Weakness (CWE)
CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere
The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.
How to prevent it (1 mitigation)
-
Architecture and Design, Implementation
Production applications should never use methods that generate internal details such as stack traces and error messages unless that information is directly committed to a log that is not viewable by the end user. All error message text should be HTML entity encoded before being written to the log file to protect against potential cross-site scripting attacks against the viewer of the logs
Source: MITRE CWE-497
342 results · Clear filters · Feed
-
Medium 4.7
HTTP.sys Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows HTTP.sys allows an authorized attacker to disclose information locally.
-
Medium 5.3
Windows Remote Desktop Services Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Remote Desktop Services allows an authorized attacker to disclose information over a network.
-
Medium 5.5
Win32k Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Win32K allows an authorized attacker to disclose information locally.
-
Medium 5.5
Server for NFS Information Disclosure Vulnerability
Improper access control in Windows Server for NFS allows an authorized attacker to disclose information locally.
-
Medium 5.9
Windows DHCP Server Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows DHCP Server allows an unauthorized attacker to disclose information over a network.
-
Medium 5.5
Windows Management Instrumentation Information Disclosure Vulnerability
Out-of-bounds read in Windows Management Instrumentation allows an authorized attacker to disclose information locally.
-
Medium 6.5
Windows Print Spooler Components Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Print Spooler Components allows an authorized attacker to disclose information over a network.
-
Medium 6.0
Windows Secure Kernel Mode Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Windows Secure Kernel Mode allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Graphics Kernel Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Graphics Kernel allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Bluetooth Service Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Bluetooth Service allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Overlay Filter Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Overlay Filter allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Shell Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Shell allows an authorized attacker to disclose information locally.
-
Medium 5.3
WordPress YITH WooCommerce Subscription plugin <= 4.22.0 - Sensitive Data Exposure vulnerability
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Subscription yith-woocommerce-subscription allows Retrieve Embedded Sensitive Data.This issue affects YITH WooCommerce Subscription: from n/a thr…
-
Medium 6.3
BigFix Mobile is affected by sensitive information disclosure
The BigFix MCM admin portal is directly accessible from the internet without VPN or network restriction. A client-side configuration file discloses non-sensitive environment details. Exposing the configuration file publicly increases the attack surface and t…
-
Medium 6.9
FlexNet Beacon Missing Authentication Vulnerability
Missing authentication in the FlexNet Beacon component of Flexera One and FlexNet Manager Suite allows unauthenticated remote attackers to obtain Beacon policy and targeting information when anonymous web server access is enabled (the default).
-
Medium 5.3
Cisco Expressway Series Information Disclosure Vulnerability
A vulnerability in Cisco Expressway Series could allow an unauthenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability is due to insufficient authorization checks of HTTP requests during Mobile and Remote Access…
-
Medium 5.3
Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header
Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the file_etag option is not set, the ETag is built from the file's inode number, modification ti…
-
Medium 4.3
WisdomGarden｜Tronclass - Sensitive Data Exposure
Tronclass developed by WisdomGarden has a Sensitive Data Exposure vulnerability. Authenticated remote attackers can bypass anonymous grading restrictions and obtain anonymous student information.
-
Medium 5.5
Windows Client Side Caching driver (csc.sys) Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to disclose information locally.
-
Medium 4.7
Windows ALPC Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows ALPC allows an authorized attacker to disclose information locally.
-
Medium 5.5
Microsoft Trace Data Helper Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper allows an authorized attacker to disclose information locally.
-
Medium 5.5
Microsoft Trace Data Helper Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper allows an authorized attacker to disclose information locally.
-
Medium 4.7
Windows Kernel Information Disclosure Vulnerability
Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally.
-
Medium 4.7
Windows Shell Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Shell allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Hello Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Hello allows an authorized attacker to disclose information locally.
-
Medium 4.7
Windows Win32 Kernel Subsystem Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Common Log File System Driver Information Disclosure Vulnerability
Buffer over-read in Windows Common Log File System Driver allows an authorized attacker to disclose information locally.
-
Medium 4.7
Windows Win32 Kernel Subsystem Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows MIDI Service Module Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows MIDI Service Module allows an authorized attacker to disclose information locally.
-
Medium 4.7
Windows Installer Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Installer allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Kernel Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Kernel Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Cryptographic Services Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Cryptographic Services allows an authorized attacker to disclose information locally.
-
Medium 6.5
Microsoft Office Excel Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
-
Medium 5.5
Windows NTFS Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows NTFS allows an authorized attacker to disclose information locally.
-
Medium 5.6
Windows Secure Kernel Mode Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Secure Kernel Mode allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Sysmain Service Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Sysmain Service allows an authorized attacker to disclose information locally.
-
Medium 4.7
Windows Win32 Kernel Subsystem Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Clipboard User Service Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Clipboard User Service allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Universal Disk Format File System Driver (UDFS) Information Disclosure Vulnerability
Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally.