated Sensitive Information Disclosure in HPE Networking Fabric Composer Management Interface3.1 Low
- hewlett packard enterprise (hpe) fabric composerAuthenticated Local Information Disclosure Vulnerability in HPE Networking Fabric Composer3.3 Low
- hewlett packard enterprise (hpe) fabric composerUnauthenticated Sensitive Information Disclosure in HPE Networking Fabric Composer3.7 Low
- hewlett packard enterprise (hpe) fabric composerAuthenticated Information Disclosure in HPE Networking Fabric Composer API Endpoint4.3 Medium
- hewlett packard enterprise (hpe) fabric composerAuthenticated Local Sensitive Information Disclosure in HPE Networking Fabric Composer4.7 Medium
- hewlett packard enterprise (hpe) fabric composerUnauthenticated Information Disclosure in HPE Networking Fabric Composer5.3 Medium
- hewlett packard enterprise (hpe) fabric composerAuthenticated Sensitive Information Disclosure in HPE Networking Fabric Composer5.3 Medium
- hewlett packard enterprise (hpe) fabric composerUnauthenticated Sensitive Information Disclosure in Web-Based Management Interface of HPE Networking Fabric Composer5.4 Medium
- hewlett packard enterprise (hpe) fabric composerAuthenticated Adjacent Sensitive Information Disclosure in HPE Networking Fabric Composer7.7 High
- hewlett packard enterprise (hpe) fabric composerAuthenticated Sensitive Information Disclosure in HPE Networking Fabric Composer API8.8 High
github.com/basekick-labs/arcGoArc has unauthenticated application log disclosure via `/api/v1/logs`No score- coollabsio coolifyCoolify before 4.1.1 Application Name Enumeration via Manual Webhook Endpoints6.9 Medium
- eclipse foundation vert.xCachingWebClient shares user-specific HTTP responses across users via the shared cache tier7.5 High
- finsys dockhandDockhand 1.0.47 before 1.0.54 Secret Disclosure via Git Stack Webhook7.1 High
- froxlorFroxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.php8.6 High
- axxonsoft axxon oneUser and Role Enumeration by Low-Privileged Users in Axxon One Security Configuration API5.3 Medium
- unknown wemailweMail <= 2.1.6 - Editor+ API Key Disclosure4.9 Medium
- hieu nguyen wati chat and notificationWATI Chat and Notification <= 1.1.8 - Unauthenticated Customer Order PII Disclosure via Leaked API Token5.3 Medium
- echohs geekezbrowserEchoHS GeekezBrowser Public API status information disclosure4.8 Medium
- regularlabs.com users anywhere (free, pro) extension for joomlaJoomla Extension - regularlabs.com - Exposure of Sensitive Information to Unauthorized Actor in Users Anywhere extension for Joomla < 3.0.15.1 Medium
- wso2 identity server, identity server as key manager, identity server keystore rest api commons +2 more +4 moreInformation Disclosure in Multiple WSO2 Products Allows Exposure of Certificate File Paths5.8 Medium
- huawei emui, harmonyos +1 morePermission control vulnerability in the autofill service module. Impact: Successful exploitation...6.6 Medium
- huawei harmonyosPermission control vulnerability in the WLAN module. Impact: Successful exploitation of this...5.5 Medium
- parse-community parse-serverParse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 Information Disclosure via Object Update Response2.3 Low
- mcphubsamanhappy MCPHub passthroughHeaders.ts information disclosure5.3 Medium
- ag-ui-protocol ag-uiag-ui-protocol ag-ui HttpAgent http.ts information disclosure6.9 Medium
- giteaGitea OAuth2 userinfo private group disclosure to public-only tokens4.3 Medium
- giteaGitea private issue disclosure through issue dependency timeline events3.5 Low
- giteaGitea contribution heatmap private activity disclosure to public-only tokens5.3 Medium
- giteaGitea Actions task token private repository enumeration4.3 Medium
- unknown mappressMapPress Maps for WordPress < 2.97.15 - Unauthenticated Email Address Disclosure5.3 Medium
- unknown kali forms — contact form & drag-and-drop builderKali Forms < 2.4.30 - Subscriber+ User Email Address Disclosure4.3 Medium
- presentonPresenton Desktop Authentication Middleware app_data information disclosure6.9 Medium
- google androidIn getSelectionBySubIds of ProviderUtil.java, there is a possible cross-user data leak due to a...4.0 Medium
- smub all in one seo – ai seo plugin to boost seo rankings & traffic (schema, local seo, sitemap & seo insights)All in One SEO <= 5.0.3 - Unauthenticated Sensitive Information Disclosure in 's' Search Query Parameter5.3 Medium
- ameliabooking booking for appointments and events calendar – ameliaBooking for Appointments and Events Calendar <= 2.4.12 - Unauthenticated Sensitive Information Exposure in 'page' Parameter5.3 Medium
- seraphinitesoft seraphinite acceleratorSeraphinite Accelerator <= 2.29.24 - Unauthenticated Sensitive Information Exposure in Object Cache Directory5.3 Medium
- Show moreLoading…