CWE-209 · Generation of Error Message Containing Sensitive Information (page 4)
Page 4 of 6 — CVEs classified under CWE-209, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-40763 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHPJabbers Taxi Booking Script v2.0. This issue occurs during password recovery, where a difference in messages could allow an att… |
CVE-2023-40762 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHPJabbers Fundraising Script v1.0. This issue occurs during password recovery, where a difference in messages could allow an atta… |
CVE-2023-40761 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHPJabbers Yacht Listing Script v2.0. This issue occurs during password recovery, where a difference in messages could allow an at… |
CVE-2023-40760 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHP Jabbers Hotel Booking System v4.0. This issue occurs during password recovery, where a difference in messages could allow an a… |
CVE-2023-40759 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHP Jabbers Restaurant Booking Script v3.0. This issue occurs during password recovery, where a difference in messages could allow… |
CVE-2023-40758 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHPJabbers Document Creator v1.0. This issue occurs during password recovery, where a difference in messages could allow an attack… |
CVE-2023-40757 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHPJabbers Food Delivery Script v3.1. This issue occurs during password recovery, where a difference in messages could allow an at… |
CVE-2023-26272 | Medium | 5.3 | 2023-08-28 | IBM Security Guardium Data Encryption (IBM Guardium Cloud Key Manager (GCKM) 1.10.3)) could allow a remote attacker to obtain sensitive information when a deta… |
CVE-2023-32755 | Medium | 5.3 | 2023-08-25 | e-Excellence U-Office Force generates an error message in webiste service. An unauthenticated remote attacker can obtain partial sensitive system information… |
CVE-2023-40171 | Critical | 9.1 | 2023-08-17 | Dispatch is an open source security incident management tool. The server response includes the JWT Secret Key used for signing JWT tokens in error message when… |
CVE-2023-35009 | Medium | 5.3 | 2023-08-16 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a remote attacker to obtain system information without authentication which could be used in reconn… |
CVE-2023-1210 | Low | 3.1 | 2023-08-02 | An issue has been discovered in GitLab affecting all versions starting from 12.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions sta… |
CVE-2023-31429 | Medium | 5.5 | 2023-08-01 | Brocade Fabric OS before Brocade Fabric OS 9.1.1c, 9.2.0 contains a vulnerability when using various commands such as “chassisdistribute”, “reboot”, “rasman”… |
CVE-2020-4868 | Medium | 4.3 | 2023-07-31 | IBM TRIRIGA 3.0, 4.0, and 4.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser… |
CVE-2023-20593 | Medium | 5.5 | 2023-07-24 | An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information. |
CVE-2023-25948 | High | 7.5 | 2023-07-13 | Server information leak of configuration data when an error is generated in response to a specially crafted message. See Honeywell Security Notification for re… |
CVE-2023-3362 | Medium | 5.3 | 2023-07-13 | An information disclosure issue in GitLab CE/EE affecting all versions from 16.0 prior to 16.0.6, and version 16.1.0 allows unauthenticated actors to access th… |
CVE-2023-37260 | High | 8.2 | 2023-07-06 | league/oauth2-server is an implementation of an OAuth 2.0 authorization server written in PHP. Starting in version 8.3.2 and prior to version 8.5.3, servers th… |
CVE-2023-37306 | High | 7.5 | 2023-06-30 | MISP 2.4.172 mishandles different certificate file extensions in server sync. An attacker can obtain sensitive information because of the nature of the error m… |
CVE-2023-34110 | Low | 2.7 | 2023-06-22 | Flask-AppBuilder is an application development framework, built on top of Flask. Prior to version 4.3.2, an authenticated malicious actor with Admin privileges… |
CVE-2023-34339 | Low | 3.3 | 2023-06-01 | In JetBrains Ktor before 2.3.1 headers containing authentication data could be added to the exception's message |
CVE-2023-33181 | Medium | 4.3 | 2023-05-30 | Xibo is a content management system (CMS). Starting in version 3.0.0 and prior to version 3.3.5, some API routes will print a stack trace when called with miss… |
