Weakness (CWE)
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
How to prevent it (1 mitigation)
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-200
3,828 results · Clear filters · Feed
-
Medium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.6 and iPadOS 26.6, tvOS 2…
-
Medium 5.5
A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8,…
-
Medium 5.5
A privacy issue was addressed by removing sensitive data. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.…
-
Medium 5.5
An information leakage was addressed with additional validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10,…
-
Medium 5.5
This issue was addressed with improved checks. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPad…
-
Medium 5.5
The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 …
-
Medium 5.5
An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.7.10 and i…
-
Medium 5.5
This issue was addressed with improved data protection. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6…
-
Medium 5.5
An authorization issue was addressed with improved state management. This issue is fixed in macOS Tahoe 26.6, watchOS 2…
-
Medium 5.5
An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7…
-
Medium 5.5
An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS…
-
Medium 5.5
This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.7.10 and iPadO…
-
Medium 5.5
The issue was addressed with improved checks. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadO…
-
Medium 5.5
This issue was addressed with improved checks. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPad…
-
Medium 6.5
JFrog Artifactory build environment properties exposure
Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repository parameter while retrieving environment properties for a protected build, exposing build environment secr…
-
Medium 6.9
Audit Log Exposure through Unauthorized Access
Honeywell S35 Series 3M/5M/8M/PinHole Cameras, all versions prior to and including version HC5.26.1.14.20260207 contains an audit log disclosure Vulnerability that could allow an attacker to access audit logs without authentication, potentially resulting in t…
-
Medium 5.3
Quiz And Survey Master < 11.1.3 - Unauthenticated User Enumeration and Password Oracle via Quiz Login
The Quiz and Survey Master (QSM) WordPress plugin before 11.1.3 does not implement rate limiting or standard failed-login auditing on its front-end credential-check functionality and returns distinct responses for valid and invalid accounts, allowing unauthen…
-
Medium 4.3
mf-yang openclaw-cn Scheme navigation-guard.ts assertBrowserNavigationAllowed information disclosure
A vulnerability has been found in mf-yang openclaw-cn up to 0.2.1. Affected by this issue is the function assertBrowserNavigationAllowed of the file src/browser/navigation-guard.ts of the component Scheme Handler. Such manipulation of the argument url leads t…
-
Medium —
Hubuum client library (Rust): Authenticated requests may escape the configured base path through redirects
## Impact The built-in async and blocking clients used reqwest's default redirect policy. `BaseUrl` constrains the initial request to the configured origin and path prefix, but redirect processing occurs after that validation. reqwest retains sensitive header…
-
Medium 5.5
Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api
A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a del…
-
Medium 6.5
Microsoft Graph Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized attacker to disclose information over a network.
-
Medium 6.0
Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Exposure of Sensitive Information to an Unaut…
-
Medium 5.3
There is a information disclosure vulnerability in some Hikvision cameras, allowing unauthenticated attackers to obtain…
-
Medium 6.8
Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported ve…
-
Medium 6.5
Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported ve…
-
Medium 6.3
Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: Import And Export). Supp…
-
Medium 6.3
Vulnerability in the Oracle HCM Configuration Workbench product of Oracle E-Business Suite (component: Install). Suppor…
-
Medium 6.3
Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll - General). Supported v…
-
Medium 6.3
Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Quality Workbench HTML system). Supp…
-
Medium 6.3
Vulnerability in the Oracle Succession planning product of Oracle E-Business Suite (component: Succession plan). Suppor…
-
Medium 5.3
Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). …
-
Medium 6.5
Vulnerability in the Oracle Self-Service Human Resources product of Oracle E-Business Suite (component: Manager Self-Se…
-
Medium 6.3
Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: Internal Operations). Supported ve…
-
Medium 4.3
Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: EDI). Supported versions that ar…
-
Medium 4.3
Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: EDI). Supported versions that ar…
-
Medium 6.3
Vulnerability in the Oracle Price Protection product of Oracle E-Business Suite (component: Internal Operations). Suppo…
-
Medium 6.3
Vulnerability in the Oracle Common Applications Calendar product of Oracle E-Business Suite (component: Calendar Synchr…
-
Medium 4.3
Vulnerability in the Oracle U.S. Federal Financials product of Oracle E-Business Suite (component: Internal Operations)…
-
Medium 6.3
Vulnerability in the Oracle Proposals product of Oracle E-Business Suite (component: Proposals). Supported versions tha…
-
Medium 6.3
Vulnerability in the Oracle Supply Chain Globalization product of Oracle E-Business Suite (component: Copy Inventory Or…