Exposure of Sensitive Information to an Unauthorized Actor
CWE-200
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
We track 1,371 vulnerabilities of this type. 99% are rated high or critical, and the average CVSS score is 7.9. 18 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Compartmentalize the system to have safe areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Latest Exposure of Sensitive Information to an Unauthorized Actor vulnerabilities
- 7.5 High severity
linqi: Exposure of Sensitive Information to an Unauthorized Actor
An issue was discovered in linqi before 1.4.0.1 on Windows. There is an NTLM hash leak via the /api/Cdn/GetFile and /api/DocumentTemplate/{GUID] endpoints.
- 7.5 High severity
Easy Digital Downloads: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Easy Digital Downloads.This issue affects Easy Digital Downloads: from n/a through 3.2.11.
- 7.5 High severity
GDPR Compliance: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Scribit GDPR Compliance.This issue affects GDPR Compliance: from n/a through 1.2.5.
- 8.2 High severity
camera: Exposure of Sensitive Information to an Unauthorized Actor
Section Camera V2.5.5.3116-S50-SMA-B20160811 and earlier versions allow the accounts and passwords of administrators and users to be changed without authorization.
- 7.5 High severity
Simple Editor: Insufficiently Protected Credentials
LG Simple Editor checkServer Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw
- 7.5 High severity
Simple Editor: Insufficiently Protected Credentials
LG Simple Editor getServerSetting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific
- 7.5 High severity
HT Mega Addons for Elementor – Elementor…: Exposure of Sensitive Information to an Unauthorized Actor
The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.6 via the purchased_products function. This makes it possible for unauthenticatied attackers to extract s
- 7.5 High severity
a9_camera_firmware: Exposure of Sensitive Information to an Unauthorized Actor
An issue in CYCZCAM, SHIX ZHAO, SHIXCAM A9 Camera (circuit board identifier A9-48B-V1.0) firmware v.CYCAM_48B_BC01_v87_0903 allows a remote attacker to obtain sensitive information via a crafted request to a UDP port.
- 7.5 High severity
v_qrs: Exposure of Sensitive Information to an Unauthorized Actor
An issue in Vaales Technologies V_QRS v.2024-01-17 allows a remote attacker to obtain sensitive information via the Models/FormModel.php and QRModel.php component.
- 7.5 High severity
connect: Exposure of Sensitive Information to an Unauthorized Actor
An issue in TVS Motor Company Limited TVS Connet Android v.4.5.1 and iOS v.5.0.0 allows a remote attacker to obtain sensitive information via an insecure API endpoint. NOTE: this is disputed as discussed in the msn-official/CVE-Evidence repository.
- 9.8 Critical severity
FS-EZViewer(Web): Exposure of Sensitive Information to an Unauthorized Actor
E-WEBInformationCo. FS-EZViewer(Web) exposes sensitive information in the service. A remote attacker can obtain the database configuration file path through the webpage source code without login. Accessing this path allows attacker to obtain the database crede
- 9.8 Critical severity
Media Streaming add-on: Improper Limitation of a Pathname to a Restricted Directory
An exposure of sensitive information vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnerability could allow users to compromise the security of the system via a network. We have already fixed the vulnerability in the foll
- 7.7 High severity
Red Hat OpenShift Container Platform 4.12: Exposure of Sensitive Information to an Unauthorized Actor
A credentials leak vulnerability was found in the cluster monitoring operator in OCP. This issue may allow a remote attacker who has basic login credentials to check the pod manifest to discover a repository pull secret.
- 8.8 High severity
WP Setup Wizard: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in CodeRevolution WP Setup Wizard.This issue affects WP Setup Wizard: from n/a through 1.0.8.1.
- 9.8 Critical severity
Brocade SANnav: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability in Brocade SANnav exposes Kafka in the wan interface. The vulnerability could allow an unauthenticated attacker to perform various attacks, including DOS against the Brocade SANnav.
- 7.5 High severity
Post Grid: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PickPlugins Post Grid.This issue affects Post Grid: from n/a through 2.2.78.
- 7.5 High severity
Email Customizer for WooCommerce: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ThemeHigh Email Customizer for WooCommerce.This issue affects Email Customizer for WooCommerce: from n/a through 2.6.0.
- 7.5 High severity
Frontend Dashboard: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in vinoth06. Frontend Dashboard.This issue affects Frontend Dashboard: from n/a through 2.2.2.
- 8.0 High severity
30Z_firmware: Exposure of Sensitive Information to an Unauthorized Actor
Various software builds for the following TCL 30Z and TCL A3X devices leak the ICCID to a system property that can be accessed by any local app on the device without any permissions or special privileges. Google restricted third-party apps from directly obtain
- 8.2 High severity
Brocade SANnav: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability affects Brocade SANnav before v2.3.1 and v2.3.0a. It allows a Brocade SANnav service to send ping commands in the background at regular intervals to gridgain.com to check if updates are available for the Component. This could make an unauthenti
- 7.8 High severity
Linux: Exposure of Sensitive Information to an Unauthorized Actor
In the Linux kernel, the following vulnerability has been resolved: tcp: Fix refcnt handling in __inet_hash_connect(). syzbot reported a warning in sk_nulls_del_node_init_rcu(). The commit 66b60b0c8c4a ("dccp/tcp: Unhash sk from ehash for tb2 alloc failure aft
- 8.2 High severity
Primavera P6 Enterprise Project Portfolio…: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 19.12.0-19.12.22, 20.12.0-20.12.21, 21.12.0-21.12.18, 22.12.0-22.12.12 an
- 7.5 High severity
Trade Management: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: GL Accounts LOV). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP
- 7.5 High severity
Trade Management: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Claim LOV). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to co
- 7.5 High severity
Citadela Listing: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in AitThemes Citadela Listing.This issue affects Citadela Listing: from n/a through 5.18.1.
- 7.5 High severity
accredible_credential.net: Exposure of Sensitive Information to an Unauthorized Actor
The API in Accredible Credential.net December 6th, 2023 allows an Insecure Direct Object Reference attack that discloses partial information about certificates and their respective holder. NOTE: the excellium-services.com web page about this issue mentions "Ve
- 7.5 High severity
scrapy/scrapy: Exposure of Sensitive Information to an Unauthorized Actor
In scrapy version 2.10.1, an issue was identified where the Authorization header, containing credentials for server authentication, is leaked to a third-party site during a cross-domain redirect. This vulnerability arises from the failure to remove the Authori
- 7.8 High severity
CGA2121: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability of Information Exposure has been found on Technicolor CGA2121 affecting the version 1.01, this vulnerability allows a local attacker to obtain sensitive information stored on the device such as wifi network's SSID and their respective passwords
- 8.3 High severity
HPE NonStop Web ViewPoint Enterprise software: Exposure of Sensitive Information to an Unauthorized Actor
A potential security vulnerability has been identified in Web ViewPoint Enterprise software. This vulnerability could be exploited to allow unauthorized users to access some resources on a NonStop system.
- 7.5 High severity
Evolution Controller: Exposure of Sensitive Information to an Unauthorized Actor
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on MOBILE_GET_USERS_LIST, allowing for an unauthenticated attacker to enumerate all users and their access levels
- 7.5 High severity
Evolution Controller: Exposure of Sensitive Information to an Unauthorized Actor
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_ABACARD_FIELDS, allowing for an unauthenticated attacker to return the abacard field of any user
- 7.5 High severity
Evolution Controller: Exposure of Sensitive Information to an Unauthorized Actor
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_KEYS_FIELDS, allowing for an unauthenticated attacker to return the keys value of any user
- 7.5 High severity
Evolution Controller: Exposure of Sensitive Information to an Unauthorized Actor
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_PIN_FIELDS, allowing for an unauthenticated attacker to return the pin value of any user
- 7.5 High severity
Evolution Controller: Exposure of Sensitive Information to an Unauthorized Actor
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_CARD, allowing for an unauthenticated attacker to return the card value data of any user
- 7.2 High severity
xibo-cms: Exposure of Sensitive Information to an Unauthorized Actor
Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. Session tokens are exposed in the return of session search API call on the sessions page. Subsequently they can be exfiltrated and used to
- 8.4 High severity
Paragon Active Assurance: Exposure of Sensitive Information to an Unauthorized Actor
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Juniper Networks Paragon Active Assurance Control Center allows a network-adjacent attacker with root access to a Test Agent Appliance the ability to access sensitive information ab
- 7.5 High severity
OpenGnsys: Exposure of Sensitive Information to an Unauthorized Actor
Information exposure vulnerability in OpenGnsys affecting version 1.1.1d (Espeto). This vulnerability allows an attacker to view a php backup file (controlaccess.php-LAST) where database credentials are stored.
- 7.5 High severity
Element Pack – Widgets, Templates & Addons for…: Exposure of Sensitive Information to an Unauthorized Actor
The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.5.6 via the element_pack_ajax_search functi
- 7.7 High severity
IGS-4215-16T2S: Exposure of Sensitive Information to an Unauthorized Actor
Information exposure vulnerability in Planet IGS-4215-16T2S, affecting firmware version 1.305b210528. This vulnerability could allow a remote attacker to access some administrative resources due to lack of proper management of the Switch web interface.
- 9.1 Critical severity
lunary-ai/lunary: Exposure of Sensitive Information to an Unauthorized Actor
By knowing an organization's ID, an attacker can join the organization without permission and gain the ability to read and modify all data within that organization. This vulnerability allows unauthorized access and modification of sensitive information, posing