CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
Description
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-116 · CAPEC-13 · CAPEC-169 · CAPEC-22 · CAPEC-224 · CAPEC-285 · CAPEC-287 · CAPEC-290 · CAPEC-291 · CAPEC-292 · CAPEC-293 · CAPEC-294 · CAPEC-295 · CAPEC-296 · CAPEC-297 · CAPEC-298 · CAPEC-299 · CAPEC-300 · CAPEC-301 · CAPEC-302 · CAPEC-303 · CAPEC-304 · CAPEC-305 · CAPEC-306 · CAPEC-307 · CAPEC-308 · CAPEC-309 · CAPEC-310 · CAPEC-312 · CAPEC-313 · CAPEC-317 · CAPEC-318 · CAPEC-319 · CAPEC-320 · CAPEC-321 · CAPEC-322 · CAPEC-323 · CAPEC-324 · CAPEC-325 · CAPEC-326 · CAPEC-327 · CAPEC-328 · CAPEC-329 · CAPEC-330 · CAPEC-472 · CAPEC-497 · CAPEC-508 · CAPEC-573 · CAPEC-574 · CAPEC-575 · CAPEC-576 · CAPEC-577 · CAPEC-59 · CAPEC-60 · CAPEC-616 · CAPEC-643 · CAPEC-646 · CAPEC-651 · CAPEC-79
CVEs mapped to this weakness (11,660)
page 211 of 583| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-24923 | Med | 0.36 | 5.5 | 0.01 | Mar 14, 2023 | Microsoft OneDrive for Android Information Disclosure Vulnerability | ||
| CVE-2023-24882 | Med | 0.36 | 5.5 | 0.01 | Mar 14, 2023 | Microsoft OneDrive for Android Information Disclosure Vulnerability | ||
| CVE-2023-1055 | Med | 0.36 | 5.5 | 0.00 | Feb 27, 2023 | A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which could lead into sensitive information leaked. An attacker with a local account where the cockpit-389-ds is running can… | ||
| CVE-2023-23511 | Med | 0.36 | 5.5 | 0.00 | Feb 27, 2023 | The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3, tvOS 16.3, watchOS 9.3. An app may be able to bypass Privacy preferences. | ||
| CVE-2023-23500 | Med | 0.36 | 5.5 | 0.00 | Feb 27, 2023 | The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3, iOS 15.7.3 and iPadOS 15.7.3, tvOS 16.3, watchOS 9.3. An app may be able to leak sensitive kernel state. | ||
| CVE-2023-23499 | Med | 0.36 | 5.5 | 0.00 | Feb 27, 2023 | This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, watchOS 9.3, macOS Big Sur 11.7.3, tvOS 16.3, iOS 16.3 and iPadOS 16.3. An app may be able to access user-sensitive data. | ||
| CVE-2022-32896 | Med | 0.36 | 5.5 | 0.00 | Feb 27, 2023 | This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.6, macOS Big Sur 11.7. A user may be able to view sensitive user information. | ||
| CVE-2022-32855 | Med | 0.36 | 5.5 | 0.00 | Feb 27, 2023 | A logic issue was addressed with improved state management. This issue is fixed in iOS 15.6 and iPadOS 15.6. A user may be able to view restricted content from the lock screen. | ||
| CVE-2022-32824 | Med | 0.36 | 5.5 | 0.00 | Feb 27, 2023 | The issue was addressed with improved memory handling. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6. An app may be able to disclose kernel memory. | ||
| CVE-2022-22668 | Med | 0.36 | 5.5 | 0.00 | Feb 27, 2023 | A logic issue was addressed with improved restrictions. This issue is fixed in iOS 15.4 and iPadOS 15.4, macOS Monterey 12.3. A malicious application may be able to leak sensitive user information. | ||
| CVE-2023-0597 | Med | 0.36 | 5.5 | 0.00 | Feb 23, 2023 | A flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping of X86 CPU data to memory was found in the way user can guess location of exception stack(s) or other important data. A local user could use this flaw to get access to some important data with expected… | ||
| CVE-2022-47367 | Med | 0.36 | 5.5 | 0.00 | Feb 12, 2023 | In bluetooth driver, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. | ||
| CVE-2022-47329 | Med | 0.36 | 5.5 | 0.00 | Feb 12, 2023 | In wlan driver, there is a possible missing permission check. This could lead to local information disclosure. | ||
| CVE-2022-47328 | Med | 0.36 | 5.5 | 0.00 | Feb 12, 2023 | In wlan driver, there is a possible missing permission check. This could lead to local information disclosure. | ||
| CVE-2022-47326 | Med | 0.36 | 5.5 | 0.00 | Feb 12, 2023 | In wlan driver, there is a possible missing permission check. This could lead to local information disclosure. | ||
| CVE-2022-47325 | Med | 0.36 | 5.5 | 0.00 | Feb 12, 2023 | In wlan driver, there is a possible missing permission check. This could lead to local information disclosure. | ||
| CVE-2022-47324 | Med | 0.36 | 5.5 | 0.00 | Feb 12, 2023 | In wlan driver, there is a possible missing permission check. This could lead to local information disclosure. | ||
| CVE-2022-38686 | Med | 0.36 | 5.5 | 0.00 | Feb 12, 2023 | In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services. | ||
| CVE-2022-4054 | Med | 0.36 | 5.5 | 0.01 | Jan 26, 2023 | An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible for a project maintainer to leak a webhook secret token by changing the… | ||
| CVE-2022-4457 | Med | 0.36 | 5.5 | 0.00 | Jan 11, 2023 | Due to a misconfiguration in the manifest file of the WARP client for Android, it was possible to a perform a task hijacking attack. An attacker could create a malicious mobile application which could hijack legitimate app and steal potentially sensitive information when… |
- risk 0.36cvss 5.5epss 0.01
Microsoft OneDrive for Android Information Disclosure Vulnerability
- risk 0.36cvss 5.5epss 0.01
Microsoft OneDrive for Android Information Disclosure Vulnerability
- risk 0.36cvss 5.5epss 0.00
A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which could lead into sensitive information leaked. An attacker with a local account where the cockpit-389-ds is running can…
- risk 0.36cvss 5.5epss 0.00
The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3, tvOS 16.3, watchOS 9.3. An app may be able to bypass Privacy preferences.
- risk 0.36cvss 5.5epss 0.00
The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3, iOS 15.7.3 and iPadOS 15.7.3, tvOS 16.3, watchOS 9.3. An app may be able to leak sensitive kernel state.
- risk 0.36cvss 5.5epss 0.00
This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, watchOS 9.3, macOS Big Sur 11.7.3, tvOS 16.3, iOS 16.3 and iPadOS 16.3. An app may be able to access user-sensitive data.
- risk 0.36cvss 5.5epss 0.00
This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.6, macOS Big Sur 11.7. A user may be able to view sensitive user information.
- risk 0.36cvss 5.5epss 0.00
A logic issue was addressed with improved state management. This issue is fixed in iOS 15.6 and iPadOS 15.6. A user may be able to view restricted content from the lock screen.
- risk 0.36cvss 5.5epss 0.00
The issue was addressed with improved memory handling. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6. An app may be able to disclose kernel memory.
- risk 0.36cvss 5.5epss 0.00
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 15.4 and iPadOS 15.4, macOS Monterey 12.3. A malicious application may be able to leak sensitive user information.
- risk 0.36cvss 5.5epss 0.00
A flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping of X86 CPU data to memory was found in the way user can guess location of exception stack(s) or other important data. A local user could use this flaw to get access to some important data with expected…
- risk 0.36cvss 5.5epss 0.00
In bluetooth driver, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
- risk 0.36cvss 5.5epss 0.00
In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
- risk 0.36cvss 5.5epss 0.00
In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
- risk 0.36cvss 5.5epss 0.00
In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
- risk 0.36cvss 5.5epss 0.00
In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
- risk 0.36cvss 5.5epss 0.00
In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
- risk 0.36cvss 5.5epss 0.00
In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
- risk 0.36cvss 5.5epss 0.01
An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible for a project maintainer to leak a webhook secret token by changing the…
- risk 0.36cvss 5.5epss 0.00
Due to a misconfiguration in the manifest file of the WARP client for Android, it was possible to a perform a task hijacking attack. An attacker could create a malicious mobile application which could hijack legitimate app and steal potentially sensitive information when…