CWE-209 · Generation of Error Message Containing Sensitive Information (page 6)
Page 6 of 6 — CVEs classified under CWE-209, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-4248 | Low | 2.7 | 2020-05-28 | IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message i… |
CVE-2020-4357 | Medium | 4.3 | 2020-05-27 | IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in… |
CVE-2019-18865 | Medium | 5.3 | 2020-05-07 | Information disclosure via error message discrepancies in authentication functions in Blaauw Remote Kiln Control through v3.00r4 allows an unauthenticated atta… |
CVE-2019-12864 | Medium | 5.5 | 2020-05-04 | SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) is vulnerable to Information Leakage, because of improper error handling with stack traces, as d… |
CVE-2019-4729 | Medium | 4.3 | 2020-04-27 | IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the bro… |
CVE-2020-4085 | Medium | 6.5 | 2020-04-22 | "HCL Connections is vulnerable to possible information leakage and could disclose sensitive information via stack trace to a local user." |
CVE-2020-11883 | Medium | 5.3 | 2020-04-17 | In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used in VueStorefront PWA, unexpected HTTP requests lead to an exception t… |
CVE-2020-4277 | High | 7.5 | 2020-04-17 | IBM TRIRIGA Application Platform 3.5.3 and 3.6.1 discloses sensitive information in error messages that could aid an attacker formulate future attacks. IBM X-F… |
CVE-2019-4593 | Medium | 4.3 | 2020-04-15 | IBM QRadar 7.3.0 to 7.3.3 Patch 2 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM… |
CVE-2020-6438 | Medium | 4.3 | 2020-04-13 | Insufficient policy enforcement in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2020-4164 | Low | 2.7 | 2020-04-08 | IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could expose sensitive information from applicatino errors which could be us… |
CVE-2019-4601 | Medium | 4.3 | 2020-04-08 | IBM Quality Manager (RQM) 6.02, 6.06, and 6.0.6.1 could allow an authenticated user to obtain sensitive information from a stack trace that could aid in furthe… |
CVE-2020-11594 | High | 7.5 | 2020-04-06 | An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request that causes a stack error to be shown pr… |
CVE-2020-4239 | Medium | 5.3 | 2020-03-31 | IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 could allow a remote attacker to obtain sensitive information when a detailed technical error message is ret… |
CVE-2020-5274 | Medium | 4.6 | 2020-03-30 | In Symfony before versions 5.0.5 and 4.4.5, some properties of the Exception were not properly escaped when the `ErrorHandler` rendered it stacktrace. In addit… |
CVE-2019-4619 | Medium | 5.5 | 2020-03-16 | IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive information by inclusion of sensitive… |
CVE-2019-12446 | High | 7.5 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 8.3 through 11.11. It allows Information Exposure through an Error Message. |
CVE-2020-10097 | Medium | 5.3 | 2020-03-05 | An issue was discovered in Zammad 3.0 through 3.2. It may respond with verbose error messages that disclose internal application or infrastructure information… |
CVE-2019-19993 | Medium | 5.3 | 2020-02-26 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. Several full path disclosure vulnerability were discovered. A user, even wi… |
CVE-2020-9351 | Medium | 5.3 | 2020-02-23 | An issue was discovered in SmartClient 12.0. If an unauthenticated attacker makes a POST request to /tools/developerConsoleOperations.jsp or /isomorphic/IDACal… |
CVE-2019-4583 | Medium | 4.3 | 2020-02-20 | IBM Maximo Asset Management 7.6.0.10 and 7.6.1.1 could allow an authenticated user to obtain sensitive information from a stack trace that could be used to aid… |
CVE-2018-21032 | Medium | 4.3 | 2020-02-14 | A vulnerability in Hitachi Command Suite prior to 8.7.1-00 and Hitachi Automation Director prior to 8.5.0-00 allow authenticated remote users to expose technic… |
CVE-2020-6189 | Medium | 5.3 | 2020-02-12 | Certain settings page(s) in SAP Business Objects Business Intelligence Platform (CMC), version 4.2, generates error messages that can give enterprise private-n… |
CVE-2019-4636 | Low | 2.7 | 2020-01-28 | IBM Security Secret Server 10.7 could disclose sensitive information to an authenticated user from generated error messages. IBM X-Force ID: 170013. |
CVE-2014-8161 | Medium | 4.3 | 2020-01-27 | PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sens… |
CVE-2020-7231 | Medium | 5.3 | 2020-01-19 | Evoko Home 1.31 devices provide different error messages for failed login requests depending on whether the username is valid. |
CVE-2019-19806 | Medium | 5.3 | 2019-12-30 | _account_forgot_password.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 displays a message indicating whether an email address is configured for the accou… |
CVE-2019-19342 | Medium | 5.3 | 2019-12-19 | A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.4, when /websocket is requested and the password contains the '#' character… |
CVE-2019-0404 | High | 7.5 | 2019-12-11 | SAP Enable Now, before version 1911, leaks information about network configuration in the server error messages, leading to Information Disclosure. |
CVE-2019-16768 | Low | 3.5 | 2019-12-05 | In affected versions of Sylius, exception messages from internal exceptions (like database exception) are wrapped by \Symfony\Component\Security\Core\Exception… |
CVE-2019-13697 | Medium | 6.5 | 2019-11-25 | Insufficient policy enforcement in performance APIs in Google Chrome prior to 77.0.3865.120 allowed a remote attacker to leak cross-origin data via a crafted H… |
CVE-2013-6879 | Medium | 5.3 | 2019-11-22 | The Mijosoft MijoSearch component 2.0.1 and earlier for Joomla! allows remote attackers to obtain sensitive information via a request to component/mijosearch/s… |
CVE-2019-4570 | Medium | 5.3 | 2019-11-22 | IBM Tivoli Netcool Impact 7.1.0 through 7.1.0.16 generates an error message that includes sensitive information about its environment, users, or associated dat… |
CVE-2019-6122 | Low | 3.1 | 2019-11-06 | A Username Enumeration via Error Message issue was discovered in NiceHash Miner before 2.0.3.0 because an "EMAIL DOES NOT EXIST" error message occurs whenever… |
CVE-2019-4512 | Medium | 4.3 | 2019-10-09 | IBM Maximo Asset Management 7.6.1.1 generates an error message that includes sensitive information that could be used in further attacks against the system. IB… |
CVE-2019-4441 | Medium | 5.3 | 2019-10-03 | IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and Liberty could allow a remote attacker to obtain sensitive information when a stack trace is returned i… |
CVE-2019-12156 | Medium | 5.3 | 2019-10-02 | Server metadata could be exposed because one of the error messages reflected the whole response back to the client in JetBrains TeamCity versions before 2018.2… |
CVE-2019-3730 | High | 7.5 | 2019-09-30 | RSA BSAFE Micro Edition Suite versions prior to 4.1.6.3 (in 4.1.x) and prior to 4.4 (in 4.2.x and 4.3.x), are vulnerable to an Information Exposure Through an… |
CVE-2019-15032 | Medium | 5.3 | 2019-09-19 | Pydio 6.0.8 mishandles error reporting when a directory allows unauthenticated uploads, and the remote-upload option is used with the http://localhost:22 URL… |
CVE-2019-3756 | Medium | 6.5 | 2019-09-18 | RSA Archer, versions prior to 6.6 P3 (6.6.0.3), contain an information disclosure vulnerability. Information relating to the backend database gets disclosed to… |
CVE-2019-11662 | Medium | 4.3 | 2019-09-18 | Class and method names in error message in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60… |
CVE-2019-6792 | Medium | 5.3 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Path Disclosure. Wh… |
CVE-2019-5483 | Medium | 5.3 | 2019-09-09 | Seneca < 3.9.0 contains a vulnerability that could lead to exposing environment variables to unauthorized users. |
CVE-2019-16101 | Medium | 5.3 | 2019-09-08 | Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows remote attackers to obtain potentially sensitive stack traces by sending incorrect JSON data to the REST A… |
CVE-2019-9455 | Low | 2.3 | 2019-09-06 | In the Android kernel in the video driver there is a kernel pointer leak due to a WARN_ON statement. This could lead to local information disclosure with Syste… |
CVE-2019-11602 | Medium | 5.3 | 2019-08-21 | Leakage of stack traces in remote access to backup & restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 allows remote… |
CVE-2019-4485 | Medium | 4.3 | 2019-08-20 | IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an… |
CVE-2019-4484 | Medium | 4.3 | 2019-08-20 | IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an… |
CVE-2019-4420 | Medium | 6.2 | 2019-08-20 | IBM Intelligent Operations Center V5.1.0 through V5.2.0 could disclose detailed error messages, revealing sensitive information that could aid in further attac… |
CVE-2019-4308 | Medium | 4.3 | 2019-08-20 | IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 could allow a… |
CVE-2019-14433 | Medium | 6.5 | 2019-08-09 | An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2. If an API request from an authenticated user ends in a fa… |
CVE-2019-1020013 | Medium | 5.3 | 2019-07-29 | parse-server before 3.6.0 allows account enumeration. |
CVE-2019-7941 | High | 7.5 | 2019-07-18 | Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Information Exposure Through an Error Message vulnerability. Successful exploitation c… |
CVE-2019-4129 | Medium | 5.3 | 2019-07-02 | IBM Spectrum Protect Operations Center 7.1 and 8.1 could allow a remote attacker to obtain sensitive information, caused by an error message containing a stack… |
CVE-2019-4269 | High | 7.5 | 2019-06-28 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console could allow a remote attacker to obtain sensitive information when a specially crafted ur… |
CVE-2019-4377 | Medium | 4.3 | 2019-06-25 | IBM Sterling B2B Integrator 6.0.0.0 and 6.0.0.1 reveals sensitive information from a stack trace that could be used in further attacks against the system. IBM… |
CVE-2019-12903 | Medium | 4.3 | 2019-06-20 | Pydio Cells before 1.5.0, when supplied with a Name field in an unexpected Unicode format, fails to handle this and includes the database column/table name as… |
CVE-2019-4257 | Medium | 4.3 | 2019-06-06 | IBM InfoSphere Information Server 11.5 and 11.7 is affected by an information disclosure vulnerability. Sensitive information in an error message may be used t… |
CVE-2019-4219 | Medium | 5.3 | 2019-06-06 | IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 generates an error message that includes sensitive information that could be used in further atta… |
CVE-2018-12886 | High | 8.1 | 2019-05-22 | stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) gen… |
CVE-2019-12215 | Medium | 4.3 | 2019-05-20 | A full path disclosure vulnerability was discovered in Matomo v3.9.1 where a user can trigger a particular error to discover the full path of Matomo on the dis… |
CVE-2019-9223 | High | 7.5 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposu… |
CVE-2019-7644 | Critical | 9.8 | 2019-04-11 | Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT signature. If this e… |
CVE-2019-7612 | Critical | 9.8 | 2019-03-25 | A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs. If a malformed URL is specified as part of… |
CVE-2017-2659 | Medium | 5.3 | 2019-03-21 | It was found that dropbear before version 2013.59 with GSSAPI leaks whether given username is valid or invalid. When an invalid username is given, the GSSAPI a… |
