CWE-209 · Generation of Error Message Containing Sensitive Information (page 5)
Page 5 of 6 — CVEs classified under CWE-209, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-40126 | Medium | 4.3 | 2021-11-04 | A vulnerability in the web-based dashboard of Cisco Umbrella could allow an authenticated, remote attacker to perform an email enumeration attack against the U… |
CVE-2021-35060 | Medium | 5.3 | 2021-10-11 | /way4acs/enroll in OpenWay WAY4 ACS before 1.2.278-2693 allows unauthenticated attackers to leverage response differences to discover whether a specific paymen… |
CVE-2021-20552 | Medium | 4.3 | 2021-10-07 | IBM Sterling File Gateway 6.0.0.0 through 6.1.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is retu… |
CVE-2021-20485 | Medium | 4.3 | 2021-09-23 | IBM Sterling File Gateway 2.2.0.0 through 6.1.0.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is retu… |
CVE-2021-20377 | Low | 2.7 | 2021-09-23 | IBM Security Guardium 11.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. Th… |
CVE-2020-4941 | Medium | 4.3 | 2021-09-23 | IBM Edge 4.2 could reveal sensitive version information about the server from error pages that could aid an attacker in further attacks against the system. IBM… |
CVE-2021-1546 | Medium | 5.5 | 2021-09-23 | A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to access sensitive information. This vulnerability is due to… |
CVE-2021-20508 | Medium | 4.3 | 2021-09-14 | IBM Security Secret Server up to 11.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the… |
CVE-2021-39458 | Medium | 6.5 | 2021-09-09 | Triggering an error page of the import process in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user has to alternate the files of a vai… |
CVE-2021-32766 | Medium | 5.3 | 2021-09-07 | Nextcloud Text is an open source plaintext editing application which ships with the nextcloud server. In affected versions the Nextcloud Text application retur… |
CVE-2021-35947 | Medium | 5.3 | 2021-09-07 | The public share controller in the ownCloud server before version 10.8.0 allows a remote attacker to see the internal path and the username of a public share b… |
CVE-2021-25958 | Medium | 6.5 | 2021-08-30 | In Apache Ofbiz, versions v17.12.01 to v17.12.07 implement a try catch exception to handle errors at multiple locations but leaks out sensitive table info whic… |
CVE-2021-22249 | Medium | 4.3 | 2021-08-23 | A verbose error message in GitLab EE affecting all versions since 12.2 could disclose the private email address of a user invited to a group |
CVE-2017-16629 | High | 7.5 | 2021-08-11 | In SapphireIMS 4097_1, it is possible to guess the registered/active usernames of the software from the errors it gives out for each type of user on the Login… |
CVE-2021-29784 | Medium | 4.3 | 2021-07-26 | IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the… |
CVE-2021-29767 | Medium | 5.3 | 2021-07-26 | IBM i2 Analyst's Notebook Premium 9.2.0, 9.2.1, and 9.2.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message… |
CVE-2021-29766 | Medium | 5.3 | 2021-07-26 | IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) could allow a remote attacker to obtain sensitive information when a detailed techni… |
CVE-2021-20430 | Medium | 5.3 | 2021-07-26 | IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) could allow a remote attacker to obtain sensitive information when a detailed techni… |
CVE-2021-25809 | Medium | 5.3 | 2021-07-23 | UCMS 1.5.0 was discovered to contain a physical path leakage via an error message returned by the adminchannelscache() function in top.php. |
CVE-2021-32775 | High | 7.7 | 2021-07-21 | Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, a non admin user can get access to many class/field values through GroupBy… |
CVE-2021-22145 | Medium | 6.5 | 2021-07-21 | A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elas… |
CVE-2021-20523 | Low | 2.7 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in t… |
CVE-2021-20499 | Low | 2.7 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in t… |
CVE-2021-20424 | Medium | 4.3 | 2021-07-13 | IBM Cloud Pak for Applications 4.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the bro… |
CVE-2021-33711 | Medium | 5.3 | 2021-07-13 | A vulnerability has been identified in Teamcenter Active Workspace V4 (All versions < V4.3.9), Teamcenter Active Workspace V5.0 (All versions < V5.0.7), Teamce… |
CVE-2021-32734 | Low | 3.1 | 2021-07-12 | Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, the Nextcloud Text application shipped wit… |
CVE-2021-20417 | Medium | 4.3 | 2021-07-07 | IBM Guardium Data Encryption (GDE) 4.0.0.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in… |
CVE-2021-20413 | Medium | 4.3 | 2021-06-28 | IBM Guardium Data Encryption (GDE) 4.0.0.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in… |
CVE-2021-32712 | Medium | 5.3 | 2021-06-24 | Shopware is an open source eCommerce platform. Versions prior to 5.6.10 are vulnerable to system information leakage in error handling. Users are recommend to… |
CVE-2020-20470 | Medium | 5.3 | 2021-06-21 | White Shark System (WSS) 1.3.2 has web site physical path leakage vulnerability. |
CVE-2021-31159 | Medium | 5.3 | 2021-06-16 | Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-message generation in the Forgot Password fun… |
CVE-2021-26997 | Medium | 6.5 | 2021-06-11 | E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploited could allow a re… |
CVE-2021-30357 | Medium | 5.3 | 2021-06-08 | SSL Network Extender Client for Linux before build 800008302 reveals part of the contents of the configuration file supplied, which allows partially disclosing… |
CVE-2021-20371 | Medium | 6.5 | 2021-06-02 | IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to obtain sensitive information when an error message is returned in the browser… |
CVE-2021-22885 | High | 7.5 | 2021-05-27 | A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper w… |
CVE-2021-20428 | Medium | 5.3 | 2021-05-24 | IBM Security Guardium 11.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. Th… |
CVE-2021-29688 | High | 7.5 | 2021-05-20 | IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the br… |
CVE-2021-29682 | Medium | 5.3 | 2021-05-20 | IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the br… |
CVE-2021-29040 | Medium | 5.3 | 2021-05-16 | The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provid… |
CVE-2021-20393 | High | 7.5 | 2021-05-14 | IBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is… |
CVE-2020-23995 | Medium | 6.5 | 2021-05-13 | An information disclosure vulnerability in ILIAS before 5.3.19, 5.4.12 and 6.0 allows remote authenticated attackers to get the upload data path via a workspac… |
CVE-2021-23135 | Medium | 5.9 | 2021-05-12 | Exposure of System Data to an Unauthorized Control Sphere vulnerability in web UI of Argo CD allows attacker to cause leaked secret data into web UI error mess… |
CVE-2020-19275 | Medium | 5.3 | 2021-05-12 | An Information Disclosure vulnerability exists in dhcms 2017-09-18 when entering invalid characters after the normal interface, which causes an error that will… |
CVE-2021-31341 | Medium | 4.3 | 2021-05-12 | Uploading a table mapping using a manipulated XML file results in an exception that could expose information about the application-server and the used XML-fram… |
CVE-2021-31339 | Medium | 4.3 | 2021-05-12 | A vulnerability has been identified in Mendix Excel Importer Module (All versions < V9.0.3). Uploading a manipulated XML File results in an exception that coul… |
CVE-2020-4536 | Medium | 4.3 | 2021-05-11 | IBM OpenPages GRC Platform 8.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser… |
CVE-2021-21421 | High | 8.1 | 2021-04-01 | node-etsy-client is a NodeJs Etsy ReST API Client. Applications that are using node-etsy-client and reporting client error to the end user will offer api key v… |
CVE-2021-21416 | Low | 3.7 | 2021-04-01 | django-registration is a user registration package for Django. The django-registration package provides tools for implementing user-account registration flows… |
CVE-2021-3393 | Medium | 4.3 | 2021-04-01 | An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user having UPDATE permission but not SELECT permissi… |
CVE-2021-20289 | Medium | 5.3 | 2021-03-26 | A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response… |
CVE-2021-22169 | Medium | 4.3 | 2021-03-24 | An issue was identified in GitLab EE 13.4 or later which leaked internal IP address via error messages. |
CVE-2021-22193 | Low | 3.5 | 2021-03-24 | An issue has been discovered in GitLab affecting all versions starting with 7.1. A member of a private group was able to validate the use of a specific name fo… |
CVE-2019-18947 | Low | 3.5 | 2021-02-26 | Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to information disclosure. |
CVE-2021-23973 | Medium | 6.5 | 2021-02-26 | When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted, and the content of that error may have revealed infor… |
CVE-2021-23968 | Medium | 4.3 | 2021-02-26 | If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation report; as opposed to… |
CVE-2020-1717 | Low | 2.7 | 2021-02-11 | A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack. |
CVE-2021-20402 | Low | 2.7 | 2021-02-11 | IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is… |
CVE-2020-4628 | Medium | 5.3 | 2021-01-27 | IBM Cloud Pak for Security (CP4S) 1.3.0.1 and 1.4.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is… |
CVE-2020-4600 | Medium | 5.3 | 2021-01-13 | IBM Security Guardium Insights 2.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the b… |
CVE-2020-4599 | Medium | 5.3 | 2021-01-13 | IBM Security Guardium Insights 2.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the b… |
CVE-2020-15219 | Medium | 4.3 | 2021-01-13 | Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, when a download error is triggered in the user portal, an SQL… |
CVE-2020-4544 | Medium | 4.3 | 2021-01-08 | IBM Jazz Foundation Products could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser… |
CVE-2020-4487 | Medium | 4.3 | 2021-01-08 | IBM Jazz Foundation Products could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser… |
CVE-2020-4897 | Medium | 5.3 | 2021-01-07 | IBM Emptoris Contract Management and IBM Emptoris Spend Analysis 10.1.0, 10.1.1, and 10.1.3 could allow a remote attacker to obtain sensitive information when… |
CVE-2020-4761 | Medium | 5.3 | 2021-01-05 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow a remote attacker to obtain sensitive… |
CVE-2020-2505 | Low | 2.3 | 2020-12-24 | If exploited, this vulnerability could allow attackers to gain sensitive information via generation of error messages. QNAP has already fixed these issues in Q… |
CVE-2020-4842 | Medium | 4.9 | 2020-12-21 | IBM Security Secret Server 10.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browse… |
CVE-2020-4846 | Low | 2.7 | 2020-12-17 | IBM Security Key Lifecycle Manager 3.0.1 and 4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is retur… |
CVE-2020-35177 | Medium | 5.3 | 2020-12-17 | HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1. |
CVE-2020-4907 | Medium | 5.3 | 2020-12-16 | IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 could allow a remote attacker to obtain sensitive information when a detailed tec… |
CVE-2020-16128 | Low | 3.8 | 2020-12-09 | The aptdaemon DBus interface disclosed file existence disclosure by setting Terminal/DebconfSocket properties, aka GHSL-2020-192 and GHSL-2020-196. This affect… |
CVE-2020-25640 | Medium | 5.3 | 2020-11-24 | A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensi… |
CVE-2020-16121 | Low | 3.3 | 2020-11-07 | PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that the user would be u… |
CVE-2020-4483 | Medium | 4.3 | 2020-11-06 | IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error… |
CVE-2020-4584 | High | 7.5 | 2020-10-30 | IBM i2 iBase 8.9.13 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This info… |
CVE-2020-27015 | Medium | 4.4 | 2020-10-30 | Trend Micro Antivirus for Mac 2020 (Consumer) contains an Error Message Information Disclosure vulnerability that if exploited, could allow kernel pointers and… |
CVE-2019-4547 | Medium | 5.3 | 2020-10-29 | IBM Security Directory Server 6.4.0 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Forc… |
CVE-2020-15794 | Medium | 4.3 | 2020-10-15 | A vulnerability has been identified in Desigo Insight (All versions). Some error messages in the web application show the absolute path to the requested resour… |
CVE-2020-25778 | Medium | 6.0 | 2020-10-14 | Trend Micro Antivirus for Mac 2020 (Consumer) has a vulnerability in a specific kernel extension where an attacker could supply a kernel pointer and leak sever… |
CVE-2020-15666 | Medium | 6.5 | 2020-10-01 | When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500, 412, 403, etc.) was disclosed via the MediaError Message… |
CVE-2020-4629 | Low | 3.3 | 2020-09-30 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local user with specialized access to obtain sensitive information from a detailed techni… |
CVE-2020-25633 | Medium | 5.3 | 2020-09-18 | A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client users to obtain the server's potentially sensitive infor… |
CVE-2020-24925 | High | 7.5 | 2020-09-15 | A Sensitive Source Code Path Disclosure vulnerability is found in ElkarBackup v1.3.3. An attacker is able to view the path of the source code jobs/sort where e… |
CVE-2018-19947 | Medium | 4.3 | 2020-09-11 | The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this information exposure vulnerability could disclose sensitive inf… |
CVE-2020-4166 | Medium | 5.3 | 2020-08-27 | IBM Security Guardium Insights 2.0.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the b… |
CVE-2019-4699 | Low | 2.7 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 generates an error message that includes sensitive information about its environment, users, or associated… |
CVE-2020-15132 | Medium | 5.3 | 2020-08-05 | In Sulu before versions 1.6.35, 2.0.10, and 2.1.1, when the "Forget password" feature on the login screen is used, Sulu asks the user for a username or email a… |
CVE-2020-14337 | Medium | 5.8 | 2020-07-31 | A data exposure flaw was found in Tower, where sensitive data was revealed from the HTTP return error codes. This flaw allows an unauthenticated, remote attack… |
CVE-2020-8213 | Medium | 5.3 | 2020-07-30 | An information exposure vulnerability exists in UniFi Protect before v1.13.4-beta.5 that allowed unauthenticated attackers access to valid usernames for the Un… |
CVE-2020-15125 | High | 7.7 | 2020-07-29 | In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is us… |
CVE-2020-4572 | Medium | 5.3 | 2020-07-29 | IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returne… |
CVE-2020-13997 | High | 7.5 | 2020-07-28 | In Shopware before 6.2.3, the database password is leaked to an unauthenticated user when a DriverException occurs and verbose error handling is enabled. |
CVE-2020-4319 | Medium | 4.3 | 2020-07-28 | IBM MQ, IBM MQ Appliance, and IBM MQ for HPE NonStop 8.0, 9.1 LTS, and 9.1 CD could allow under special circumstances, an authenticated user to obtain sensitiv… |
CVE-2019-11252 | Medium | 5.9 | 2020-07-23 | The Kubernetes kube-controller-manager in versions v1.0-v1.17 is vulnerable to a credential leakage via error messages in mount failure logs and events for Azu… |
CVE-2020-6511 | Medium | 6.5 | 2020-07-22 | Information leak in content security policy in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2020-15478 | High | 7.5 | 2020-07-01 | The Journal theme before 3.1.0 for OpenCart allows exposure of sensitive data via SQL errors. |
CVE-2020-4341 | Medium | 5.3 | 2020-06-24 | IBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browse… |
CVE-2020-4327 | Medium | 5.3 | 2020-06-24 | IBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browse… |
CVE-2020-4532 | Medium | 5.3 | 2020-06-17 | IBM Business Automation Workflow and IBM Business Process Manager (IBM Business Process Manager Express 8.5.5, 8.5.6, 8.5.7, and 8.6) could allow a remote atta… |
CVE-2020-6503 | Medium | 6.5 | 2020-06-03 | Inappropriate implementation in accessibility in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information fro… |