CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
Description
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-116 · CAPEC-13 · CAPEC-169 · CAPEC-22 · CAPEC-224 · CAPEC-285 · CAPEC-287 · CAPEC-290 · CAPEC-291 · CAPEC-292 · CAPEC-293 · CAPEC-294 · CAPEC-295 · CAPEC-296 · CAPEC-297 · CAPEC-298 · CAPEC-299 · CAPEC-300 · CAPEC-301 · CAPEC-302 · CAPEC-303 · CAPEC-304 · CAPEC-305 · CAPEC-306 · CAPEC-307 · CAPEC-308 · CAPEC-309 · CAPEC-310 · CAPEC-312 · CAPEC-313 · CAPEC-317 · CAPEC-318 · CAPEC-319 · CAPEC-320 · CAPEC-321 · CAPEC-322 · CAPEC-323 · CAPEC-324 · CAPEC-325 · CAPEC-326 · CAPEC-327 · CAPEC-328 · CAPEC-329 · CAPEC-330 · CAPEC-472 · CAPEC-497 · CAPEC-508 · CAPEC-573 · CAPEC-574 · CAPEC-575 · CAPEC-576 · CAPEC-577 · CAPEC-59 · CAPEC-60 · CAPEC-616 · CAPEC-643 · CAPEC-646 · CAPEC-651 · CAPEC-79
CVEs mapped to this weakness (11,670)
page 355 of 584| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-8483 | Med | 0.28 | 4.3 | 0.00 | Sep 25, 2024 | The MAS Static Content plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.8 via the static_content() function. This makes it possible for authenticated attackers, with contributor-level access and above, to extract potentially… | ||
| CVE-2024-47060 | Med | 0.28 | 4.3 | 0.00 | Sep 20, 2024 | Zitadel is an open source identity management platform. In Zitadel, even after an organization is deactivated, associated projects, respectively their applications remain active. Users across other organizations can still log in and access through these applications, leading to… | ||
| CVE-2024-47059 | Med | 0.28 | 4.3 | 0.00 | Sep 18, 2024 | When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak. However when an incorrect username is provided alongside with a weak password, the application responds with ’Invalid credentials’… | ||
| CVE-2024-31490 | Med | 0.28 | 4.3 | 0.00 | Sep 10, 2024 | An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0 all versions, FortiSandbox 3.2.2 through 3.2.4, FortiSandbox 3.1.5 allows attacker to information… | ||
| CVE-2024-8538 | Med | 0.28 | 4.3 | 0.01 | Sep 7, 2024 | The Big File Uploads – Increase Maximum File Upload Size plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.1.2. This is due the plugin not sanitizing a file path in an error message. This makes it possible for authenticated… | ||
| CVE-2024-43319 | Med | 0.28 | 4.3 | 0.00 | Aug 26, 2024 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in bPlugins LLC Flash & HTML5 Video.This issue affects Flash & HTML5 Video: from n/a through 2.5.31. | ||
| CVE-2024-42339 | Med | 0.28 | 4.3 | 0.00 | Aug 25, 2024 | CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor | ||
| CVE-2024-42338 | Med | 0.28 | 4.3 | 0.00 | Aug 25, 2024 | CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor | ||
| CVE-2024-42337 | Med | 0.28 | 4.3 | 0.00 | Aug 25, 2024 | CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor | ||
| CVE-2024-5880 | Med | 0.28 | 4.3 | 0.00 | Aug 21, 2024 | The Hide My Site plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 due to the plugin not restricting access to the REST API when password protection is enabled. This makes it possible for unauthenticated attackers to… | ||
| CVE-2024-41698 | Med | 0.28 | 4.3 | 0.00 | Aug 20, 2024 | Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor | ||
| CVE-2024-7925 | Med | 0.28 | 4.3 | 0.01 | Aug 19, 2024 | A vulnerability was found in ZZCMS 2023. It has been rated as problematic. This issue affects some unknown processing of the file 3/E_bak5.1/upload/eginfo.php. The manipulation of the argument phome with the input ShowPHPInfo leads to information disclosure. The attack may be… | ||
| CVE-2024-42486 | Med | 0.28 | 5.4 | 0.01 | Aug 16, 2024 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In versions on the 1.15.x branch prior to 1.15.8 and the 1.16.x branch prior to 1.16.1, ReferenceGrant changes are not correctly propagated in Cilium's GatewayAPI controller, which could… | ||
| CVE-2024-7063 | Med | 0.28 | 4.3 | 0.00 | Aug 15, 2024 | The ElementsKit Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.6 via the 'render_raw' function. This can allow authenticated attackers, with Contributor-level permissions and above, to extract sensitive data… | ||
| CVE-2024-41723 | Med | 0.28 | 4.3 | 0.00 | Aug 14, 2024 | Undisclosed requests to BIG-IP iControl REST can lead to information leak of user account names. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | ||
| CVE-2024-41736 | Med | 0.28 | 4.3 | 0.00 | Aug 13, 2024 | Under certain conditions SAP Permit to Work allows an authenticated attacker to access information which would otherwise be restricted causing low impact on the confidentiality of the application. | ||
| CVE-2024-42222 | Med | 0.28 | 4.3 | 0.01 | Aug 7, 2024 | In Apache CloudStack 4.19.1.0, a regression in the network listing API allows unauthorised list access of network details for domain admin and normal user accounts. This vulnerability compromises tenant isolation, potentially leading to unauthorised access to network details,… | ||
| CVE-2024-6398 | Med | 0.28 | 4.3 | 0.00 | Jul 15, 2024 | An information disclosure vulnerability in SWG in versions 12.x prior to 12.2.10 and 11.x prior to 11.2.24 allows information stored in a customizable block page to be disclosed to third-party websites due to Same Origin Policy Bypass of browsers in certain scenarios. The risk… | ||
| CVE-2023-52238 | Med | 0.28 | 4.3 | 0.00 | Jul 9, 2024 | A vulnerability has been identified in RUGGEDCOM RST2228 (All versions < V5.9.0), RUGGEDCOM RST2228P (All versions < V5.9.0). The web server of the affected systems leaks the MACSEC key in clear text to a logged in user. An attacker with the credentials of a low privileged user… | ||
| CVE-2024-35682 | Med | 0.28 | 4.3 | 0.00 | Jun 8, 2024 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Themeisle Otter Blocks PRO.This issue affects Otter Blocks PRO: from n/a through 2.6.11. |
- risk 0.28cvss 4.3epss 0.00
The MAS Static Content plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.8 via the static_content() function. This makes it possible for authenticated attackers, with contributor-level access and above, to extract potentially…
- risk 0.28cvss 4.3epss 0.00
Zitadel is an open source identity management platform. In Zitadel, even after an organization is deactivated, associated projects, respectively their applications remain active. Users across other organizations can still log in and access through these applications, leading to…
- risk 0.28cvss 4.3epss 0.00
When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak. However when an incorrect username is provided alongside with a weak password, the application responds with ’Invalid credentials’…
- risk 0.28cvss 4.3epss 0.00
An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0 all versions, FortiSandbox 3.2.2 through 3.2.4, FortiSandbox 3.1.5 allows attacker to information…
- risk 0.28cvss 4.3epss 0.01
The Big File Uploads – Increase Maximum File Upload Size plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.1.2. This is due the plugin not sanitizing a file path in an error message. This makes it possible for authenticated…
- risk 0.28cvss 4.3epss 0.00
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in bPlugins LLC Flash & HTML5 Video.This issue affects Flash & HTML5 Video: from n/a through 2.5.31.
- risk 0.28cvss 4.3epss 0.00
CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- risk 0.28cvss 4.3epss 0.00
CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- risk 0.28cvss 4.3epss 0.00
CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- risk 0.28cvss 4.3epss 0.00
The Hide My Site plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 due to the plugin not restricting access to the REST API when password protection is enabled. This makes it possible for unauthenticated attackers to…
- risk 0.28cvss 4.3epss 0.00
Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- risk 0.28cvss 4.3epss 0.01
A vulnerability was found in ZZCMS 2023. It has been rated as problematic. This issue affects some unknown processing of the file 3/E_bak5.1/upload/eginfo.php. The manipulation of the argument phome with the input ShowPHPInfo leads to information disclosure. The attack may be…
- risk 0.28cvss 5.4epss 0.01
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In versions on the 1.15.x branch prior to 1.15.8 and the 1.16.x branch prior to 1.16.1, ReferenceGrant changes are not correctly propagated in Cilium's GatewayAPI controller, which could…
- risk 0.28cvss 4.3epss 0.00
The ElementsKit Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.6 via the 'render_raw' function. This can allow authenticated attackers, with Contributor-level permissions and above, to extract sensitive data…
- risk 0.28cvss 4.3epss 0.00
Undisclosed requests to BIG-IP iControl REST can lead to information leak of user account names. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- risk 0.28cvss 4.3epss 0.00
Under certain conditions SAP Permit to Work allows an authenticated attacker to access information which would otherwise be restricted causing low impact on the confidentiality of the application.
- risk 0.28cvss 4.3epss 0.01
In Apache CloudStack 4.19.1.0, a regression in the network listing API allows unauthorised list access of network details for domain admin and normal user accounts. This vulnerability compromises tenant isolation, potentially leading to unauthorised access to network details,…
- risk 0.28cvss 4.3epss 0.00
An information disclosure vulnerability in SWG in versions 12.x prior to 12.2.10 and 11.x prior to 11.2.24 allows information stored in a customizable block page to be disclosed to third-party websites due to Same Origin Policy Bypass of browsers in certain scenarios. The risk…
- risk 0.28cvss 4.3epss 0.00
A vulnerability has been identified in RUGGEDCOM RST2228 (All versions < V5.9.0), RUGGEDCOM RST2228P (All versions < V5.9.0). The web server of the affected systems leaks the MACSEC key in clear text to a logged in user. An attacker with the credentials of a low privileged user…
- risk 0.28cvss 4.3epss 0.00
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Themeisle Otter Blocks PRO.This issue affects Otter Blocks PRO: from n/a through 2.6.11.