CWE-209— Generation of Error Message Containing Sensitive Information

The product generates an error message that includes sensitive information about its environment, users, or associated data.— MITRE CWE catalog

643 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-209page 8 of 13

CVE-2023-25695MEDIUMCVSS 5.3EG 5.3
2023-03-15
Generation of Error Message Containing Sensitive Information vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.5.2.
CVE-2023-0655MEDIUMCVSS 5.3EG 5.3
2023-02-14
SonicWall Email Security contains a vulnerability that could permit a remote unauthenticated attacker access to an error page that includes sensitive information about users email addresses.
CVE-2022-46675MEDIUMCVSS 5.3EG 5.3
2023-02-11
Wyse Management Suite Repository 3.8 and below contain an information disclosure vulnerability. A unauthenticated attacker could potentially discover the internal structure of the application and its components and use this information fo…
CVE-2022-46371MEDIUMCVSS 5.3EG 5.3
2023-01-12
Alotcer - AR7088H-A firmware version 16.10.3 Information disclosure. Unspecified error message contains the default administrator user name.
CVE-2022-22449MEDIUMCVSS 5.3EG 5.3
2022-12-24
IBM Security Verify Governance, Identity Manager 10.01 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks aga…
CVE-2022-40292MEDIUMCVSS 5.3EG 5.3
2022-10-31
The application allowed for Unauthenticated User Enumeration by interacting with an unsecured endpoint to retrieve information on each account within the system.
CVE-2022-2508MEDIUMCVSS 5.3EG 5.3
2022-10-27
In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to due to verbose error messaging.
CVE-2022-38107MEDIUMCVSS 5.3EG 5.3
2022-10-19
Sensitive information could be displayed when a detailed technical error message is posted. This information could disclose environmental details.
CVE-2021-39086MEDIUMCVSS 5.3EG 5.3
2022-08-16
IBM Sterling File Gateway 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This …
CVE-2022-31189MEDIUMCVSS 5.3EG 5.3
2022-08-01
DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. When an "Internal System Error" occurs in the JSPUI, then entire exception (including st…
CVE-2022-31047MEDIUMCVSS 5.3EG 5.3
2022-06-14
TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, system internal credentials or keys (e.g. database credentials) can be logged as plaintext in exception h…
CVE-2022-26973MEDIUMCVSS 5.3EG 5.3
2022-06-02
Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. By tweaking the license file name, the returned error message exposes internal directory path detai…
CVE-2022-23794MEDIUMCVSS 5.3EG 5.3
2022-03-30
An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Uploading a file name of an excess length causes the error. This error brings up the screen with the path of the source code of the web application.
CVE-2021-35251MEDIUMCVSS 5.3EG 5.3
2022-03-10
Sensitive information could be displayed when a detailed technical error message is posted. This information could disclose environmental details about the Web Help Desk installation.
CVE-2021-46353MEDIUMCVSS 5.3EG 5.3
2022-03-04
An information disclosure in web interface in D-Link DIR-X1860 before 1.03 RevA1 allows a remote unauthenticated attacker to send a specially crafted HTTP request and gain knowledge of different absolute paths that are being used by the we…
CVE-2022-0622MEDIUMCVSS 5.3EG 5.3
2022-02-17
Generation of Error Message Containing Sensitive Information in Packagist snipe/snipe-it prior to 5.3.11.
CVE-2022-0083MEDIUMCVSS 5.3EG 5.3
2022-01-04
livehelperchat is vulnerable to Generation of Error Message Containing Sensitive Information
CVE-2022-0079MEDIUMCVSS 5.3EG 5.3
2022-01-03
showdoc is vulnerable to Generation of Error Message Containing Sensitive Information
CVE-2021-4177MEDIUMCVSS 5.3EG 5.3
2021-12-28
livehelperchat is vulnerable to Generation of Error Message Containing Sensitive Information
CVE-2021-44155MEDIUMCVSS 5.3EG 5.3
2021-12-13
An issue was discovered in /goform/login_process in Reprise RLM 14.2. When an attacker attempts to login, the response if a username is valid includes Login Failed, but does not include this string if the username is invalid. This allows a…
CVE-2021-38980MEDIUMCVSS 5.3EG 5.3
2021-11-23
IBM Tivoli Key Lifecycle Manager (IBM Security Guardium Key Lifecycle Manager) 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This …
CVE-2021-38981MEDIUMCVSS 5.3EG 5.3
2021-11-15
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks a…
CVE-2021-35060MEDIUMCVSS 5.3EG 5.3
2021-10-11
/way4acs/enroll in OpenWay WAY4 ACS before 1.2.278-2693 allows unauthenticated attackers to leverage response differences to discover whether a specific payment card number is stored in the system.
CVE-2021-32766MEDIUMCVSS 5.3EG 5.3
2021-09-07
Nextcloud Text is an open source plaintext editing application which ships with the nextcloud server. In affected versions the Nextcloud Text application returned different error messages depending on whether a folder existed in a public l…
CVE-2021-35947MEDIUMCVSS 5.3EG 5.3
2021-09-07
The public share controller in the ownCloud server before version 10.8.0 allows a remote attacker to see the internal path and the username of a public share by including invalid characters in the URL.
CVE-2021-29767MEDIUMCVSS 5.3EG 5.3
2021-07-26
IBM i2 Analyst's Notebook Premium 9.2.0, 9.2.1, and 9.2.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks a…
CVE-2021-29766MEDIUMCVSS 5.3EG 5.3
2021-07-26
IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in …
CVE-2021-20430MEDIUMCVSS 5.3EG 5.3
2021-07-26
IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in …
CVE-2021-25809MEDIUMCVSS 5.3EG 5.3
2021-07-23
UCMS 1.5.0 was discovered to contain a physical path leakage via an error message returned by the adminchannelscache() function in top.php.
CVE-2021-33711MEDIUMCVSS 5.3EG 5.3
2021-07-13
A vulnerability has been identified in Teamcenter Active Workspace V4 (All versions < V4.3.9), Teamcenter Active Workspace V5.0 (All versions < V5.0.7), Teamcenter Active Workspace V5.1 (All versions < V5.1.4). The affected application all…
CVE-2021-32712MEDIUMCVSS 5.3EG 5.3
2021-06-24
Shopware is an open source eCommerce platform. Versions prior to 5.6.10 are vulnerable to system information leakage in error handling. Users are recommend to update to version 5.6.10. You can get the update to 5.6.10 regularly via the Aut…
CVE-2020-20470MEDIUMCVSS 5.3EG 5.3
2021-06-21
White Shark System (WSS) 1.3.2 has web site physical path leakage vulnerability.
CVE-2021-31159MEDIUMCVSS 5.3EG 5.3
2021-06-16
Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-message generation in the Forgot Password functionality, aka SDPMSP-15732.
CVE-2021-30357MEDIUMCVSS 5.3EG 5.3
2021-06-08
SSL Network Extender Client for Linux before build 800008302 reveals part of the contents of the configuration file supplied, which allows partially disclosing files to which the user did not have access.
CVE-2021-20428MEDIUMCVSS 5.3EG 5.3
2021-05-24
IBM Security Guardium 11.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force …
CVE-2021-29682MEDIUMCVSS 5.3EG 5.3
2021-05-20
IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM…
CVE-2021-29040MEDIUMCVSS 5.3EG 5.3
2021-05-16
The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provide overly verbose error messages, which allows remote attackers to use the conten…
CVE-2020-19275MEDIUMCVSS 5.3EG 5.3
2021-05-12
An Information Disclosure vulnerability exists in dhcms 2017-09-18 when entering invalid characters after the normal interface, which causes an error that will leak the physical path.
CVE-2021-20289MEDIUMCVSS 5.3EG 5.3
2021-03-26
A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the …
CVE-2020-4628MEDIUMCVSS 5.3EG 5.3
2021-01-27
IBM Cloud Pak for Security (CP4S) 1.3.0.1 and 1.4.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks again…
CVE-2020-4600MEDIUMCVSS 5.3EG 5.3
2021-01-13
IBM Security Guardium Insights 2.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IB…
CVE-2020-4599MEDIUMCVSS 5.3EG 5.3
2021-01-13
IBM Security Guardium Insights 2.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IB…
CVE-2020-4897MEDIUMCVSS 5.3EG 5.3
2021-01-07
IBM Emptoris Contract Management and IBM Emptoris Spend Analysis 10.1.0, 10.1.1, and 10.1.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information …
CVE-2020-4761MEDIUMCVSS 5.3EG 5.3
2021-01-05
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. …
CVE-2020-14270MEDIUMCVSS 5.3EG 5.3
2020-12-22
HCL Domino v9, v10, v11 is susceptible to an Information Disclosure vulnerability in XPages due to improper error handling of user input. An unauthenticated attacker could exploit this vulnerability to obtain information about the XPages s…
CVE-2020-35177MEDIUMCVSS 5.3EG 5.3
2020-12-17
HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1.
CVE-2020-4907MEDIUMCVSS 5.3EG 5.3
2020-12-16
IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used …
CVE-2020-25640MEDIUMCVSS 5.3EG 5.3
2020-11-24
A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensitive information in the log file.
CVE-2019-4547MEDIUMCVSS 5.3EG 5.3
2020-10-29
IBM Security Directory Server 6.4.0 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 165949.
CVE-2020-25633MEDIUMCVSS 5.3EG 5.3
2020-09-18
A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client users to obtain the server's potentially sensitive information when the server got WebApplicationException from the RESTEasy client call…

Map vulnerabilities like CWE-209 to your infrastructure

EchelonGraph correlates every CVE — across CWE-209 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →