CWE-209— Generation of Error Message Containing Sensitive Information
The product generates an error message that includes sensitive information about its environment, users, or associated data.— MITRE CWE catalog
643 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-209page 9 of 13
- CVE-2020-4166MEDIUMCVSS 5.3EG 5.32020-08-27
IBM Security Guardium Insights 2.0.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IB…
- CVE-2020-15132MEDIUMCVSS 5.3EG 5.32020-08-05
In Sulu before versions 1.6.35, 2.0.10, and 2.1.1, when the "Forget password" feature on the login screen is used, Sulu asks the user for a username or email address. If the given string is not found, a response with a `400` error code is …
- CVE-2020-8213MEDIUMCVSS 5.3EG 5.32020-07-30
An information exposure vulnerability exists in UniFi Protect before v1.13.4-beta.5 that allowed unauthenticated attackers access to valid usernames for the UniFi Protect web application via HTTP response code and response timing.
- CVE-2020-4572MEDIUMCVSS 5.3EG 5.32020-07-29
IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the …
- CVE-2020-4341MEDIUMCVSS 5.3EG 5.32020-06-24
IBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-F…
- CVE-2020-4327MEDIUMCVSS 5.3EG 5.32020-06-24
IBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-F…
- CVE-2020-4532MEDIUMCVSS 5.3EG 5.32020-06-17
IBM Business Automation Workflow and IBM Business Process Manager (IBM Business Process Manager Express 8.5.5, 8.5.6, 8.5.7, and 8.6) could allow a remote attacker to obtain sensitive information when a detailed technical error message is …
- CVE-2019-18865MEDIUMCVSS 5.3EG 5.32020-05-07
Information disclosure via error message discrepancies in authentication functions in Blaauw Remote Kiln Control through v3.00r4 allows an unauthenticated attacker to enumerate valid usernames.
- CVE-2020-11883MEDIUMCVSS 5.3EG 5.32020-04-17
In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used in VueStorefront PWA, unexpected HTTP requests lead to an exception that discloses the error stack trace, with absolute file paths and Node.js module…
- CVE-2020-4239MEDIUMCVSS 5.3EG 5.32020-03-31
IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against …
- CVE-2020-10097MEDIUMCVSS 5.3EG 5.32020-03-05
An issue was discovered in Zammad 3.0 through 3.2. It may respond with verbose error messages that disclose internal application or infrastructure information. This information could aid attackers in successfully exploiting other vulnerabi…
- CVE-2019-19993MEDIUMCVSS 5.3EG 5.32020-02-26
An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. Several full path disclosure vulnerability were discovered. A user, even with no authentication, may simply send arbitrary content to the vulnerable pages …
- CVE-2020-9351MEDIUMCVSS 5.3EG 5.32020-02-23
An issue was discovered in SmartClient 12.0. If an unauthenticated attacker makes a POST request to /tools/developerConsoleOperations.jsp or /isomorphic/IDACall with malformed XML data in the _transaction parameter, the server replies with…
- CVE-2020-6189MEDIUMCVSS 5.3EG 5.32020-02-12
Certain settings page(s) in SAP Business Objects Business Intelligence Platform (CMC), version 4.2, generates error messages that can give enterprise private-network related information which would otherwise be restricted leading to Inform…
- CVE-2020-7231MEDIUMCVSS 5.3EG 5.32020-01-19
Evoko Home 1.31 devices provide different error messages for failed login requests depending on whether the username is valid.
- CVE-2019-19806MEDIUMCVSS 5.3EG 5.32019-12-30
_account_forgot_password.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 displays a message indicating whether an email address is configured for the account name provided. This can be used by an attacker to enumerate accounts by guess…
- CVE-2019-19342MEDIUMCVSS 5.3EG 5.32019-12-19
A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.4, when /websocket is requested and the password contains the '#' character. This request would cause a socket error in RabbitMQ when parsing the password …
- CVE-2013-6879MEDIUMCVSS 5.3EG 5.32019-11-22
The Mijosoft MijoSearch component 2.0.1 and earlier for Joomla! allows remote attackers to obtain sensitive information via a request to component/mijosearch/search, which reveals the installation path in an error message.
- CVE-2019-4570MEDIUMCVSS 5.3EG 5.32019-11-22
IBM Tivoli Netcool Impact 7.1.0 through 7.1.0.16 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 166720.
- CVE-2019-4441MEDIUMCVSS 5.3EG 5.32019-10-03
IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and Liberty could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser. IBM X-Force ID: 163177.
- CVE-2019-12156MEDIUMCVSS 5.3EG 5.32019-10-02
Server metadata could be exposed because one of the error messages reflected the whole response back to the client in JetBrains TeamCity versions before 2018.2.5 and UpSource versions before 2018.2 build 1293.
- CVE-2019-15032MEDIUMCVSS 5.3EG 5.32019-09-19
Pydio 6.0.8 mishandles error reporting when a directory allows unauthenticated uploads, and the remote-upload option is used with the http://localhost:22 URL. The attacker can obtain sensitive information such as the name of the user who c…
- CVE-2019-6792MEDIUMCVSS 5.3EG 5.32019-09-09
An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Path Disclosure. When an error is encountered on project import, the error message will display ins…
- CVE-2019-5483MEDIUMCVSS 5.3EG 5.32019-09-09
Seneca < 3.9.0 contains a vulnerability that could lead to exposing environment variables to unauthorized users.
- CVE-2019-16101MEDIUMCVSS 5.3EG 5.32019-09-08
Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows remote attackers to obtain potentially sensitive stack traces by sending incorrect JSON data to the REST API, such as the rest/json/banners URI.
- CVE-2019-11602MEDIUMCVSS 5.3EG 5.32019-08-21
Leakage of stack traces in remote access to backup & restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 allows remote attackers to gather information about the file system structure.
- CVE-2019-1020013MEDIUMCVSS 5.3EG 5.32019-07-29
parse-server before 3.6.0 allows account enumeration.
- CVE-2019-4129MEDIUMCVSS 5.3EG 5.32019-07-02
IBM Spectrum Protect Operations Center 7.1 and 8.1 could allow a remote attacker to obtain sensitive information, caused by an error message containing a stack trace. By creating an error with a stack trace, an attacker could exploit this …
- CVE-2019-4219MEDIUMCVSS 5.3EG 5.32019-06-06
IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force ID: 159228.
- CVE-2019-7550MEDIUMCVSS 5.3EG 5.32019-02-12
In JForum 2.1.8, an unauthenticated, remote attacker can enumerate whether a user exists by using the "create user" function. If a register/check/username?username= request corresponds to a username that exists, then an "is already in use"…
- CVE-2018-14907MEDIUMCVSS 5.3EG 5.32018-08-03
The Web server in 3CX version 15.5.8801.3 is vulnerable to Information Leakage, because of improper error handling in Stack traces, as demonstrated by discovering a full pathname.
- CVE-2018-12536MEDIUMCVSS 5.3EG 5.32018-06-27
In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file se…
- CVE-2018-1073MEDIUMCVSS 5.3EG 5.32018-06-19
The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and invalid passwords, allowing an attacker to discover the names of valid user accounts.
- CVE-2021-40338MEDIUMCVSS 3.7EG 5.32022-01-28
Hitachi Energy LinkOne product, has a vulnerability due to a web server misconfiguration, that enables debug mode and reveals the full path of the filesystem directory when an attacker generates errors during a query operation. This issue …
- CVE-2026-73409MEDIUMCVSS 5.1EG 5.12026-07-24
Budibase is an open-source low-code platform. Prior to 3.40.1, packages/server/src/integrations/mongodb.ts passed builder-controlled tlsCertificateKeyFile and tlsCAFile values directly to MongoClient on Budibase Cloud. A builder could subm…
- CVE-2024-45713MEDIUMCVSS 5.1EG 5.12024-10-17
SolarWinds Kiwi CatTools is susceptible to a sensitive data disclosure vulnerability when a non-default setting has been enabled for troubleshooting purposes.
