CWE-209— Generation of Error Message Containing Sensitive Information

The product generates an error message that includes sensitive information about its environment, users, or associated data.— MITRE CWE catalog

643 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-209page 11 of 13

CVE-2023-41365MEDIUMCVSS 4.3EG 4.3
2023-10-10
SAP Business One (B1i) - version 10.0, allows an authorized attacker to retrieve the details stack trace of the fault message to conduct the XXE injection, which will lead to information disclosure. After successful exploitation, an attack…
CVE-2023-39264MEDIUMCVSS 4.3EG 4.3
2023-09-06
By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.
CVE-2023-33835MEDIUMCVSS 4.3EG 4.3
2023-08-31
IBM Security Verify Information Queue 10.0.4 and 10.0.5 could allow a remote attacker to obtain sensitive information that could aid in further attacks against the system. IBM X-Force ID: 256015.
CVE-2023-33834MEDIUMCVSS 4.3EG 4.3
2023-08-31
IBM Security Verify Information Queue 10.0.4 and 10.0.5 could allow a remote attacker to obtain sensitive information that could aid in further attacks against the system. IBM X-force ID: 256014.
CVE-2020-4868MEDIUMCVSS 4.3EG 4.3
2023-07-31
IBM TRIRIGA 3.0, 4.0, and 4.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-F…
CVE-2023-33181MEDIUMCVSS 4.3EG 4.3
2023-05-30
Xibo is a content management system (CMS). Starting in version 3.0.0 and prior to version 3.3.5, some API routes will print a stack trace when called with missing or invalid parameters revealing sensitive information about the locations of…
CVE-2022-4770MEDIUMCVSS 4.3EG 4.3
2023-04-03
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the full parametrized SQL query in an error message when an invalid character is used within a Pentaho Report (*.prpt).
CVE-2022-4769MEDIUMCVSS 4.3EG 4.3
2023-04-03
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the target path on host when a file is uploaded with an invalid character in its name.
CVE-2023-25687MEDIUMCVSS 4.3EG 4.3
2023-03-21
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to obtain sensitive information from log files. IBM X-Force ID: 247602.
CVE-2022-2760MEDIUMCVSS 4.3EG 4.3
2022-09-28
In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an error message when a resource is part of another Space.
CVE-2021-39018MEDIUMCVSS 4.3EG 4.3
2022-07-14
IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could disclose sensitive information in a SQL error message that could aid in further attacks against the system. IBM X-Force ID: 213726.
CVE-2022-26070MEDIUMCVSS 4.3EG 4.3
2022-05-06
When handling a mismatched pre-authentication cookie, the application leaks the internal error message in the response, which contains the Splunk Enterprise local system path. The vulnerability impacts Splunk Enterprise versions before 8.1…
CVE-2021-43206MEDIUMCVSS 4.3EG 4.3
2022-05-04
A server-generated error message containing sensitive information in Fortinet FortiOS 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.x, 6.0.x and FortiProxy 7.0.0 through 7.0.1, 2.0.x allows malicious webservers to retrieve a web proxy's cl…
CVE-2021-40126MEDIUMCVSS 4.3EG 4.3
2021-11-04
A vulnerability in the web-based dashboard of Cisco Umbrella could allow an authenticated, remote attacker to perform an email enumeration attack against the Umbrella infrastructure. This vulnerability is due to an overly descriptive error…
CVE-2021-20552MEDIUMCVSS 4.3EG 4.3
2021-10-07
IBM Sterling File Gateway 6.0.0.0 through 6.1.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against t…
CVE-2021-20485MEDIUMCVSS 4.3EG 4.3
2021-09-23
IBM Sterling File Gateway 2.2.0.0 through 6.1.0.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against t…
CVE-2020-4941MEDIUMCVSS 4.3EG 4.3
2021-09-23
IBM Edge 4.2 could reveal sensitive version information about the server from error pages that could aid an attacker in further attacks against the system. IBM X-Force ID: 191941.
CVE-2021-20508MEDIUMCVSS 4.3EG 4.3
2021-09-14
IBM Security Secret Server up to 11.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. I…
CVE-2021-22249MEDIUMCVSS 4.3EG 4.3
2021-08-23
A verbose error message in GitLab EE affecting all versions since 12.2 could disclose the private email address of a user invited to a group
CVE-2021-29784MEDIUMCVSS 4.3EG 4.3
2021-07-26
IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. …
CVE-2021-20424MEDIUMCVSS 4.3EG 4.3
2021-07-13
IBM Cloud Pak for Applications 4.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. X-Fo…
CVE-2021-20417MEDIUMCVSS 4.3EG 4.3
2021-07-07
IBM Guardium Data Encryption (GDE) 4.0.0.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the syst…
CVE-2021-20413MEDIUMCVSS 4.3EG 4.3
2021-06-28
IBM Guardium Data Encryption (GDE) 4.0.0.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the syst…
CVE-2021-31341MEDIUMCVSS 4.3EG 4.3
2021-05-12
Uploading a table mapping using a manipulated XML file results in an exception that could expose information about the application-server and the used XML-framework on the Mendix Database Replication Module (All versions prior to v7.0.1).
CVE-2021-31339MEDIUMCVSS 4.3EG 4.3
2021-05-12
A vulnerability has been identified in Mendix Excel Importer Module (All versions < V9.0.3). Uploading a manipulated XML File results in an exception that could expose information about the Application-Server and the used XML-Framework.
CVE-2020-4536MEDIUMCVSS 4.3EG 4.3
2021-05-11
IBM OpenPages GRC Platform 8.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Fo…
CVE-2021-3393MEDIUMCVSS 4.3EG 4.3
2021-04-01
An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user having UPDATE permission but not SELECT permission to a particular column could craft queries which, under some circumstances, m…
CVE-2021-22169MEDIUMCVSS 4.3EG 4.3
2021-03-24
An issue was identified in GitLab EE 13.4 or later which leaked internal IP address via error messages.
CVE-2021-23968MEDIUMCVSS 4.3EG 4.3
2021-02-26
If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation report; as opposed to the original frame URI. This could be used to leak sensitive information contai…
CVE-2020-15219MEDIUMCVSS 4.3EG 4.3
2021-01-13
Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, when a download error is triggered in the user portal, an SQL query is displayed to the user. This is fixed in versions 2.7.2 and 3.0.0.
CVE-2020-4544MEDIUMCVSS 4.3EG 4.3
2021-01-08
IBM Jazz Foundation Products could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Forc…
CVE-2020-4487MEDIUMCVSS 4.3EG 4.3
2021-01-08
IBM Jazz Foundation Products could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Forc…
CVE-2020-4483MEDIUMCVSS 4.3EG 4.3
2020-11-06
IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further a…
CVE-2020-15794MEDIUMCVSS 4.3EG 4.3
2020-10-15
A vulnerability has been identified in Desigo Insight (All versions). Some error messages in the web application show the absolute path to the requested resource. This could allow an authenticated attacker to retrieve additional informatio…
CVE-2018-19947MEDIUMCVSS 4.3EG 4.3
2020-09-11
The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this information exposure vulnerability could disclose sensitive information. QNAP has already fixed the issue in Helpdesk 3.0.3 and later.
CVE-2020-4319MEDIUMCVSS 4.3EG 4.3
2020-07-28
IBM MQ, IBM MQ Appliance, and IBM MQ for HPE NonStop 8.0, 9.1 LTS, and 9.1 CD could allow under special circumstances, an authenticated user to obtain sensitive information due to a data leak from an error message within the pre-v7 pubsub …
CVE-2020-4357MEDIUMCVSS 4.3EG 4.3
2020-05-27
IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the syst…
CVE-2019-4729MEDIUMCVSS 4.3EG 4.3
2020-04-27
IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM …
CVE-2019-4593MEDIUMCVSS 4.3EG 4.3
2020-04-15
IBM QRadar 7.3.0 to 7.3.3 Patch 2 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-ForceID: 167743.
CVE-2020-6438MEDIUMCVSS 4.3EG 4.3
2020-04-13
Insufficient policy enforcement in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Ch…
CVE-2019-4601MEDIUMCVSS 4.3EG 4.3
2020-04-08
IBM Quality Manager (RQM) 6.02, 6.06, and 6.0.6.1 could allow an authenticated user to obtain sensitive information from a stack trace that could aid in further attacks against the system.
CVE-2019-4583MEDIUMCVSS 4.3EG 4.3
2020-02-20
IBM Maximo Asset Management 7.6.0.10 and 7.6.1.1 could allow an authenticated user to obtain sensitive information from a stack trace that could be used to aid future attacks. IBM X-Force ID: 167289.
CVE-2018-21032MEDIUMCVSS 4.3EG 4.3
2020-02-14
A vulnerability in Hitachi Command Suite prior to 8.7.1-00 and Hitachi Automation Director prior to 8.5.0-00 allow authenticated remote users to expose technical information through error messages. Hitachi Command Suite includes Hitachi De…
CVE-2014-8161MEDIUMCVSS 4.3EG 4.3
2020-01-27
PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the erro…
CVE-2019-4512MEDIUMCVSS 4.3EG 4.3
2019-10-09
IBM Maximo Asset Management 7.6.1.1 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force ID: 164554.
CVE-2019-11662MEDIUMCVSS 4.3EG 4.3
2019-09-18
Class and method names in error message in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. This vulnerability could be exploited in some special cases to allo…
CVE-2019-4485MEDIUMCVSS 4.3EG 4.3
2019-08-20
IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive information that could be used in further …
CVE-2019-4484MEDIUMCVSS 4.3EG 4.3
2019-08-20
IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive information that could be used in further …
CVE-2019-4308MEDIUMCVSS 4.3EG 4.3
2019-08-20
IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 could allow an authenticated user to obtain sensitive information from error messages IBM X-F…
CVE-2019-4377MEDIUMCVSS 4.3EG 4.3
2019-06-25
IBM Sterling B2B Integrator 6.0.0.0 and 6.0.0.1 reveals sensitive information from a stack trace that could be used in further attacks against the system. IBM X-Force ID: 162803.

Map vulnerabilities like CWE-209 to your infrastructure

EchelonGraph correlates every CVE — across CWE-209 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →