CWE-209 · Generation of Error Message Containing Sensitive Information (page 3)
Page 3 of 6 — CVEs classified under CWE-209, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-52896 | Medium | 6.2 | 2024-12-19 | IBM MQ 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a remote attacker to obtain sensitive information when a detailed technical error… |
CVE-2024-49818 | Medium | 4.3 | 2024-12-17 | IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information when a detailed techni… |
CVE-2024-54366 | Medium | 5.3 | 2024-12-16 | Generation of Error Message Containing Sensitive Information vulnerability in videogallery Vimeography vimeography allows Retrieve Embedded Sensitive Data.This… |
CVE-2024-51460 | Medium | 4.3 | 2024-12-11 | IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information when a detailed technical error message is returned in… |
CVE-2024-53948 | Medium | 5.3 | 2024-12-09 | Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recomme… |
CVE-2024-54141 | High | 8.6 | 2024-12-06 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Prior to 4.0.0, phpMyFAQ exposes the database (ie postgr… |
CVE-2024-53253 | Medium | 5.3 | 2024-11-22 | Sentry is an error tracking and performance monitoring platform. Version 24.11.0, and only version 24.11.0, is vulnerable to a scenario where a specific error… |
CVE-2024-48896 | Medium | 4.3 | 2024-11-18 | A vulnerability was found in Moodle. It is possible for users with the "send message" capability to view other users' names that they may not otherwise have ac… |
CVE-2021-3986 | Medium | 4.3 | 2024-11-15 | A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users. This issue occurs in the file… |
CVE-2023-40457 | | 2024-11-11 | The BGP daemon in Extreme Networks ExtremeXOS (aka EXOS) 30.7.1.1 allows an attacker (who is not on a directly connected network) to cause a denial of service… | |
CVE-2024-30141 | Medium | 4.7 | 2024-11-07 | HCL BigFix Compliance is vulnerable to the generation of error messages containing sensitive information. Detailed error messages can provide enticement infor… |
CVE-2024-52043 | Medium | 5.3 | 2024-11-06 | Generation of Error Message Containing Sensitive Information in HumHub GmbH & Co. KG - HumHub on Linux allows: Excavation (user enumeration).This issue affects… |
CVE-2024-51560 | Medium | 4.3 | 2024-11-04 | This vulnerability exists in the Wave 2.0 due to improper exception handling for invalid inputs at certain API endpoint. An authenticated remote attacker could… |
CVE-2024-39719 | High | 7.5 | 2024-10-31 | An issue was discovered in Ollama through 0.3.14. File existence disclosure can occur via api/create. When calling the CreateModel route with a path parameter… |
CVE-2024-50512 | Medium | 5.3 | 2024-10-30 | Generation of Error Message Containing Sensitive Information vulnerability in Posti Posti Shipping posti-shipping allows Retrieve Embedded Sensitive Data.This… |
CVE-2023-50355 | Low | 3.6 | 2024-10-23 | HCL Sametime is impacted by the error messages containing sensitive information. An attacker can use this information to launch another, more focused attack. |
CVE-2024-45713 | Medium | 5.1 | 2024-10-17 | SolarWinds Kiwi CatTools is susceptible to a sensitive data disclosure vulnerability when a non-default setting has been enabled for troubleshooting purposes. |
CVE-2024-44762 | Medium | 5.3 | 2024-10-16 | A discrepancy in error messages for invalid login attempts in Webmin Usermin v2.100 allows attackers to enumerate valid user accounts. |
CVE-2024-47803 | Medium | 4.3 | 2024-10-02 | Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissions involving the `sec… |
CVE-2024-45817 | High | 7.3 | 2024-09-25 | In x86's APIC (Advanced Programmable Interrupt Controller) architecture, error conditions are reported in a status register. Furthermore, the OS can opt to re… |
CVE-2024-7426 | Medium | 5.3 | 2024-09-25 | The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Full Path Disclosure in all versions up… |
CVE-2024-45384 | Medium | 5.3 | 2024-09-17 | Padding Oracle vulnerability in Apache Druid extension, druid-pac4j. This could allow an attacker to manipulate a pac4j session cookie. This issue affects Apa… |
CVE-2024-6544 | Medium | 5.3 | 2024-09-13 | The Custom Post Limits plugin for WordPress is vulnerable to full path disclosure in all versions up to, and including, 4.4.1. This is due to the plugin utiliz… |
