CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
Description
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-116 · CAPEC-13 · CAPEC-169 · CAPEC-22 · CAPEC-224 · CAPEC-285 · CAPEC-287 · CAPEC-290 · CAPEC-291 · CAPEC-292 · CAPEC-293 · CAPEC-294 · CAPEC-295 · CAPEC-296 · CAPEC-297 · CAPEC-298 · CAPEC-299 · CAPEC-300 · CAPEC-301 · CAPEC-302 · CAPEC-303 · CAPEC-304 · CAPEC-305 · CAPEC-306 · CAPEC-307 · CAPEC-308 · CAPEC-309 · CAPEC-310 · CAPEC-312 · CAPEC-313 · CAPEC-317 · CAPEC-318 · CAPEC-319 · CAPEC-320 · CAPEC-321 · CAPEC-322 · CAPEC-323 · CAPEC-324 · CAPEC-325 · CAPEC-326 · CAPEC-327 · CAPEC-328 · CAPEC-329 · CAPEC-330 · CAPEC-472 · CAPEC-497 · CAPEC-508 · CAPEC-573 · CAPEC-574 · CAPEC-575 · CAPEC-576 · CAPEC-577 · CAPEC-59 · CAPEC-60 · CAPEC-616 · CAPEC-643 · CAPEC-646 · CAPEC-651 · CAPEC-79
CVEs mapped to this weakness (11,323)
page 51 of 567| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-47799 | Hig | 0.49 | 7.5 | 0.00 | Aug 25, 2025 | Mahara before 22.10.4 and 23.x before 23.04.4 allows information disclosure if the experimental HTML bulk export is used via the administration interface or via the CLI, and the resulting export files are given to the account holders. They may contain images of other account… | ||
| CVE-2025-43988 | Hig | 0.49 | 7.5 | 0.00 | Aug 13, 2025 | KuWFi 5G01-X55 FL2020_V0.0.12 devices expose an unauthenticated API endpoint (ajax_get.cgi), allowing remote attackers to retrieve sensitive configuration data, including admin credentials. | ||
| CVE-2025-33051 | Hig | 0.49 | 7.5 | 0.01 | Aug 12, 2025 | Exposure of sensitive information to an unauthorized actor in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network. | ||
| CVE-2025-46659 | Hig | 0.49 | 7.5 | 0.00 | Aug 6, 2025 | An issue was discovered in ExonautWeb in 4C Strategies Exonaut 21.6. Information disclosure can occur via an external HTTPS request. | ||
| CVE-2025-51040 | Hig | 0.49 | 7.5 | 0.00 | Aug 6, 2025 | Electrolink FM/DAB/TV Transmitter Web Management System Unauthorized access vulnerability via the /FrameSetCore.html endpoint in Electrolink 500W, 1kW, 2kW Medium DAB Transmitter Web v01.09, v01.08, v01.07, and Display v1.4, v1.2. | ||
| CVE-2025-29745 | Hig | 0.49 | 7.5 | 0.00 | Aug 5, 2025 | A vulnerability affecting the scanning module in Emsisoft Anti-Malware prior to 2024.12 allows attackers on a remote server to obtain Net-NTLMv2 hash information via a specially created A2S (Emsisoft Custom Scan) extension file. | ||
| CVE-2025-31955 | Hig | 0.49 | 7.6 | 0.00 | Jul 24, 2025 | HCL iAutomate is affected by a sensitive data exposure vulnerability. This issue may allow unauthorized access to sensitive information within the system. | ||
| CVE-2025-50708 | Hig | 0.49 | 7.5 | 0.00 | Jul 18, 2025 | An issue in Perplexity AI GPT-4 v.2.51.0 allows a remote attacker to obtain sensitive information via the token component in the shared chat URL | ||
| CVE-2024-51769 | Hig | 0.49 | 7.5 | 0.00 | Jul 14, 2025 | An information disclosure vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. | ||
| CVE-2025-34098 | Hig | 0.49 | — | 0.01 | Jul 10, 2025 | A path traversal vulnerability exists in Riverbed SteelHead VCX appliances (confirmed in VCX255U 9.6.0a) due to improper input validation in the log filtering functionality exposed via the management web interface. An authenticated attacker can exploit this flaw by submitting… | ||
| CVE-2025-49845 | Hig | 0.49 | 7.5 | 0.00 | Jun 25, 2025 | Discourse is an open-source discussion platform. The visibility of posts typed `whisper` is controlled via the `whispers_allowed_groups` site setting. Only users that belong to groups specified in the site setting are allowed to view posts typed `whisper`. However, it has been… | ||
| CVE-2025-23173 | Hig | 0.49 | 7.5 | 0.01 | Jun 19, 2025 | The Versa Director SD-WAN orchestration platform provides direct web-based access to uCPE virtual machines through the Director GUI. By default, the websockify service is exposed on port 6080 and accessible from the internet. This exposure introduces significant risk, as… | ||
| CVE-2025-49184 | Hig | 0.49 | 7.5 | 0.00 | Jun 12, 2025 | A remote unauthorized attacker may gather sensitive information of the application, due to missing authorization of configuration settings of the product. | ||
| CVE-2025-40662 | Hig | 0.49 | 7.5 | 0.00 | Jun 10, 2025 | Absolute path disclosure vulnerability in DM Corporative CMS. This vulnerability allows an attacker to view the contents of webroot/file, if navigating to a non-existent file. | ||
| CVE-2025-5334 | Hig | 0.49 | 7.5 | 0.01 | May 29, 2025 | Exposure of private personal information to an unauthorized actor in the user vaults component of Devolutions Remote Desktop Manager allows an authenticated user to gain unauthorized access to private personal information. Under specific circumstances, entries may be… | ||
| CVE-2024-53359 | Hig | 0.49 | 7.5 | 0.00 | May 20, 2025 | An issue in Zalo v23.09.01 allows attackers to obtain sensitive user information via a crafted GET request. | ||
| CVE-2025-41230 | Hig | 0.49 | 7.5 | 0.00 | May 20, 2025 | VMware Cloud Foundation contains an information disclosure vulnerability. A malicious actor with network access to port 443 on VMware Cloud Foundation may exploit this issue to gain access to sensitive information. | ||
| CVE-2025-32986 | Hig | 0.49 | 7.5 | 0.00 | Apr 25, 2025 | NETSCOUT nGeniusONE before 6.4.0 b2350 has a Sensitive File Accessible Without Proper Authentication to an endpoint. | ||
| CVE-2025-32983 | Hig | 0.49 | 7.5 | 0.00 | Apr 25, 2025 | NETSCOUT nGeniusONE before 6.4.0 b2350 allows Technical Information Disclosure via a Stack Trace. | ||
| CVE-2025-23174 | — | Hig | 0.49 | 7.5 | 0.00 | Apr 21, 2025 | CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
- risk 0.49cvss 7.5epss 0.00
Mahara before 22.10.4 and 23.x before 23.04.4 allows information disclosure if the experimental HTML bulk export is used via the administration interface or via the CLI, and the resulting export files are given to the account holders. They may contain images of other account…
- risk 0.49cvss 7.5epss 0.00
KuWFi 5G01-X55 FL2020_V0.0.12 devices expose an unauthenticated API endpoint (ajax_get.cgi), allowing remote attackers to retrieve sensitive configuration data, including admin credentials.
- risk 0.49cvss 7.5epss 0.01
Exposure of sensitive information to an unauthorized actor in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.
- risk 0.49cvss 7.5epss 0.00
An issue was discovered in ExonautWeb in 4C Strategies Exonaut 21.6. Information disclosure can occur via an external HTTPS request.
- risk 0.49cvss 7.5epss 0.00
Electrolink FM/DAB/TV Transmitter Web Management System Unauthorized access vulnerability via the /FrameSetCore.html endpoint in Electrolink 500W, 1kW, 2kW Medium DAB Transmitter Web v01.09, v01.08, v01.07, and Display v1.4, v1.2.
- risk 0.49cvss 7.5epss 0.00
A vulnerability affecting the scanning module in Emsisoft Anti-Malware prior to 2024.12 allows attackers on a remote server to obtain Net-NTLMv2 hash information via a specially created A2S (Emsisoft Custom Scan) extension file.
- risk 0.49cvss 7.6epss 0.00
HCL iAutomate is affected by a sensitive data exposure vulnerability. This issue may allow unauthorized access to sensitive information within the system.
- risk 0.49cvss 7.5epss 0.00
An issue in Perplexity AI GPT-4 v.2.51.0 allows a remote attacker to obtain sensitive information via the token component in the shared chat URL
- risk 0.49cvss 7.5epss 0.00
An information disclosure vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17.
- risk 0.49cvss —epss 0.01
A path traversal vulnerability exists in Riverbed SteelHead VCX appliances (confirmed in VCX255U 9.6.0a) due to improper input validation in the log filtering functionality exposed via the management web interface. An authenticated attacker can exploit this flaw by submitting…
- risk 0.49cvss 7.5epss 0.00
Discourse is an open-source discussion platform. The visibility of posts typed `whisper` is controlled via the `whispers_allowed_groups` site setting. Only users that belong to groups specified in the site setting are allowed to view posts typed `whisper`. However, it has been…
- risk 0.49cvss 7.5epss 0.01
The Versa Director SD-WAN orchestration platform provides direct web-based access to uCPE virtual machines through the Director GUI. By default, the websockify service is exposed on port 6080 and accessible from the internet. This exposure introduces significant risk, as…
- risk 0.49cvss 7.5epss 0.00
A remote unauthorized attacker may gather sensitive information of the application, due to missing authorization of configuration settings of the product.
- risk 0.49cvss 7.5epss 0.00
Absolute path disclosure vulnerability in DM Corporative CMS. This vulnerability allows an attacker to view the contents of webroot/file, if navigating to a non-existent file.
- risk 0.49cvss 7.5epss 0.01
Exposure of private personal information to an unauthorized actor in the user vaults component of Devolutions Remote Desktop Manager allows an authenticated user to gain unauthorized access to private personal information. Under specific circumstances, entries may be…
- risk 0.49cvss 7.5epss 0.00
An issue in Zalo v23.09.01 allows attackers to obtain sensitive user information via a crafted GET request.
- risk 0.49cvss 7.5epss 0.00
VMware Cloud Foundation contains an information disclosure vulnerability. A malicious actor with network access to port 443 on VMware Cloud Foundation may exploit this issue to gain access to sensitive information.
- risk 0.49cvss 7.5epss 0.00
NETSCOUT nGeniusONE before 6.4.0 b2350 has a Sensitive File Accessible Without Proper Authentication to an endpoint.
- risk 0.49cvss 7.5epss 0.00
NETSCOUT nGeniusONE before 6.4.0 b2350 allows Technical Information Disclosure via a Stack Trace.
- risk 0.49cvss 7.5epss 0.00
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor