CWE-209 · Generation of Error Message Containing Sensitive Information (page 4)
Page 4 of 7 — CVEs classified under CWE-209, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-27315 | Medium | 4.3 | 2024-02-28 | An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an er… |
CVE-2024-21866 | Medium | 5.3 | 2024-02-02 | In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the affected product responds back with an error message containing sensitive data if it r… |
CVE-2024-22646 | Medium | 5.3 | 2024-01-30 | An email address enumeration vulnerability exists in the password reset function of SEO Panel version 4.10.0. This allows an attacker to guess which emails exi… |
CVE-2024-21619 | Medium | 5.3 | 2024-01-25 | A Missing Authentication for Critical Function vulnerability combined with a Generation of Error Message Containing Sensitive Information vulnerability in J-We… |
CVE-2023-47152 | Medium | 5.9 | 2024-01-22 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to an insecure cryptographic algorithm and to information disclosure in st… |
CVE-2024-23689 | High | 8.8 | 2024-01-19 | Exposure of sensitive information in exceptions in ClichHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickhouse-client versions… |
CVE-2024-21733 | Medium | 5.3 | 2024-01-19 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9… |
CVE-2023-49107 | Medium | 5.3 | 2024-01-16 | Generation of Error Message Containing Sensitive Information vulnerability in Hitachi Device Manager on Windows, Linux (Device Manager Agent modules).This issu… |
CVE-2024-21313 | Medium | 5.3 | 2024-01-09 | Windows TCP/IP Information Disclosure Vulnerability |
CVE-2023-6944 | Medium | 5.7 | 2024-01-04 | A flaw was found in the Red Hat Developer Hub (RHDH). The catalog-import function leaks GitLab access tokens on the frontend when the base64 encoded GitLab tok… |
CVE-2023-50348 | Low | 3.1 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by an improper error handling vulnerability. The application returns detailed error messages that can provide an attacker wit… |
CVE-2023-45701 | Medium | 4.3 | 2023-12-28 | HCL Launch could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information c… |
CVE-2023-27319 | Medium | 5.3 | 2023-12-21 | ONTAP Mediator versions prior to 1.7 are susceptible to a vulnerability that can allow an unauthenticated attacker to enumerate URLs via REST API. |
CVE-2023-47703 | Medium | 5.3 | 2023-12-20 | IBM Security Guardium Key Lifecycle Manager 4.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is return… |
CVE-2023-42013 | Medium | 5.3 | 2023-12-20 | IBM UrbanCode Deploy (UCD) 7.1 through 7.1.2.14, 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 could allow a remote attacker to obtain sensitive information whe… |
CVE-2023-6839 | Medium | 5.3 | 2023-12-15 | Due to improper error handling, a REST API resource could expose a server side error containing an internal WSO2 specific package name in the HTTP response. |
CVE-2023-48393 | Medium | 4.3 | 2023-12-15 | Kaifa Technology WebITR is an online attendance system. A remote attacker with regular user privilege can obtain partial sensitive system information from erro… |
CVE-2023-49878 | Medium | 4.3 | 2023-12-13 | IBM System Storage Virtualization Engine TS7700 3957-VEC, 3948-VED and 3957-VEC could allow a remote attacker to obtain sensitive information when a detailed t… |
CVE-2023-31048 | Medium | 5.3 | 2023-12-12 | The OPC UA .NET Standard Reference Server before 1.4.371.86. places sensitive information into an error message that may be seen remotely. |
CVE-2023-49080 | Low | 3.5 | 2023-12-04 | The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and… |
CVE-2023-43021 | Medium | 5.3 | 2023-12-01 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in th… |
CVE-2023-47636 | Medium | 5.3 | 2023-11-15 | The Pimcore Admin Classic Bundle provides a Backend UI for Pimcore. Full Path Disclosure (FPD) vulnerabilities enable the attacker to see the path to the webro… |
CVE-2023-5514 | Medium | 5.3 | 2023-11-01 | The response messages received from the eSOMS report generation using certain parameter queries with full file path can be abused for enumerating the local fi… |
CVE-2023-46240 | High | 7.5 | 2023-10-31 | CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error report is displayed even… |
CVE-2022-43891 | Low | 2.7 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow a remote attacker to obtain sensitive information when a detailed technical error message is return… |
CVE-2023-4457 | Medium | 5.5 | 2023-10-16 | Grafana is an open-source platform for monitoring and observability. The Google Sheets data source plugin for Grafana, versions 0.9.0 to 1.2.2 are vulnerable… |
CVE-2023-42475 | Medium | 4.3 | 2023-10-10 | The Statutory Reporting application has a vulnerable file storage location, potentially enabling low privileged attacker to read server files with minimal impa… |
CVE-2023-0833 | Medium | 4.7 | 2023-09-27 | A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exception triggered by a he… |
CVE-2023-41027 | High | 8.0 | 2023-09-22 | Credential disclosure in the '/webs/userpasswd.htm' endpoint in Juplink RX4-1500 Wifi router firmware versions V1.0.4 and V1.0.5 allows an authenticated attack… |
CVE-2023-40725 | Medium | 4.0 | 2023-09-12 | A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application returns inconsistent error messages in response to inva… |
CVE-2023-37489 | Medium | 5.3 | 2023-09-12 | Due to the lack of validation, SAP BusinessObjects Business Intelligence Platform (Version Management System) - version 403, permits an unauthenticated user to… |
CVE-2023-39264 | Medium | 4.3 | 2023-09-06 | By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists i… |
CVE-2023-35124 | Low | 3.1 | 2023-09-05 | An information disclosure vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OAS Platform v18.00.0072. A… |
CVE-2023-33835 | Medium | 4.3 | 2023-08-31 | IBM Security Verify Information Queue 10.0.4 and 10.0.5 could allow a remote attacker to obtain sensitive information that could aid in further attacks against… |
CVE-2023-33834 | Medium | 4.3 | 2023-08-31 | IBM Security Verify Information Queue 10.0.4 and 10.0.5 could allow a remote attacker to obtain sensitive information that could aid in further attacks against… |
CVE-2023-40767 | Critical | 9.8 | 2023-08-28 | User enumeration is found in in PHPJabbers Make an Offer Widget v1.0. This issue occurs during password recovery, where a difference in messages could allow an… |
CVE-2023-40766 | Critical | 9.8 | 2023-08-28 | User enumeration is found in in PHPJabbers Ticket Support Script v3.2. This issue occurs during password recovery, where a difference in messages could allow a… |
CVE-2023-40765 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHPJabbers Event Booking Calendar v4.0. This issue occurs during password recovery, where a difference in messages could allow an… |
CVE-2023-40764 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHP Jabbers Car Rental Script v3.0. This issue occurs during password recovery, where a difference in messages could allow an atta… |
CVE-2023-40763 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHPJabbers Taxi Booking Script v2.0. This issue occurs during password recovery, where a difference in messages could allow an att… |
CVE-2023-40762 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHPJabbers Fundraising Script v1.0. This issue occurs during password recovery, where a difference in messages could allow an atta… |
CVE-2023-40761 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHPJabbers Yacht Listing Script v2.0. This issue occurs during password recovery, where a difference in messages could allow an at… |
CVE-2023-40760 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHP Jabbers Hotel Booking System v4.0. This issue occurs during password recovery, where a difference in messages could allow an a… |
CVE-2023-40759 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHP Jabbers Restaurant Booking Script v3.0. This issue occurs during password recovery, where a difference in messages could allow… |
CVE-2023-40758 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHPJabbers Document Creator v1.0. This issue occurs during password recovery, where a difference in messages could allow an attack… |
CVE-2023-40757 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHPJabbers Food Delivery Script v3.1. This issue occurs during password recovery, where a difference in messages could allow an at… |
CVE-2023-26272 | Medium | 5.3 | 2023-08-28 | IBM Security Guardium Data Encryption (IBM Guardium Cloud Key Manager (GCKM) 1.10.3)) could allow a remote attacker to obtain sensitive information when a deta… |
CVE-2023-32755 | Medium | 5.3 | 2023-08-25 | e-Excellence U-Office Force generates an error message in webiste service. An unauthenticated remote attacker can obtain partial sensitive system information… |
CVE-2023-40171 | Critical | 9.1 | 2023-08-17 | Dispatch is an open source security incident management tool. The server response includes the JWT Secret Key used for signing JWT tokens in error message when… |