CVE-2024-5435 | Medium | 4.5 | 2024-09-12 | An issue has been discovered discovered in GitLab EE/CE affecting all versions starting from 15.10 before 17.1.7, all versions starting from 17.2 before 17.2.5… |
CVE-2024-8571 | Low | 3.5 | 2024-09-08 | A vulnerability was found in erjemin roll_cms up to 1484fe2c4e0805946a7bcf46218509fcb34883a9. It has been classified as problematic. This affects an unknown pa… |
CVE-2024-7415 | Medium | 5.3 | 2024-09-06 | The Remember Me Controls plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0.1. This is due to the plugin allo… |
CVE-2024-6551 | Medium | 5.3 | 2024-08-29 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.15.1… |
CVE-2024-45440 | Medium | 5.3 | 2024-08-29 | core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file th… |
CVE-2024-41674 | Medium | 5.3 | 2024-08-21 | CKAN is an open-source data management system for powering data hubs and data portals. If there were connection issues with the Solr server, the internal Solr… |
CVE-2024-43376 | Medium | 4.3 | 2024-08-20 | Umbraco is an ASP.NET CMS. Some endpoints in the Management API can return stack trace information, even when Umbraco is not in debug mode. This vulnerability… |
CVE-2023-47728 | Medium | 6.5 | 2024-08-16 | IBM QRadar Suite Software 1.10.12.0 through 1.10.22.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow a remote attacker to obtain sensiti… |
CVE-2024-39751 | Medium | 4.3 | 2024-08-06 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the… |
CVE-2024-6980 | Critical | 9.8 | 2024-07-31 | A verbose error handling issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. Thi… |
CVE-2024-5250 | Low | 3.5 | 2024-07-30 | In versions of Akana API Platform prior to 2024.1.0 overly verbose errors can be found in SAML integrations |
CVE-2024-6984 | High | 8.8 | 2024-07-29 | An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive dat… |
CVE-2024-3454 | Low | 3.5 | 2024-07-24 | An implementation issue in the Connectivity Standards Alliance Matter 1.2 protocol as used in the connectedhomeip SDK allows a third party to disclose informat… |
CVE-2022-35640 | Medium | 4.0 | 2024-07-16 | IBM Sterling Partner Engagement Manager 6.2.2 could allow a local attacker to obtain sensitive information when a detailed technical error message is returned… |
CVE-2024-39737 | Medium | 5.4 | 2024-07-15 | IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to obtain sensitive information when a detailed technical error messa… |
CVE-2024-6613 | Medium | 5.5 | 2024-07-09 | The frame iterator could get stuck in a loop when encountering certain wasm frames leading to incorrect stack traces. This vulnerability affects Firefox < 128… |
CVE-2023-50953 | Medium | 5.4 | 2024-06-30 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. This… |
CVE-2024-35119 | Medium | 5.3 | 2024-06-30 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in a s… |
CVE-2024-35156 | Medium | 6.5 | 2024-06-28 | IBM MQ 9.3 LTS and 9.3 CD could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. Th… |
CVE-2024-35155 | Medium | 6.5 | 2024-06-28 | IBM MQ Console 9.3 LTS and 9.3 CD could disclose could allow a remote attacker to obtain sensitive information when a detailed technical error message is retur… |
CVE-2024-39458 | Low | 3.1 | 2024-06-26 | When Jenkins Structs Plugin 337.v1b_04ea_4df7c8 and earlier fails to configure a build step, it logs a warning message containing diagnostic information that m… |
CVE-2024-37162 | Medium | 4.0 | 2024-06-07 | zsa is a library for building typesafe server actions in Next.js. All users are impacted. The zsa application transfers the parse error stack from the server t… |
CVE-2024-36106 | Medium | 4.3 | 2024-06-06 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It’s possible for authenticated users to enumerate clusters by name by inspecting err… |
CVE-2024-36375 | Medium | 5.3 | 2024-05-29 | In JetBrains TeamCity before 2024.03.2 technical information regarding TeamCity server could be exposed |
CVE-2024-35232 | Low | 3.7 | 2024-05-24 | github.com/huandu/facebook is a Go package that fully supports the Facebook Graph API with file upload, batch request and marketing API. access_token can be ex… |
CVE-2024-31844 | Medium | 5.3 | 2024-05-21 | An issue was discovered in Italtel Embrace 1.6.4. The server does not properly handle application errors. In some cases, this leads to a disclosure of informat… |
