CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
Description
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-116 · CAPEC-13 · CAPEC-169 · CAPEC-22 · CAPEC-224 · CAPEC-285 · CAPEC-287 · CAPEC-290 · CAPEC-291 · CAPEC-292 · CAPEC-293 · CAPEC-294 · CAPEC-295 · CAPEC-296 · CAPEC-297 · CAPEC-298 · CAPEC-299 · CAPEC-300 · CAPEC-301 · CAPEC-302 · CAPEC-303 · CAPEC-304 · CAPEC-305 · CAPEC-306 · CAPEC-307 · CAPEC-308 · CAPEC-309 · CAPEC-310 · CAPEC-312 · CAPEC-313 · CAPEC-317 · CAPEC-318 · CAPEC-319 · CAPEC-320 · CAPEC-321 · CAPEC-322 · CAPEC-323 · CAPEC-324 · CAPEC-325 · CAPEC-326 · CAPEC-327 · CAPEC-328 · CAPEC-329 · CAPEC-330 · CAPEC-472 · CAPEC-497 · CAPEC-508 · CAPEC-573 · CAPEC-574 · CAPEC-575 · CAPEC-576 · CAPEC-577 · CAPEC-59 · CAPEC-60 · CAPEC-616 · CAPEC-643 · CAPEC-646 · CAPEC-651 · CAPEC-79
CVEs mapped to this weakness (11,323)
page 59 of 567| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-39053 | Hig | 0.49 | 7.5 | 0.01 | Nov 2, 2023 | An information leak in Hattoriya v13.6.1 allows attackers to obtain the channel access token and send crafted messages. | ||
| CVE-2023-39051 | Hig | 0.49 | 7.5 | 0.01 | Nov 2, 2023 | An information leak in VISION MEAT WORKS Track Diner 10/10mbl v13.6.1 allows attackers to obtain the channel access token and send crafted messages. | ||
| CVE-2023-39050 | Hig | 0.49 | 7.5 | 0.01 | Nov 2, 2023 | An information leak in Daiky-value.Fukueten v13.6.1 allows attackers to obtain the channel access token and send crafted messages. | ||
| CVE-2023-39048 | Hig | 0.49 | 7.5 | 0.01 | Nov 2, 2023 | An information leak in Tokudaya.honten v13.6.1 allows attackers to obtain the channel access token and send crafted messages. | ||
| CVE-2023-39047 | Hig | 0.49 | 7.5 | 0.01 | Nov 2, 2023 | An information leak in shouzu sweets oz v13.6.1 allows attackers to obtain the channel access token and send crafted messages. | ||
| CVE-2023-39042 | Hig | 0.49 | 7.5 | 0.01 | Nov 2, 2023 | An information leak in Gyouza-newhushimi v13.6.1 allows attackers to obtain the channel access token and send crafted messages. | ||
| CVE-2022-3611 | Hig | 0.49 | 7.6 | 0.00 | Oct 27, 2023 | An information disclosure vulnerability has been identified in the Lenovo App Store which may allow some applications to gain unauthorized access to sensitive user data used by other unrelated applications. | ||
| CVE-2023-33558 | Hig | 0.49 | 7.5 | 0.01 | Oct 26, 2023 | An information disclosure vulnerability in the component users-grid-data.php of Ocomon before v4.0.1 allows attackers to obtain sensitive information such as e-mails and usernames. | ||
| CVE-2023-38849 | Hig | 0.49 | 7.5 | 0.01 | Oct 25, 2023 | An issue in tire-sales Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. | ||
| CVE-2023-38847 | Hig | 0.49 | 7.5 | 0.01 | Oct 25, 2023 | An issue in CHRISTINA JAPAN Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. | ||
| CVE-2023-38846 | Hig | 0.49 | 7.5 | 0.01 | Oct 25, 2023 | An issue in Marbre Lapin Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. | ||
| CVE-2023-38845 | Hig | 0.49 | 7.5 | 0.01 | Oct 25, 2023 | An issue in Anglaise Company Anglaise.Company v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. | ||
| CVE-2023-42490 | Hig | 0.49 | 7.5 | 0.01 | Oct 25, 2023 | EisBaer Scada - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor | ||
| CVE-2023-34437 | Hig | 0.49 | 7.5 | 0.00 | Oct 19, 2023 | Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a vulnerability in their password retrieval functionality which could allow an attacker to access passwords stored on the device. | ||
| CVE-2023-45912 | Hig | 0.49 | 7.5 | 0.01 | Oct 18, 2023 | WIPOTEC GmbH ComScale v4.3.29.21344 and v4.4.12.723 fails to validate user sessions, allowing unauthenticated attackers to read files from the underlying operating system and obtain directory listings. | ||
| CVE-2023-22086 | Hig | 0.49 | 7.5 | 0.01 | Oct 17, 2023 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to… | ||
| CVE-2023-22019 | Hig | 0.49 | 7.5 | 0.01 | Oct 17, 2023 | Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP… | ||
| CVE-2023-44097 | Hig | 0.49 | 7.5 | 0.00 | Oct 11, 2023 | Vulnerability of the permission to access device SNs being improperly managed.Successful exploitation of this vulnerability may affect service confidentiality. | ||
| CVE-2023-44093 | Hig | 0.49 | 7.5 | 0.00 | Oct 11, 2023 | Vulnerability of package names' public keys not being verified in the security module.Successful exploitation of this vulnerability may affect service confidentiality. | ||
| CVE-2023-29348 | Hig | 0.49 | 7.5 | 0.02 | Oct 10, 2023 | Windows Remote Desktop Gateway (RD Gateway) Information Disclosure Vulnerability |
- risk 0.49cvss 7.5epss 0.01
An information leak in Hattoriya v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- risk 0.49cvss 7.5epss 0.01
An information leak in VISION MEAT WORKS Track Diner 10/10mbl v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- risk 0.49cvss 7.5epss 0.01
An information leak in Daiky-value.Fukueten v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- risk 0.49cvss 7.5epss 0.01
An information leak in Tokudaya.honten v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- risk 0.49cvss 7.5epss 0.01
An information leak in shouzu sweets oz v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- risk 0.49cvss 7.5epss 0.01
An information leak in Gyouza-newhushimi v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- risk 0.49cvss 7.6epss 0.00
An information disclosure vulnerability has been identified in the Lenovo App Store which may allow some applications to gain unauthorized access to sensitive user data used by other unrelated applications.
- risk 0.49cvss 7.5epss 0.01
An information disclosure vulnerability in the component users-grid-data.php of Ocomon before v4.0.1 allows attackers to obtain sensitive information such as e-mails and usernames.
- risk 0.49cvss 7.5epss 0.01
An issue in tire-sales Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request.
- risk 0.49cvss 7.5epss 0.01
An issue in CHRISTINA JAPAN Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request.
- risk 0.49cvss 7.5epss 0.01
An issue in Marbre Lapin Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request.
- risk 0.49cvss 7.5epss 0.01
An issue in Anglaise Company Anglaise.Company v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request.
- risk 0.49cvss 7.5epss 0.01
EisBaer Scada - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- risk 0.49cvss 7.5epss 0.00
Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a vulnerability in their password retrieval functionality which could allow an attacker to access passwords stored on the device.
- risk 0.49cvss 7.5epss 0.01
WIPOTEC GmbH ComScale v4.3.29.21344 and v4.4.12.723 fails to validate user sessions, allowing unauthenticated attackers to read files from the underlying operating system and obtain directory listings.
- risk 0.49cvss 7.5epss 0.01
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to…
- risk 0.49cvss 7.5epss 0.01
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP…
- risk 0.49cvss 7.5epss 0.00
Vulnerability of the permission to access device SNs being improperly managed.Successful exploitation of this vulnerability may affect service confidentiality.
- risk 0.49cvss 7.5epss 0.00
Vulnerability of package names' public keys not being verified in the security module.Successful exploitation of this vulnerability may affect service confidentiality.
- risk 0.49cvss 7.5epss 0.02
Windows Remote Desktop Gateway (RD Gateway) Information Disclosure Vulnerability