Weakness (CWE)
CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere
The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.
How to prevent it (1 mitigation)
-
Architecture and Design, Implementation
Production applications should never use methods that generate internal details such as stack traces and error messages unless that information is directly committed to a log that is not viewable by the end user. All error message text should be HTML entity encoded before being written to the log file to protect against potential cross-site scripting attacks against the viewer of the logs
Source: MITRE CWE-497
13 results · Clear filters · Feed
-
Critical 9.1
Cross-Cluster Impersonation Confused-Deputy Privilege Escalation
A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the default user global role can gain full administrative access to the Rancher control plane and transiti…
-
Critical 9.8
PROG MIS｜Prog Management System - Exposure of Sensitive Information
Prog Management System developed by PROG MIS has a Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to view a specific page and obtain the database account and password.
-
Critical 9.3
Sparx Pro Cloud Server reveals sensitive information to an unauthenticated user
Exposure of Private Personal Information to an Unauthorized Actor, : Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Sparx Systems Pty Ltd. Sparx Pro Cloud Server. Unauthenticated user can retrieve database password…
-
Critical 9.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Sharp Display Solutions pro…
Sharp Display Solutions NP-CG6500UL, NP-CG6500WL, NP-CB4500UL, NP-CB4500WL, NP-P525ULH, NP-P525WLH, NP-P605ULH, NP-P554U, NP-P554UG, NP-P554U+, NP-P554W, NP-P554WG, NP-P554W+, NP-P474U, NP-P474UG, NP-P474W, NP-P474 NP-PA521U+, NP-PA722X, NP-PA622X, NP-PA572W, NP-PA672W, NP-PA622U, NP-PA522U, NP-PA722XG, NP-PA622XG, NP-PA572WG, NP-PA672WG, NP-PA622UG, NP-522UG, NP-PA722X+, NP-PA622X+, NP-PA572W+, NP-PA6 NP-PA1705UL-W, NP-PA1705UL-W+, NP-PA1705UL-B, NP-PA1705UL-B+, NP-PA1505UL-W, NP-PA1505UL-W+, NP-PA1505UL-B, NP-PA1505UL-B+, NP-PA1505UL-BJL NP-PV800UL-W, NP-PV800UL-W+, NP-PV800UL-B, NP-PV80 -
Critical 9.9
Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) in the Gallagher Morpho integratio…
-
Critical 9.9
Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nag…
-
Critical 10.0
Digiever｜NVR - Exposure of Sensitive Information
Certain models of NVR developed by Digiever has an Exposure of Sensitive Information vulnerability, allowing unauthenticated remoter attackers to access the system configuration file and obtain plaintext credentials of the NVR and its connected cameras.
-
Critical 9.8
Hunt Electronic Hybrid DVR - Exposure of Sensitive System Information
Certain hybrid DVR models ((HBF-09KD and HBF-16NK)) from Hunt Electronic have an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to directly access a system configuration file and obtain plaintext administrator crede…
-
Critical 9.8
Honding Technology Smart Parking Management System - Exposure of Sensitive Information
Smart Parking Management System from Honding Technology has an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to access a specific page and obtain plaintext administrator credentials.
-
Critical 9.8
Quanxun School Affairs System - Exposure of Sensitive Information
School Affairs System from Quanxun has an Exposure of Sensitive Information, allowing unauthenticated attackers to view specific pages and obtain database information as well as plaintext administrator credentials.
-
Critical 9.8
Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call Me KW-60 R3…
-
Critical 9.6
FDSK Leak in KNX Secure Devices
FDSK Leak in ABB, Busch-Jaeger, FTS Display (version 1.00) and BCU (version 1.3.0.33) allows attacker to take control via access to local KNX Bus-System
-
Critical 9.3
Landscape's Apache server-status is accessible by default
Landscape's server-status page exposed sensitive system information. This data leak included GET requests which contain information to attack and leak further information from the Landscape API.