Weakness (CWE)
CWE-209: Generation of Error Message Containing Sensitive Information
The product generates an error message that includes sensitive information about its environment, users, or associated data.
How to prevent it (7 mitigations)
-
Implementation
Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success.
If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files.
Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.
-
Implementation
Handle exceptions internally and do not display errors containing potentially sensitive information to a user.
-
Implementation
Use naming conventions and strong types to make it easier to spot when sensitive data is being used. When creating structures, objects, or other complex entities, separate the sensitive and non-sensitive data as much as possible.
-
Implementation, Build and Compilation
Debugging information should not make its way into a production release.
-
Implementation, Build and Compilation
Debugging information should not make its way into a production release.
-
System Configuration
Where available, configure the environment to use less verbose error messages. For example, in PHP, disable the display_errors setting during configuration, or at runtime using the error_reporting() function.
-
System Configuration
Create default error pages or messages that do not leak any information.
Source: MITRE CWE-209
524 results · Feed
-
Medium 4.3
IBM Planning Analytics Local is vulnerable to disclosing sensitive information
IBM Planning Analytics Local 2.1.0 - 2.1.15 could disclose sensitive information about server architecture that could aid in further attacks against the system.
-
Low 2.4
Nextcloud Desktop discloses information when attempting to lock a file inside a end-to-end encrypted directory
Nextcloud Desktop is the desktop sync client for Nextcloud. Prior to 3.16.5, when trying to manually lock a file inside an end-to-end encrypted directory, the path of the file was sent to the server unencrypted, making it possible for administrators to see it…
-
Low 2.7
Improper Error Handling Leading to Sensitive Information Disclosure in CIGES ≤ 2.15.6
A sensitive information disclosure vulnerability exists in the error handling component of ATISoluciones CIGES Application version 2.15.6 and earlier. When certain unexpected conditions trigger unhandled exceptions, the application returns detailed error mess…
-
Medium 4.3
Debug information disclosure in the SQL error message to in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes…
-
Medium 6.9
Multiple vulnerabilities in Limesurvey
In version 6.13.0 of LimeSurvey, any external user can cause a 500 error in the survey system by sending a malformed session cookie. Instead of displaying a generic error message, the system exposes internal backend information, including the use of the Yii f…
-
Medium 5.3
Improper neutralization of input in Times Software E-PAYROLL
Value provided in one of POST parameters sent during the process of logging in to Times Software E-Payroll is not sanitized properly, which allows an unauthenticated attacker to perform DoS attacks. SQL injection attacks might also be feasible, although so fa…
-
Medium 4.3
A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows…
-
Medium 4.3
Directus Vulnerable to Information Leakage in Existing Collections
Directus is a real-time API and App dashboard for managing SQL database content. An observable difference in error messaging was found in the Directus REST API in versions of Directus prior to version 11.13.0. The `/items/{collection}` API returns different e…
-
Medium 5.5
A vulnerability has been identified in Altair Grid Engine (All versions < V2026.0.0). Affected products do not properly…
-
Medium 5.3
Vertikal Systems Hospital Manager Backend Services Generation of Error Message Containing Sensitive Information
Prior to September 19, 2025, the Hospital Manager Backend Services returned verbose ASP.NET error pages for invalid WebResource.axd requests, disclosing framework and ASP.NET version information, stack traces, internal paths, and the insecure configuration 'c…
-
Medium 6.9
Error Messages Wrapped In HTTP Header
Error Messages Wrapped In HTTP Header.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
-
Medium 5.3
Moodle: router produces json instead of 404 error for invalid course id
The router’s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially aiding reconnaissance.
-
Medium 4.2
Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers
### Summary The GoCardless components in Actualbudget in are logging responses to STDOUT in a parsed format using `console.log`and `console.debug` (Which in this version of node is an alias for `console.log`). This is exposing sensitive information in log fil…
-
Medium —
ibexa/user login enumerates user accounts
### Impact In v5, error messages could provide enough information to tell whether a user exists or not. This is resolved by ensuring the error messages are sufficiently ambigious. ### Patches See "Patched versions". ### Workarounds None. ### Resources https:/…
-
Critical 10.0
Squid vulnerable to information disclosure via authentication credential leakage in error handling
Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. The vulnerability allows a script to bypass browser security protections and learn the c…
-
Medium 5.5
Windows USB Video Class System Driver Information Disclosure Vulnerability
Generation of error message containing sensitive information in Windows USB Video Driver allows an authorized attacker to disclose information locally.