CVE-2021-47381 | Medium | 5.5 | 2024-05-21 | In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Fix DSP oops stack dump output contents Fix @buf arg given to hex_dump_to_buff… |
CVE-2024-35935 | Low | 3.3 | 2024-05-19 | In the Linux kernel, the following vulnerability has been resolved: btrfs: send: handle path ref underflow in header iterate_inode_ref() Change BUG_ON to pro… |
CVE-2024-28285 | Critical | 9.8 | 2024-05-14 | A Fault Injection vulnerability in the SymmetricDecrypt function in cryptopp/elgamal.h of Cryptopp Crypto++ 8.9, allows an attacker to co-reside in the same sy… |
CVE-2023-23474 | Low | 3.7 | 2024-05-03 | IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser… |
CVE-2024-32046 | Medium | 4.3 | 2024-04-26 | Mattermost versions 9.6.x <= 9.6.0, 9.5.x <= 9.5.2, 9.4.x <= 9.4.4 and 8.1.x <= 8.1.11 fail to remove detailed error messages in API requests even if the devel… |
CVE-2024-30614 | Medium | 5.3 | 2024-04-12 | An issue in Ametys CMS v4.5.0 and before allows attackers to obtain sensitive information via exposed resources to the error scope. |
CVE-2024-28939 | High | 8.8 | 2024-04-09 | Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability |
CVE-2021-47161 | Medium | 5.5 | 2024-03-25 | In the Linux kernel, the following vulnerability has been resolved: spi: spi-fsl-dspi: Fix a resource leak in an error handling path 'dspi_request_dma()' sho… |
CVE-2024-29059 | High | 7.5 | 2024-03-23 | .NET Framework Information Disclosure Vulnerability |
CVE-2022-32756 | Low | 2.7 | 2024-03-22 | IBM Security Verify Directory 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the b… |
CVE-2024-2009 | Medium | 5.3 | 2024-02-29 | A vulnerability was found in Nway Pro 9. It has been rated as problematic. Affected by this issue is the function ajax_login_submit_form of the file login\inde… |
CVE-2023-5617 | Medium | 5.3 | 2024-02-28 | Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.6, including 9.5.x and 8.3.x, display the version of Tomcat when a ser… |
CVE-2024-27315 | Medium | 4.3 | 2024-02-28 | An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an er… |
CVE-2024-21866 | Medium | 5.3 | 2024-02-02 | In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the affected product responds back with an error message containing sensitive data if it r… |
CVE-2024-22646 | Medium | 5.3 | 2024-01-30 | An email address enumeration vulnerability exists in the password reset function of SEO Panel version 4.10.0. This allows an attacker to guess which emails exi… |
CVE-2024-21619 | Medium | 5.3 | 2024-01-25 | A Missing Authentication for Critical Function vulnerability combined with a Generation of Error Message Containing Sensitive Information vulnerability in J-We… |
CVE-2023-47152 | Medium | 5.9 | 2024-01-22 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to an insecure cryptographic algorithm and to information disclosure in st… |
CVE-2024-23689 | High | 8.8 | 2024-01-19 | Exposure of sensitive information in exceptions in ClichHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickhouse-client versions… |
CVE-2024-21733 | Medium | 5.3 | 2024-01-19 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9… |
CVE-2023-49107 | Medium | 5.3 | 2024-01-16 | Generation of Error Message Containing Sensitive Information vulnerability in Hitachi Device Manager on Windows, Linux (Device Manager Agent modules).This issu… |
CVE-2024-21313 | Medium | 5.3 | 2024-01-09 | Windows TCP/IP Information Disclosure Vulnerability |
CVE-2023-6944 | Medium | 5.7 | 2024-01-04 | A flaw was found in the Red Hat Developer Hub (RHDH). The catalog-import function leaks GitLab access tokens on the frontend when the base64 encoded GitLab tok… |
CVE-2023-50348 | Low | 3.1 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by an improper error handling vulnerability. The application returns detailed error messages that can provide an attacker wit… |
CVE-2023-45701 | Medium | 4.3 | 2023-12-28 | HCL Launch could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information c… |
CVE-2023-27319 | Medium | 5.3 | 2023-12-21 | ONTAP Mediator versions prior to 1.7 are susceptible to a vulnerability that can allow an unauthenticated attacker to enumerate URLs via REST API. |
CVE-2023-47703 | Medium | 5.3 | 2023-12-20 | IBM Security Guardium Key Lifecycle Manager 4.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is return… |
CVE-2023-42013 | Medium | 5.3 | 2023-12-20 | IBM UrbanCode Deploy (UCD) 7.1 through 7.1.2.14, 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 could allow a remote attacker to obtain sensitive information whe… |
CVE-2023-6839 | Medium | 5.3 | 2023-12-15 | Due to improper error handling, a REST API resource could expose a server side error containing an internal WSO2 specific package name in the HTTP response. |
CVE-2023-48393 | Medium | 4.3 | 2023-12-15 | Kaifa Technology WebITR is an online attendance system. A remote attacker with regular user privilege can obtain partial sensitive system information from erro… |
CVE-2023-49878 | Medium | 4.3 | 2023-12-13 | IBM System Storage Virtualization Engine TS7700 3957-VEC, 3948-VED and 3957-VEC could allow a remote attacker to obtain sensitive information when a detailed t… |
CVE-2023-31048 | Medium | 5.3 | 2023-12-12 | The OPC UA .NET Standard Reference Server before 1.4.371.86. places sensitive information into an error message that may be seen remotely. |
CVE-2023-49080 | Low | 3.5 | 2023-12-04 | The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and… |
CVE-2023-43021 | Medium | 5.3 | 2023-12-01 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in th… |
CVE-2023-47636 | Medium | 5.3 | 2023-11-15 | The Pimcore Admin Classic Bundle provides a Backend UI for Pimcore. Full Path Disclosure (FPD) vulnerabilities enable the attacker to see the path to the webro… |
CVE-2023-5514 | Medium | 5.3 | 2023-11-01 | The response messages received from the eSOMS report generation using certain parameter queries with full file path can be abused for enumerating the local fi… |
CVE-2023-46240 | High | 7.5 | 2023-10-31 | CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error report is displayed even… |
CVE-2022-43891 | Low | 2.7 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow a remote attacker to obtain sensitive information when a detailed technical error message is return… |
CVE-2023-4457 | Medium | 5.5 | 2023-10-16 | Grafana is an open-source platform for monitoring and observability. The Google Sheets data source plugin for Grafana, versions 0.9.0 to 1.2.2 are vulnerable… |
CVE-2023-42475 | Medium | 4.3 | 2023-10-10 | The Statutory Reporting application has a vulnerable file storage location, potentially enabling low privileged attacker to read server files with minimal impa… |
CVE-2023-0833 | Medium | 4.7 | 2023-09-27 | A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exception triggered by a he… |
CVE-2023-41027 | High | 8.0 | 2023-09-22 | Credential disclosure in the '/webs/userpasswd.htm' endpoint in Juplink RX4-1500 Wifi router firmware versions V1.0.4 and V1.0.5 allows an authenticated attack… |
CVE-2023-40725 | Medium | 4.0 | 2023-09-12 | A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application returns inconsistent error messages in response to inva… |
CVE-2023-37489 | Medium | 5.3 | 2023-09-12 | Due to the lack of validation, SAP BusinessObjects Business Intelligence Platform (Version Management System) - version 403, permits an unauthenticated user to… |
CVE-2023-39264 | Medium | 4.3 | 2023-09-06 | By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists i… |
CVE-2023-35124 | Low | 3.1 | 2023-09-05 | An information disclosure vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OAS Platform v18.00.0072. A… |
CVE-2023-33835 | Medium | 4.3 | 2023-08-31 | IBM Security Verify Information Queue 10.0.4 and 10.0.5 could allow a remote attacker to obtain sensitive information that could aid in further attacks against… |
CVE-2023-33834 | Medium | 4.3 | 2023-08-31 | IBM Security Verify Information Queue 10.0.4 and 10.0.5 could allow a remote attacker to obtain sensitive information that could aid in further attacks against… |
CVE-2023-40767 | Critical | 9.8 | 2023-08-28 | User enumeration is found in in PHPJabbers Make an Offer Widget v1.0. This issue occurs during password recovery, where a difference in messages could allow an… |
CVE-2023-40766 | Critical | 9.8 | 2023-08-28 | User enumeration is found in in PHPJabbers Ticket Support Script v3.2. This issue occurs during password recovery, where a difference in messages could allow a… |
CVE-2023-40765 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHPJabbers Event Booking Calendar v4.0. This issue occurs during password recovery, where a difference in messages could allow an… |
CVE-2023-40764 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHP Jabbers Car Rental Script v3.0. This issue occurs during password recovery, where a difference in messages could allow an atta… |