CWE-209 · Generation of Error Message Containing Sensitive Information (page 7)
Page 7 of 7 — CVEs classified under CWE-209, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-9223 | High | 7.5 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposu… |
CVE-2019-7644 | Critical | 9.8 | 2019-04-11 | Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT signature. If this e… |
CVE-2019-7612 | Critical | 9.8 | 2019-03-25 | A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs. If a malformed URL is specified as part of… |
CVE-2017-2659 | Medium | 5.3 | 2019-03-21 | It was found that dropbear before version 2013.59 with GSSAPI leaks whether given username is valid or invalid. When an invalid username is given, the GSSAPI a… |
CVE-2019-7550 | Medium | 5.3 | 2019-02-12 | In JForum 2.1.8, an unauthenticated, remote attacker can enumerate whether a user exists by using the "create user" function. If a register/check/username?user… |
CVE-2018-14623 | Medium | 4.3 | 2018-12-14 | A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the bac… |
CVE-2018-17961 | High | 8.6 | 2018-10-15 | Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving errorhandler setup. NOTE: this issue exist… |
CVE-2018-17891 | Low | 3.7 | 2018-10-04 | Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream server where there is… |
CVE-2018-10913 | Medium | 6.5 | 2018-09-04 | An information disclosure vulnerability was discovered in glusterfs server. An attacker could issue a xattr request via glusterfs FUSE to determine the existen… |
CVE-2018-14925 | Critical | 9.8 | 2018-08-03 | Matera Banco 1.0.0 mishandles Java errors in the backend, as demonstrated by a stack trace revealing use of net.sf.acegisecurity components. |
CVE-2018-14907 | Medium | 5.3 | 2018-08-03 | The Web server in 3CX version 15.5.8801.3 is vulnerable to Information Leakage, because of improper error handling in Stack traces, as demonstrated by discover… |
CVE-2018-10624 | Medium | 4.3 | 2018-08-01 | In Johnson Controls Metasys System Versions 8.0 and prior and BCPro (BCM) all versions prior to 3.0.2, this vulnerability results from improper error handling… |
CVE-2018-8042 | High | 8.1 | 2018-07-18 | Apache Ambari, version 2.5.0 to 2.6.2, passwords for Hadoop credential stores are exposed in Ambari Agent informational log messages when the credential store… |
CVE-2018-12536 | Medium | 5.3 | 2018-06-27 | In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynam… |
CVE-2018-1073 | Medium | 5.3 | 2018-06-19 | The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and invalid passwords, allowing an attacker to… |
CVE-2018-11325 | Critical | 9.8 | 2018-05-22 | An issue was discovered in Joomla! Core before 3.8.8. The web install application would autofill password fields after either a form validation error or naviga… |
CVE-2017-2594 | Medium | 5.4 | 2018-05-08 | hawtio before versions 2.0-beta-1, 2.0-beta-2 2.0-m1, 2.0-m2, 2.0-m3, and 1.5 is vulnerable to a path traversal that leads to a NullPointerException with a ful… |
CVE-2018-2379 | Medium | 6.5 | 2018-02-14 | In SAP HANA Extended Application Services, 1.0, an unauthenticated user could test if a given username is valid by evaluating error messages of a specific endp… |
CVE-2017-7551 | Critical | 9.8 | 2017-08-16 | 389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on… |
CVE-2017-1370 | Medium | 4.9 | 2017-07-31 | IBM Jazz Reporting Service (JRS) 5.0 and 6.0 could disclose sensitive information, including user credentials, through an error message from the Report Builder… |
CVE-2017-7945 | Critical | 9.8 | 2017-04-29 | The GlobalProtect external interface in Palo Alto Networks PAN-OS before 6.1.17, 7.x before 7.0.15, 7.1.x before 7.1.9, and 8.x before 8.0.2 provides different… |
CVE-2017-0885 | Medium | 4.3 | 2017-04-05 | Nextcloud Server before 9.0.55 and 10.0.2 suffers from a error message disclosing existence of file in write-only share. Due to an error in the application log… |
CVE-2016-9459 | Medium | 6.1 | 2017-03-28 | Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a log pollution vulnerability potentially leading to a local XSS. The download… |
CVE-2013-7331 | Medium | 6.5 | 2014-02-26 | The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share path… |
CVE-2012-0059 | Medium | 4.9 | 2014-02-05 | A flaw was found in Spacewalk-backend. This information disclosure vulnerability occurs when a system registration XML-RPC call fails, causing cleartext user p… |
CVE-2010-3332 | | 2010-09-22 | Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides… | |
CVE-2000-1191 | | 2001-08-31 | htsearch program in htDig 3.2 beta, 3.1.6, 3.1.5, and earlier allows remote attackers to determine the physical path of the server by requesting a non-existent… |