Weakness (CWE)
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
How to prevent it (1 mitigation)
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-200
264 results · Clear filters · Feed
-
Critical 9.8CVE-2025-24204 Public exploit
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4. An app may be able to access p…
-
Critical 9.8
The issue was addressed with improved restriction of data container access. This issue is fixed in iOS 18.4 and iPadOS …
-
Critical 9.8
This issue was addressed with improved access restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.…
-
Critical 9.8
An injection issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7…
-
Critical 9.8
A logging issue was addressed with improved data redaction. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.…
-
Critical 9.8
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Vulnerable Ope…
-
Critical —
Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string)
### Summary Private key can be extracted from ECDSA signature upon signing a malformed input (e.g. a string or a number), which could e.g. come from JSON network input Note that `elliptic` by design accepts hex strings as one of the possible input types ### D…
-
Critical 9.3
PMD Designer's release key passphrase (GPG) available on Maven Central in cleartext
PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in jar published to Maven Central. The private key itself is not known to have been compromised itself, but given its passph…
-
Critical 9.8
This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.3, m…
-
Critical 9.8
The issue was addressed with improved checks. This issue is fixed in iPadOS 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14…
-
Critical 9.8
A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.3, m…
-
Critical 10.0
Coolify Vulnerable to Private Key Enumeration on Onboarding resulting in Remote Command Execution (RCE)
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.374, the missing authorization allows an authenticated user to retrieve any existing private keys on a coolify instance in plain te…
-
Critical 9.0
Fleet Server sensitive information exposure via logs
An issue was identified in Fleet Server where Fleet policies that could contain sensitive information were logged on INFO and ERROR log levels. The nature of the sensitive information largely depends on the integrations enabled.
-
Critical 9.8CVE-2024-55875 Public exploit
http4k has a potential XXE (XML External Entity Injection) vulnerability
http4k is a functional toolkit for Kotlin HTTP applications. Prior to version 6.50.0.0, there is a potential XXE (XML External Entity Injection) vulnerability when http4k handling malicious XML contents within requests, which might allow attackers to read loc…
-
Critical 9.8
Tolgee's configuration all configuration properties leaked in public configuration DTO
Tolgee is an open-source localization platform. Tolgee 3.81.1 included the all configuration properties in the PublicConfiguratioDTO publicly exposed to users. This vulnerability is fixed in v3.81.2.
-
Critical 9.8
CE21 Suite <= 2.2.0 - JWT Token Disclosure
The CE21 Suite plugin for WordPress is vulnerable to sensitive information disclosure via the plugin-log.txt in versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to log in the user associated with the JWT token.
-
Critical 9.1
hornetq vulnerable to file overwrite, sensitive information disclosure
An issue in the createTempFile method of hornetq v2.4.9 allows attackers to arbitrarily overwrite files or access sensitive information.
-
Critical 9.8
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause exposure of c…
-
Critical 9.3
Insecure Direct Object Reference to export Database in SOPlanning before 1.52.02
An unauthenticated Insecure Direct Object Reference (IDOR) to the database has been found in the SO Planning tool that occurs when the public view setting is enabled. An attacker could use this vulnerability to gain access to the underlying database by export…
-
Critical 9.9
An authentication bypass vulnerability can allow a low privileged attacker to access the NTLM hash of service account o…
-
Critical 9.0
A vulnerability that allows an attacker to access the NTLM hash of the Veeam Reporter Service service account. This att…
-
Critical 9.8
Insecure Default in FileCatalyst Workflow 5.1.6 Build 139 (and earlier)
The default credentials for the setup HSQL database (HSQLDB) for FileCatalyst Workflow are published in a vendor knowledgebase article. Misuse of these credentials could lead to a compromise of confidentiality, integrity, or availability of the software. The …
-
Critical 9.8
Unauthenticated Stack-Based Buffer Overflow Remote Command Execution (RCE) in the Soft AP Daemon Service Accessed by the PAPI Protocol
There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to comp…
-
Critical 9.1
Navidrome uses MD5 hashing algorithm
Use of insecure hashing algorithm in the Gravatar's service in Navidrome v0.52.3 allows attackers to manipulate a user's account information.
-
Critical 9.1CVE-2024-42049 Public exploit
TightVNC (Server for Windows) before 2.8.84 allows attackers to connect to the control pipe via a network connection.
-
Critical 9.8
CWE-200: Information Exposure vulnerability exists that could cause disclosure of credentials when a specially crafted …
-
Critical 9.8
WordPress WishList Member X plugin < 3.26.7 - Unauthenticated Database Backup Download vulnerability
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/a before 3.26.7.
-
Critical 9.8
Tenable Vulnerability Disclosure | Sensitive Information Disclosure Via Fake FMPS Worker
Adobe Framemaker Publishing Server versions 2020.3, 2022.2 and earlier are affected by an Information Exposure vulnerability (CWE-200) that could lead to privilege escalation. An attacker could exploit this vulnerability to gain access to sensitive informatio…
-
Critical 9.1
Account Takeover via Exposed Recovery Token in lunary-ai/lunary
In lunary-ai/lunary version 1.2.4, an account takeover vulnerability exists due to the exposure of password recovery tokens in API responses. Specifically, when a user initiates the password reset process, the recovery token is included in the response of the…
-
Critical 9.8
Certain Anpviz products allow unauthenticated users to download arbitrary files from the device's filesystem via a HTTP…
-
Critical 9.8
E-WEBInformationCo. FS-EZViewer(Web) - Sensitive Data Exposure
E-WEBInformationCo. FS-EZViewer(Web) exposes sensitive information in the service. A remote attacker can obtain the database configuration file path through the webpage source code without login. Accessing this path allows attacker to obtain the database cred…
-
Critical 9.6
Media Streaming add-on
An exposure of sensitive information vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnerability could allow users to compromise the security of the system via a network. We have already fixed the vulnerability in the fol…
-
Critical 9.1
Unauthorized Organization Access in lunary-ai/lunary
By knowing an organization's ID, an attacker can join the organization without permission and gain the ability to read and modify all data within that organization. This vulnerability allows unauthorized access and modification of sensitive information, posin…
-
Critical 9.1
An issue was discovered in OpenClinic GA 5.247.01. It allows retrieval of patient lists via queries such as findFirstna…
-
Critical 9.1
An issue was discovered in OpenClinic GA 5.247.01. An Unauthenticated File Download vulnerability has been discovered i…
-
Critical 9.6
Default user role exporting save state of instance
As a default user on a multi-user instance of AnythingLLM, you could execute a call to the `/export-data` endpoint of the system and then unzip and read that export that would enable you do exfiltrate data of the system at that save state. This would require …
-
Critical 9.1
An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. It displays values of secrets …
-
Critical 9.1
Apache Aurora: padding oracle can allow construction an authentication cookie
** UNSUPPORTED WHEN ASSIGNED ** Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Aurora. An endpoint exposing internals to unauthenticated users can be used as a "padding oracle" allowing an anonymous attacker to construct a …
-
Critical 9.1
Rack CORS Middleware has Insecure File Permissions
rack-cors (aka Rack CORS Middleware) 2.0.1 has 0666 permissions for the .rb files.
-
Critical 9.1
TokenManager not checking permissions on cached tokens in DIRAC
DIRAC is a distributed resource framework. In affected versions any user could get a token that has been requested by another user/agent. This may expose resources to unintended parties. This issue has been addressed in release version 8.0.37. Users are advis…