CWE-209 · Generation of Error Message Containing Sensitive Information (page 2)
Page 2 of 6 — CVEs classified under CWE-209, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-36437 | Medium | 4.3 | 2025-12-09 | IBM Planning Analytics Local 2.1.0 - 2.1.15 could disclose sensitive information about server architecture that could aid in further attacks against the system. |
CVE-2025-66549 | Low | 2.4 | 2025-12-05 | Nextcloud Desktop is the desktop sync client for Nextcloud. Prior to 3.16.5, when trying to manually lock a file inside an end-to-end encrypted directory, the… |
CVE-2025-13596 | | 2025-11-24 | A sensitive information disclosure vulnerability exists in the error handling component of ATISoluciones CIGES Application version 2.15.6 and earlier. When cer… | |
CVE-2025-52671 | Medium | 4.3 | 2025-11-20 | Debug information disclosure in the SQL error message to in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to acquire information… |
CVE-2025-41076 | Medium | 6.5 | 2025-11-20 | In version 6.13.0 of LimeSurvey, any external user can cause a 500 error in the survey system by sending a malformed session cookie. Instead of displaying a ge… |
CVE-2025-9977 | | 2025-11-18 | Value provided in one of POST parameters sent during the process of logging in to Times Software E-Payroll is not sanitized properly, which allows an unauthent… | |
CVE-2025-54562 | Medium | 4.3 | 2025-11-14 | A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows Technical Information to be Disclosed t… |
CVE-2025-64749 | Medium | 4.3 | 2025-11-13 | Directus is a real-time API and App dashboard for managing SQL database content. An observable difference in error messaging was found in the Directus REST API… |
CVE-2025-40760 | Medium | 5.5 | 2025-11-11 | A vulnerability has been identified in Altair Grid Engine (All versions < V2026.0.0). Affected products do not properly handle error messages and discloses sen… |
CVE-2025-61959 | Medium | 5.3 | 2025-10-29 | Prior to September 19, 2025, the Hospital Manager Backend Services returned verbose ASP.NET error pages for invalid WebResource.axd requests, disclosing framew… |
CVE-2025-12365 | Medium | 5.3 | 2025-10-27 | Error Messages Wrapped In HTTP Header.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-62397 | Medium | 5.3 | 2025-10-23 | The router’s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially aiding reconnaissance. |
CVE-2025-62168 | Critical | 10.0 | 2025-10-17 | Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information… |
CVE-2025-55676 | Medium | 5.5 | 2025-10-14 | Generation of error message containing sensitive information in Windows USB Video Driver allows an authorized attacker to disclose information locally. |
CVE-2025-31998 | Low | 3.5 | 2025-10-12 | HCL Unica Centralized Offer Management is vulnerable to poor unhandled exceptions which exposes sensitive information. An attacker can exploit use this inform… |
CVE-2025-54291 | Medium | 5.3 | 2025-10-02 | Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project exist… |
CVE-2025-26333 | Medium | 5.9 | 2025-09-25 | Dell BSAFE Crypto-J generates an error message that includes sensitive information about its environment and associated data. A remote attacker could potential… |
CVE-2025-53803 | Medium | 5.5 | 2025-09-09 | Generation of error message containing sensitive information in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2025-43776 | Medium | 5.4 | 2025-09-09 | A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025… |
CVE-2025-59016 | Medium | 4.3 | 2025-09-09 | Error messages containing sensitive information in the File Abstraction Layer in TYPO3 CMS versions 9.0.0-9.5.54, 10.0.0-10.4.53, 11.0.0-11.5.47, 12.0.0-12.4.3… |
CVE-2025-43777 | Medium | 5.3 | 2025-09-09 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 thro… |
CVE-2025-48562 | Medium | 5.0 | 2025-09-04 | In writeContent of RemotePrintDocument.java, there is a possible information disclosure due to a logic error. This could lead to local information disclosure w… |
CVE-2025-22421 | Medium | 5.5 | 2025-09-02 | In contentDescForNotification of NotificationContentDescription.kt, there is a possible notification content leak through the lockscreen due to a logic error i… |
CVE-2025-36003 | High | 7.5 | 2025-08-28 | IBM Security Verify Governance Identity Manager 10.0.2 could allow a remote attacker to obtain sensitive information when detailed technical error messages are… |
CVE-2025-9229 | Medium | 5.3 | 2025-08-20 | Information disclosure vulnerability in error handling in MiR software prior to version 3.0.0 allows unauthenticated attackers to view detailed error informati… |
CVE-2025-52619 | Medium | 5.3 | 2025-08-15 | HCL BigFix SaaS Authentication Service is affected by a sensitive information disclosure. Under certain conditions, error messages disclose sensitive version… |
CVE-2025-9005 | Low | 3.7 | 2025-08-15 | A vulnerability was determined in mtons mblog up to 3.5.0. Affected is an unknown function of the file /register. The manipulation leads to information exposur… |
CVE-2025-54791 | Medium | 5.3 | 2025-08-13 | OMERO.web provides a web based client and plugin infrastructure. Prior to version 5.29.2, if an error occurred when resetting a user's password using the Forgo… |
CVE-2024-41984 | Low | 2.6 | 2025-08-12 | A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SO… |
CVE-2024-41983 | Low | 3.5 | 2025-08-12 | A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SO… |
