CWE-209 · Generation of Error Message Containing Sensitive Information (page 3)
Page 3 of 7 — CVEs classified under CWE-209, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-56812 | Low | 3.3 | 2025-02-27 | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used… |
CVE-2024-56811 | Low | 3.3 | 2025-02-27 | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used… |
CVE-2024-56810 | Low | 3.3 | 2025-02-27 | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used… |
CVE-2024-56496 | Low | 3.3 | 2025-02-27 | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used… |
CVE-2024-56495 | Low | 3.3 | 2025-02-27 | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used… |
CVE-2024-56494 | Low | 3.3 | 2025-02-27 | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used… |
CVE-2024-56493 | Low | 3.3 | 2025-02-27 | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used… |
CVE-2025-0941 | Medium | 5.8 | 2025-02-26 | MET ONE 3400+ instruments running software v1.0.41 can, under rare conditions, temporarily store credentials in plain text within the system. This data is not… |
CVE-2024-13537 | Medium | 5.3 | 2025-02-21 | The C9 Blocks plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.7.7. This is due the plugin containing a publi… |
CVE-2024-13540 | Medium | 5.3 | 2025-02-18 | The WooODT Lite – Delivery & pickup date time location for WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and in… |
CVE-2024-13538 | Medium | 5.3 | 2025-02-18 | The BigBuy Dropshipping Connector for WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0.0. This… |
CVE-2024-13535 | Medium | 5.3 | 2025-02-18 | The Actionwear products sync plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.3.2. This is due the composer-s… |
CVE-2024-13539 | Medium | 5.3 | 2025-02-12 | The AForms Eats plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.3.1. This is due the /vendor/aura/payload-in… |
CVE-2024-52611 | Low | 3.5 | 2025-02-11 | The SolarWinds Platform is vulnerable to an information disclosure vulnerability through an error message. While the data does not provide anything sensitive… |
CVE-2024-56467 | Low | 3.3 | 2025-02-06 | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used… |
CVE-2024-49798 | Medium | 4.3 | 2025-02-06 | IBM ApplinX 11.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This informa… |
CVE-2024-45658 | Low | 2.7 | 2025-02-04 | IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a remote attacker to obtain sensitive information when a detailed technica… |
CVE-2024-45659 | Medium | 5.3 | 2025-02-04 | IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a remote attacker to obtain sensitive information when a detailed technica… |
CVE-2025-23216 | Medium | 6.8 | 2025-01-30 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was discovered in Argo CD that exposed secret values in error message… |
CVE-2025-22218 | High | 8.5 | 2025-01-30 | VMware Aria Operations for Logs contains an information disclosure vulnerability. A malicious actor with View Only Admin permissions may be able to read the cr… |
CVE-2024-35134 | Medium | 5.3 | 2025-01-25 | IBM Analytics Content Hub 2.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser… |
CVE-2024-35112 | Medium | 5.4 | 2025-01-25 | IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the b… |
CVE-2024-35111 | Medium | 4.3 | 2025-01-25 | IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the bro… |
CVE-2023-38716 | Medium | 5.3 | 2025-01-25 | IBM Cloud Pak System 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, and 2.3.4.0 could disclose sensitive information about the system that could… |
CVE-2023-38714 | Medium | 5.3 | 2025-01-25 | IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensit… |
CVE-2023-38713 | Medium | 5.3 | 2025-01-25 | IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensit… |
CVE-2025-24552 | Medium | 5.3 | 2025-01-24 | Generation of Error Message Containing Sensitive Information vulnerability in paytiumsupport Paytium paytium allows Retrieve Embedded Sensitive Data.This issue… |
CVE-2024-13536 | Medium | 5.3 | 2025-01-21 | The 1003 Mortgage Application plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.87. This is due the /inc/class… |
CVE-2024-52898 | Medium | 6.2 | 2025-01-14 | IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a local user to obtain sensitive information when a detailed technical error message is ret… |
CVE-2025-0053 | Medium | 5.3 | 2025-01-14 | SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to gain unauthorized access to system information. By using a specific URL param… |
CVE-2024-25037 | Medium | 4.3 | 2025-01-07 | IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow a remote attacker to obtain sensitive information when a stack trace is retur… |
CVE-2022-22363 | Medium | 4.3 | 2025-01-07 | IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical e… |
CVE-2021-20455 | Low | 3.7 | 2025-01-07 | IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical e… |
CVE-2024-52893 | Medium | 5.3 | 2025-01-07 | IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3 could allow a remote attacker to obtain sensitive information when a detailed technical error me… |
CVE-2024-11625 | High | 7.7 | 2025-01-07 | Information Exposure Through an Error Message vulnerability in Progress Software Corporation Sitefinity.This issue affects Sitefinity: from 4.0 through 14.4.81… |
CVE-2024-5591 | Medium | 4.3 | 2025-01-03 | IBM Jazz Foundation 7.0.2, 7.0.3, and 7.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned i… |
CVE-2024-39725 | Medium | 5.3 | 2024-12-25 | IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 could allow a remote attacker to obtain sensitive information when a detailed tec… |
CVE-2024-23945 | Medium | 5.9 | 2024-12-23 | Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps p… |
CVE-2024-52897 | Medium | 6.2 | 2024-12-19 | IBM MQ 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a remote attacker to obtain sensitive information when a detailed technical error… |
CVE-2024-52896 | Medium | 6.2 | 2024-12-19 | IBM MQ 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a remote attacker to obtain sensitive information when a detailed technical error… |
CVE-2024-49818 | Medium | 4.3 | 2024-12-17 | IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information when a detailed techni… |
CVE-2024-54366 | Medium | 5.3 | 2024-12-16 | Generation of Error Message Containing Sensitive Information vulnerability in videogallery Vimeography vimeography allows Retrieve Embedded Sensitive Data.This… |
CVE-2024-51460 | Medium | 4.3 | 2024-12-11 | IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information when a detailed technical error message is returned in… |
CVE-2024-53948 | Medium | 5.3 | 2024-12-09 | Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recomme… |
CVE-2024-54141 | High | 8.6 | 2024-12-06 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Prior to 4.0.0, phpMyFAQ exposes the database (ie postgr… |
CVE-2024-53253 | Medium | 5.3 | 2024-11-22 | Sentry is an error tracking and performance monitoring platform. Version 24.11.0, and only version 24.11.0, is vulnerable to a scenario where a specific error… |
CVE-2024-48896 | Medium | 4.3 | 2024-11-18 | A vulnerability was found in Moodle. It is possible for users with the "send message" capability to view other users' names that they may not otherwise have ac… |
CVE-2021-3986 | Medium | 4.3 | 2024-11-15 | A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users. This issue occurs in the file… |
CVE-2023-40457 | | 2024-11-11 | The BGP daemon in Extreme Networks ExtremeXOS (aka EXOS) 30.7.1.1 allows an attacker (who is not on a directly connected network) to cause a denial of service… | |
CVE-2024-30141 | Medium | 4.7 | 2024-11-07 | HCL BigFix Compliance is vulnerable to the generation of error messages containing sensitive information. Detailed error messages can provide enticement infor… |
CVE-2024-52043 | Medium | 5.3 | 2024-11-06 | Generation of Error Message Containing Sensitive Information in HumHub GmbH & Co. KG - HumHub on Linux allows: Excavation (user enumeration).This issue affects… |
CVE-2024-51560 | Medium | 4.3 | 2024-11-04 | This vulnerability exists in the Wave 2.0 due to improper exception handling for invalid inputs at certain API endpoint. An authenticated remote attacker could… |
CVE-2024-39719 | High | 7.5 | 2024-10-31 | An issue was discovered in Ollama through 0.3.14. File existence disclosure can occur via api/create. When calling the CreateModel route with a path parameter… |
CVE-2024-50512 | Medium | 5.3 | 2024-10-30 | Generation of Error Message Containing Sensitive Information vulnerability in Posti Posti Shipping posti-shipping allows Retrieve Embedded Sensitive Data.This… |
CVE-2023-50355 | Low | 3.6 | 2024-10-23 | HCL Sametime is impacted by the error messages containing sensitive information. An attacker can use this information to launch another, more focused attack. |
CVE-2024-45713 | Medium | 5.1 | 2024-10-17 | SolarWinds Kiwi CatTools is susceptible to a sensitive data disclosure vulnerability when a non-default setting has been enabled for troubleshooting purposes. |
CVE-2024-44762 | Medium | 5.3 | 2024-10-16 | A discrepancy in error messages for invalid login attempts in Webmin Usermin v2.100 allows attackers to enumerate valid user accounts. |
CVE-2024-47803 | Medium | 4.3 | 2024-10-02 | Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissions involving the `sec… |
CVE-2024-45817 | High | 7.3 | 2024-09-25 | In x86's APIC (Advanced Programmable Interrupt Controller) architecture, error conditions are reported in a status register. Furthermore, the OS can opt to re… |
CVE-2024-7426 | Medium | 5.3 | 2024-09-25 | The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Full Path Disclosure in all versions up… |
CVE-2024-45384 | Medium | 5.3 | 2024-09-17 | Padding Oracle vulnerability in Apache Druid extension, druid-pac4j. This could allow an attacker to manipulate a pac4j session cookie. This issue affects Apa… |
CVE-2024-6544 | Medium | 5.3 | 2024-09-13 | The Custom Post Limits plugin for WordPress is vulnerable to full path disclosure in all versions up to, and including, 4.4.1. This is due to the plugin utiliz… |
CVE-2024-5435 | Medium | 4.5 | 2024-09-12 | An issue has been discovered discovered in GitLab EE/CE affecting all versions starting from 15.10 before 17.1.7, all versions starting from 17.2 before 17.2.5… |
CVE-2024-8571 | Low | 3.5 | 2024-09-08 | A vulnerability was found in erjemin roll_cms up to 1484fe2c4e0805946a7bcf46218509fcb34883a9. It has been classified as problematic. This affects an unknown pa… |
CVE-2024-7415 | Medium | 5.3 | 2024-09-06 | The Remember Me Controls plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0.1. This is due to the plugin allo… |
CVE-2024-6551 | Medium | 5.3 | 2024-08-29 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.15.1… |
CVE-2024-45440 | Medium | 5.3 | 2024-08-29 | core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file th… |
CVE-2024-41674 | Medium | 5.3 | 2024-08-21 | CKAN is an open-source data management system for powering data hubs and data portals. If there were connection issues with the Solr server, the internal Solr… |
CVE-2024-43376 | Medium | 4.3 | 2024-08-20 | Umbraco is an ASP.NET CMS. Some endpoints in the Management API can return stack trace information, even when Umbraco is not in debug mode. This vulnerability… |
CVE-2023-47728 | Medium | 6.5 | 2024-08-16 | IBM QRadar Suite Software 1.10.12.0 through 1.10.22.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow a remote attacker to obtain sensiti… |
CVE-2024-39751 | Medium | 4.3 | 2024-08-06 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the… |
CVE-2024-6980 | Critical | 9.8 | 2024-07-31 | A verbose error handling issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. Thi… |
CVE-2024-5250 | Low | 3.5 | 2024-07-30 | In versions of Akana API Platform prior to 2024.1.0 overly verbose errors can be found in SAML integrations |
CVE-2024-6984 | High | 8.8 | 2024-07-29 | An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive dat… |
CVE-2024-3454 | Low | 3.5 | 2024-07-24 | An implementation issue in the Connectivity Standards Alliance Matter 1.2 protocol as used in the connectedhomeip SDK allows a third party to disclose informat… |
CVE-2022-35640 | Medium | 4.0 | 2024-07-16 | IBM Sterling Partner Engagement Manager 6.2.2 could allow a local attacker to obtain sensitive information when a detailed technical error message is returned… |
CVE-2024-39737 | Medium | 5.4 | 2024-07-15 | IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to obtain sensitive information when a detailed technical error messa… |
CVE-2024-6613 | Medium | 5.5 | 2024-07-09 | The frame iterator could get stuck in a loop when encountering certain wasm frames leading to incorrect stack traces. This vulnerability affects Firefox < 128… |
CVE-2023-50953 | Medium | 5.4 | 2024-06-30 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. This… |
CVE-2024-35119 | Medium | 5.3 | 2024-06-30 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in a s… |
CVE-2024-35156 | Medium | 6.5 | 2024-06-28 | IBM MQ 9.3 LTS and 9.3 CD could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. Th… |
CVE-2024-35155 | Medium | 6.5 | 2024-06-28 | IBM MQ Console 9.3 LTS and 9.3 CD could disclose could allow a remote attacker to obtain sensitive information when a detailed technical error message is retur… |
CVE-2024-39458 | Low | 3.1 | 2024-06-26 | When Jenkins Structs Plugin 337.v1b_04ea_4df7c8 and earlier fails to configure a build step, it logs a warning message containing diagnostic information that m… |
CVE-2024-37162 | Medium | 4.0 | 2024-06-07 | zsa is a library for building typesafe server actions in Next.js. All users are impacted. The zsa application transfers the parse error stack from the server t… |
CVE-2024-36106 | Medium | 4.3 | 2024-06-06 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It’s possible for authenticated users to enumerate clusters by name by inspecting err… |
CVE-2024-36375 | Medium | 5.3 | 2024-05-29 | In JetBrains TeamCity before 2024.03.2 technical information regarding TeamCity server could be exposed |
CVE-2024-35232 | Low | 3.7 | 2024-05-24 | github.com/huandu/facebook is a Go package that fully supports the Facebook Graph API with file upload, batch request and marketing API. access_token can be ex… |
CVE-2024-31844 | Medium | 5.3 | 2024-05-21 | An issue was discovered in Italtel Embrace 1.6.4. The server does not properly handle application errors. In some cases, this leads to a disclosure of informat… |
CVE-2021-47381 | Medium | 5.5 | 2024-05-21 | In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Fix DSP oops stack dump output contents Fix @buf arg given to hex_dump_to_buff… |
CVE-2024-35935 | Low | 3.3 | 2024-05-19 | In the Linux kernel, the following vulnerability has been resolved: btrfs: send: handle path ref underflow in header iterate_inode_ref() Change BUG_ON to pro… |
CVE-2024-28285 | Critical | 9.8 | 2024-05-14 | A Fault Injection vulnerability in the SymmetricDecrypt function in cryptopp/elgamal.h of Cryptopp Crypto++ 8.9, allows an attacker to co-reside in the same sy… |
CVE-2023-23474 | Low | 3.7 | 2024-05-03 | IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser… |
CVE-2024-32046 | Medium | 4.3 | 2024-04-26 | Mattermost versions 9.6.x <= 9.6.0, 9.5.x <= 9.5.2, 9.4.x <= 9.4.4 and 8.1.x <= 8.1.11 fail to remove detailed error messages in API requests even if the devel… |
CVE-2024-30614 | Medium | 5.3 | 2024-04-12 | An issue in Ametys CMS v4.5.0 and before allows attackers to obtain sensitive information via exposed resources to the error scope. |
CVE-2024-28939 | High | 8.8 | 2024-04-09 | Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability |
CVE-2021-47161 | Medium | 5.5 | 2024-03-25 | In the Linux kernel, the following vulnerability has been resolved: spi: spi-fsl-dspi: Fix a resource leak in an error handling path 'dspi_request_dma()' sho… |
CVE-2024-29059 | High | 7.5 | 2024-03-23 | .NET Framework Information Disclosure Vulnerability |
CVE-2022-32756 | Low | 2.7 | 2024-03-22 | IBM Security Verify Directory 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the b… |
CVE-2024-2009 | Medium | 5.3 | 2024-02-29 | A vulnerability was found in Nway Pro 9. It has been rated as problematic. Affected by this issue is the function ajax_login_submit_form of the file login\inde… |
CVE-2023-5617 | Medium | 5.3 | 2024-02-28 | Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.6, including 9.5.x and 8.3.x, display the version of Tomcat when a ser… |