Exposure of Sensitive Information to an Unauthorized Actor
CWE-200
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
We track 1,371 vulnerabilities of this type. 99% are rated high or critical, and the average CVSS score is 7.9. 18 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Compartmentalize the system to have safe areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Latest Exposure of Sensitive Information to an Unauthorized Actor vulnerabilities
- 8.5 High severity
FactoryTalk® Action Manager: Exposure of Sensitive Information to an Unauthorized Actor
A security issue in the runtime event system allows unauthenticated connections to receive a reusable API token. This token is broadcasted over a WebSocket and can be intercepted by any local client listening on the connection.
- 8.2 High severity
autocaliweb: Exposure of Sensitive Information to an Unauthorized Actor
Autocaliweb is a web app that offers an interface for browsing, reading, and downloading eBooks using a valid Calibre database. Prior to version 0.8.3, the debug pack generated by Autocaliweb can expose sensitive configuration data, including API keys. This oc
- 7.0 High severity
Windows 10 Version 1507: Exposure of Sensitive Information to an Unauthorized Actor
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
- 7.5 High severity
Microsoft Exchange Server 2016 Cumulative…: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of sensitive information to an unauthorized actor in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.
- 7.8 High severity
SINEC Traffic Analyzer: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V3.0). The affected application exposes an internal service port to be accessible from outside the system. This could allow an unauthorized attacker to access th
- 7.1 High severity
authkit-remix: Exposure of Sensitive Information to an Unauthorized Actor
The AuthKit library for Remix provides convenient helpers for authentication and session management using WorkOS & AuthKit with Remix. In versions 0.14.1 and below, @workos-inc/authkit-remix exposed sensitive authentication artifacts — specifically sealedSessi
- 7.1 High severity
authkit-react-router: Exposure of Sensitive Information to an Unauthorized Actor
The AuthKit library for React Router 7+ provides helpers for authentication and session management using WorkOS & AuthKit with React Router. In versions 0.6.1 and below, @workos-inc/authkit-react-router exposed sensitive authentication artifacts — specifically
- 7.5 High severity
Fm/dab/tv Transmitter Web Management System: Exposure of Sensitive Information to an Unauthorized Actor
Electrolink FM/DAB/TV Transmitter Web Management System Unauthorized access vulnerability via the /FrameSetCore.html endpoint in Electrolink 500W, 1kW, 2kW Medium DAB Transmitter Web v01.09, v01.08, v01.07, and Display v1.4, v1.2.
- 9.6 Critical severity
cursor: Improper Neutralization of Special Elements used in an OS Command
Cursor is a code editor built for programming with AI. In versions 1.17 through 1.2, there is a UI information disclosure vulnerability in Cursor's MCP (Model Context Protocol) deeplink handler, allowing attackers to execute 2-click arbitrary system commands t
- 9.8 Critical severity
macOS: Exposure of Sensitive Information to an Unauthorized Actor
This issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. A malicious app may be able to read kernel memory.
- 9.8 Critical severity
iPadOS: Exposure of Sensitive Information to an Unauthorized Actor
A permissions issue was addressed with additional restrictions. This issue is fixed in iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to fingerprint the user.
- 9.8 Critical severity
Memos: Exposure of Sensitive Information to an Unauthorized Actor
The Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs. When a user views a memo containing such an image, their browser automatically fetches the image URL without explicit user consent or interaction bey
- 9.8 Critical severity
ChanCMS: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability was found in yanyutao0402 ChanCMS up to 3.1.2. It has been classified as problematic. Affected is an unknown function of the file /sysApp/find. The manipulation of the argument accessKey/secretKey leads to information disclosure. It is possible
- 9.1 Critical severity
Home Kit Firmware: Use of Default Credentials
Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 use weak default credentials for secure shell access. This may result in attackers gaining access to exposed Gardyn Home Kits.
- 9.4 Critical severity
Home Kit Firmware: Improper Enforcement of Message Integrity During Transmission in a Communication Channel
A Gardyn Azure IoT Hub connection string is downloaded over an insecure HTTP connection in Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 leaving the string vulnerable to intercept
- 8.1 High severity
Firefox: Exposure of Sensitive Information to an Unauthorized Actor
In some cases search terms persisted in the URL bar even after navigating away from the search page. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.
- 9.1 Critical severity
MetaCRM: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability was found in Metasoft 美特软件 MetaCRM up to 6.4.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /env.jsp. The manipulation leads to information disclosure. The attack may be launched remotely.