CVE-2023-28514 | Medium | 6.2 | 2023-05-19 | IBM MQ 8.0, 9.0, and 9.1 could allow a local user to obtain sensitive credential information when a detailed technical error message is returned in a stack tra… |
CVE-2022-4870 | Medium | 5.3 | 2023-05-18 | In affected versions of Octopus Deploy it is possible to discover network details via error message |
CVE-2023-21103 | Medium | 5.5 | 2023-05-15 | In registerPhoneAccount of PhoneAccountRegistrar.java, uncaught exceptions in parsing persisted user data could lead to local persistent denial of service with… |
CVE-2023-27860 | Medium | 5.3 | 2023-04-27 | IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 could disclose sensitive information in an error message. This information could be used in further attacks ag… |
CVE-2023-31286 | Medium | 5.3 | 2023-04-27 | An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. When a password reset request occurs, the server response leaks the existence of user… |
CVE-2023-23837 | High | 7.5 | 2023-04-25 | No exception handling vulnerability which revealed sensitive or excessive information to users. |
CVE-2023-29193 | High | 8.7 | 2023-04-14 | SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. The `spicedb serve` c… |
CVE-2022-4770 | Medium | 4.3 | 2023-04-03 | Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the full parametrized SQL query in an error m… |
CVE-2022-4769 | Medium | 4.3 | 2023-04-03 | Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the target path on host when a file is upload… |
CVE-2023-28117 | High | 7.6 | 2023-03-22 | Sentry SDK is the official Python SDK for Sentry, real-time crash reporting software. When using the Django integration of versions prior to 1.14.0 of the Sent… |
CVE-2023-25687 | Medium | 4.3 | 2023-03-21 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to obtain sensitive information from log files… |
CVE-2023-25695 | Medium | 5.3 | 2023-03-15 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: befo… |
CVE-2023-27587 | High | 7.4 | 2023-03-13 | ReadtoMyShoe, a web app that lets users upload articles and listen to them later, generates an error message containing sensitive information prior to commit 8… |
CVE-2023-26052 | Low | 3.7 | 2023-03-02 | Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handled properly and thus… |
CVE-2023-26051 | Medium | 6.5 | 2023-03-02 | Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handled properly and thus… |
CVE-2020-5026 | Medium | 4.3 | 2023-03-01 | IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.2.0 through 3.2.7 could allow a remote attacker to obtain sensitive information whe… |
CVE-2023-25956 | High | 7.5 | 2023-02-24 | Generation of Error Message Containing Sensitive Information vulnerability in the Apache Airflow AWS Provider. This issue affects Apache Airflow AWS Provider… |
CVE-2023-0655 | Medium | 5.3 | 2023-02-14 | SonicWall Email Security contains a vulnerability that could permit a remote unauthenticated attacker access to an error page that includes sensitive informati… |
CVE-2022-46675 | Medium | 5.3 | 2023-02-11 | Wyse Management Suite Repository 3.8 and below contain an information disclosure vulnerability. A unauthenticated attacker could potentially discover the inte… |
CVE-2022-46371 | Medium | 5.3 | 2023-01-12 | Alotcer - AR7088H-A firmware version 16.10.3 Information disclosure. Unspecified error message contains the default administrator user name. |
CVE-2023-22626 | High | 7.5 | 2023-01-05 | PgHero before 3.1.0 allows Information Disclosure via EXPLAIN because query results may be present in an error message. (Depending on database user privileges… |
CVE-2015-10012 | Low | 3.5 | 2023-01-03 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in sumocoders FrameworkUserBundle up to 1.3.x. It has been rated as problematic. Affected by this iss… |
CVE-2022-22449 | Medium | 5.3 | 2022-12-24 | IBM Security Verify Governance, Identity Manager 10.01 could allow a remote attacker to obtain sensitive information when a detailed technical error message is… |
CVE-2022-22760 | Medium | 6.5 | 2022-12-22 | When importing resources using Web Workers, error messages would distinguish the difference between <code>application/javascript</code> responses and non-scrip… |
CVE-2022-39304 | Medium | 5.0 | 2022-12-20 | ghinstallation provides transport, which implements http.RoundTripper to provide authentication as an installation for GitHub Apps. In ghinstallation version 1… |