CVE-2023-35009 | Medium | 5.3 | 2023-08-16 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a remote attacker to obtain system information without authentication which could be used in reconn… |
CVE-2023-1210 | Low | 3.1 | 2023-08-02 | An issue has been discovered in GitLab affecting all versions starting from 12.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions sta… |
CVE-2023-31429 | Medium | 5.5 | 2023-08-01 | Brocade Fabric OS before Brocade Fabric OS 9.1.1c, 9.2.0 contains a vulnerability when using various commands such as “chassisdistribute”, “reboot”, “rasman”… |
CVE-2020-4868 | Medium | 4.3 | 2023-07-31 | IBM TRIRIGA 3.0, 4.0, and 4.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser… |
CVE-2023-20593 | Medium | 5.5 | 2023-07-24 | An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information. |
CVE-2023-25948 | High | 7.5 | 2023-07-13 | Server information leak of configuration data when an error is generated in response to a specially crafted message. See Honeywell Security Notification for re… |
CVE-2023-3362 | Medium | 5.3 | 2023-07-13 | An information disclosure issue in GitLab CE/EE affecting all versions from 16.0 prior to 16.0.6, and version 16.1.0 allows unauthenticated actors to access th… |
CVE-2023-37260 | High | 8.2 | 2023-07-06 | league/oauth2-server is an implementation of an OAuth 2.0 authorization server written in PHP. Starting in version 8.3.2 and prior to version 8.5.3, servers th… |
CVE-2023-37306 | High | 7.5 | 2023-06-30 | MISP 2.4.172 mishandles different certificate file extensions in server sync. An attacker can obtain sensitive information because of the nature of the error m… |
CVE-2023-34110 | Low | 2.7 | 2023-06-22 | Flask-AppBuilder is an application development framework, built on top of Flask. Prior to version 4.3.2, an authenticated malicious actor with Admin privileges… |
CVE-2023-34339 | Low | 3.3 | 2023-06-01 | In JetBrains Ktor before 2.3.1 headers containing authentication data could be added to the exception's message |
CVE-2023-33181 | Medium | 4.3 | 2023-05-30 | Xibo is a content management system (CMS). Starting in version 3.0.0 and prior to version 3.3.5, some API routes will print a stack trace when called with miss… |
CVE-2023-28514 | Medium | 6.2 | 2023-05-19 | IBM MQ 8.0, 9.0, and 9.1 could allow a local user to obtain sensitive credential information when a detailed technical error message is returned in a stack tra… |
CVE-2022-4870 | Medium | 5.3 | 2023-05-18 | In affected versions of Octopus Deploy it is possible to discover network details via error message |
CVE-2023-21103 | Medium | 5.5 | 2023-05-15 | In registerPhoneAccount of PhoneAccountRegistrar.java, uncaught exceptions in parsing persisted user data could lead to local persistent denial of service with… |
CVE-2023-27860 | Medium | 5.3 | 2023-04-27 | IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 could disclose sensitive information in an error message. This information could be used in further attacks ag… |
CVE-2023-31286 | Medium | 5.3 | 2023-04-27 | An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. When a password reset request occurs, the server response leaks the existence of user… |
CVE-2023-23837 | High | 7.5 | 2023-04-25 | No exception handling vulnerability which revealed sensitive or excessive information to users. |
CVE-2023-29193 | High | 8.7 | 2023-04-14 | SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. The `spicedb serve` c… |
CVE-2022-4770 | Medium | 4.3 | 2023-04-03 | Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the full parametrized SQL query in an error m… |
CVE-2022-4769 | Medium | 4.3 | 2023-04-03 | Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the target path on host when a file is upload… |
CVE-2023-28117 | High | 7.6 | 2023-03-22 | Sentry SDK is the official Python SDK for Sentry, real-time crash reporting software. When using the Django integration of versions prior to 1.14.0 of the Sent… |
CVE-2023-25687 | Medium | 4.3 | 2023-03-21 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to obtain sensitive information from log files… |
CVE-2023-25695 | Medium | 5.3 | 2023-03-15 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: befo… |
CVE-2023-27587 | High | 7.4 | 2023-03-13 | ReadtoMyShoe, a web app that lets users upload articles and listen to them later, generates an error message containing sensitive information prior to commit 8… |
CVE-2023-26052 | Low | 3.7 | 2023-03-02 | Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handled properly and thus… |
