CWE-209 · Generation of Error Message Containing Sensitive Information (page 5)
Page 5 of 7 — CVEs classified under CWE-209, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-35715 | High | 7.5 | 2022-08-10 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in a s… |
CVE-2022-33930 | Medium | 4.3 | 2022-08-10 | Dell Wyse Management Suite 3.6.1 and below contains Information Disclosure in Devices error pages. An attacker could potentially exploit this vulnerability, le… |
CVE-2022-31189 | Medium | 5.3 | 2022-08-01 | DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. When an… |
CVE-2021-39018 | Medium | 4.3 | 2022-07-14 | IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could disclose sensitive information in a SQL error message that coul… |
CVE-2022-31140 | High | 7.5 | 2022-07-11 | Valinor is a PHP library that helps to map any input into a strongly-typed value object structure. Prior to version 0.12.0, Valinor can use `Throwable#getMessa… |
CVE-2022-31124 | High | 7.7 | 2022-07-06 | openssh_key_parser is an open source Python package providing utilities to parse and pack OpenSSH private and public key files. In versions prior to 0.0.6 if a… |
CVE-2022-31229 | Critical | 9.6 | 2022-06-28 | Dell PowerScale OneFS, 8.2.x through 9.3.0.x, contain an error message with sensitive information. An administrator could potentially exploit this vulnerabilit… |
CVE-2022-31047 | Medium | 5.3 | 2022-06-14 | TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, system internal credentia… |
CVE-2022-2062 | High | 7.5 | 2022-06-13 | Generation of Error Message Containing Sensitive Information in GitHub repository nocodb/nocodb prior to 0.91.7+. |
CVE-2022-31023 | Medium | 5.9 | 2022-06-02 | Play Framework is a web framework for Java and Scala. Verions prior to 2.8.16 are vulnerable to generation of error messages containing sensitive information… |
CVE-2022-26973 | Medium | 5.3 | 2022-06-02 | Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. By tweaking the lic… |
CVE-2022-24906 | Low | 3.5 | 2022-05-20 | Nextcloud Deck is a Kanban-style project & personal management tool for Nextcloud, similar to Trello. The full path of the application is exposed to unauthoriz… |
CVE-2022-26070 | Medium | 4.3 | 2022-05-06 | When handling a mismatched pre-authentication cookie, the application leaks the internal error message in the response, which contains the Splunk Enterprise lo… |
CVE-2021-39023 | High | 7.5 | 2022-05-06 | IBM Guardium Data Encryption (GDE) 4.0.0 and 5.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is ret… |
CVE-2021-43206 | Medium | 4.3 | 2022-05-04 | A server-generated error message containing sensitive information in Fortinet FortiOS 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.x, 6.0.x and FortiProxy 7.0… |
CVE-2022-29266 | High | 7.5 | 2022-04-20 | In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned from the dependenc… |
CVE-2021-39033 | Medium | 6.5 | 2022-04-19 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5 and 6.1.0.0 through 6.1.1.0 could allow a remote attacker to obtain sensitive information… |
CVE-2022-1120 | Medium | 4.8 | 2022-04-04 | Missing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 exposed sensitive… |
CVE-2021-32937 | High | 7.5 | 2022-04-01 | An attacker can gain knowledge of a session temporary working folder where the getfile and putfile commands are used in MDT AutoSave versions prior to v6.02.06… |
CVE-2022-23794 | Medium | 5.3 | 2022-03-30 | An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Uploading a file name of an excess length causes the error. This error brings up… |
CVE-2022-24731 | Medium | 6.8 | 2022-03-23 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is v… |
CVE-2021-35251 | Medium | 5.3 | 2022-03-10 | Sensitive information could be displayed when a detailed technical error message is posted. This information could disclose environmental details about the Web… |
CVE-2021-46353 | Medium | 5.3 | 2022-03-04 | An information disclosure in web interface in D-Link DIR-X1860 before 1.03 RevA1 allows a remote unauthenticated attacker to send a specially crafted HTTP requ… |
