Weakness (CWE)
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
How to prevent it (1 mitigation)
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-200
648 results · Clear filters · Feed
-
Low 3.3
An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadO…
-
Low 3.3
A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and i…
-
Low 3.3
An information disclosure issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPad…
-
Low 3.3
cosmicstack-labs mercury-agent Shell Permission Manifest permissions.ts PermissionManager.checkShellCommand information disclosure
A weakness has been identified in cosmicstack-labs mercury-agent up to 1.2.0. This affects the function PermissionManager.checkShellCommand of the file mercury-agent/src/capabilities/permissions.ts of the component Shell Permission Manifest. Executing a manip…
-
Low 2.3
Chengdu Qilu Technology Ludashi ComputerZ_x64.sys sub_11008 information disclosure
A flaw has been found in Chengdu Qilu Technology Ludashi 6.1026.4715.714. The affected element is the function sub_11008 in the library ComputerZ_x64.sys. Executing a manipulation of the argument PhysicalAddress can lead to information disclosure. The attack …
-
Low 3.7
User Registration & Membership < 5.2.8 - Unauthenticated User Data Disclosure via Membership Thank You Page
The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticate…
-
Low 3.7
rclone: http backend forwards custom/auth headers to a different host on redirect
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attaches headers configured through --http-headers or headers= to requests in backend/http/http.go, while …
-
Low 3.1
Information leak in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the rend…
-
Low 3.1
Information leak in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the…
-
Low 3.1
Information leak in WebMCP in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the re…
-
Low 2.3
MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data
Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information. Several organisation-related widgets did not honor Security.hide_organisation_index_from_users. As a result, authenticated user…
-
Low 2.3
MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users
Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view. The affected endpoint returned fields inclu…
-
Low 2.7
EmbedPress 4.6.0 - 4.6.3 - Contributor+ Administrator Email Disclosure via Google Reviews REST Route
The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, …
-
Low 2.7
The Events Calendar < 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure via REST API
The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished…
-
Low 3.7
My Private Site < 4.2.3 - Unauthenticated Sensitive Information Exposure via RSS Feeds and Sitemap
The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthenticated users to view post content, comments and post URLs from a site the administrator plac…
-
Low 3.1
Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the rend…
-
Low 3.1
Unauthenticated Limited Information Disclosure allows Data Exposure in the API of HPE Networking Fabric Composer
A vulnerability in the API endpoint of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to view some information handled by the affected system. Successful exploitation could allow an attacker to gain insight into internal service…
-
Low 3.3
extension.vn 2FA Authenticator Extension Background Service Worker chrome.runtime.onMessageExternal.addListener information disclosure
A weakness has been identified in extension.vn 2FA Authenticator Extension 1.0.0.2 on Chrome. The impacted element is the function chrome.runtime.onMessageExternal.addListener of the component Background Service Worker. Executing a manipulation of the argumen…
-
Low 2.1
Cloaked plaintext leaks through a non-sensitive action argument in AshCloak
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the librar…
-
Low 3.1
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the conf…
-
Low 3.7
When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes…
-
Low 3.1
Information leak in CORS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the rend…
-
Low 3.1
Information leak in BFCache in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the r…
-
Low 3.1
Information leak in Core in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the rend…
-
Low 3.7
HCL Hive is affected by multiple security vulnerabilities.
HCL Hive is affected by an information disclosure vulnerability, which could lead to an attacker gathering sensitive information about the host environment.
-
Low 2.7
Copy & Delete Posts < 1.5.6 - Authenticated Arbitrary Post Content and Password Disclosure
The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users…
-
Low 2.7
Easy Appointments < 4.0.1 - Contributor+ Sensitive Information Disclosure via REST Appointments Listing
The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including custo…
-
Low 3.7
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions…
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
Low 2.7
File Browser: Share API exposes the password hash and bypass token
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, the Link storage struct is serialized directly by sharePostHandler, shareListHandler, and shareGetsHandl…
-
Low 3.6
Plaintext pre-auth secret exposure via Desktop App diagnostics report
Mattermost Desktop App versions <=6.2 6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, which allows a local attacker with access to a user's diagnostics report or log files to obtain the plaintext pre-auth secret configured for…
-
Low 3.1
Orange View Limited DualSafe Password Manager & Digital Vault Extension postMessage-based Bridge information disclosure
A flaw has been found in Orange View Limited DualSafe Password Manager & Digital Vault Extension up to 1.4.35 on Chrome. Affected is an unknown function of the component postMessage-based Bridge. Executing a manipulation can lead to information disclosure. Th…
-
Low 2.7
Webkul Bagisto Customer Search search information disclosure
A weakness has been identified in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /admin/customers/search of the component Customer Search. Executing a manipulation of the argument Query can lead to information disclosure. The attack may …
-
Low 2.7
Webhook Authorization Header Returned in Plaintext via API
Webhook Authorization Header Returned in Plaintext via API
-
Low 3.6
Cross-thread FPU register leak on ARM when FPU enabled without register sharing
On the Zephyr ARM port, enabling the hardware FPU (CONFIG_FPU) forces the "Floating point ABI" choice, which defaults to CONFIG_FP_HARDABI. Both FP_HARDABI and FP_SOFTABI permit the compiler to emit hardware FP instructions in any function, even code that nev…
-
Low 3.3
HKUDS nanobot Login-shell Environment shell.py ExecTool._prepare_command information disclosure
A flaw has been found in HKUDS nanobot up to 0.2.1. The impacted element is the function ExecTool._prepare_command of the file nanobot/agent/tools/shell.py of the component Login-shell Environment Handler. Executing a manipulation can lead to information disc…
-
Low 3.7
Hono: Proxy Helper does not remove response headers listed in the `Connection` header
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy() function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110 Section 7.6.1, …
-
Low 3.7
DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Disclosure via Unprotected Uploads Directory
The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not protect its shipping-label storage directory with server-independent access control, relying only on an Apache .htaccess file, so on a web server that does not honor .htaccess (su…
-
Low 2.6
Contao crawler leaks auth credentials to external hosts
Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external hosts. Contao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creat…
-
Low 2.7
Easy Appointments < 3.12.28 - Contributor+ Customer Data Disclosure
The Easy Appointments WordPress plugin before 3.12.28 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal informa…