CWE-201: Insertion of Sensitive Information Into Sent Data
The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
A kind of CWE-200 Information Disclosure.
From the CWE List. © The MITRE Corporation.
Newest
- saad iqbal wp easypayWordPress WP EasyPay plugin <= 4.3.0 - Sensitive Data Exposure vulnerability5.3 Medium
- mantisbtMantisBT has an authorization bypass via private issue monitoring5.3 Medium
- hcl software bigfix service management (sm), hcltech bigfix service management +1 moreHCL BigFix Service Management (SM) does not adequately sanitize or safely render4.6 Medium
- openstack ironic, red hat openshift container platform 4, openstack platform 16.2 +2 more +4 moreOpenStack Ironic has an Incorrect Resource Transfer Between Spheres7.7 High
- traefikTraefik: Errors middleware forwards Authorization and Cookie headers to separate error page service6.9 Medium
- argoproj argo cd, argo-cd, red hat openshift data foundation 4 +3 more +5 moreArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction9.6 Critical
- wpdeveloper templatelyWordPress Templately plugin <= 3.6.1 - Sensitive Data Exposure vulnerability7.7 High
- axiosAxios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion5.4 Medium
- github enterprise serverImproper authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository names via mobile upload policy API5.3 Medium
- linuxfoundation tekton pipelines, tektoncd pipeline +1 moreTekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL7.7 High
- hashicorp vault, vault enterprise, red hat openshift container platform 4 +1 more +3 moreVault Token Leaked to Backends via Authorization: Bearer Passthrough Header7.5 High
- grafana pyroscope, red hat multicluster global hub, multicluster global hub 1.7.0 +5 more +7 moreSensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protection9.1 Critical
- red hat openshift ai (rhoai), redhat openshift ai, red hat openshift ai 2.16 +3 more +5 moreOdh-dashboard: odh dashboard kubernetes service account exposure8.5 High
- cedar2025 xboard, v2board +1 morev2board / Xboard Authentication Token Exposure via loginWithMailLink9.1 Critical
- openfga, red hat multicluster global hub 1.7.0, advanced cluster management for kubernetes 2.14 +3 more +5 moreOpenFGA Playground Preshared Key Exposure6.5 Medium
- stmcan rt-theme 18 | extensionsWordPress RT-Theme 18 | Extensions plugin <= 2.5 - Sensitive Data Exposure vulnerability5.3 Medium
- thetechtribe the tribalWordPress The Tribal plugin <= 1.3.4 - Sensitive Data Exposure vulnerability5.3 Medium
- ateeq rafeeq repairbuddyWordPress RepairBuddy plugin <= 4.1132 - Sensitive Data Exposure vulnerability5.3 Medium
- aa web servant 12 step meeting listWordPress 12 Step Meeting List plugin <= 3.19.9 - Sensitive Data Exposure vulnerability5.3 Medium
- sunshinephotocart sunshine photo cartWordPress Sunshine Photo Cart plugin < 3.6.2 - Sensitive Data Exposure vulnerability5.3 Medium
- doofinder for woocommerceWordPress Doofinder for WooCommerce plugin <= 2.10.13 - Sensitive Data Exposure vulnerability5.3 Medium
- pär thernström simple historyWordPress Simple History plugin <= 5.24.0 - Sensitive Data Exposure vulnerability5.3 Medium
- jahlives openssl encryptopenssl_encrypt before 1.4.0 Information Disclosure via /ready endpoint8.7 High
- cisco smart software manager on-premCisco Smart Software Manager On-Prem Privilege Escalation Vulnerability7.3 High
- devolutions serverExposure of sensitive information in the users MFA feature in Devolutions Server allows users...6.5 Medium
- capricorn86 happy dom, happy-dom, red hat ansible automation platform 2 +1 more +3 moreHappy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies7.5 High
- grafana, red hat enterprise linux 10, enterprise linux 10.0 extended update support +3 more +5 morePublic dashboards discloses all direct mode datasources6.5 Medium
- noor alam smtp mailerWordPress SMTP Mailer plugin <= 1.1.24 - Sensitive Data Exposure vulnerability7.5 High
- syed balkhi contact form by wpformsWordPress Contact Form by WPForms plugin <= 1.9.8.7 - Sensitive Data Exposure vulnerability6.5 Medium
- discourseDiscourse leaks private topic metadata to non-authorized users6.9 Medium
- discourseDiscourse leaks private topic title and post excerpt via user action API endpoint8.7 High
- hapifhir org.hl7.fhir.core, red hat fuse 7 +1 moreHAPI FHIR HTTP authentication leak in redirects7.5 High
- pseitz lz4 flex, red hat logging subsystem for red hat openshift 6.2, logging subsystem for red hat openshift 6.4 +7 more +9 morelz4_flex: Decompression can leak information from uninitialized memory or reused output buffer8.2 High
- mattermost, mattermost server +1 moreInformation Disclosure via WebSocket Event When Deleting Unrevealed Burn on Read Posts4.3 Medium
- tinycontrol lk3.9, lk4, tcpdu +1 more +3 moreCredentials exposure in tinycontrol devices8.7 High
- ibm sterling b2b integrator, sterling file gateway +1 moreIBM Sterling B2B Integrator and IBM Sterling File Gateway Information Disclosure4.3 Medium
- magepeopleteam wpeventlyWordPress WpEvently plugin < 5.1.9 - Sensitive Data Exposure vulnerability5.3 Medium
- joe dolson my ticketsWordPress My Tickets plugin <= 2.1.0 - Sensitive Data Exposure vulnerability7.5 High
- premio chatyWordPress Chaty plugin <= 3.5.1 - Sensitive Data Exposure vulnerability7.5 High
- radiustheme classified listingWordPress Classified Listing plugin <= 5.3.4 - Sensitive Data Exposure vulnerability6.5 Medium
- roland murg wp booking systemWordPress WP Booking System plugin <= 2.0.19.12 - Sensitive Data Exposure vulnerability5.8 Medium
- wpvibes elementor addon elementsWordPress Elementor Addon Elements plugin <= 1.14.4 - Sensitive Data Exposure vulnerability6.5 Medium
- arcinfo pcvueServer configuration details in HTTP headers2.3 Low
- fleetdm fleetFleet: Sensitive Google Calendar credentials disclosed to low-privileged users1.3 Low
- binardat ltd. 10g08-0800gsm network switch, binardat 10g08-0800gsm firmware +1 moreBinardat 10G08-0800GSM Network Switch Plaintext Password Exposure8.6 High
- apache airflowApache Airflow: Connection Secrets not masked in UI when Connection are added via Airflow cli6.5 Medium
- shenzhen tenda technology co., ltd. tenda f3, tenda f3 firmware +1 moreTenda F3 Plaintext Credential Exposure in Configuration Download7.1 High
- themeglow jobboard job listingWordPress JobBoard Job listing plugin <= 1.2.8 - Sensitive Data Exposure vulnerability5.9 Medium
- shahjahan jewel ninja tablesWordPress Ninja Tables plugin <= 5.2.5 - Sensitive Data Exposure vulnerability4.3 Medium
- openclawOpenClaw < 2026.2.1 - Bearer Token Leakage via MS Teams Attachment Downloader Suffix Matching5.9 Medium
- Show moreLoading…