CWE-209: Generation of Error Message Containing Sensitive Information
The product generates an error message that includes sensitive information about its environment, users, or associated data.
A kind of CWE-200 Information Disclosure.
From the CWE List. © The MITRE Corporation.
Newest
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller-container: automation-controller: notification template jinja whitelist bypass via conditional gating leaks tracebacks2.7 Low
- red hat ansible automation platform 2, ansible automation platform 2.7 +1 moreAutomation-controller: automation-controller-container: automation-controller: verbose internal exception disclosure via hostlist bare-exception handler4.3 Medium
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.2.7 Low
- ibm concertMultiple Vulnerabilities in IBM Concert Software5.3 Medium
- hkuds lightragLightRAG: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses5.3 Medium
- No product listedCRMEB Knowledge-Paid System crmeb_zzff_class 1.4.4 has a backend verification function that...6.2 Medium
- ibm common licensingMultiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent4.3 Medium
- ibm controllerMultiple vulnerabilities in IBM Controller5.3 Medium
- patriksimek vm2vm2 3.11.0 before 3.11.7 Information Disclosure via Error Stack6.9 Medium
- microsoft skype for business server 2015 cu13, skype for business server 2019 cu8, skype for business server subscription edition cu1 +2 more +4 moreSkype for Business Information Disclosure Vulnerability6.5 Medium
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +16 more +18 moreMicrosoft COM for Windows Information Disclosure Vulnerability5.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +20 more +22 moreWindows Network Connection Broker Information Disclosure Vulnerability5.5 Medium
- microsoft sql server 2025 (cu8), sql server 2025 for x64-based systems (gdr), sql server 2025 +2 moreMicrosoft SQL Server Information Disclosure Vulnerability6.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +23 more +25 moreWindows Error Reporting Information Disclosure Vulnerability5.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 moreWindows Print Spooler Components Information Disclosure Vulnerability5.7 Medium
- red hat certificate system 9, enterprise linux 10, enterprise linux 6 +3 more +5 morePki-core: dogtag-pki: empty request to dogtag /ca/rest/certrequests causes http 500, java exception, and stacktrace disclosure6.5 Medium
- ash-project ashAsh.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error2.1 Low
- ash-project ash typescriptRoute handler return value echoed into AshTypescript error response6.3 Medium
- ash-project ash typescriptRPC error handler fails open in AshTypescript, disclosing unredacted errors6.3 Medium
- ash-project ash phoenixAshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message2.3 Low
- ash-project ash aiAshAi vectorize change leaks raw embedding-provider errors, including credentials, in a user-facing error7.1 High
- ash-project ash aiAshAi echoes raw tool exception messages into the conversation, disclosing internal details5.3 Medium
- ash-project ash graphqlIncomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names6.9 Medium
- spring amqp, vmware spring advanced message queuing protocol +1 moreAdmin password disclosed in BrokerNotAliveException message5.3 Medium
- hclsoftware bigfix quantum risk analyzerHCL BigFix Quantum Risk Analyzer is affected by generating error messages with sensitive information3.9 Low
- murrelektronik 6 tx m ge + 4 power m12 ip67, xelity 10 tx ip67 m fe 4p, xelity 10 tx ip67 m fe 5p +20 more +22 moreInformation Disclosure via 'Copy learned MAC Addresses' Function5.3 Medium
- combodo itopCombodo iTop: Information disclosure in ajax.render.php3.5 Low
@nocobase/servernpmNocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code executionNo score- n8nn8n before 1.123.69 Credential Leak via GraphQL Node Error7.1 High
mcp-searxngnpmSearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses5.5 Medium- ha-china blueprint-studioBlueprint Studio API exposed internal exception details5.3 Medium
ep_etherpad-litenpmEtherpad addressed weak token RNG, login timing, plugin path handling, API request handlingNo score- ondata ckan-mcp-serverCKAN MCP Server: Information disclosure via verbose error reflection3.7 Low
- vllmvLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages5.3 Medium
- kyndryl-open-source hashi-vault-jshashi-vault-js: Vault token and secret values exposed in thrown errors5.8 Medium
- spring framework, vmware spring framework +1 moreSpring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService7.5 High
- hcl bigfix mobile, hclsoftware hcl bigfix mobile +1 moreHCL BigFix Mobile is vulnerable to information disclosure4.3 Medium
- ggml llama.cppllama.cpp b4882-b8487 Out-of-Bounds Read Information Disclosure6.3 Medium
- rclonerclone before v1.75.0 Information Disclosure via RC API5.1 Medium
- nvidia dynamoNVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause the generation of...5.3 Medium
- pyca cryptographycryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing8.2 High
- hcl software icontrolHCL iControl is affected by multiple security vulnerabilities.3.7 Low
- hcl software icontrolHCL iControl is affected by multiple security vulnerabilities.3.7 Low
- ibm security verify access, security verify access container, verify identity access +1 more +3 moreSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access5.3 Medium
- ericsson packet core controller (pcc)Generation of Error Message Containing Sensitive Information Vulnerability6.8 Medium
- hclsoftware connectionsHCL Connections is vulnerable to information disclosure3.5 Low
- budibaseBudibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile5.1 Medium
- parse-community parse-serverParse Server 9.0.0 Information Disclosure via GraphQL Error Messages6.3 Medium
- parse-community parse-serverParse Server 9.0.0 Information Disclosure via GraphQL Error Messages6.3 Medium
- dompdfDompdf: Embedded SVG images can leak existence of files and directories within the filesystem6.3 Medium
- Show moreLoading…