CVE-2023-26051 | Medium | 6.5 | 2023-03-02 | Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handled properly and thus… |
CVE-2020-5026 | Medium | 4.3 | 2023-03-01 | IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.2.0 through 3.2.7 could allow a remote attacker to obtain sensitive information whe… |
CVE-2023-25956 | High | 7.5 | 2023-02-24 | Generation of Error Message Containing Sensitive Information vulnerability in the Apache Airflow AWS Provider. This issue affects Apache Airflow AWS Provider… |
CVE-2023-0655 | Medium | 5.3 | 2023-02-14 | SonicWall Email Security contains a vulnerability that could permit a remote unauthenticated attacker access to an error page that includes sensitive informati… |
CVE-2022-46675 | Medium | 5.3 | 2023-02-11 | Wyse Management Suite Repository 3.8 and below contain an information disclosure vulnerability. A unauthenticated attacker could potentially discover the inte… |
CVE-2022-46371 | Medium | 5.3 | 2023-01-12 | Alotcer - AR7088H-A firmware version 16.10.3 Information disclosure. Unspecified error message contains the default administrator user name. |
CVE-2023-22626 | High | 7.5 | 2023-01-05 | PgHero before 3.1.0 allows Information Disclosure via EXPLAIN because query results may be present in an error message. (Depending on database user privileges… |
CVE-2015-10012 | Low | 3.5 | 2023-01-03 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in sumocoders FrameworkUserBundle up to 1.3.x. It has been rated as problematic. Affected by this iss… |
CVE-2022-22449 | Medium | 5.3 | 2022-12-24 | IBM Security Verify Governance, Identity Manager 10.01 could allow a remote attacker to obtain sensitive information when a detailed technical error message is… |
CVE-2022-22760 | Medium | 6.5 | 2022-12-22 | When importing resources using Web Workers, error messages would distinguish the difference between <code>application/javascript</code> responses and non-scrip… |
CVE-2022-39304 | Medium | 5.0 | 2022-12-20 | ghinstallation provides transport, which implements http.RoundTripper to provide authentication as an installation for GitHub Apps. In ghinstallation version 1… |
CVE-2022-20525 | Low | 3.3 | 2022-12-16 | In enforceVisualVoicemailPackage of PhoneInterfaceManager.java, there is a possible leak of visual voicemail package name due to a permissions bypass. This cou… |
CVE-2022-34881 | Low | 3.3 | 2022-12-06 | Generation of Error Message Containing Sensitive Information vulnerability in Hitachi JP1/Automatic Operation allows local users to gain sensitive information… |
CVE-2022-39307 | Medium | 6.7 | 2022-11-09 | Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the `/api/user… |
CVE-2022-40292 | Medium | 5.3 | 2022-10-31 | The application allowed for Unauthenticated User Enumeration by interacting with an unsecured endpoint to retrieve information on each account within the syst… |
CVE-2021-42777 | Critical | 9.8 | 2022-10-29 | Stimulsoft (aka Stimulsoft Reports) 2013.1.1600.0, when Compilation Mode is used, allows an attacker to execute arbitrary C# code on any machine that renders a… |
CVE-2022-2508 | Medium | 5.3 | 2022-10-27 | In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to due to verbose erro… |
CVE-2022-39315 | Medium | 6.5 | 2022-10-25 | Kirby is a Content Management System. Prior to versions 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, a user enumeration vulnerability affects all Kirby sites with use… |
CVE-2022-38107 | Medium | 5.3 | 2022-10-19 | Sensitive information could be displayed when a detailed technical error message is posted. This information could disclose environmental details. |
CVE-2022-2760 | Medium | 4.3 | 2022-09-28 | In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an error message when a re… |
CVE-2021-27774 | Low | 3.1 | 2022-09-22 | User input included in error response, which could be used in a phishing attack. |
CVE-2021-38924 | High | 7.5 | 2022-09-14 | IBM Maximo Asset Management 7.6.1.1 and 7.6.1.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is return… |
CVE-2022-34882 | Critical | 9.0 | 2022-09-06 | Information Exposure Through an Error Message vulnerability in Hitachi RAID Manager Storage Replication Adapter allows remote authenticated users to gain sensi… |
CVE-2021-3513 | High | 7.5 | 2022-08-22 | A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled. This is due to a wrong error message di… |
CVE-2021-39086 | Medium | 5.3 | 2022-08-16 | IBM Sterling File Gateway 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 could allow a remote attacker to obtain sensitive infor… |