Weakness (CWE)
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Class Draft Mapping discouraged
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
How to prevent it (1 mitigation)
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-200
6,460 results · Feed
-
Medium 5.8
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-security-providers-jwt). Supported…
-
Low 3.7
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: LRA). Supported versions that are affected…
-
Medium 5.3
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-security-providers-google-login). …
-
Medium 5.3
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-health). Supported versions that a…
-
Medium 6.2
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Import). The supported version that is…
-
Medium 5.9
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Acollect). The supported version that …
-
High 7.5
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Acollect). The supported version that …
-
High 7.5
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Inte…
-
High 7.7
Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations). Supported ver…
-
High 7.7
Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations). Supported ver…
-
High 7.5
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics …
-
Medium 5.9
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars…
-
Medium 4.3
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata …
-
Medium 6.5
Vulnerability in Oracle Trusted Answer Search (component: PLSQL package). The supported version that is affected is 26.…
-
High 7.7
Vulnerability in Oracle Trusted Answer Search (component: Application expert UI). The supported version that is affecte…
-
High 7.7
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.2.2. E…
-
Medium 5.3
Vulnerability in Oracle Secure Backup (component: NDMP daemon). Supported versions that are affected are 19.1.0.0.0 and…
-
Medium 6.5
Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Logging). Supported v…
-
High 7.5
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Cloud Gateway). Supported versions …
-
High 7.5
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported v…
-
Medium 5.3
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Siebel Management Console). Support…
-
Low 2.4
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Siebel Management Console). Support…
-
Medium 5.8
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution). S…
-
Low 2.2
Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions th…
-
Medium 5.5
Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions th…
-
Medium 5.0
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. E…
-
Low 3.7
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. D…
-
Low 3.1
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. D…
-
Medium 4.3
Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are affected are 24.2.0-26.1.0. Ea…
-
High 8.8
Information leak in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineerin…
-
High 8.8
Information leak in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive informa…
-
High 8.8
Information leak in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker leveraging s…
-
High 8.8
Information leak in ContentCapture in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker to le…
-
Medium 6.5
Information leak in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social eng…
-
High 8.8
Information leak in PerformanceAPIs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to …
-
High 8.8
Information leak in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information…
-
High 8.8
Information leak in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive informati…
-
Medium 6.5
Information leak in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker to leak s…
-
High 8.8
Information leak in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive infor…
-
High 8.8
Information leak in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the rend…