CWE-209: Generation of Error Message Containing Sensitive Information
The product generates an error message that includes sensitive information about its environment, users, or associated data.
A kind of CWE-200 Information Disclosure.
From the CWE List. © The MITRE Corporation.
Newest
- senecajs senecaSensitive Data Exposure in seneca5.3 Medium
- silver-peak unity edgeconnect sd-wan firmwareSilver Peak EdgeConnect SD-WAN before 8.1.7.x allows remote attackers to obtain potentially...5.3 Medium
- google android, opensuse leap +1 moreIn the Android kernel in the video driver there is a kernel pointer leak due to a WARN_ON...2.3 Low
- bosch iot gateway software, prosyst mbs sdk +1 moreLeakage of stack traces in the backup & restore functionality of ProSyst mBS SDK and Bosch IoT Gateway Software5.3 Medium
- ibm contract management, emptoris sourcing, emptoris spend analysis +1 more +3 moreIBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and...4.3 Medium
- ibm contract management, emptoris sourcing, emptoris spend analysis +1 more +3 moreIBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and...4.3 Medium
- ibm intelligent operations center, intelligent operations center for emergency management, water operations for waternamics +2 moreIBM Intelligent Operations Center V5.1.0 through V5.2.0 could disclose detailed error messages,...6.2 Medium
- ibm contract management, emptoris sourcing, emptoris spend analysis +1 more +3 moreIBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and...4.3 Medium
- google chromeInappropriate implementation in accessibility in Google Chrome prior to 74.0.3729.108 allowed a...6.5 Medium
- openstack nova, redhat openstack, canonical ubuntu linux +1 more +3 moreOpenStack Nova Server Resource Faults Leak External Exception Details6.5 Medium
- adobe campaignAdobe Campaign Classic version 18.10.5-8984 and earlier versions have an Information Exposure...7.5 High
- parse parse-serverSensitive Data Exposure in parse-server5.3 Medium
- ibm spectrum protect, spectrum protect operations center +1 moreIBM Spectrum Protect Operations Center 7.1 and 8.1 could allow a remote attacker to obtain...3.1 Low
- ibm websphere application serverIBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console could allow a remote...5.3 Medium
- ibm sterling b2b integratorIBM Sterling B2B Integrator 6.0.0.0 and 6.0.0.1 reveals sensitive information from a stack trace...4.3 Medium
- pydio cellsPydio Cells before 1.5.0, when supplied with a Name field in an unexpected Unicode format, fails...4.3 Medium
- ibm infosphere information server, infosphere information analyzer, infosphere information governance catalog +1 more +3 moreIBM InfoSphere Information Server 11.5 and 11.7 is affected by an information disclosure...4.3 Medium
- ibm security information queueIBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 generates an error message that...4.3 Medium
- gnu gcc, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +1 more +3 morestack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler...8.1 High
- matomo** DISPUTED ** A full path disclosure vulnerability was discovered in Matomo v3.9.1 where a user...4.3 Medium
- gitlabAn issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before...7.5 High
- auth0 auth0-wcf-service-jwtCritical severity vulnerability that affects Auth0-WCF-Service-JWT9.8 Critical
- elastic logstash, netapp active iq performance analytics services +1 moreA sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1...9.8 Critical
- [unknown] dropbear, dropbear ssh project ssh +1 moreIt was found that dropbear before version 2013.59 with GSSAPI leaks whether given username is...5.3 Medium
- jforumIn JForum 2.1.8, an unauthenticated, remote attacker can enumerate whether a user exists by using...5.3 Medium
- red hat katellokatello SQL Injection vulnerability4.3 Medium
- artifex ghostscript, canonical ubuntu linux, debian linux +6 more +8 moreArtifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism...8.6 High
- carestream vue risCarestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine...3.7 Low
- gluster glusterfs, debian linux, opensuse leap +2 more +4 moreAn information disclosure vulnerability was discovered in glusterfs server. An attacker could...3.5 Low
- matera bancoMatera Banco 1.0.0 mishandles Java errors in the backend, as demonstrated by a stack trace...9.8 Critical
- 3cx web serverThe Web server in 3CX version 15.5.8801.3 is vulnerable to Information Leakage, because of...5.3 Medium
- johnson controls bcpro (bcm), metasys system, johnsoncontrols bcpro +2 moreJohnson Controls Metasys and BCPro Generation of Error Message Containing Sensitive Information4.3 Medium
- apache ambariApache Ambari, version 2.5.0 to 2.6.2, passwords for Hadoop credential stores are exposed in...8.1 High
- eclipse jetty, the eclipse foundation eclipse jetty, oracle retail xstore point of service +2 moreEclipse Jetty XmlParser allows arbitrary DOCTYPE declarations5.3 Medium
- [unknown] ovirt-engine, redhat virtualization, virtualization host +2 moreThe web console login form in ovirt-engine before version 4.2.3 returned different errors for non...5.3 Medium
- joomla joomla\!An issue was discovered in Joomla! Core before 3.8.8. The web install application would autofill...9.8 Critical
- hawt hawtioPath Traversal in io.hawt:project5.4 Medium
- sap hana extended application servicesIn SAP HANA Extended Application Services, 1.0, an unauthenticated user could test if a given...6.5 Medium
- 389 directory server 389-ds-base, fedoraproject 389 directory server +1 more389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks...9.8 Critical
- ibm jazz reporting serviceIBM Jazz Reporting Service (JRS) 5.0 and 6.0 could disclose sensitive information, including user...4.9 Medium
- paloaltonetworks pan-osThe GlobalProtect external interface in Palo Alto Networks PAN-OS before 6.1.17, 7.x before 7.0...9.8 Critical
- hackerone nextcloud server, nextcloud server +1 moreNextcloud Server before 9.0.55 and 10.0.2 suffers from a error message disclosing existence of...4.3 Medium
- nextcloud server, owncloud +1 moreNextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a log pollution...6.1 Medium
- weblateWeblate user account enumeration via reset password form5.3 Medium
- postgresql, debian linux +1 morePostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x...4.3 Medium
- microsoft internet explorerThe Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers...4.3 Medium
- red hat enterprise linux 6, enterprise linux 7, network proxy v 5.4 +3 more +5 moreSpacewalk-backend: spacewalk-backend: information disclosure via cleartext passwords in error messages4.9 Medium
- microsoft .net frameworkMicrosoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP...6.4 Medium
- typo3TYPO3 leaks a hash secret in an error message5.0 Medium
- apache tomcatApache Tomcat Leaks Pathname Information via Error Message5.0 Medium
- Show moreLoading…