-
Low 3.5
HCL Unica Centralized Offer Management is vulnerable to poor unhandled exceptions which exposes sensitive information
HCL Unica Centralized Offer Management is vulnerable to poor unhandled exceptions which exposes sensitive information. An attacker can exploit use this information to exploit known vulnerabilities launch targeted attacks, such as remote code execution or deni…
-
Medium 6.9
Project existence disclosure in LXD images API
Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses.
-
Medium 5.9
Dell BSAFE Crypto-J generates an error message that includes sensitive information about its environment and associated…
-
Medium 5.5
Windows Kernel Memory Information Disclosure Vulnerability
Generation of error message containing sensitive information in Windows Kernel allows an authorized attacker to disclose information locally.
-
Medium 4.6
Liferay Portal and Liferay DXP vulnerable to store Cross-site Scripting
A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024…
-
Medium 5.3
Information Disclosure via File Abstraction Layer
Error messages containing sensitive information in the File Abstraction Layer in TYPO3 CMS versions 9.0.0-9.5.54, 10.0.0-10.4.53, 11.0.0-11.5.47, 12.0.0-12.4.36, and 13.0.0-13.4.17 allow backend users to disclose full file paths via failed low-level file-syst…
-
Medium 5.1
Liferay Portal exposes 500 status when attempting login with a deleted client secret
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.19 exposes "Internal Serve…
-
Medium 5.0
In writeContent of RemotePrintDocument.java, there is a possible information disclosure due to a logic error. This coul…
-
Medium 5.5
In contentDescForNotification of NotificationContentDescription.kt, there is a possible notification content leak throu…
-
High 7.5
IBM Security Verify Governance Identity Manager information disclosure
IBM Security Verify Governance Identity Manager 10.0.2 could allow a remote attacker to obtain sensitive information when detailed technical error messages are returned. This information could be used in further attacks against the system.
-
Medium 5.3
Information Disclosure in MiR robots and MiR fleet through verbose error pages
Information disclosure vulnerability in error handling in MiR software prior to version 3.0.0 allows unauthenticated attackers to view detailed error information, such as file paths and other data, via access to verbose error pages.
-
Medium 5.3
HCL BigFix SaaS Authentication Service is affected by a sensitive information disclosure
HCL BigFix SaaS Authentication Service is affected by a sensitive information disclosure. Under certain conditions, error messages disclose sensitive version information about the underlying platform.
-
Low 3.7
mtons mblog register information exposure
A vulnerability was determined in mtons mblog up to 3.5.0. Affected is an unknown function of the file /register. The manipulation leads to information exposure through error message. It is possible to launch the attack remotely. The complexity of an attack i…
-
Medium 5.3
OMERO.web displays unecessary user information when requesting to reset the password
OMERO.web provides a web based client and plugin infrastructure. Prior to version 5.29.2, if an error occurred when resetting a user's password using the Forgot Password option in OMERO.web, the error message displayed on the Web page can disclose information…
-
Low 2.6
A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA A…
-
Low 3.5
A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA A…
-
Medium 4.3
WuKongOpenSource WukongCRM API Response upload information exposure
A vulnerability was identified in WuKongOpenSource WukongCRM 11.0. This affects an unknown part of the file /adminFile/upload of the component API Response Handler. The manipulation leads to information exposure through error message. It is possible to initia…
-
High 7.5CVE-2025-23320 Public exploit
NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker …
-
Low 3.7
atjiu pybbs Registered Email SettingsApiController.java sendEmailCode information exposure
A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic. This issue affects the function sendEmailCode of the file src/main/java/co/yiiu/pybbs/controller/api/SettingsApiController.java of the component Registered Email Handler. The …
-
Critical 9.8
An issue was discovered in ExonautWeb in 4C Strategies Exonaut 21.6. There are verbose error messages.
-
Medium 4.3
IBM Analytics Content Hub information disclosure
IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 could allow a remote attacker to obtain information about the application framework which could be used in reconnaissance to gather information for future attacks from a detailed technical error message.
-
Medium 5.3
IBM Analytics Content Hub information disclosure
IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.
-
Medium 4.3
loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a…
KEV Mar 16, 2026 -
Medium 6.9
Improper error handling vulnerability in Quiter Gateway
Improper error handling vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to send malformed payloads to generate error messages containing sensitive information.