CVE-2021-3620 | Medium | 5.5 | 2022-03-03 | A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the… |
CVE-2022-0563 | Medium | 5.5 | 2022-02-21 | A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to… |
CVE-2022-0660 | High | 7.5 | 2022-02-18 | Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0622 | Medium | 5.3 | 2022-02-17 | Generation of Error Message Containing Sensitive Information in Packagist snipe/snipe-it prior to 5.3.11. |
CVE-2021-26726 | High | 8.8 | 2022-02-16 | A remote code execution vulnerability affecting a Valmet DNA service listening on TCP port 1517, allows an attacker to execute commands with SYSTEM privileges… |
CVE-2022-0504 | Medium | 6.5 | 2022-02-08 | Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11. |
CVE-2021-40338 | Low | 3.7 | 2022-01-28 | Hitachi Energy LinkOne product, has a vulnerability due to a web server misconfiguration, that enables debug mode and reveals the full path of the filesystem d… |
CVE-2022-22162 | High | 7.3 | 2022-01-19 | A Generation of Error Message Containing Sensitive Information vulnerability in the CLI of Juniper Networks Junos OS allows a locally authenticated attacker wi… |
CVE-2021-38894 | Low | 2.7 | 2022-01-10 | IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is ret… |
CVE-2022-0083 | Medium | 5.3 | 2022-01-04 | livehelperchat is vulnerable to Generation of Error Message Containing Sensitive Information |
CVE-2022-0079 | Medium | 5.3 | 2022-01-03 | showdoc is vulnerable to Generation of Error Message Containing Sensitive Information |
CVE-2021-4177 | Medium | 5.3 | 2021-12-28 | livehelperchat is vulnerable to Generation of Error Message Containing Sensitive Information |
CVE-2021-44155 | Medium | 5.3 | 2021-12-13 | An issue was discovered in /goform/login_process in Reprise RLM 14.2. When an attacker attempts to login, the response if a username is valid includes Login Fa… |
CVE-2021-43542 | Medium | 6.5 | 2021-12-08 | Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols. This vulnerability aff… |
CVE-2021-38980 | Medium | 5.3 | 2021-11-23 | IBM Tivoli Key Lifecycle Manager (IBM Security Guardium Key Lifecycle Manager) 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive infor… |
CVE-2021-38981 | Medium | 5.3 | 2021-11-15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message… |
CVE-2021-40126 | Medium | 4.3 | 2021-11-04 | A vulnerability in the web-based dashboard of Cisco Umbrella could allow an authenticated, remote attacker to perform an email enumeration attack against the U… |
CVE-2021-35060 | Medium | 5.3 | 2021-10-11 | /way4acs/enroll in OpenWay WAY4 ACS before 1.2.278-2693 allows unauthenticated attackers to leverage response differences to discover whether a specific paymen… |
CVE-2021-20552 | Medium | 4.3 | 2021-10-07 | IBM Sterling File Gateway 6.0.0.0 through 6.1.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is retu… |
CVE-2021-20485 | Medium | 4.3 | 2021-09-23 | IBM Sterling File Gateway 2.2.0.0 through 6.1.0.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is retu… |
CVE-2021-20377 | Low | 2.7 | 2021-09-23 | IBM Security Guardium 11.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. Th… |
CVE-2020-4941 | Medium | 4.3 | 2021-09-23 | IBM Edge 4.2 could reveal sensitive version information about the server from error pages that could aid an attacker in further attacks against the system. IBM… |
CVE-2021-1546 | Medium | 5.5 | 2021-09-23 | A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to access sensitive information. This vulnerability is due to… |
CVE-2021-20508 | Medium | 4.3 | 2021-09-14 | IBM Security Secret Server up to 11.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the… |
CVE-2021-39458 | Medium | 6.5 | 2021-09-09 | Triggering an error page of the import process in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user has to alternate the files of a vai… |
