Weakness (CWE)
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
How to prevent it (1 mitigation)
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-200
1,413 results · Clear filters · Feed
-
High 7.1
Unauthenticated Adjacent Sensitive Information Disclosure and Denial-of-Service in AOS-8 via the PAPI Protocol
A sensitive information disclosure vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to access limited information handled by the affected service. Successful exploitation could allow an attacker to view some informa…
-
High 7.2
Sensitive Information Disclosure through REST API Query Filters in Splunk SOAR
In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and Roles view permission could use the Representational State Transfer (REST) API to infer authentication token values for other users. If the inferred token grants administrative a…
-
High 7.5
Information Disclosure through REST API Query Filters in Splunk SOAR
In Splunk SOAR versions below 8.7.0, a user that has the "Observer" role could use query filters in the Representational State Transfer (REST) API to infer password hashes and authorization tokens for other users. The information disclosure is possible becaus…
-
High 7.5
HKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via read_document and safe_user_path
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files through LLM agent file-read tools. Attackers can prompt the agent to invoke read_document, which lacks sandbox check…
-
High 7.7
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exp…
-
High 7.7
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exp…
-
High 7.7
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exp…
-
High 7.7
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exp…
-
High 7.5
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that a…
-
High 7.5
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported…
-
High 7.5
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported…
-
High 7.5
Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: Integr…
-
High 7.5
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported v…
-
High 7.5
Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration). Supported versi…
-
High 8.6
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Cont…
-
High 7.5
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Su…
-
High 7.5
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Su…
-
High 7.5
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Su…
-
High 8.6
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions…
-
High 8.6
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions…
-
High 7.5
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System). The supported versio…
-
High 7.5
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported vers…
-
High 8.8
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). Supported versions that …
-
High 7.1
Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations). Support…
-
High 7.2
Vulnerability in the Order Capture product of Oracle E-Business Suite (component: Internal Operations). Supported versi…
-
High 7.8
Vulnerability in the Applications Platform Engineering product of Oracle E-Business Suite (component: Valid Session). S…
-
High 8.7
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Oracle Weblogic Server Proxy Pl…
-
High 7.1
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure …
-
High 7.1
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC). Sup…
-
High 8.1
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC). Sup…
-
High 8.4
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version tha…
-
High 7.5
Vulnerability in the Sourcing product of Oracle E-Business Suite (component: Auctions). Supported versions that are aff…
-
High 7.4
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events). Support…
-
High 7.8
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services). The supported version that is affe…
-
High 8.8
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). Supported versions that are affecte…
-
High 7.1
Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Data Provider UI). Supported version…
-
High 7.6
Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Create Item Instance). Supported ver…
-
High 7.5
Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). Supp…
-
High 7.2
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-cors). Supported versions that are…
-
High 7.2
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-grpc-server). Supported versions t…