Weakness (CWE)
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
How to prevent it (1 mitigation)
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-200
3,837 results · Clear filters · Feed
-
Medium 5.9
http vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack.
-
Medium 4.3
Jenkins GitHub Branch Source Plugin allows any user with Overall/Read permission to get list of valid credentials IDs
GitHub Branch Source provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use. This functionality did not check permissions, allowing any user with Overall/Read permission to get a list of valid creden…
-
Medium 6.5
When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 b…
-
Medium 6.5
Jenkins Docker Commons Plugin allows any user with Overall/Read permission to get list of valid credentials IDs
Docker Commons Plugin provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use to authenticate with a Docker Registry. This functionality did not check permissions, allowing any user with Overall/Read …
-
Medium 5.5
Jenkins Deploy to container Plugin stored plain text passwords in job configuration
The Deploy to container Plugin stored passwords unencrypted as part of its configuration. This allowed users with Jenkins master local file system access, or users with Extended Read access to the jobs it is used in, to retrieve those passwords. The Deploy to…
-
Medium 5.3CVE-2014-0043 Public exploit
Apache Wicket allows attackers to check for third-party libraries
In Apache Wicket 1.5.10 or 6.13.0, by issuing requests to special urls handled by Wicket, it is possible to check for the existence of particular classes in the classpath and thus check whether a third party library with a known security vulnerability is in u…
-
Medium 6.5
Apache Geode vulnerable to Exposure of Sensitive Information
When an Apache Geode cluster before v1.2.1 is operating in secure mode, an unauthenticated client can enter multi-user authentication mode and send metadata messages. These metadata operations could leak information about application data types. In addition, …
-
Medium 4.3
Apache Geode gfsh query vulnerability
When a cluster is operating in secure mode, a user with read privileges for specific data regions can use the gfsh command line utility to execute queries. In Apache Geode before 1.2.1, the query results may contain data from another user's concurrently execu…
-
Medium 5.9
Laravel Sensitive Data Exposure
Laravel before 5.5.10 mishandles the remember_me token verification process because DatabaseUserProvider does not have constant-time token comparison.
-
Medium 4.3
Moodle sensitive information disclosure
In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access.
-
Medium 6.5
Fastly Magento2 sensitive information disclosure
The Fastly CDN module before 1.2.26 for Magento2, when used with a third-party authentication plugin, might allow remote authenticated users to obtain sensitive information from authenticated sessions via vectors involving caching of redirect responses.
-
Medium 5.9
SimpleSAMLphp allows timing side-channel attacks
The (1) Htpasswd authentication source in the authcrypt module and (2) SimpleSAML_Session class in SimpleSAMLphp 1.14.11 and earlier allow remote attackers to conduct timing side-channel attacks by leveraging use of the standard comparison operator to compare…
-
Medium 5.9
SimpleSAMLphp Unauthenticated encryption in CBC mode
SimpleSAMLphp 1.14.12 and earlier make it easier for man-in-the-middle attackers to obtain sensitive information by leveraging use of the aesEncrypt and aesDecrypt methods in the SimpleSAML/Utils/Crypto class to protect session identifiers in replies to non-H…
-
Medium 5.5
Exposure of Sensitive Information to an Unauthorized Actor in Apache Hadoop
This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of HDFS. A local user on an HDFS DataNode may be able to craft a block token that grants unauthorized read access to random…
-
Medium 4.3
ChakraCore information disclosure vulnerability
Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to obtain information to further compromise the user's system due to the Chakra scripting engine not properly handling objects in memory, aka "Scripting Engine Information Disclosure Vulnerability…
-
Medium 5.5
sosreport sensitive information disclosure via weak permissions of the generated archives
sosreport 3.2 uses weak permissions for generated sosreport archives, which allows local users with access to /var/tmp/ to obtain sensitive information by reading the contents of the archive.
-
Medium 4.3
Moodle Information Disclosure
In Moodle 3.3, the course overview block reveals activities in hidden courses.