CVE-2021-32766 | Medium | 5.3 | 2021-09-07 | Nextcloud Text is an open source plaintext editing application which ships with the nextcloud server. In affected versions the Nextcloud Text application retur… |
CVE-2021-35947 | Medium | 5.3 | 2021-09-07 | The public share controller in the ownCloud server before version 10.8.0 allows a remote attacker to see the internal path and the username of a public share b… |
CVE-2021-25958 | Medium | 6.5 | 2021-08-30 | In Apache Ofbiz, versions v17.12.01 to v17.12.07 implement a try catch exception to handle errors at multiple locations but leaks out sensitive table info whic… |
CVE-2021-22249 | Medium | 4.3 | 2021-08-23 | A verbose error message in GitLab EE affecting all versions since 12.2 could disclose the private email address of a user invited to a group |
CVE-2017-16629 | High | 7.5 | 2021-08-11 | In SapphireIMS 4097_1, it is possible to guess the registered/active usernames of the software from the errors it gives out for each type of user on the Login… |
CVE-2021-29784 | Medium | 4.3 | 2021-07-26 | IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the… |
CVE-2021-29767 | Medium | 5.3 | 2021-07-26 | IBM i2 Analyst's Notebook Premium 9.2.0, 9.2.1, and 9.2.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message… |
CVE-2021-29766 | Medium | 5.3 | 2021-07-26 | IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) could allow a remote attacker to obtain sensitive information when a detailed techni… |
CVE-2021-20430 | Medium | 5.3 | 2021-07-26 | IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) could allow a remote attacker to obtain sensitive information when a detailed techni… |
CVE-2021-25809 | Medium | 5.3 | 2021-07-23 | UCMS 1.5.0 was discovered to contain a physical path leakage via an error message returned by the adminchannelscache() function in top.php. |
CVE-2021-32775 | High | 7.7 | 2021-07-21 | Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, a non admin user can get access to many class/field values through GroupBy… |
CVE-2021-22145 | Medium | 6.5 | 2021-07-21 | A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elas… |
CVE-2021-20523 | Low | 2.7 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in t… |
CVE-2021-20499 | Low | 2.7 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in t… |
CVE-2021-20424 | Medium | 4.3 | 2021-07-13 | IBM Cloud Pak for Applications 4.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the bro… |
CVE-2021-33711 | Medium | 5.3 | 2021-07-13 | A vulnerability has been identified in Teamcenter Active Workspace V4 (All versions < V4.3.9), Teamcenter Active Workspace V5.0 (All versions < V5.0.7), Teamce… |
CVE-2021-32734 | Low | 3.1 | 2021-07-12 | Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, the Nextcloud Text application shipped wit… |
CVE-2021-20417 | Medium | 4.3 | 2021-07-07 | IBM Guardium Data Encryption (GDE) 4.0.0.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in… |
CVE-2021-20413 | Medium | 4.3 | 2021-06-28 | IBM Guardium Data Encryption (GDE) 4.0.0.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in… |
CVE-2021-32712 | Medium | 5.3 | 2021-06-24 | Shopware is an open source eCommerce platform. Versions prior to 5.6.10 are vulnerable to system information leakage in error handling. Users are recommend to… |
CVE-2020-20470 | Medium | 5.3 | 2021-06-21 | White Shark System (WSS) 1.3.2 has web site physical path leakage vulnerability. |
CVE-2021-31159 | Medium | 5.3 | 2021-06-16 | Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-message generation in the Forgot Password fun… |
CVE-2021-26997 | Medium | 6.5 | 2021-06-11 | E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploited could allow a re… |
CVE-2021-30357 | Medium | 5.3 | 2021-06-08 | SSL Network Extender Client for Linux before build 800008302 reveals part of the contents of the configuration file supplied, which allows partially disclosing… |
CVE-2021-20371 | Medium | 6.5 | 2021-06-02 | IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to obtain sensitive information when an error message is returned in the browser… |
