Weakness (CWE)
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
How to prevent it (1 mitigation)
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-200
3,821 results · Clear filters · Feed
-
Medium 4.8
HCL AION is affected by multiple security vulnerabilities.
HCL AION is affected by a vulnerability where the Cross-Origin-Opener-Policy (COOP) header was missing or insecure, allowing cross-origin documents to share a browsing context with the application. This may enable cross-window attacks, potentially resulting i…
-
Medium 4.8
HCL AION is affected by multiple security vulnerabilities.
HCL AION is affected by a vulnerability where the Cross-Origin-Resource-Policy (CORP) header was missing or insecure, allowing application resources to be loaded by other origins. This may expose resources to cross-origin data leakage, potentially resulting i…
-
Medium 5.9
undici vulnerable to cross-origin credential disclosure via array-of-tuples headers bypassing redirect stripping
undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, the redirect interceptor strips sensitive headers such as Authorization, Cookie, Proxy-Authorization, and Host when a request is redirected to a different origin,…
-
Medium 4.3
PublishPress Revisions 3.9.0 - 4.2.0 - Subscriber+ Unpublished Content Disclosure
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user is permitted to read a given post before returning its content through its revision-comparison feature, allowin…
-
Medium 6.5
Model Context Protocol TypeScript SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. Prior to 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/client, the HTTP client transports …
-
Medium 5.3
OpenEMR: Username Enumeration via Pre-Authentication User Settings Loading
OpenEMR is a free and open source electronic health records and medical practice management application. From 6.0.0 until 8.3.0, interface/globals.php uses the unauthenticated authUser login parameter to populate temp_authuserid and load that account's user_s…
-
Medium 5.3
OpenEMR: Unauthenticated Information Disclosure in admin.php Exposes Database Names and Versions
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the webroot admin.php multisite administration page is enabled without an authentication check, reads database configuration from sqlconf.…
-
Medium 6.2
OpenHuman: Unauthenticated server-sent events endpoint leaks user-facing event data
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0, the local server exposes the server-sent events endpoint at /events without bearer authentication, permits cross-origin browser access, and uses only…
-
Medium 5.3
Apache OFBiz: Unauthenticated HR organization and employee disclosure
Missing authorization check in the getHRChild service in Apache OFBiz through 24.09.07 on all platforms allows a remote unauthenticated attacker to recursively enumerate Human Resources organization and employee data, including department names and identifier…
-
Medium 5.3
Apache OFBiz: Unauthenticated disclosure through HR, Catalog, and Order Manager helpers
Missing Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to disclose internal business records — including organization, employee, product catalog, and product-store data — by requesting several hel…
-
Medium 5.3
Car Dealer <= 4.73 - Unauthenticated Private/Draft/Pending Post Content Disclosure via cardealer_single_car_ajax
The Car Dealer (Dealership) and Vehicle sales WordPress plugin through 4.73 does not restrict its unauthenticated single-listing AJAX action to published content, allowing an unauthenticated attacker to read the title, content and metadata of any private, dra…
-
Medium 5.3
Essential Real Estate < 5.3.5 - Unauthenticated Unpublished Property Listing and Agent Contact Disclosure via property_print_ajax
The Essential Real Estate WordPress plugin before 5.3.5 does not perform any authorization or publication-status check in one of its AJAX actions, allowing unauthenticated users to read the full contents of property listings that have not been published, toge…
-
Medium 4.3
Tutor LMS 1.6.4 - 4.1.3 - Subscriber+ Quiz Answer Key Disclosure
The Tutor LMS WordPress plugin before 4.2.0 does not prevent the correct answers to quiz questions from being included in the page it serves to the student taking the quiz, and does so regardless of the setting intended to control whether answers are revealed…
-
Medium 5.3
purocean Yank Note Settings Endpoint index.ts config.getAll information disclosure
A vulnerability was found in purocean Yank Note 3.93.0. This impacts the function config.getAll of the file src/main/server/index.ts of the component Settings Endpoint. The manipulation results in information disclosure. The attack may be launched remotely. T…
-
Medium 4.3
NST Labs Tech Nstbrowser Local Agent API info information disclosure
A vulnerability has been found in NST Labs Tech Nstbrowser 1.21.0. Affected by this vulnerability is an unknown functionality of the file /agent/info of the component Local Agent API. Such manipulation leads to information disclosure. It is possible to launch…
-
Medium 5.5
nvm prints the contents of any readable file through a symlinked .nvmrc
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.2.0 through 0.40.8, nvm does not check whether `.nvmrc` is a symbolic link. A repository or archive that ships `.nvmrc` as a symlink to anothe…
-
Medium 5.3
vtenext before 25.02.2 Session Identifier Disclosure via Touch Web Service
vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web service endpoint. Attackers who can run script in the vtenext origin, such as through cross-site scriptin…
-
Medium 5.3CVE-2026-118523 Scanner template
EventPrime < 4.3.6.1 - Unauthenticated Pending Post Disclosure via Public Post Status Override
The EventPrime WordPress plugin before 4.3.6.1 does not keep the built-in Pending Review post status non-public, allowing unauthenticated users to view posts, pages and other content that are awaiting review.