-
Medium 6.5
Moodle User fullname disclosure on user preferences page
Moodle 3.x has user fullname disclosure on the user preferences page.
-
Medium 5.9
txAWS AWSServiceEndpoint defaults to not verifying server certificates
txAWS (all current versions) fail to perform complete certificate verification resulting in vulnerability to MitM attacks and information disclosure.
-
Medium 6.5
Logstash Logs Sensitive Information
Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating connections after sniffing, would log to file HTTP basic auth credentials.
-
Medium 5.3
rack-mini-profiler allows remote attackers to obtain sensitive information about allocated strings and objects
The rack-mini-profiler gem before 0.10.1 for Ruby allows remote attackers to obtain sensitive information about allocated strings and objects by leveraging incorrect ordering of security checks.
-
Medium 6.4
Exposure of Sensitive Information to an Unauthorized Actor in Oracle MySQL Connectors Java
Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protoc…
-
Medium 4.3
Moodle sensitive information disclosure
The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to read the badges of other users.
-
Medium 4.3CVE-2017-0208 EPSS 15%
ChakraCore information disclosure vulnerability
An information disclosure vulnerability exists in Microsoft Edge when the Chakra scripting engine does not properly handle objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user's sy…
-
Medium 5.5
Apache Ambari reveals administrator passwords
Apache Ambari 2.x before 2.4.0 includes KDC administrator passwords on the kadmin command line, which allows local users to obtain sensitive information via a process listing.
-
Medium 5.3
Moodle Global search displays user names for unauthenticated users
In Moodle 3.2.x, global search displays user names for unauthenticated users.
-
Medium 5.3
Weblate user account enumeration via reset password form
The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a series of requests.
-
Medium 5.3
Cloudera HUE Account Enumeration
Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to desktop/api/users/autocomplete.
-
Medium 5.3
Plone vulnerable to unauthorized disclosure of site content
Plone 3.3 through 5.1a1 allows remote attackers to obtain information about the ID of sensitive content via unspecified vectors.
-
Medium 5.9
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static…
-
Medium 5.3
SimpleSAMLphp Information leakage issue in the sanitycheck module
The sanitycheck module in SimpleSAMLphp before 1.14.1 allows remote attackers to learn the PHP version on the system via unspecified vectors.
-
Medium 6.4
Information Exposure in RunC
RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container. This allows the main processes of the container, if running as root, to gain access to file-descriptors of these new processes during the initialization a…
-
Medium 5.3
Root Path Disclosure in send
The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.
-
Medium 5.4
Moodle sensitive information disclosure
In Moodle 2.x and 3.x, an unenrolled user still receives event monitor notifications even though they can no longer access the course.
-
Medium 5.3
Moodle Glossary search displays entries without checking user permissions to view them
In Moodle 3.x, glossary search displays entries without checking user permissions to view them.
-
Medium 5.5CVE-2017-5223 Public exploit
Local file disclosure in PHPMailer
An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to an HTML document to make it usable as an email message body. One of the transformations is to convert relative image URLs into attachments using a script…
-
Medium 5.9
A vulnerability has been identified in SIMATIC S7-300 CPU family (All versions), SIMATIC S7-300 CPU family (incl. relat…
-
Medium 5.3
Apache Tika Server exposes sensitive information
Apache Tika server (aka tika-server) in Apache Tika 1.9 might allow remote attackers to read arbitrary files via the HTTP fileUrl header.
-
Medium 4.3
phpMyAdmin allows to detect if user is logged in
An issue was discovered in phpMyAdmin. An attacker can determine whether a user is logged in to phpMyAdmin. The user's session, username, and password are not compromised by this vulnerability. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4…
-
Medium 6.5
phpMyAdmin Local file exposure
An issue was discovered in phpMyAdmin. A user can exploit the LOAD LOCAL INFILE functionality to expose files on the server to the database system. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17…