CWE-497 · Exposure of Sensitive System Information to an Unauthorized Control Sphere (page 3)
Page 3 of 4 — CVEs classified under CWE-497, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-58007 | Medium | 4.3 | 2025-09-22 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NerdPress Hubbub Lite social-pug allows Retrieve Embedded Sensitive… |
CVE-2025-57937 | Medium | 4.3 | 2025-09-22 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in etruel WPeMatico RSS Feed Fetcher wpematico allows Retrieve Embedde… |
CVE-2025-57916 | Medium | 4.3 | 2025-09-22 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Nurul Amin WP System Information wp-system-info allows Retrieve Emb… |
CVE-2025-36146 | Medium | 4.3 | 2025-09-18 | IBM Lakehouse (watsonx.data 2.2) could allow an authenticated user to obtain sensitive server component version information which could aid in further attacks… |
CVE-2024-12367 | High | 8.6 | 2025-09-16 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Vegagrup Software Vega Master allows Directory Indexing. This issu… |
CVE-2025-4235 | | 2025-09-12 | An information exposure vulnerability in the Palo Alto Networks User-ID Credential Agent (Windows-based) can expose the service account password under specific… | |
CVE-2025-10264 | Critical | 10.0 | 2025-09-12 | Certain models of NVR developed by Digiever has an Exposure of Sensitive Information vulnerability, allowing unauthenticated remoter attackers to access the sy… |
CVE-2025-6769 | Medium | 4.3 | 2025-09-12 | An issue has been discovered in GitLab CE/EE affecting all versions from 15.1 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed… |
CVE-2025-9364 | High | 8.8 | 2025-09-09 | An open database issue exists in the affected product and version. The security issue stems from an over permissive Redis instance. This could result in an att… |
CVE-2025-58866 | Low | 2.7 | 2025-09-05 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Rami Yushuvaev Site Info site-info-dashboard-widget allows Retrieve… |
CVE-2025-58797 | Medium | 5.3 | 2025-09-05 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Mahmudul Hasan Arif Ninja Charts ninja-charts allows Retrieve Embed… |
CVE-2025-2667 | Low | 2.7 | 2025-09-04 | IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.7_1 and 6.2.0.0 through 6.2.0.4 and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7_1 and 6.2.0.0 through 6… |
CVE-2025-36162 | Medium | 4.3 | 2025-09-02 | IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) 8.1 before 8.1.2.2 could allow an authenticated user to obtain sensitive information about configuration on the… |
CVE-2025-8700 | | 2025-08-26 | Invoice Ninja's configuration on macOS, specifically the presence of entitlement "com.apple.security.get-task-allow", allows local attackers with unprivileged… | |
CVE-2025-8597 | | 2025-08-26 | MacVim's configuration on macOS, specifically the presence of entitlement "com.apple.security.get-task-allow", allows local attackers with unprivileged access… | |
CVE-2025-57888 | Medium | 5.3 | 2025-08-22 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NooTheme Jobmonster noo-jobmonster allows Retrieve Embedded Sensiti… |
CVE-2025-27721 | High | 7.5 | 2025-08-21 | Unauthorized users can access INFINITT PACS System Manager without proper authorization, which could lead to unauthorized access to system resources. |
CVE-2025-48355 | Medium | 5.3 | 2025-08-21 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ProveSource LTD ProveSource Social Proof provesource allows Retriev… |
CVE-2025-2988 | Low | 2.7 | 2025-08-19 | IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7, 6.2.0.0 through 6.2.0.4, and 6.2.1.0 could disclose sensitive server informa… |
CVE-2025-54736 | Medium | 5.3 | 2025-08-14 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NordicMade Savoy savoy allows Retrieve Embedded Sensitive Data.This… |
CVE-2025-23288 | Low | 3.3 | 2025-08-02 | NVIDIA GPU Display Driver for Windows contains a vulnerability where an attacker may cause an exposure of sensitive system information with local unprivileged… |
CVE-2025-23287 | Low | 3.3 | 2025-08-02 | NVIDIA GPU Display Driver for Windows contains a vulnerability where an attacker may access sensitive system-level information. A successful exploit of this vu… |
CVE-2025-54422 | Medium | 5.5 | 2025-07-29 | Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. In versions 1.16.1 and below, a critical security vul… |
CVE-2022-50237 | Medium | 5.9 | 2025-07-28 | The ed25519-dalek crate before 2 for Rust allows a double public key signing function oracle attack. The Keypair implementation leads to a simple computation f… |
CVE-2025-53031 | Medium | 5.3 | 2025-07-15 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform)… |
CVE-2024-51770 | High | 7.5 | 2025-07-14 | An information disclosure vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. |
CVE-2025-53862 | Low | 3.5 | 2025-07-11 | A flaw was found in Ansible. Three API endpoints are accessible and return verbose, unauthenticated responses. This flaw allows a malicious user to access data… |
CVE-2025-6390 | Medium | 4.4 | 2025-07-10 | Brocade SANnav before SANnav 2.4.0a logs passwords and pbe keys in the Brocade SANnav server audit logs after installation and under specific conditions. These… |
CVE-2025-4662 | Medium | 4.4 | 2025-07-10 | Brocade SANnav before SANnav 2.4.0a logs plaintext passphrases in the Brocade SANnav host server audit logs while executing OpenSSL command using a passphrase… |
CVE-2025-53364 | Medium | 5.3 | 2025-07-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Starting in 5.3.0 and before 7.5.3 and 8.2.2, the Parse… |
CVE-2025-7381 | Medium | 5.3 | 2025-07-09 | ImpactThis is an information disclosure vulnerability originating from PHP's base image. This vulnerability exposes the PHP version through an X-Powered-By hea… |
CVE-2025-2670 | Medium | 4.3 | 2025-07-09 | IBM OpenPages 9.0 is vulnerable to information disclosure of sensitive information due to a weaker than expected security for certain REST end points related t… |
CVE-2025-27369 | Medium | 4.3 | 2025-07-08 | IBM OpenPages with Watson 8.3 and 9.0 is vulnerable to information disclosure of sensitive information due to a weaker than expected security for certa… |
CVE-2025-24334 | Low | 3.3 | 2025-07-02 | The Nokia Single RAN baseband software earlier than 23R2-SR 1.0 MP can be made to reveal the exact software release version by sending a specific HTTP POST req… |
CVE-2025-53211 | Medium | 5.3 | 2025-06-27 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Roland Beaussant Audio Editor & Recorder audio-editor-recorder allo… |
CVE-2025-6561 | Critical | 9.8 | 2025-06-26 | Certain hybrid DVR models ((HBF-09KD and HBF-16NK)) from Hunt Electronic have an Exposure of Sensitive Information vulnerability, allowing unauthenticated remo… |
CVE-2025-49147 | Medium | 5.3 | 2025-06-24 | Umbraco, a free and open source .NET content management system, has a vulnerability in versions 10.0.0 through 10.8.10 and 13.0.0 through 13.9.1. Via a request… |
CVE-2025-5416 | Low | 2.7 | 2025-06-20 | A vulnerability has been identified in Keycloak that could lead to unauthorized information disclosure. While it requires an already authenticated user, the /a… |
CVE-2025-52719 | Medium | 4.3 | 2025-06-20 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communi… |
CVE-2025-4229 | | 2025-06-13 | An information disclosure vulnerability in the SD-WAN feature of Palo Alto Networks PAN-OS® software enables an unauthorized user to view unencrypted data sent… | |
CVE-2025-0036 | Low | 3.2 | 2025-06-10 | In AMD Versal Adaptive SoC devices, the incorrect configuration of the SSS during runtime (post-boot) cryptographic operations could cause data to be incorrect… |
CVE-2025-31045 | High | 7.5 | 2025-06-09 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in elfsight elfsight Contact Form widget elfsight-contact-form allows… |
CVE-2025-5893 | Critical | 9.8 | 2025-06-09 | Smart Parking Management System from Honding Technology has an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to ac… |
CVE-2025-49419 | Medium | 5.5 | 2025-06-06 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in esigngenie Foxit eSign for WordPress esign-genie-for-wp allows Retr… |
CVE-2025-23969 | Medium | 5.3 | 2025-06-06 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in whassan KI Live Video Conferences ki-live-video-conferences allows… |
CVE-2025-24473 | Low | 3.7 | 2025-05-28 | A exposure of sensitive system information to an unauthorized control sphere vulnerability in Fortinet FortiClientWindows 7.2.0 through 7.2.1, FortiClientWindo… |
CVE-2025-2236 | | 2025-05-27 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in OpenText Advanced Authentication allows Information Elicitation. Th… | |
CVE-2025-30170 | Medium | 5.5 | 2025-05-22 | Exposure of file path, file size or file existence vulnerabilities in ASPECT provide attackers access to file system information if session administrator crede… |
CVE-2025-4364 | | 2025-05-20 | The affected products could allow an unauthenticated attacker to access system information that could enable further access to sensitive files and obtain admin… | |
CVE-2025-39394 | Medium | 5.3 | 2025-05-19 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Solid Plugins AnalyticsWP allows Retrieve Embedded Sensitive Data.T… |
CVE-2025-32299 | Medium | 4.3 | 2025-05-16 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Themovation QuickCal - Appointment Booking Calendar for WordPress q… |
CVE-2025-31062 | Medium | 4.3 | 2025-05-16 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in redqteam Wishlist wishlist allows Retrieve Embedded Sensitive Data… |
CVE-2025-48024 | Medium | 5.0 | 2025-05-15 | In BlueWave Checkmate before 2.1, an authenticated regular user can access sensitive application secrets via the /api/v1/settings endpoint. |
CVE-2025-30011 | Medium | 5.3 | 2025-05-13 | The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an… |
CVE-2025-46747 | Medium | 5.7 | 2025-05-12 | An authenticated user without user-management permissions could identify other user accounts. |
CVE-2025-46718 | Low | 3.3 | 2025-05-12 | sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with limited sudo privileges (e.g. execution of a single… |
CVE-2025-46717 | Low | 3.3 | 2025-05-12 | sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with no (or very limited) sudo privileges can determine w… |
CVE-2025-3506 | Medium | 5.3 | 2025-05-08 | Files to be deployed with agents are accessible without authentication in Checkmk 2.1.0, Checkmk 2.2.0, Checkmk 2.3.0 and <Checkmk 2.4.0b6 allows attacker to a… |
CVE-2025-47540 | Medium | 5.3 | 2025-05-07 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in weDevs weMail wemail allows Retrieve Embedded Sensitive Data.This i… |
CVE-2025-3606 | High | 7.5 | 2025-04-25 | Vestel AC Charger version 3.75.0 contains a vulnerability that could enable an attacker to access files containing sensitive information, such as credenti… |
CVE-2025-46421 | Medium | 6.8 | 2025-04-24 | A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redir… |
CVE-2025-32792 | | 2025-04-18 | SES safely executes third-party JavaScript 'strict' mode programs in compartments that have no excess authority in their global scope. Prior to version 1.12.0… | |
CVE-2025-39439 | Medium | 5.3 | 2025-04-17 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Markus Drubba wpLike2Get wplike2get allows Retrieve Embedded Sensit… |
CVE-2025-39589 | Medium | 4.3 | 2025-04-16 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-ele… |
CVE-2025-39556 | Medium | 5.3 | 2025-04-16 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in mediavine Mediavine Control Panel mediavine-control-panel allows Re… |
CVE-2025-26730 | High | 7.5 | 2025-04-15 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NotFound Macro Calculator with Admin Email Optin & Data. This issue… |
CVE-2025-30686 | High | 7.6 | 2025-04-15 | Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: EMC). Supported versions that are affected are 1… |
CVE-2022-43852 | Medium | 5.3 | 2025-04-14 | IBM Aspera Console 3.4.0 through 3.4.4 could disclose sensitive information in HTTP headers that could be used in further attacks against the system. |
CVE-2025-32228 | Medium | 4.3 | 2025-04-10 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WP Messiah Ai Image Alt Text Generator for WP ai-image-alt-text-gen… |
CVE-2025-31003 | Low | 2.7 | 2025-04-09 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Bogdan Bendziukov Squeeze squeeze allows Retrieve Embedded Sensitiv… |
CVE-2025-27934 | High | 7.5 | 2025-04-09 | Information disclosure of authentication information in the specific service vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a remote… |
CVE-2025-32164 | Medium | 6.5 | 2025-04-08 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in maennchen1.de m1.DownloadList m1downloadlist allows Retrieve Embedd… |
CVE-2025-32026 | Low | 3.8 | 2025-04-08 | Element Web is a Matrix web client built using the Matrix React SDK. Element Web, starting from version 1.11.16 up to version 1.11.96, can be configured to loa… |
CVE-2024-45549 | High | 7.7 | 2025-04-07 | Information disclosure while creating MQ channels. |
CVE-2025-32255 | Medium | 5.3 | 2025-04-04 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ERA404 StaffList stafflist allows Retrieve Embedded Sensitive Data… |
CVE-2025-32251 | Medium | 5.3 | 2025-04-04 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in J. Tyler Wiest Jetpack Feedback Exporter jetpack-feedback-exporter… |
CVE-2025-0278 | Medium | 4.3 | 2025-04-03 | HCL Traveler is affected by an internal path disclosure in a Windows application when the application inadvertently reveals internal file paths, in error messa… |
CVE-2025-31832 | Medium | 5.3 | 2025-04-01 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Beee ACF City Selector acf-city-selector allows Retrieve Embedded S… |
CVE-2025-30802 | Medium | 4.3 | 2025-04-01 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPBean Our Team Members our-team-members.This issue affects Our Tea… |
CVE-2025-27149 | Low | 2.7 | 2025-03-31 | Zulip server provides an open-source team chat that helps teams stay productive and focused. Prior to 10.0, the data export to organization administrators feat… |
CVE-2024-8313 | | 2025-03-25 | An Exposure of Sensitive System Information to an Unauthorized Control Sphere and Initialization of a Resource with an Insecure Default vulnerability in the SN… | |
CVE-2025-2598 | Medium | 5.5 | 2025-03-21 | When the AWS Cloud Development Kit (AWS CDK) Command Line Interface (AWS CDK CLI) is used with a credential plugin which returns an expiration property with th… |
CVE-2024-10940 | Medium | 5.3 | 2025-03-20 | A vulnerability in langchain-core versions >=0.1.17,<0.1.53, >=0.2.0,<0.2.43, and >=0.3.0,<0.3.15 allows unauthorized users to read arbitrary files from the ho… |
CVE-2025-23382 | Medium | 5.5 | 2025-03-19 | Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS, version(s) 5.26, contain(s) an Exposure of Sensitive System Information to an Unauthorized Control Spher… |
CVE-2024-52905 | Low | 2.7 | 2025-03-10 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.3 could disclose sensitive database information to a privileged… |
CVE-2024-11035 | Low | 2.5 | 2025-03-05 | Carbon Black Cloud Windows Sensor, prior to 4.0.3, may be susceptible to an Information Leak vulnerability, which s a type of issue whereby sensitive informati… |
CVE-2025-26911 | Medium | 4.3 | 2025-02-25 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Bowo System Dashboard system-dashboard allows Exploiting Incorrectl… |
CVE-2025-26758 | Medium | 5.3 | 2025-02-17 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in RebelCode Spotlight Social Media Feeds spotlight-social-photo-feeds… |
CVE-2025-1212 | Medium | 4.3 | 2025-02-12 | An information disclosure vulnerability in GitLab CE/EE affecting all versions from 8.3 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows… |
CVE-2025-1144 | Critical | 9.8 | 2025-02-11 | School Affairs System from Quanxun has an Exposure of Sensitive Information, allowing unauthenticated attackers to view specific pages and obtain database info… |
CVE-2024-8550 | High | 7.5 | 2025-02-10 | A Local File Inclusion (LFI) vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4. This vulnerability allows an attacker… |
CVE-2024-36554 | Critical | 9.8 | 2025-02-06 | Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call Me KW-60 R36CW_YDE_S4_A29_2_V1.0_2023.05.24_22.49.4… |
CVE-2025-22222 | High | 7.7 | 2025-01-30 | VMware Aria Operations contains an information disclosure vulnerability. A malicious user with non-administrative privileges may exploit this vulnerability to… |
CVE-2024-37526 | Medium | 6.5 | 2025-01-27 | IBM Watson Query on Cloud Pak for Data (IBM Data Virtualization 1.8, 2.0, 2.1, 2.2, and 3.0.0) could allow an authenticated user to obtain sensitive informatio… |
CVE-2024-40706 | Medium | 5.3 | 2025-01-24 | IBM InfoSphere Information Server 11.7 could allow a remote user to obtain sensitive version information that could aid in further attacks against the system. |
CVE-2024-53683 | Medium | 4.4 | 2025-01-17 | A valid set of credentials in a .js file and a static token for communication were obtained from the decompiled IPA. An attacker could use the information to… |
CVE-2024-11029 | Medium | 5.5 | 2025-01-15 | A flaw was found in the FreeIPA API audit, where it sends the whole FreeIPA command line to journalctl. As a consequence, during the FreeIPA installation proce… |
CVE-2025-0061 | High | 8.7 | 2025-01-14 | SAP BusinessObjects Business Intelligence Platform allows an unauthenticated attacker to perform session hijacking over the network without any user interactio… |
CVE-2025-0059 | Medium | 6.0 | 2025-01-14 | Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP store user input in the local browser storage to improve usability. An attacker… |
CVE-2025-0056 | Medium | 6.0 | 2025-01-14 | SAP GUI for Java saves user input on the client PC to improve usability. An attacker with administrative privileges or access to the victim�s user directory on… |