-
Medium 5.3
Premium Packages < 7.3.1 - Unauthenticated Cross-User Saved Cart Disclosure via IDOR
The Premium Packages WordPress plugin before 7.3.1 does not verify ownership or session binding when loading a previously saved shopping cart, allowing any unauthenticated user who obtains another shopper's saved-cart identifier to load that shopper's cart co…
-
Medium 4.3
WP ERP < 1.17.11 - Subscriber+ Sensitive Data Disclosure via Audit Log
The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin before 1.17.11 does not perform a capability check on an AJAX action that returns the stored before-and-after values of a record change, allowing any authenticated user, inclu…
-
Medium 5.3
Linksys E5600 Factory Quality Control fqc.cgi information disclosure
A weakness has been identified in Linksys E5600 1.1.0.26. This affects an unknown part of the file /cgi-bin/fqc.cgi of the component Factory Quality Control. This manipulation causes information disclosure. Remote exploitation of the attack is possible. The e…
-
Medium 4.3
Tanium addressed an information disclosure vulnerability in Discover.
Tanium addressed an information disclosure vulnerability in Discover.
-
Medium 4.3
Tanium addressed an information disclosure vulnerability in Discover.
Tanium addressed an information disclosure vulnerability in Discover.
-
Medium 6.5
Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive informa…
-
Medium 5.3
Information leak in ServiceWorker in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised…
-
Medium 6.5
Information leak in Frames in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive inform…
-
Medium 6.5
Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive informa…
-
Medium 6.5
Information leak in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data vi…
-
Medium 6.5
Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data …
-
Medium 6.5
Information leak in Select in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive inform…
-
Medium 6.5
Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to leak cross-origin data vi…
-
Medium 6.5
Information leak in Omnibox in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to leak sen…
-
Medium 6.5
Information leak in PrivateTokens in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive…
-
Medium 6.5
Information leak in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-o…
-
Medium 6.5
Information leak in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin da…
-
Medium 6.5
Information leak in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origi…
-
Medium 5.3
Headless CMS Plugin REST API post get_required_post_data information disclosure
A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function get_required_post_data of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument post_id/post_slug results in inf…
-
Medium 6.5
Authenticated Sensitive Information Disclosure in VIA
A sensitive information disclosure vulnerability exists in HPE Networking VIA. Successful exploitation could allow an authenticated attacker to obtain sensitive information.
-
Medium 4.3
Authenticated Information Disclosure in HPE Networking Fabric Composer API Endpoint
An authenticated information disclosure vulnerability exists in an API endpoint of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated remote attacker to obtain limited information about the affected system.
-
Medium 4.7
Authenticated Local Sensitive Information Disclosure in HPE Networking Fabric Composer
A sensitive information disclosure vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low-privileged user with local access to view sensitive information, if certain preconditions outside of the att…