CVE-2021-22885 | High | 7.5 | 2021-05-27 | A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper w… |
CVE-2021-20428 | Medium | 5.3 | 2021-05-24 | IBM Security Guardium 11.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. Th… |
CVE-2021-29688 | High | 7.5 | 2021-05-20 | IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the br… |
CVE-2021-29682 | Medium | 5.3 | 2021-05-20 | IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the br… |
CVE-2021-29040 | Medium | 5.3 | 2021-05-16 | The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provid… |
CVE-2021-20393 | High | 7.5 | 2021-05-14 | IBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is… |
CVE-2020-23995 | Medium | 6.5 | 2021-05-13 | An information disclosure vulnerability in ILIAS before 5.3.19, 5.4.12 and 6.0 allows remote authenticated attackers to get the upload data path via a workspac… |
CVE-2021-23135 | Medium | 5.9 | 2021-05-12 | Exposure of System Data to an Unauthorized Control Sphere vulnerability in web UI of Argo CD allows attacker to cause leaked secret data into web UI error mess… |
CVE-2020-19275 | Medium | 5.3 | 2021-05-12 | An Information Disclosure vulnerability exists in dhcms 2017-09-18 when entering invalid characters after the normal interface, which causes an error that will… |
CVE-2021-31341 | Medium | 4.3 | 2021-05-12 | Uploading a table mapping using a manipulated XML file results in an exception that could expose information about the application-server and the used XML-fram… |
CVE-2021-31339 | Medium | 4.3 | 2021-05-12 | A vulnerability has been identified in Mendix Excel Importer Module (All versions < V9.0.3). Uploading a manipulated XML File results in an exception that coul… |
CVE-2020-4536 | Medium | 4.3 | 2021-05-11 | IBM OpenPages GRC Platform 8.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser… |
CVE-2021-21421 | High | 8.1 | 2021-04-01 | node-etsy-client is a NodeJs Etsy ReST API Client. Applications that are using node-etsy-client and reporting client error to the end user will offer api key v… |
CVE-2021-21416 | Low | 3.7 | 2021-04-01 | django-registration is a user registration package for Django. The django-registration package provides tools for implementing user-account registration flows… |
CVE-2021-3393 | Medium | 4.3 | 2021-04-01 | An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user having UPDATE permission but not SELECT permissi… |
CVE-2021-20289 | Medium | 5.3 | 2021-03-26 | A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response… |
CVE-2021-22169 | Medium | 4.3 | 2021-03-24 | An issue was identified in GitLab EE 13.4 or later which leaked internal IP address via error messages. |
CVE-2021-22193 | Low | 3.5 | 2021-03-24 | An issue has been discovered in GitLab affecting all versions starting with 7.1. A member of a private group was able to validate the use of a specific name fo… |
CVE-2019-18947 | Low | 3.5 | 2021-02-26 | Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to information disclosure. |
CVE-2021-23973 | Medium | 6.5 | 2021-02-26 | When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted, and the content of that error may have revealed infor… |
CVE-2021-23968 | Medium | 4.3 | 2021-02-26 | If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation report; as opposed to… |
CVE-2020-1717 | Low | 2.7 | 2021-02-11 | A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack. |
CVE-2021-20402 | Low | 2.7 | 2021-02-11 | IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is… |
CVE-2020-4628 | Medium | 5.3 | 2021-01-27 | IBM Cloud Pak for Security (CP4S) 1.3.0.1 and 1.4.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is… |
CVE-2020-4600 | Medium | 5.3 | 2021-01-13 | IBM Security Guardium Insights 2.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the b… |
CVE-2020-4599 | Medium | 5.3 | 2021-01-13 | IBM Security Guardium Insights 2.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the b… |
CVE-2020-15219 | Medium | 4.3 | 2021-01-13 | Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, when a download error is triggered in the user portal, an SQL… |