CVE-2022-20525 | Low | 3.3 | 2022-12-16 | In enforceVisualVoicemailPackage of PhoneInterfaceManager.java, there is a possible leak of visual voicemail package name due to a permissions bypass. This cou… |
CVE-2022-34881 | Low | 3.3 | 2022-12-06 | Generation of Error Message Containing Sensitive Information vulnerability in Hitachi JP1/Automatic Operation allows local users to gain sensitive information… |
CVE-2022-39307 | Medium | 6.7 | 2022-11-09 | Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the `/api/user… |
CVE-2022-40292 | Medium | 5.3 | 2022-10-31 | The application allowed for Unauthenticated User Enumeration by interacting with an unsecured endpoint to retrieve information on each account within the syst… |
CVE-2021-42777 | Critical | 9.8 | 2022-10-29 | Stimulsoft (aka Stimulsoft Reports) 2013.1.1600.0, when Compilation Mode is used, allows an attacker to execute arbitrary C# code on any machine that renders a… |
CVE-2022-2508 | Medium | 5.3 | 2022-10-27 | In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to due to verbose erro… |
CVE-2022-39315 | Medium | 6.5 | 2022-10-25 | Kirby is a Content Management System. Prior to versions 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, a user enumeration vulnerability affects all Kirby sites with use… |
CVE-2022-38107 | Medium | 5.3 | 2022-10-19 | Sensitive information could be displayed when a detailed technical error message is posted. This information could disclose environmental details. |
CVE-2022-2760 | Medium | 4.3 | 2022-09-28 | In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an error message when a re… |
CVE-2021-27774 | Low | 3.1 | 2022-09-22 | User input included in error response, which could be used in a phishing attack. |
CVE-2021-38924 | High | 7.5 | 2022-09-14 | IBM Maximo Asset Management 7.6.1.1 and 7.6.1.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is return… |
CVE-2022-34882 | Critical | 9.0 | 2022-09-06 | Information Exposure Through an Error Message vulnerability in Hitachi RAID Manager Storage Replication Adapter allows remote authenticated users to gain sensi… |
CVE-2021-3513 | High | 7.5 | 2022-08-22 | A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled. This is due to a wrong error message di… |
CVE-2021-39086 | Medium | 5.3 | 2022-08-16 | IBM Sterling File Gateway 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 could allow a remote attacker to obtain sensitive infor… |
CVE-2022-35715 | High | 7.5 | 2022-08-10 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in a s… |
CVE-2022-33930 | Medium | 4.3 | 2022-08-10 | Dell Wyse Management Suite 3.6.1 and below contains Information Disclosure in Devices error pages. An attacker could potentially exploit this vulnerability, le… |
CVE-2022-31189 | Medium | 5.3 | 2022-08-01 | DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. When an… |
CVE-2021-39018 | Medium | 4.3 | 2022-07-14 | IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could disclose sensitive information in a SQL error message that coul… |
CVE-2022-31140 | High | 7.5 | 2022-07-11 | Valinor is a PHP library that helps to map any input into a strongly-typed value object structure. Prior to version 0.12.0, Valinor can use `Throwable#getMessa… |
CVE-2022-31124 | High | 7.7 | 2022-07-06 | openssh_key_parser is an open source Python package providing utilities to parse and pack OpenSSH private and public key files. In versions prior to 0.0.6 if a… |
CVE-2022-31229 | Critical | 9.6 | 2022-06-28 | Dell PowerScale OneFS, 8.2.x through 9.3.0.x, contain an error message with sensitive information. An administrator could potentially exploit this vulnerabilit… |
CVE-2022-31047 | Medium | 5.3 | 2022-06-14 | TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, system internal credentia… |
CVE-2022-2062 | High | 7.5 | 2022-06-13 | Generation of Error Message Containing Sensitive Information in GitHub repository nocodb/nocodb prior to 0.91.7+. |
CVE-2022-31023 | Medium | 5.9 | 2022-06-02 | Play Framework is a web framework for Java and Scala. Verions prior to 2.8.16 are vulnerable to generation of error messages containing sensitive information… |
CVE-2022-26973 | Medium | 5.3 | 2022-06-02 | Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. By tweaking the lic… |
CVE-2022-24906 | Low | 3.5 | 2022-05-20 | Nextcloud Deck is a Kanban-style project & personal management tool for Nextcloud, similar to Trello. The full path of the application is exposed to unauthoriz… |
CVE-2022-26070 | Medium | 4.3 | 2022-05-06 | When handling a mismatched pre-authentication cookie, the application leaks the internal error message in the response, which contains the Splunk Enterprise lo… |
CVE-2021-39023 | High | 7.5 | 2022-05-06 | IBM Guardium Data Encryption (GDE) 4.0.0 and 5.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is ret… |
CVE-2021-43206 | Medium | 4.3 | 2022-05-04 | A server-generated error message containing sensitive information in Fortinet FortiOS 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.x, 6.0.x and FortiProxy 7.0… |
CVE-2022-29266 | High | 7.5 | 2022-04-20 | In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned from the dependenc… |
CVE-2021-39033 | Medium | 6.5 | 2022-04-19 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5 and 6.1.0.0 through 6.1.1.0 could allow a remote attacker to obtain sensitive information… |
CVE-2022-1120 | Medium | 4.8 | 2022-04-04 | Missing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 exposed sensitive… |
CVE-2021-32937 | High | 7.5 | 2022-04-01 | An attacker can gain knowledge of a session temporary working folder where the getfile and putfile commands are used in MDT AutoSave versions prior to v6.02.06… |
CVE-2022-23794 | Medium | 5.3 | 2022-03-30 | An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Uploading a file name of an excess length causes the error. This error brings up… |
CVE-2022-24731 | Medium | 6.8 | 2022-03-23 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is v… |
CVE-2021-35251 | Medium | 5.3 | 2022-03-10 | Sensitive information could be displayed when a detailed technical error message is posted. This information could disclose environmental details about the Web… |
CVE-2021-46353 | Medium | 5.3 | 2022-03-04 | An information disclosure in web interface in D-Link DIR-X1860 before 1.03 RevA1 allows a remote unauthenticated attacker to send a specially crafted HTTP requ… |
CVE-2021-3620 | Medium | 5.5 | 2022-03-03 | A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the… |
CVE-2022-0563 | Medium | 5.5 | 2022-02-21 | A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to… |
CVE-2022-0660 | High | 7.5 | 2022-02-18 | Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0622 | Medium | 5.3 | 2022-02-17 | Generation of Error Message Containing Sensitive Information in Packagist snipe/snipe-it prior to 5.3.11. |
CVE-2021-26726 | High | 8.8 | 2022-02-16 | A remote code execution vulnerability affecting a Valmet DNA service listening on TCP port 1517, allows an attacker to execute commands with SYSTEM privileges… |
CVE-2022-0504 | Medium | 6.5 | 2022-02-08 | Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11. |
CVE-2021-40338 | Low | 3.7 | 2022-01-28 | Hitachi Energy LinkOne product, has a vulnerability due to a web server misconfiguration, that enables debug mode and reveals the full path of the filesystem d… |
CVE-2022-22162 | High | 7.3 | 2022-01-19 | A Generation of Error Message Containing Sensitive Information vulnerability in the CLI of Juniper Networks Junos OS allows a locally authenticated attacker wi… |
CVE-2021-38894 | Low | 2.7 | 2022-01-10 | IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is ret… |
CVE-2022-0083 | Medium | 5.3 | 2022-01-04 | livehelperchat is vulnerable to Generation of Error Message Containing Sensitive Information |
CVE-2022-0079 | Medium | 5.3 | 2022-01-03 | showdoc is vulnerable to Generation of Error Message Containing Sensitive Information |
CVE-2021-4177 | Medium | 5.3 | 2021-12-28 | livehelperchat is vulnerable to Generation of Error Message Containing Sensitive Information |
CVE-2021-44155 | Medium | 5.3 | 2021-12-13 | An issue was discovered in /goform/login_process in Reprise RLM 14.2. When an attacker attempts to login, the response if a username is valid includes Login Fa… |
CVE-2021-43542 | Medium | 6.5 | 2021-12-08 | Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols. This vulnerability aff… |
CVE-2021-38980 | Medium | 5.3 | 2021-11-23 | IBM Tivoli Key Lifecycle Manager (IBM Security Guardium Key Lifecycle Manager) 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive infor… |
CVE-2021-38981 | Medium | 5.3 | 2021-11-15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message… |