Weakness (CWE)
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
How to prevent it (1 mitigation)
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-200
3,828 results · Clear filters · Feed
-
Medium 5.3
D-Link DI-7003GV2 login.data information disclosure
A vulnerability was found in D-Link DI-7003GV2 24.04.18D1 R(68125) and classified as problematic. Affected by this issue is some unknown functionality of the file /login.data. The manipulation leads to information disclosure. The attack may be launched remote…
-
Medium 5.3
D-Link DI-7003GV2 install_base.data information disclosure
A vulnerability has been found in D-Link DI-7003GV2 24.04.18D1 R(68125) and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /install_base.data. The manipulation leads to information disclosure. The attack can …
-
Medium 5.3
D-Link DI-7003GV2 index.data information disclosure
A vulnerability, which was classified as problematic, was found in D-Link DI-7003GV2 24.04.18D1 R(68125). Affected is an unknown function of the file /index.data. The manipulation leads to information disclosure. It is possible to launch the attack remotely. …
-
Medium 5.3
D-Link DI-7003GV2 Configuration get_version.data information disclosure
A vulnerability, which was classified as problematic, has been found in D-Link DI-7003GV2 24.04.18D1 R(68125). This issue affects some unknown processing of the file /H5/get_version.data of the component Configuration Handler. The manipulation leads to inform…
-
Medium 5.5
An issue in wps office before v.19302 allows a local attacker to obtain sensitive information via a crafted file.
-
Medium 4.6
An issue in realme GT 2 (RMX3311) running Android 14 with realme UI 5.0 allows a physically proximate attacker to obtai…
-
Medium 5.5
Exposure of sensitive information to an unauthorized actor for some Edge Orchestrator software for Intel(R) Tiber™ Edge…
-
Medium 5.7
Exposure of sensitive information to an unauthorized actor for some Edge Orchestrator software for Intel(R) Tiber™ Edge…
-
Medium 4.7
Exposure of sensitive information to an unauthorized actor for some Edge Orchestrator software for Intel(R) Tiber™ Edge…
-
Medium 5.5
Exposure of sensitive information to an unauthorized actor for some Edge Orchestrator software for Intel(R) Tiber™ Edge…
-
Medium 5.5
Visual Studio Information Disclosure Vulnerability
Insufficient granularity of access control in Visual Studio allows an authorized attacker to disclose information locally.
-
Medium 5.5
A privacy issue was addressed by removing sensitive data. This issue is fixed in iPadOS 17.7.7, macOS Sequoia 15.5, mac…
-
Medium 5.5
An information disclosure issue was addressed with improved privacy controls. This issue is fixed in macOS Sequoia 15.5…
-
Medium 5.5
The issue was addressed with improved handling of caches. This issue is fixed in macOS Sequoia 15.5. Hot corner may une…
-
Medium 5.5
An information disclosure issue was addressed with improved privacy controls. This issue is fixed in macOS Sequoia 15.5…
-
Medium 5.5
The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.6, …
-
Medium 5.5
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoi…
-
Medium 6.2
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.5. An app may be able…
-
Medium 5.5
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 18.5 and…
-
Medium 5.5
An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.3 and iPad…
-
Medium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS…
-
Medium 5.3
Gosuncn Technology Group Audio-Visual Integrated Management Platform listByPage information disclosure
A vulnerability has been found in Gosuncn Technology Group Audio-Visual Integrated Management Platform 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /sysmgr/user/listByPage. The manipulation leads to in…
-
Medium 5.3
Gosuncn Technology Group Audio-Visual Integrated Management Platform Configuration File config.properties information disclosure
A vulnerability, which was classified as problematic, was found in Gosuncn Technology Group Audio-Visual Integrated Management Platform 4.0. Affected is an unknown function of the file /config/config.properties of the component Configuration File Handler. The…
-
Medium 4.3
Dígitro NGC Explorer Configuration missing password field masking
A vulnerability was identified in Dígitro NGC Explorer up to 3.48.21. The affected element is an unknown function of the component Configuration Page. Such manipulation leads to missing password field masking. It is possible to launch the attack remotely. Upg…
-
Medium 5.3
A vulnerability in the packet filtering features of Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote…
-
Medium 4.3
Download Manager and Payment Form WordPress Plugin – WP SmartPay 1.1.0 - 2.7.13 - Authenticated (Subscriber+) Information Exposure
The Download Manager and Payment Form WordPress Plugin – WP SmartPay plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 1.1.0 to 2.7.13 via the show() function due to missing validation on a user controlled key. This makes it p…
-
Medium 5.3
Recording
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Crestron Automate VX allows Functionality Misuse. There is no visible indication when the system is recording and recording can be enabled remotely via a network API. This issue affec…
-
Medium 5.1
Enable Debug Images
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Crestron Automate VX allows Functionality Misuse. When Enable Debug Images in Crestron Automate VX is active, snapshots of the captured video or portions thereof are stored locally on…
-
Medium 6.2
Vulnerability of insufficient information protection in the media library module Impact: Successful exploitation of thi…
-
Medium 5.8
Private data leak on login-required Discourse sites
Discourse is an open-source community platform. A data leak vulnerability affects sites deployed between commits 10df7fdee060d44accdee7679d66d778d1136510 and 82d84af6b0efbd9fa2aeec3e91ce7be1a768511b. On login-required sites, the leak meant that some content o…
-
Medium 4.3
Shenzhen Sixun Software Sixun Shanghui Group Business Management System LoadData information disclosure
A vulnerability, which was classified as problematic, was found in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 7. This affects an unknown part of the file /api/GylOperator/LoadData. The manipulation leads to information disclosure.…
-
Medium 5.3
TOTOLINK A720R cstecgi.cgi information disclosure
A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument topicurl with the input showSyslog lead…
-
Medium 5.3CVE-2025-4270 EPSS 14%
TOTOLINK A720R Config cstecgi.cgi information disclosure
A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been classified as problematic. Affected is an unknown function of the file /cgi-bin/cstecgi.cgi of the component Config Handler. The manipulation of the argument topicurl with the input getInitC…
-
Medium 5.9
Database Toolset <= 1.8.4 - Unauthenticated Sensitive Information Exposure via Backup Files
The Database Toolset plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.4 via backup files stored in a publicly accessible location. This makes it possible for unauthenticated attackers to extract se…
-
Medium 6.5
Information Disclosure via Flags override link
Flags SDK is an open-source feature flags toolkit for Next.js and SvelteKit. Impacted versions include flags from 3.2.0 and prior and @vercel/flags from 3.1.1 and prior as certain circumstances allows a bad actor with detailed knowledge of the vulnerability t…
-
Medium 5.3
Yame | Link In Bio <= 0.9.0 - Unauthenticated Information Exposure
The Yame | Link In Bio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.0 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentiall…
-
Medium 5.7
APM Server Insertion of Sensitive Information into Log File
APM server logs could contain parts of the document body from a partially failed bulk index request. Depending on the nature of the document, this could disclose sensitive information in APM Server error logs.
-
Medium 6.2
Elastic Agent / Elastic Endpoint Security local API key disclosure
Exposure of sensitive information to local unauthorized actors in Elastic Agent and Elastic Security Endpoint can lead to loss of confidentiality and impersonation of Endpoint to the Elastic Stack. This issue was identified by Elastic engineers and Elastic ha…
-
Medium 6.3
KHC-INVITATION-AUTOMATION Sensitive User Information Leakage in Invitation Automation
KHC-INVITATION-AUTOMATION is a GitHub automation script that automatically invites followers of a bot account to join your organization. In some commits on version 1.2, a vulnerability was identified where user data, including email addresses and Discord user…
-
Medium 5.7
This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.…