CVE-2025-8852 | Medium | 4.3 | 2025-08-11 | A vulnerability was identified in WuKongOpenSource WukongCRM 11.0. This affects an unknown part of the file /adminFile/upload of the component API Response Han… |
CVE-2025-23320 | High | 7.5 | 2025-08-06 | NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause the shared memory limit to b… |
CVE-2025-46658 | Critical | 9.8 | 2025-08-05 | An issue was discovered in ExonautWeb in 4C Strategies Exonaut 21.6. There are verbose error messages. |
CVE-2025-8548 | Low | 3.7 | 2025-08-05 | A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic. This issue affects the function sendEmailCode of the file src/main/java/co/… |
CVE-2025-47813 | Medium | 4.3 | 2025-07-10 | loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie. |
CVE-2025-36090 | Medium | 4.3 | 2025-07-10 | IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 could allow a remote attacker to obtain information about the application framework which could be used in rec… |
CVE-2024-37524 | Medium | 5.3 | 2025-07-10 | IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is retur… |
CVE-2025-40718 | High | 7.5 | 2025-07-08 | Improper error handling vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to send malformed payloads… |
CVE-2025-5731 | Medium | 5.5 | 2025-06-26 | A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command… |
CVE-2025-44203 | High | 7.5 | 2025-06-20 | In HotelDruid 3.0.0 and 3.0.7, the unauthenticated database-setup endpoint creadb.php can be reached before setup is completed and performs database creation w… |
CVE-2025-49128 | Medium | 4.0 | 2025-06-06 | Jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. Starting in version 2.0.0 and… |
CVE-2024-56342 | Medium | 4.3 | 2025-06-06 | IBM Verify Identity Access Digital Credentials 24.06 could allow a remote attacker to obtain sensitive information when a detailed technical error message is r… |
CVE-2025-25025 | Medium | 4.3 | 2025-05-28 | IBM Security Guardium 12.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. T… |
CVE-2025-40653 | | 2025-05-26 | User enumeration vulnerability in M3M Printer Server Web. This issue occurs during user authentication, where a difference in error messages could allow an att… | |
CVE-2025-41441 | Medium | 5.3 | 2025-05-26 | Mailform Pro CGI prior to 4.3.4 generates error messages containing sensitive information, which may allow a remote unauthenticated attacker to obtain coupon c… |
CVE-2025-46746 | Medium | 5.8 | 2025-05-12 | An administrator could discover another account's credentials. |
CVE-2025-4166 | Medium | 4.5 | 2025-05-02 | Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submi… |
CVE-2025-0049 | Low | 3.5 | 2025-04-28 | When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error message includes the absolute server p… |
CVE-2025-46575 | Medium | 4.9 | 2025-04-27 | There is an information disclosure vulnerability in the GoldenDB database product. Attackers can exploit error messages to obtain the system's sensitive inform… |
CVE-2025-25045 | Medium | 4.3 | 2025-04-23 | IBM InfoSphere Information 11.7 Server authenticated user to obtain sensitive information when a detailed technical error message is returned in a request. Th… |
CVE-2025-20150 | Medium | 5.3 | 2025-04-16 | A vulnerability in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to enumerate LDAP user accounts. This vulnerability is due to the i… |
CVE-2024-11129 | Medium | 6.3 | 2025-04-10 | An issue has been discovered in GitLab EE affecting all versions from 17.1 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. This allows attackers… |
CVE-2025-32238 | Medium | 4.3 | 2025-04-04 | Generation of Error Message Containing Sensitive Information vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-schedul… |
CVE-2025-0279 | Medium | 4.3 | 2025-04-03 | HCL Traveler generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, sensitive tokens, c… |
CVE-2023-47639 | Medium | 5.3 | 2025-04-03 | API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. From 3.2.0 until 3.2.4, exception messages, that are not HTTP exceptions, are… |
CVE-2024-55895 | Low | 2.7 | 2025-03-29 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the… |
CVE-2025-31141 | Low | 2.7 | 2025-03-27 | In JetBrains TeamCity before 2025.03 exception could lead to credential leakage on Cloud Profiles page |
CVE-2024-12380 | Medium | 4.4 | 2025-03-13 | An issue was discovered in GitLab EE/CE affecting all versions starting from 11.5 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions st… |
CVE-2025-2239 | Medium | 5.3 | 2025-03-12 | Generation of Error Message Containing Sensitive Information vulnerability in Hillstone Networks Hillstone Next Generation FireWall.This issue affects Hillston… |
CVE-2025-23185 | Medium | 4.1 | 2025-03-11 | Due to improper error handling in SAP Business Objects Business Intelligence Platform, technical details of the application are revealed in exceptions thrown t… |
CVE-2025-20002 | Medium | 5.3 | 2025-03-05 | After attempting to upload a file that does not meet prerequisites, GMOD Apollo will respond with local path information disclosure |
CVE-2024-56812 | Low | 3.3 | 2025-02-27 | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used… |
CVE-2024-56811 | Low | 3.3 | 2025-02-27 | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used… |
CVE-2024-56810 | Low | 3.3 | 2025-02-27 | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used… |
CVE-2024-56496 | Low | 3.3 | 2025-02-27 | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used… |
CVE-2024-56495 | Low | 3.3 | 2025-02-27 | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used… |
CVE-2024-56494 | Low | 3.3 | 2025-02-27 | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used… |
CVE-2024-56493 | Low | 3.3 | 2025-02-27 | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used… |
CVE-2025-0941 | Medium | 5.8 | 2025-02-26 | MET ONE 3400+ instruments running software v1.0.41 can, under rare conditions, temporarily store credentials in plain text within the system. This data is not… |
CVE-2024-13537 | Medium | 5.3 | 2025-02-21 | The C9 Blocks plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.7.7. This is due the plugin containing a publi… |
CVE-2024-13540 | Medium | 5.3 | 2025-02-18 | The WooODT Lite – Delivery & pickup date time location for WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and in… |
CVE-2024-13538 | Medium | 5.3 | 2025-02-18 | The BigBuy Dropshipping Connector for WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0.0. This… |
CVE-2024-13535 | Medium | 5.3 | 2025-02-18 | The Actionwear products sync plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.3.2. This is due the composer-s… |
CVE-2024-13539 | Medium | 5.3 | 2025-02-12 | The AForms Eats plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.3.1. This is due the /vendor/aura/payload-in… |
CVE-2024-52611 | Low | 3.5 | 2025-02-11 | The SolarWinds Platform is vulnerable to an information disclosure vulnerability through an error message. While the data does not provide anything sensitive… |
CVE-2024-56467 | Low | 3.3 | 2025-02-06 | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used… |
CVE-2024-49798 | Medium | 4.3 | 2025-02-06 | IBM ApplinX 11.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This informa… |
CVE-2024-45658 | Low | 2.7 | 2025-02-04 | IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a remote attacker to obtain sensitive information when a detailed technica… |
CVE-2024-45659 | Medium | 5.3 | 2025-02-04 | IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a remote attacker to obtain sensitive information when a detailed technica… |
CVE-2025-23216 | Medium | 6.8 | 2025-01-30 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was discovered in Argo CD that exposed secret values in error message… |
CVE-2025-22218 | High | 8.5 | 2025-01-30 | VMware Aria Operations for Logs contains an information disclosure vulnerability. A malicious actor with View Only Admin permissions may be able to read the cr… |
CVE-2024-35134 | Medium | 5.3 | 2025-01-25 | IBM Analytics Content Hub 2.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser… |
CVE-2024-35112 | Medium | 5.4 | 2025-01-25 | IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the b… |
CVE-2024-35111 | Medium | 4.3 | 2025-01-25 | IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the bro… |
CVE-2023-38716 | Medium | 5.3 | 2025-01-25 | IBM Cloud Pak System 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, and 2.3.4.0 could disclose sensitive information about the system that could… |
CVE-2023-38714 | Medium | 5.3 | 2025-01-25 | IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensit… |
CVE-2023-38713 | Medium | 5.3 | 2025-01-25 | IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensit… |
CVE-2025-24552 | Medium | 5.3 | 2025-01-24 | Generation of Error Message Containing Sensitive Information vulnerability in paytiumsupport Paytium paytium allows Retrieve Embedded Sensitive Data.This issue… |
CVE-2024-13536 | Medium | 5.3 | 2025-01-21 | The 1003 Mortgage Application plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.87. This is due the /inc/class… |
CVE-2024-52898 | Medium | 6.2 | 2025-01-14 | IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a local user to obtain sensitive information when a detailed technical error message is ret… |
CVE-2025-0053 | Medium | 5.3 | 2025-01-14 | SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to gain unauthorized access to system information. By using a specific URL param… |
CVE-2024-25037 | Medium | 4.3 | 2025-01-07 | IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow a remote attacker to obtain sensitive information when a stack trace is retur… |
CVE-2022-22363 | Medium | 4.3 | 2025-01-07 | IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical e… |
CVE-2021-20455 | Low | 3.7 | 2025-01-07 | IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical e… |
CVE-2024-52893 | Medium | 5.3 | 2025-01-07 | IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3 could allow a remote attacker to obtain sensitive information when a detailed technical error me… |
CVE-2024-11625 | High | 7.7 | 2025-01-07 | Information Exposure Through an Error Message vulnerability in Progress Software Corporation Sitefinity.This issue affects Sitefinity: from 4.0 through 14.4.81… |
CVE-2024-5591 | Medium | 4.3 | 2025-01-03 | IBM Jazz Foundation 7.0.2, 7.0.3, and 7.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned i… |
CVE-2024-39725 | Medium | 5.3 | 2024-12-25 | IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 could allow a remote attacker to obtain sensitive information when a detailed tec… |
CVE-2024-23945 | Medium | 5.9 | 2024-12-23 | Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps p… |
CVE-2024-52897 | Medium | 6.2 | 2024-12-19 | IBM MQ 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a remote attacker to obtain sensitive information when a detailed technical error… |