CVE-2019-7550 | Medium | 5.3 | 2019-02-12 | In JForum 2.1.8, an unauthenticated, remote attacker can enumerate whether a user exists by using the "create user" function. If a register/check/username?user… |
CVE-2018-14623 | Medium | 4.3 | 2018-12-14 | A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the bac… |
CVE-2018-17961 | High | 8.6 | 2018-10-15 | Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving errorhandler setup. NOTE: this issue exist… |
CVE-2018-17891 | Low | 3.7 | 2018-10-04 | Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream server where there is… |
CVE-2018-10913 | Medium | 6.5 | 2018-09-04 | An information disclosure vulnerability was discovered in glusterfs server. An attacker could issue a xattr request via glusterfs FUSE to determine the existen… |
CVE-2018-14925 | Critical | 9.8 | 2018-08-03 | Matera Banco 1.0.0 mishandles Java errors in the backend, as demonstrated by a stack trace revealing use of net.sf.acegisecurity components. |
CVE-2018-14907 | Medium | 5.3 | 2018-08-03 | The Web server in 3CX version 15.5.8801.3 is vulnerable to Information Leakage, because of improper error handling in Stack traces, as demonstrated by discover… |
CVE-2018-10624 | Medium | 6.5 | 2018-08-01 | In Johnson Controls Metasys System Versions 8.0 and prior and BCPro (BCM) all versions prior to 3.0.2, this vulnerability results from improper error handling… |
CVE-2018-8042 | High | 8.1 | 2018-07-18 | Apache Ambari, version 2.5.0 to 2.6.2, passwords for Hadoop credential stores are exposed in Ambari Agent informational log messages when the credential store… |
CVE-2018-12536 | Medium | 5.3 | 2018-06-27 | In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynam… |
CVE-2018-1073 | Medium | 5.3 | 2018-06-19 | The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and invalid passwords, allowing an attacker to… |
CVE-2018-11325 | Critical | 9.8 | 2018-05-22 | An issue was discovered in Joomla! Core before 3.8.8. The web install application would autofill password fields after either a form validation error or naviga… |
CVE-2017-2594 | Medium | 5.4 | 2018-05-08 | hawtio before versions 2.0-beta-1, 2.0-beta-2 2.0-m1, 2.0-m2, 2.0-m3, and 1.5 is vulnerable to a path traversal that leads to a NullPointerException with a ful… |
CVE-2018-2379 | Medium | 6.5 | 2018-02-14 | In SAP HANA Extended Application Services, 1.0, an unauthenticated user could test if a given username is valid by evaluating error messages of a specific endp… |
CVE-2017-7551 | Critical | 9.8 | 2017-08-16 | 389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on… |
CVE-2017-1370 | Medium | 4.9 | 2017-07-31 | IBM Jazz Reporting Service (JRS) 5.0 and 6.0 could disclose sensitive information, including user credentials, through an error message from the Report Builder… |
CVE-2017-7945 | Critical | 9.8 | 2017-04-29 | The GlobalProtect external interface in Palo Alto Networks PAN-OS before 6.1.17, 7.x before 7.0.15, 7.1.x before 7.1.9, and 8.x before 8.0.2 provides different… |
CVE-2017-0885 | Medium | 4.3 | 2017-04-05 | Nextcloud Server before 9.0.55 and 10.0.2 suffers from a error message disclosing existence of file in write-only share. Due to an error in the application log… |
CVE-2016-9459 | Medium | 6.1 | 2017-03-28 | Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a log pollution vulnerability potentially leading to a local XSS. The download… |
CVE-2013-7331 | Medium | 6.5 | 2014-02-26 | The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share path… |
CVE-2012-0059 | Medium | 4.9 | 2014-02-05 | A flaw was found in Spacewalk-backend. This information disclosure vulnerability occurs when a system registration XML-RPC call fails, causing cleartext user p… |
CVE-2010-3332 | | 2010-09-22 | Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides… | |
CVE-2000-1191 | | 2001-08-31 | htsearch program in htDig 3.2 beta, 3.1.6, 3.1.5, and earlier allows remote attackers to determine the physical path of the server by requesting a non-existent… |