CWE-202: Exposure of Sensitive Information Through Data Queries
When trying to keep information confidential, an attacker can often infer some of the information by using statistics.
A kind of CWE-1230 Exposure of Sensitive Information Through Metadata.
From the CWE List. © The MITRE Corporation.
Newest
- dalibo postgresql anonymizer PostgreSQL Anonymizer: statistics can expose some of the original data after statistic masking 4.3 Medium
- dalibo postgresql anonymizer PostgreSQL Anonymizer: Masked roles can read the statistics of masked columns in pg_stats 3.5 Low
- drupal commerce core Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-259 3.7 Low
- tp-link systems inc. deco be63 v2.0 Information disclosure vulnerability in the cloud-client daemon of Deco BE63 6.8 Medium
- apache software foundation answer Apache Answer: Missing Authorization Allows Mutations of Non-Public Content 8.1 High
- apache software foundation answer Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata 4.3 Medium
- apache software foundation answer Apache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles 5.3 Medium
- @backstage plugin-scaffolder-backend, backstage, linuxfoundation backstage\/plugin-scaffolder-backend +2 more Backstage: Improper input validation in scaffolder task list ordering 5.3 Medium
- the wikimedia foundation mediawiki pagetriage extension pagetriagelist discloses suppressed reviewer usernames 1.2 Low
- synology diskstation manager (dsm) An exposure of sensitive information through data queries vulnerability in Desktop API in... 5.3 Medium
- apache software foundation syncope Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist 4.9 Medium
- genians genian nac v4.0, genian nac v5.0, genian ztna v6.0 +2 more Improper input validation and Exposure of sensitive information through data queries... 8.7 High
- suse neuvector Potential information leakage from manager /network/graph API in NeuVector 7.3 High
- flowiseai flowise Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history 8.3 High
- apache syncope Apache Syncope: JexlContextBuilder Information Disclosure 4.9 Medium
- apache skywalking Apache SkyWalking: The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL. 7.5 High
- free5gc Free5GC: UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authentication 7.5 High
- inventree InvenTree Vulnerable to ORM Filter Injection 7.7 High
- forfront e-shot e-shot <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via API Token via 'eshot_form_builder_get_account_data' AJAX Action 5.3 Medium
- vendure Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy 2.7 Low
- geopandas geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclosure 8.6 High
- aio-libs aiohttp AIOHTTP allows for a brute-force leak of internal static filepath components 6.3 Medium
- craftcms cms, craft cms +1 more Unauthenticated Craft CMS users can trigger a database backup 7.0 High
- discourse Users are able to find users by name even when `enable_names` is off 6.3 Medium
- phpmyfaq phpMyFAQ has unauthenticated config backup download via /api/setup/backup 7.5 High
- langfuse Langfuse vulnerable to cross‑organization enumeration of member & invitation lists via project membership APIs 5.0 Medium
- dragonflyoss dragonfly Dragonfly allows arbitrary file read and write on a peer machine 6.9 Medium
-
github.com/goharbor/harborGo,govulncheck-vulndbopenSUSE +1 more Possible ORM Leak Vulnerability in the Harbor 4.9 Medium - dell wyse management suite Dell Wyse Management Suite, versions prior to WMS 5.2, contain an Exposure of Sensitive... 7.5 High
- dell wyse management suite Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Exposure of Sensitive... 7.5 High
- advplyr audiobookshelf audiobookshelf - %2F Encoding Discrepancy Bypasses Cover/Image Auth Exemption Regex, Enabling Unauthenticated Path Traversal 7.5 High
- advplyr audiobookshelf Remote Authentication-Bypass can lead to server crash or limited information disclosure due to faulty pattern matching 8.2 High
- drupal restful web services, restful web services project web services +1 more RESTful Web Services - Critical - Access bypass - SA-CONTRIB-2024-019 7.5 High
- cisco firepower management center, firepower threat defense software, secure firewall management center +1 more +3 more A vulnerability in the password change feature of Cisco Firepower Management Center (FMC)... 5.3 Medium
- finrota, finrota netahsilat +1 more Cleartext Storage of Username and Password in Finrota's Netahsilat 8.2 High
- paidmembershipspro paid memberships pro, unknown pmpro-member-directory +1 more Paid Memberships Pro - Member Directory Add On < 1.2.6 - Contributor+ Sensitive Information Disclosure via SQLi 6.5 Medium
- wavlink wn551k1 firmware WAVLINK WN551K1'live_check.shtml enables attackers to obtain sensitive router information. 5.3 Medium
- wavlink wn551k1 firmware WAVLINK WN551K1'live_mfg.shtml enables attackers to obtain sensitive router information. 5.3 Medium
- wavlink wn551k1 firmware An issue in Wavlink WN551K1 allows a remote attacker to obtain sensitive information via the... 6.5 Medium
- nextscripts nextscripts: social networks auto-poster, social networks auto poster +1 more NextScripts: Social Networks Auto-Poster <= 4.4.3 - Authenticated(Subscriber+) Sensitive Information Exposure 8.5 High
- pickplugins post grid, post grid combo +1 more Post Grid Combo – 36+ Gutenberg Blocks <= 2.2.68 - Information Exposure via get_posts API Endpoint 7.5 High
- cisco asyncos, secure web appliance +1 more A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance... 5.8 Medium
- openstack heat, rdo openstack rdo, red hat openstack platform 13 (queens) +4 more +6 more Information leak in api 7.4 High
- mayurik best online news portal SourceCodester Best Online News Portal check_availability.php information exposure 3.7 Low
- villatheme ald - aliexpress dropshipping and fulfillment for woocommerce (wordpress plugin), dropshipping and fulfillment for aliexpress and woocommerce +1 more WordPress ALD - AliExpress Dropshipping and Fulfillment for WooCommerce premium plugin <= 1.1.0 - Sensitive Data Exposure vulnerability 7.5 High
- cisco ios xe, ios xe software +1 more Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family SNMP Information Disclosure Vulnerability 6.5 Medium
- cisco sd-wan vmanage, catalyst sd-wan manager +1 more Cisco SD-WAN vManage Software Information Disclosure Vulnerability 6.5 Medium
- debian linux, linux kernel, redhat enterprise linux +2 more A vulnerability was found in the Linux kernel's EBPF verifier when handling internal data... 4.4 Medium
- cisco catalyst center, digital network architecture center (dna center) +1 more Cisco DNA Center Information Disclosure Vulnerability 4.3 Medium
- icinga, debian linux, icinga icinga2 +2 more Passwords used to access external services inadvertently exposed through API 8.8 High
- Show olderLoading…