CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
Description
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-116 · CAPEC-13 · CAPEC-169 · CAPEC-22 · CAPEC-224 · CAPEC-285 · CAPEC-287 · CAPEC-290 · CAPEC-291 · CAPEC-292 · CAPEC-293 · CAPEC-294 · CAPEC-295 · CAPEC-296 · CAPEC-297 · CAPEC-298 · CAPEC-299 · CAPEC-300 · CAPEC-301 · CAPEC-302 · CAPEC-303 · CAPEC-304 · CAPEC-305 · CAPEC-306 · CAPEC-307 · CAPEC-308 · CAPEC-309 · CAPEC-310 · CAPEC-312 · CAPEC-313 · CAPEC-317 · CAPEC-318 · CAPEC-319 · CAPEC-320 · CAPEC-321 · CAPEC-322 · CAPEC-323 · CAPEC-324 · CAPEC-325 · CAPEC-326 · CAPEC-327 · CAPEC-328 · CAPEC-329 · CAPEC-330 · CAPEC-472 · CAPEC-497 · CAPEC-508 · CAPEC-573 · CAPEC-574 · CAPEC-575 · CAPEC-576 · CAPEC-577 · CAPEC-59 · CAPEC-60 · CAPEC-616 · CAPEC-643 · CAPEC-646 · CAPEC-651 · CAPEC-79
CVEs mapped to this weakness (11,323)
page 71 of 567| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-14366 | Hig | 0.49 | 7.5 | 0.02 | Nov 12, 2019 | WP SlackSync plugin through 1.8.5 for WordPress leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack (channels, members, etc.). | ||
| CVE-2019-14365 | Hig | 0.49 | 7.5 | 0.02 | Nov 12, 2019 | The Intercom plugin through 1.2.1 for WordPress leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack (channels, members, etc.). | ||
| CVE-2018-21026 | Hig | 0.49 | 7.5 | 0.01 | Nov 12, 2019 | A vulnerability in Hitachi Command Suite 7.x and 8.x before 8.6.5-00 allows an unauthenticated remote user to read internal information. | ||
| CVE-2010-2450 | Hig | 0.49 | 7.5 | 0.01 | Nov 7, 2019 | The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES private key which is placed in sp-key.pm. It relies on the root umask (default 22) instead of chmoding the resulting file itself, so the generated private key… | ||
| CVE-2009-5045 | Hig | 0.49 | 7.5 | 0.02 | Nov 6, 2019 | Dump Servlet information leak in jetty before 6.1.22. | ||
| CVE-2013-4105 | Hig | 0.49 | 7.5 | 0.01 | Nov 4, 2019 | Cryptocat before 2.0.22 has Multiparty Encryption Scheme Information Disclosure | ||
| CVE-2013-2262 | Hig | 0.49 | 7.5 | 0.02 | Nov 4, 2019 | Cryptocat strophe.js before 2.0.22 has information disclosure | ||
| CVE-2013-2600 | Hig | 0.49 | 7.5 | 0.02 | Nov 1, 2019 | MiniUPnPd has information disclosure use of snprintf() | ||
| CVE-2019-6850 | Hig | 0.49 | 7.5 | 0.02 | Oct 29, 2019 | A CWE-200: Information Exposure vulnerability exists in Modicon M580, Modicon BMENOC 0311, and Modicon BMENOC 0321, which could cause the disclosure of sensitive information when reading specific registers with the REST API of the controller/communication module. | ||
| CVE-2019-6849 | Hig | 0.49 | 7.5 | 0.02 | Oct 29, 2019 | A CWE-200: Information Exposure vulnerability exists in Modicon M580, Modicon BMENOC 0311, and Modicon BMENOC 0321, which could cause the disclosure of sensitive information when using specific Modbus services provided by the REST API of the controller/communication module. | ||
| CVE-2012-0046 | Hig | 0.49 | 7.5 | 0.01 | Oct 29, 2019 | mediawiki allows deleted text to be exposed | ||
| CVE-2019-13410 | Hig | 0.49 | 7.5 | 0.02 | Oct 17, 2019 | TOPMeeting before version 8.8 (2019/08/19) shows attendees account and password in front end page that allows an attacker to obtain sensitive information by browsing the source code of the page. | ||
| CVE-2015-9492 | Hig | 0.49 | 7.5 | 0.03 | Oct 11, 2019 | The ThemeMakers SmartIT Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI. | ||
| CVE-2015-9491 | Hig | 0.49 | 7.5 | 0.03 | Oct 11, 2019 | The ThemeMakers Blessing Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI. | ||
| CVE-2015-9490 | Hig | 0.49 | 7.5 | 0.03 | Oct 11, 2019 | The ThemeMakers GamesTheme Premium theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI. | ||
| CVE-2015-9489 | Hig | 0.49 | 7.5 | 0.03 | Oct 11, 2019 | The ThemeMakers Goodnex Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI. | ||
| CVE-2015-9488 | Hig | 0.49 | 7.5 | 0.03 | Oct 11, 2019 | The ThemeMakers Almera Responsive Portfolio Site Template component through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_us… | ||
| CVE-2015-9487 | Hig | 0.49 | 7.5 | 0.03 | Oct 11, 2019 | The ThemeMakers Almera Responsive Portfolio theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI. | ||
| CVE-2015-9486 | Hig | 0.49 | 7.5 | 0.03 | Oct 11, 2019 | The ThemeMakers Axioma Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI. | ||
| CVE-2015-9485 | Hig | 0.49 | 7.5 | 0.03 | Oct 11, 2019 | The ThemeMakers Accio Responsive Parallax One Page Site Template component through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the… |
- risk 0.49cvss 7.5epss 0.02
WP SlackSync plugin through 1.8.5 for WordPress leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack (channels, members, etc.).
- risk 0.49cvss 7.5epss 0.02
The Intercom plugin through 1.2.1 for WordPress leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack (channels, members, etc.).
- risk 0.49cvss 7.5epss 0.01
A vulnerability in Hitachi Command Suite 7.x and 8.x before 8.6.5-00 allows an unauthenticated remote user to read internal information.
- risk 0.49cvss 7.5epss 0.01
The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES private key which is placed in sp-key.pm. It relies on the root umask (default 22) instead of chmoding the resulting file itself, so the generated private key…
- risk 0.49cvss 7.5epss 0.02
Dump Servlet information leak in jetty before 6.1.22.
- risk 0.49cvss 7.5epss 0.01
Cryptocat before 2.0.22 has Multiparty Encryption Scheme Information Disclosure
- risk 0.49cvss 7.5epss 0.02
Cryptocat strophe.js before 2.0.22 has information disclosure
- risk 0.49cvss 7.5epss 0.02
MiniUPnPd has information disclosure use of snprintf()
- risk 0.49cvss 7.5epss 0.02
A CWE-200: Information Exposure vulnerability exists in Modicon M580, Modicon BMENOC 0311, and Modicon BMENOC 0321, which could cause the disclosure of sensitive information when reading specific registers with the REST API of the controller/communication module.
- risk 0.49cvss 7.5epss 0.02
A CWE-200: Information Exposure vulnerability exists in Modicon M580, Modicon BMENOC 0311, and Modicon BMENOC 0321, which could cause the disclosure of sensitive information when using specific Modbus services provided by the REST API of the controller/communication module.
- risk 0.49cvss 7.5epss 0.01
mediawiki allows deleted text to be exposed
- risk 0.49cvss 7.5epss 0.02
TOPMeeting before version 8.8 (2019/08/19) shows attendees account and password in front end page that allows an attacker to obtain sensitive information by browsing the source code of the page.
- risk 0.49cvss 7.5epss 0.03
The ThemeMakers SmartIT Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
- risk 0.49cvss 7.5epss 0.03
The ThemeMakers Blessing Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
- risk 0.49cvss 7.5epss 0.03
The ThemeMakers GamesTheme Premium theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
- risk 0.49cvss 7.5epss 0.03
The ThemeMakers Goodnex Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
- risk 0.49cvss 7.5epss 0.03
The ThemeMakers Almera Responsive Portfolio Site Template component through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_us…
- risk 0.49cvss 7.5epss 0.03
The ThemeMakers Almera Responsive Portfolio theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
- risk 0.49cvss 7.5epss 0.03
The ThemeMakers Axioma Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
- risk 0.49cvss 7.5epss 0.03
The ThemeMakers Accio Responsive Parallax One Page Site Template component through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the…