- 9.8 Critical severity
wolfSSL: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
In the OpenSSL compatibility layer implementation, the function RAND_poll() was not behaving as expected and leading to the potential for predictable values returned from RAND_bytes() after fork() is called. This can lead to weak or predictable random numbers
- 8.7 High severity
DVR Firmware: Exposure of Sensitive Information to an Unauthorized Actor
An unauthenticated arbitrary file read exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 via the /z/zbin/net_html.cgi endpoint. This vulnerability allows attackers to read sensitive configuration files, such as /zco
- 7.5 High severity
BL-AC3600: Insufficiently Protected Credentials
A vulnerability, which was classified as critical, was found in LB-LINK BL-AC3600 up to 1.0.22. This affects the function geteasycfg of the file /cgi-bin/lighttpd.cgi of the component Web Management Interface. The manipulation of the argument Password leads to
- 7.1 High severity
SteelHead VCX: Exposure of Sensitive Information to an Unauthorized Actor
A path traversal vulnerability exists in Riverbed SteelHead VCX appliances (confirmed in VCX255U 9.6.0a) due to improper input validation in the log filtering functionality exposed via the management web interface. An authenticated attacker can exploit this fl
- 10.0 Critical severity
docusaurus-plugin-content-gists: Exposure of Sensitive Information to an Unauthorized Actor
The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts wh
- 9.3 Critical severity
A data exfiltration vulnerability exists in Anthropic’s deprecated Slack Model Context…
A data exfiltration vulnerability exists in Anthropic’s deprecated Slack Model Context Protocol (MCP) Server via automatic link unfurling. When an AI agent using the Slack MCP Server processes untrusted data, it can be manipulated to generate messages containi
- 7.5 High severity
Bit Form – Custom Contact Form, Multi Step…: Exposure of Sensitive Information to an Unauthorized Actor
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.17.4 via file uploads due t
- 9.0 Critical severity
OneLogin Active Directory Connector (ADC): Exposure of Sensitive Information to an Unauthorized Actor
A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a hardcoded S3 bucket (onelogin-adc-logs-production) without validating bucket ownership. An attacker who registers this unclaimed bucket can begin receiving log
- 8.7 High severity
Smart Cloud Gateway Registration Management…: Improper Neutralization of Special Elements used in an SQL Command
An SQL injection vulnerability exists in the Dahua Smart Cloud Gateway Registration Management Platform via the username parameter in the /index.php/User/doLogin endpoint. The application fails to properly sanitize user input, allowing unauthenticated attacker
- 8.2 High severity
jans: Exposure of Sensitive Information to an Unauthorized Actor
The Janssen Project is an open-source identity and access management (IAM) platform. Prior to version 1.8.0, the Config API returns results without scope verification. This has a large internal surface attack area that exposes all sorts of information from the
- 8.8 High severity
frappe: Exposure of Sensitive Information to an Unauthorized Actor
Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, a carefully crafted request could lead to a malicious actor getting access to a user's password reset token. This can only be exploited on self hosted instances configured
- 7.5 High severity
discourse: Exposure of Sensitive Information to an Unauthorized Actor
Discourse is an open-source discussion platform. The visibility of posts typed `whisper` is controlled via the `whispers_allowed_groups` site setting. Only users that belong to groups specified in the site setting are allowed to view posts typed `whisper`. How
- 8.6 High severity
Firefox: Exposure of Sensitive Information to an Unauthorized Actor
When Multi-Account Containers was enabled, DNS requests could have bypassed a SOCKS proxy when the domain name was invalid or the SOCKS proxy was not responding. This vulnerability was fixed in Firefox 140 and Thunderbird 140.
- 9.8 Critical severity
Terminal Handler: Exposure of Sensitive Information to an Unauthorized Actor
An issue in NCR Terminal Handler v.1.5.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via a crafted POST request to the UserService component
- 8.6 High severity
Dnn.Platform: Exposure of Sensitive Information to an Unauthorized Actor
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted series of malicious interaction to potentially expose NTLM hashes to a thi
- 9.3 Critical severity
Aquatronica Controller System: Exposure of Sensitive Information to an Unauthorized Actor
An information disclosure vulnerability exists in Aquatronica Controller System firmware versions <= 5.1.6 and web interface versions <= 2.0. The tcp.php endpoint fails to restrict unauthenticated access, allowing remote attackers to issue crafted POST request
- 9.1 Critical severity
pgai: Exposure of Sensitive Information to an Unauthorized Actor
pgai is a Python library that transforms PostgreSQL into a retrieval engine for RAG and Agentic applications. Prior to commit 8eb3567, the pgai repository was vulnerable to an attack allowing the exfiltration of all secrets used in one workflow. In particular,
- 7.5 High severity
Director: Exposure of Sensitive Information to an Unauthorized Actor
The Versa Director SD-WAN orchestration platform provides direct web-based access to uCPE virtual machines through the Director GUI. By default, the websockify service is exposed on port 6080 and accessible from the internet. This exposure introduces significa
- 7.5 High severity
SICK Field Analytics: Exposure of Sensitive Information to an Unauthorized Actor
The created backup files are unencrypted, making the application vulnerable for gathering sensitive information by downloading and decompressing the backup files.
- 7.5 High severity
Field Analytics: Exposure of Sensitive Information to an Unauthorized Actor
A remote unauthorized attacker may gather sensitive information of the application, due to missing authorization of configuration settings of the product.
- 8.1 High severity
Apache CloudStack: Exposure of Sensitive Information to an Unauthorized Actor
When an Apache CloudStack user-account creates a CKS-based Kubernetes cluster in a project, the API key and the secret key of the 'kubeadmin' user of the caller account are used to create the secret config in the CKS-based Kubernetes cluster. A member of the p
- 7.5 High severity
geoserver: Exposure of Sensitive Information to an Unauthorized Actor
GeoServer is an open source server that allows users to share and edit geospatial data. org.geowebcache.GeoWebCacheDispatcher.handleFrontPage(HttpServletRequest, HttpServletResponse) has no check to hide potentially sensitive information from users except for
- 8.2 High severity
geoserver: Exposure of Sensitive Information to an Unauthorized Actor
GeoServer is an open source server that allows users to share and edit geospatial data. An improper URI validation vulnerability exists that enables an unauthorized attacker to perform XML External Entities (XEE) attack, then send GET request to any HTTP serve