- CVE-2025-48562MEDIUMCVSS 5.0EG 5.02025-09-04
In writeContent of RemotePrintDocument.java, there is a possible information disclosure due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for ex…
- CVE-2022-39304MEDIUMCVSS 5.0EG 5.02022-12-20
ghinstallation provides transport, which implements http.RoundTripper to provide authentication as an installation for GitHub Apps. In ghinstallation version 1, when the request to refresh an installation token failed, the HTTP request and…
- CVE-2002-2009MEDIUMCVSS v2 5.0EG 5.02002-12-31
Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by (1) +/, (2) >/, (3) </, and (4) %20/, which leaks the pathname in an error message.
- CVE-2000-1191MEDIUMCVSS v2 5.0EG 5.02001-08-31
htsearch program in htDig 3.2 beta, 3.1.6, 3.1.5, and earlier allows remote attackers to determine the physical path of the server by requesting a non-existent configuration file using the config parameter, which generates an error message…
- CVE-2025-36348MEDIUMCVSS 4.9EG 4.92026-02-17
IBM Sterling B2B Integrator versions 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5, and 6.2.1.0 through 6.2.1.1, and IBM Sterling File Gateway versions 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5, and 6.2.1.0 through 6.2.1.1 m…
- CVE-2025-46575MEDIUMCVSS 4.9EG 4.92025-04-27
There is an information disclosure vulnerability in the GoldenDB database product. Attackers can exploit error messages to obtain the system's sensitive information.
- CVE-2020-4842MEDIUMCVSS 4.9EG 4.92020-12-21
IBM Security Secret Server 10.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-F…
- CVE-2017-1370MEDIUMCVSS 4.9EG 4.92017-07-31
IBM Jazz Reporting Service (JRS) 5.0 and 6.0 could disclose sensitive information, including user credentials, through an error message from the Report Builder administrator configuration page. IBM X-Force ID: 126863.
- CVE-2012-0059MEDIUMCVSS 4.9EG 4.92014-02-05
A flaw was found in Spacewalk-backend. This information disclosure vulnerability occurs when a system registration XML-RPC call fails, causing cleartext user passwords to be included in error messages. Remote administrators can exploit thi…
- CVE-2024-30141MEDIUMCVSS 4.7EG 4.72024-11-07
HCL BigFix Compliance is vulnerable to the generation of error messages containing sensitive information. Detailed error messages can provide enticement information or expose information about its environment, users, or associated data.
- CVE-2020-5274MEDIUMCVSS 4.6EG 4.62020-03-30
In Symfony before versions 5.0.5 and 4.4.5, some properties of the Exception were not properly escaped when the `ErrorHandler` rendered it stacktrace. In addition, the stacktrace were displayed even in a non-debug configuration. The ErrorH…
- CVE-2025-4166MEDIUMCVSS 4.5EG 4.52025-05-02
Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault R…
- CVE-2024-5435MEDIUMCVSS 4.5EG 4.52024-09-12
An issue has been discovered discovered in GitLab EE/CE affecting all versions starting from 15.10 before 17.1.7, all versions starting from 17.2 before 17.2.5, all versions starting from 17.3 before 17.3.2 will disclose user password from…
- CVE-2026-24511MEDIUMCVSS 4.4EG 4.42026-04-08
Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.6 and versions 9.11.0.0 through 9.13.0.0, contains a generation of error message containing sensitive information vulnerability. A high privileged attacker with local access could p…
Map vulnerabilities like CWE-209 to your infrastructure
EchelonGraph correlates every CVE — across CWE-209 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →