Exposure of Sensitive Information to an Unauthorized Actor
CWE-200
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
We track 1,371 vulnerabilities of this type. 99% are rated high or critical, and the average CVSS score is 7.9. 18 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Compartmentalize the system to have safe areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Latest Exposure of Sensitive Information to an Unauthorized Actor vulnerabilities
- 8.1 High severity
Firefox: Exposure of Sensitive Information to an Unauthorized Actor
Information disclosure due to race condition in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- 8.1 High severity
Firefox: Exposure of Sensitive Information to an Unauthorized Actor
Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- 8.5 High severity
openpanel: Exposure of Sensitive Information to an Unauthorized Actor
OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the notification.rules tRPC
- 8.7 High severity
gtm-server-side-wordpress-plugin: Exposure of Sensitive Information to an Unauthorized Actor
The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another
- 8.7 High severity
odhcpd: Out-of-bounds Read
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA_NA or IA_PD option whose body is shorter than struct dhcpv6_ia_hdr, casts the option header t
- 7.5 High severity
PraisonAI: Exposure of Sensitive Information to an Unauthorized Actor
PraisonAI is a multi-agent teams system. From version 4.5.115 to before version 4.6.61, the published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription
- 9.8 Critical severity
PraisonAI: Exposure of Sensitive Information to an Unauthorized Actor
PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and in releases after the published patched version for GHSA-pm96-6xpr-978x / CVE-2026-
- 7.5 High severity
PraisonAI: Improper Limitation of a Pathname to a Restricted Directory
PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context Discovery feature exposes artifact helper tools through ctx.get_tools(). The implemented artifact tools do not enforce that the supplied artifact_
- 7.5 High severity
PraisonAI: Improper Limitation of a Pathname to a Restricted Directory
PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context module provides filesystem-backed history and terminal-log storage. The module also exports agent-callable tool factories. Those tools accept run_
- 7.1 High severity
ArubaOS (AOS): Exposure of Sensitive Information to an Unauthorized Actor
A sensitive information disclosure vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to access limited information handled by the affected service. Successful exploitation could allow an attacker to view some informat
- 9.3 Critical severity
ArubaOS (AOS): Exposure of Sensitive Information to an Unauthorized Actor
A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be us
- 9.6 Critical severity
ArubaOS (AOS): Exposure of Sensitive Information to an Unauthorized Actor
A sensitive information disclosure vulnerability in the command line interface of AOS-10 could allow an unauthenticated remote attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used
- 9.8 Critical severity
ArubaOS (AOS): Exposure of Sensitive Information to an Unauthorized Actor
Sensitive information disclosure vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to obtain sensitive information from the affected system. Successful exploitation could allow an attacker to execute arbitrary c
- 7.2 High severity
Splunk SOAR: Exposure of Sensitive Information to an Unauthorized Actor
In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and Roles view permission could use the Representational State Transfer (REST) API to infer authentication token values for other users. If the inferred token grants administrative ac
- 7.5 High severity
Splunk SOAR: Exposure of Sensitive Information to an Unauthorized Actor
In Splunk SOAR versions below 8.7.0, a user that has the "Observer" role could use query filters in the Representational State Transfer (REST) API to infer password hashes and authorization tokens for other users. The information disclosure is possible because
- 7.7 High severity
Oracle Essbase: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is i
- 7.7 High severity
Oracle Essbase: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is i
- 7.7 High severity
Oracle Essbase: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is i
- 7.7 High severity
Oracle Essbase: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is i
- 7.5 High severity
Oracle BI Publisher: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access v
- 7.5 High severity
Oracle WebCenter Sites: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network acce
- 7.5 High severity
Oracle WebCenter Sites: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network acce
- 7.5 High severity
PeopleSoft Enterprise FIN Common Objects…: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: Integration). The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access v
- 7.5 High severity
Siebel CRM Deployment: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to com
- 7.5 High severity
Siebel CRM Integration: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration). Supported versions that are affected are 25.12-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compro
- 8.6 High severity
Oracle Outside In Technology: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network acce
- 7.5 High severity
JD Edwards EnterpriseOne Tools: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access
- 7.5 High severity
JD Edwards EnterpriseOne Tools: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access
- 7.5 High severity
JD Edwards EnterpriseOne Tools: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access
- 8.6 High severity
Oracle SOA Suite: Missing Authentication for Critical Functionality
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HT
- 8.6 High severity
Oracle SOA Suite: Missing Authentication for Critical Functionality
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HT
- 7.5 High severity
Oracle Solaris: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System). The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracl
- 7.5 High severity
Oracle Payroll: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to
- 8.8 High severity
Oracle Service Bus: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to c
- 7.1 High severity
Oracle General Ledger: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via H
- 7.2 High severity
Order Capture: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Order Capture product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to co
- 7.8 High severity
Applications Platform Engineering: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Applications Platform Engineering product of Oracle E-Business Suite (component: Valid Session). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the inf
- 9.6 Critical severity
Oracle HTTP Server: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HT
- 8.7 High severity
Oracle HTTP Server: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Oracle Weblogic Server Proxy Plug-in for Oracle HTTP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows
- 10.0 Critical severity
Oracle Access Manager: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network