CWE-209 · Generation of Error Message Containing Sensitive Information (page 6)
Page 6 of 7 — CVEs classified under CWE-209, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-4544 | Medium | 4.3 | 2021-01-08 | IBM Jazz Foundation Products could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser… |
CVE-2020-4487 | Medium | 4.3 | 2021-01-08 | IBM Jazz Foundation Products could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser… |
CVE-2020-4897 | Medium | 5.3 | 2021-01-07 | IBM Emptoris Contract Management and IBM Emptoris Spend Analysis 10.1.0, 10.1.1, and 10.1.3 could allow a remote attacker to obtain sensitive information when… |
CVE-2020-4761 | Medium | 5.3 | 2021-01-05 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow a remote attacker to obtain sensitive… |
CVE-2020-2505 | Low | 2.3 | 2020-12-24 | If exploited, this vulnerability could allow attackers to gain sensitive information via generation of error messages. QNAP has already fixed these issues in Q… |
CVE-2020-4842 | Medium | 4.9 | 2020-12-21 | IBM Security Secret Server 10.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browse… |
CVE-2020-4846 | Low | 2.7 | 2020-12-17 | IBM Security Key Lifecycle Manager 3.0.1 and 4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is retur… |
CVE-2020-35177 | Medium | 5.3 | 2020-12-17 | HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1. |
CVE-2020-4907 | Medium | 5.3 | 2020-12-16 | IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 could allow a remote attacker to obtain sensitive information when a detailed tec… |
CVE-2020-16128 | Low | 3.8 | 2020-12-09 | The aptdaemon DBus interface disclosed file existence disclosure by setting Terminal/DebconfSocket properties, aka GHSL-2020-192 and GHSL-2020-196. This affect… |
CVE-2020-25640 | Medium | 5.3 | 2020-11-24 | A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensi… |
CVE-2020-16121 | Low | 3.3 | 2020-11-07 | PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that the user would be u… |
CVE-2020-4483 | Medium | 4.3 | 2020-11-06 | IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error… |
CVE-2020-4584 | High | 7.5 | 2020-10-30 | IBM i2 iBase 8.9.13 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This info… |
CVE-2020-27015 | Medium | 4.4 | 2020-10-30 | Trend Micro Antivirus for Mac 2020 (Consumer) contains an Error Message Information Disclosure vulnerability that if exploited, could allow kernel pointers and… |
CVE-2019-4547 | Medium | 5.3 | 2020-10-29 | IBM Security Directory Server 6.4.0 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Forc… |
CVE-2020-15794 | Medium | 4.3 | 2020-10-15 | A vulnerability has been identified in Desigo Insight (All versions). Some error messages in the web application show the absolute path to the requested resour… |
CVE-2020-25778 | Medium | 6.0 | 2020-10-14 | Trend Micro Antivirus for Mac 2020 (Consumer) has a vulnerability in a specific kernel extension where an attacker could supply a kernel pointer and leak sever… |
CVE-2020-15666 | Medium | 6.5 | 2020-10-01 | When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500, 412, 403, etc.) was disclosed via the MediaError Message… |
CVE-2020-4629 | Low | 3.3 | 2020-09-30 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local user with specialized access to obtain sensitive information from a detailed techni… |
CVE-2020-25633 | Medium | 5.3 | 2020-09-18 | A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client users to obtain the server's potentially sensitive infor… |
CVE-2020-24925 | High | 7.5 | 2020-09-15 | A Sensitive Source Code Path Disclosure vulnerability is found in ElkarBackup v1.3.3. An attacker is able to view the path of the source code jobs/sort where e… |
CVE-2018-19947 | Medium | 4.3 | 2020-09-11 | The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this information exposure vulnerability could disclose sensitive inf… |
CVE-2020-4166 | Medium | 5.3 | 2020-08-27 | IBM Security Guardium Insights 2.0.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the b… |
CVE-2019-4699 | Low | 2.7 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 generates an error message that includes sensitive information about its environment, users, or associated… |
CVE-2020-15132 | Medium | 5.3 | 2020-08-05 | In Sulu before versions 1.6.35, 2.0.10, and 2.1.1, when the "Forget password" feature on the login screen is used, Sulu asks the user for a username or email a… |
CVE-2020-14337 | Medium | 5.8 | 2020-07-31 | A data exposure flaw was found in Tower, where sensitive data was revealed from the HTTP return error codes. This flaw allows an unauthenticated, remote attack… |
CVE-2020-8213 | Medium | 5.3 | 2020-07-30 | An information exposure vulnerability exists in UniFi Protect before v1.13.4-beta.5 that allowed unauthenticated attackers access to valid usernames for the Un… |
CVE-2020-15125 | High | 7.7 | 2020-07-29 | In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is us… |
CVE-2020-4572 | Medium | 5.3 | 2020-07-29 | IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returne… |
CVE-2020-13997 | High | 7.5 | 2020-07-28 | In Shopware before 6.2.3, the database password is leaked to an unauthenticated user when a DriverException occurs and verbose error handling is enabled. |
CVE-2020-4319 | Medium | 4.3 | 2020-07-28 | IBM MQ, IBM MQ Appliance, and IBM MQ for HPE NonStop 8.0, 9.1 LTS, and 9.1 CD could allow under special circumstances, an authenticated user to obtain sensitiv… |
CVE-2019-11252 | Medium | 5.9 | 2020-07-23 | The Kubernetes kube-controller-manager in versions v1.0-v1.17 is vulnerable to a credential leakage via error messages in mount failure logs and events for Azu… |
CVE-2020-6511 | Medium | 6.5 | 2020-07-22 | Information leak in content security policy in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2020-15478 | High | 7.5 | 2020-07-01 | The Journal theme before 3.1.0 for OpenCart allows exposure of sensitive data via SQL errors. |
CVE-2020-4341 | Medium | 5.3 | 2020-06-24 | IBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browse… |
CVE-2020-4327 | Medium | 5.3 | 2020-06-24 | IBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browse… |
CVE-2020-4532 | Medium | 5.3 | 2020-06-17 | IBM Business Automation Workflow and IBM Business Process Manager (IBM Business Process Manager Express 8.5.5, 8.5.6, 8.5.7, and 8.6) could allow a remote atta… |
CVE-2020-6503 | Medium | 6.5 | 2020-06-03 | Inappropriate implementation in accessibility in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information fro… |
CVE-2020-4248 | Low | 2.7 | 2020-05-28 | IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message i… |
CVE-2020-4357 | Medium | 4.3 | 2020-05-27 | IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in… |
CVE-2019-18865 | Medium | 5.3 | 2020-05-07 | Information disclosure via error message discrepancies in authentication functions in Blaauw Remote Kiln Control through v3.00r4 allows an unauthenticated atta… |
CVE-2019-12864 | Medium | 5.5 | 2020-05-04 | SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) is vulnerable to Information Leakage, because of improper error handling with stack traces, as d… |
CVE-2019-4729 | Medium | 4.3 | 2020-04-27 | IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the bro… |
CVE-2020-4085 | Medium | 6.5 | 2020-04-22 | "HCL Connections is vulnerable to possible information leakage and could disclose sensitive information via stack trace to a local user." |
CVE-2020-11883 | Medium | 5.3 | 2020-04-17 | In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used in VueStorefront PWA, unexpected HTTP requests lead to an exception t… |
CVE-2020-4277 | High | 7.5 | 2020-04-17 | IBM TRIRIGA Application Platform 3.5.3 and 3.6.1 discloses sensitive information in error messages that could aid an attacker formulate future attacks. IBM X-F… |
CVE-2019-4593 | Medium | 4.3 | 2020-04-15 | IBM QRadar 7.3.0 to 7.3.3 Patch 2 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM… |
CVE-2020-6438 | Medium | 4.3 | 2020-04-13 | Insufficient policy enforcement in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2020-4164 | Low | 2.7 | 2020-04-08 | IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could expose sensitive information from applicatino errors which could be us… |
CVE-2019-4601 | Medium | 4.3 | 2020-04-08 | IBM Quality Manager (RQM) 6.02, 6.06, and 6.0.6.1 could allow an authenticated user to obtain sensitive information from a stack trace that could aid in furthe… |
CVE-2020-11594 | High | 7.5 | 2020-04-06 | An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request that causes a stack error to be shown pr… |
CVE-2020-4239 | Medium | 5.3 | 2020-03-31 | IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 could allow a remote attacker to obtain sensitive information when a detailed technical error message is ret… |
CVE-2020-5274 | Medium | 4.6 | 2020-03-30 | In Symfony before versions 5.0.5 and 4.4.5, some properties of the Exception were not properly escaped when the `ErrorHandler` rendered it stacktrace. In addit… |
CVE-2019-4619 | Medium | 5.5 | 2020-03-16 | IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive information by inclusion of sensitive… |
CVE-2019-12446 | High | 7.5 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 8.3 through 11.11. It allows Information Exposure through an Error Message. |
CVE-2020-10097 | Medium | 5.3 | 2020-03-05 | An issue was discovered in Zammad 3.0 through 3.2. It may respond with verbose error messages that disclose internal application or infrastructure information… |
CVE-2019-19993 | Medium | 5.3 | 2020-02-26 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. Several full path disclosure vulnerability were discovered. A user, even wi… |
CVE-2020-9351 | Medium | 5.3 | 2020-02-23 | An issue was discovered in SmartClient 12.0. If an unauthenticated attacker makes a POST request to /tools/developerConsoleOperations.jsp or /isomorphic/IDACal… |
CVE-2019-4583 | Medium | 4.3 | 2020-02-20 | IBM Maximo Asset Management 7.6.0.10 and 7.6.1.1 could allow an authenticated user to obtain sensitive information from a stack trace that could be used to aid… |
CVE-2018-21032 | Medium | 4.3 | 2020-02-14 | A vulnerability in Hitachi Command Suite prior to 8.7.1-00 and Hitachi Automation Director prior to 8.5.0-00 allow authenticated remote users to expose technic… |
CVE-2020-6189 | Medium | 5.3 | 2020-02-12 | Certain settings page(s) in SAP Business Objects Business Intelligence Platform (CMC), version 4.2, generates error messages that can give enterprise private-n… |
CVE-2019-4636 | Low | 2.7 | 2020-01-28 | IBM Security Secret Server 10.7 could disclose sensitive information to an authenticated user from generated error messages. IBM X-Force ID: 170013. |
CVE-2014-8161 | Medium | 4.3 | 2020-01-27 | PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sens… |
CVE-2020-7231 | Medium | 5.3 | 2020-01-19 | Evoko Home 1.31 devices provide different error messages for failed login requests depending on whether the username is valid. |
CVE-2019-19806 | Medium | 5.3 | 2019-12-30 | _account_forgot_password.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 displays a message indicating whether an email address is configured for the accou… |
CVE-2019-19342 | Medium | 5.3 | 2019-12-19 | A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.4, when /websocket is requested and the password contains the '#' character… |
CVE-2019-0404 | High | 7.5 | 2019-12-11 | SAP Enable Now, before version 1911, leaks information about network configuration in the server error messages, leading to Information Disclosure. |
CVE-2019-16768 | Low | 3.5 | 2019-12-05 | In affected versions of Sylius, exception messages from internal exceptions (like database exception) are wrapped by \Symfony\Component\Security\Core\Exception… |
CVE-2019-13697 | Medium | 6.5 | 2019-11-25 | Insufficient policy enforcement in performance APIs in Google Chrome prior to 77.0.3865.120 allowed a remote attacker to leak cross-origin data via a crafted H… |
CVE-2013-6879 | Medium | 5.3 | 2019-11-22 | The Mijosoft MijoSearch component 2.0.1 and earlier for Joomla! allows remote attackers to obtain sensitive information via a request to component/mijosearch/s… |
CVE-2019-4570 | Medium | 5.3 | 2019-11-22 | IBM Tivoli Netcool Impact 7.1.0 through 7.1.0.16 generates an error message that includes sensitive information about its environment, users, or associated dat… |
CVE-2019-6122 | Low | 3.1 | 2019-11-06 | A Username Enumeration via Error Message issue was discovered in NiceHash Miner before 2.0.3.0 because an "EMAIL DOES NOT EXIST" error message occurs whenever… |
CVE-2019-4512 | Medium | 4.3 | 2019-10-09 | IBM Maximo Asset Management 7.6.1.1 generates an error message that includes sensitive information that could be used in further attacks against the system. IB… |
CVE-2019-4441 | Medium | 5.3 | 2019-10-03 | IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and Liberty could allow a remote attacker to obtain sensitive information when a stack trace is returned i… |
CVE-2019-12156 | Medium | 5.3 | 2019-10-02 | Server metadata could be exposed because one of the error messages reflected the whole response back to the client in JetBrains TeamCity versions before 2018.2… |
CVE-2019-3730 | High | 7.5 | 2019-09-30 | RSA BSAFE Micro Edition Suite versions prior to 4.1.6.3 (in 4.1.x) and prior to 4.4 (in 4.2.x and 4.3.x), are vulnerable to an Information Exposure Through an… |
CVE-2019-15032 | Medium | 5.3 | 2019-09-19 | Pydio 6.0.8 mishandles error reporting when a directory allows unauthenticated uploads, and the remote-upload option is used with the http://localhost:22 URL… |
CVE-2019-3756 | Medium | 6.5 | 2019-09-18 | RSA Archer, versions prior to 6.6 P3 (6.6.0.3), contain an information disclosure vulnerability. Information relating to the backend database gets disclosed to… |
CVE-2019-11662 | Medium | 4.3 | 2019-09-18 | Class and method names in error message in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60… |
CVE-2019-6792 | Medium | 5.3 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Path Disclosure. Wh… |
CVE-2019-5483 | Medium | 5.3 | 2019-09-09 | Seneca < 3.9.0 contains a vulnerability that could lead to exposing environment variables to unauthorized users. |
CVE-2019-16101 | Medium | 5.3 | 2019-09-08 | Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows remote attackers to obtain potentially sensitive stack traces by sending incorrect JSON data to the REST A… |
CVE-2019-9455 | Low | 2.3 | 2019-09-06 | In the Android kernel in the video driver there is a kernel pointer leak due to a WARN_ON statement. This could lead to local information disclosure with Syste… |
CVE-2019-11602 | Medium | 5.3 | 2019-08-21 | Leakage of stack traces in remote access to backup & restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 allows remote… |
CVE-2019-4485 | Medium | 4.3 | 2019-08-20 | IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an… |
CVE-2019-4484 | Medium | 4.3 | 2019-08-20 | IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an… |
CVE-2019-4420 | Medium | 6.2 | 2019-08-20 | IBM Intelligent Operations Center V5.1.0 through V5.2.0 could disclose detailed error messages, revealing sensitive information that could aid in further attac… |
CVE-2019-4308 | Medium | 4.3 | 2019-08-20 | IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 could allow a… |
CVE-2019-14433 | Medium | 6.5 | 2019-08-09 | An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2. If an API request from an authenticated user ends in a fa… |
CVE-2019-1020013 | Medium | 5.3 | 2019-07-29 | parse-server before 3.6.0 allows account enumeration. |
CVE-2019-7941 | High | 7.5 | 2019-07-18 | Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Information Exposure Through an Error Message vulnerability. Successful exploitation c… |
CVE-2019-4129 | Medium | 5.3 | 2019-07-02 | IBM Spectrum Protect Operations Center 7.1 and 8.1 could allow a remote attacker to obtain sensitive information, caused by an error message containing a stack… |
CVE-2019-4269 | High | 7.5 | 2019-06-28 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console could allow a remote attacker to obtain sensitive information when a specially crafted ur… |
CVE-2019-4377 | Medium | 4.3 | 2019-06-25 | IBM Sterling B2B Integrator 6.0.0.0 and 6.0.0.1 reveals sensitive information from a stack trace that could be used in further attacks against the system. IBM… |
CVE-2019-12903 | Medium | 4.3 | 2019-06-20 | Pydio Cells before 1.5.0, when supplied with a Name field in an unexpected Unicode format, fails to handle this and includes the database column/table name as… |
CVE-2019-4257 | Medium | 4.3 | 2019-06-06 | IBM InfoSphere Information Server 11.5 and 11.7 is affected by an information disclosure vulnerability. Sensitive information in an error message may be used t… |
CVE-2019-4219 | Medium | 5.3 | 2019-06-06 | IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 generates an error message that includes sensitive information that could be used in further atta… |
CVE-2018-12886 | High | 8.1 | 2019-05-22 | stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) gen… |
CVE-2019-12215 | Medium | 4.3 | 2019-05-20 | A full path disclosure vulnerability was discovered in Matomo v3.9.1 where a user can trigger a particular error to discover the full path of Matomo on the dis… |