Weakness (CWE)
CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere
The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.
How to prevent it (1 mitigation)
-
Architecture and Design, Implementation
Production applications should never use methods that generate internal details such as stack traces and error messages unless that information is directly committed to a log that is not viewable by the end user. All error message text should be HTML entity encoded before being written to the log file to protect against potential cross-site scripting attacks against the viewer of the logs
Source: MITRE CWE-497
469 results · Feed
-
Medium 4.7
HTTP.sys Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows HTTP.sys allows an authorized attacker to disclose information locally.
-
Medium 5.3
Windows Remote Desktop Services Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Remote Desktop Services allows an authorized attacker to disclose information over a network.
-
Medium 5.5
Win32k Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Win32K allows an authorized attacker to disclose information locally.
-
High 7.0
Windows Overlay Filter Elevation of Privilege Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
-
Medium 5.5
Server for NFS Information Disclosure Vulnerability
Improper access control in Windows Server for NFS allows an authorized attacker to disclose information locally.
-
Medium 5.9
Windows DHCP Server Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows DHCP Server allows an unauthorized attacker to disclose information over a network.
-
Medium 5.5
Windows Management Instrumentation Information Disclosure Vulnerability
Out-of-bounds read in Windows Management Instrumentation allows an authorized attacker to disclose information locally.
-
Medium 6.5
Windows Print Spooler Components Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Print Spooler Components allows an authorized attacker to disclose information over a network.
-
Medium 6.0
Windows Secure Kernel Mode Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Windows Secure Kernel Mode allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Graphics Kernel Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Graphics Kernel allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Bluetooth Service Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Bluetooth Service allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Overlay Filter Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Overlay Filter allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Shell Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Shell allows an authorized attacker to disclose information locally.
-
High 7.5
WordPress myCred plugin <= 4.0.2 - Sensitive Data Exposure vulnerability
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in myCred myCred mycred allows Retrieve Embedded Sensitive Data.This issue affects myCred: from n/a through 4.0.2.
-
Unscored —
Apache Airflow: Secrets masker: pattern-based masking bounded at depth 5 returns deeply-nested registered secrets in cleartext
Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection password or a Variable value — that appeared more than five containers deep under non-sensitive keys…
-
Medium 5.3
WordPress YITH WooCommerce Subscription plugin <= 4.22.0 - Sensitive Data Exposure vulnerability
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Subscription yith-woocommerce-subscription allows Retrieve Embedded Sensitive Data.This issue affects YITH WooCommerce Subscription: from n/a thr…
-
Medium 6.3
BigFix Mobile is affected by sensitive information disclosure
The BigFix MCM admin portal is directly accessible from the internet without VPN or network restriction. A client-side configuration file discloses non-sensitive environment details. Exposing the configuration file publicly increases the attack surface and t…
-
Medium 6.9
FlexNet Beacon Missing Authentication Vulnerability
Missing authentication in the FlexNet Beacon component of Flexera One and FlexNet Manager Suite allows unauthenticated remote attackers to obtain Beacon policy and targeting information when anonymous web server access is enabled (the default).
-
Low 2.3
Host filesystem path disclosure via DNS rebinding
An attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar. Neither response checks the Host header. A web page that rebinds its own domain to the loopback address…
-
High 7.4
Goose: goose: shell history and environment leak via terminal integration
A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model (LLM) provider endpoints during queries. If a user enters…
-
Medium 5.3
Cisco Expressway Series Information Disclosure Vulnerability
A vulnerability in Cisco Expressway Series could allow an unauthenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability is due to insufficient authorization checks of HTTP requests during Mobile and Remote Access…
-
High 7.5
Apache Cocoon: Unauthenticated access to diagnostic interfaces
** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated user could gain access to diagnostic interfaces, including triggering of cache, exposure of (verbose)…
-
Medium 5.3
Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header
Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the file_etag option is not set, the ETag is built from the file's inode number, modification ti…
-
Medium 4.3
WisdomGarden｜Tronclass - Sensitive Data Exposure
Tronclass developed by WisdomGarden has a Sensitive Data Exposure vulnerability. Authenticated remote attackers can bypass anonymous grading restrictions and obtain anonymous student information.
-
Medium 5.5
Windows Client Side Caching driver (csc.sys) Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to disclose information locally.
-
Medium 4.7
Windows ALPC Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows ALPC allows an authorized attacker to disclose information locally.
-
Medium 5.5
Microsoft Trace Data Helper Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper allows an authorized attacker to disclose information locally.
-
Medium 5.5
Microsoft Trace Data Helper Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper allows an authorized attacker to disclose information locally.
-
Medium 4.7
Windows Kernel Information Disclosure Vulnerability
Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally.
-
Medium 4.7
Windows Shell Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Shell allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Hello Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Hello allows an authorized attacker to disclose information locally.
-
Medium 4.7
Windows Win32 Kernel Subsystem Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Common Log File System Driver Information Disclosure Vulnerability
Buffer over-read in Windows Common Log File System Driver allows an authorized attacker to disclose information locally.
-
Medium 4.7
Windows Win32 Kernel Subsystem Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows MIDI Service Module Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows MIDI Service Module allows an authorized attacker to disclose information locally.
-
Medium 4.7
Windows Installer Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Installer allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Kernel Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Kernel Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Cryptographic Services Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Cryptographic Services allows an authorized attacker to disclose information locally.
-
Medium 6.5
Microsoft Office Excel Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.