Exposure of Sensitive Information to an Unauthorized Actor
CWE-200
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
We track 1,371 vulnerabilities of this type. 99% are rated high or critical, and the average CVSS score is 7.9. 18 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Compartmentalize the system to have safe areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Latest Exposure of Sensitive Information to an Unauthorized Actor vulnerabilities
- 7.1 High severity
JD Edwards EnterpriseOne Tools: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon t
- 7.1 High severity
JD Edwards EnterpriseOne Tools: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access v
- 8.1 High severity
JD Edwards EnterpriseOne Tools: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access v
- 8.4 High severity
Oracle VM VirtualBox: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM Vir
- 7.5 High severity
Sourcing: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Sourcing product of Oracle E-Business Suite (component: Auctions). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Sourci
- 7.4 High severity
Oracle Shipping Execution: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via
- 7.8 High severity
Oracle Solaris: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes
- 8.8 High severity
Oracle Solaris: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). Supported versions that are affected are 11.3 and 11.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Solari
- 8.8 High severity
Chrome: Exposure of Sensitive Information to an Unauthorized Actor
Information leak in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)
- 8.8 High severity
Chrome: Exposure of Sensitive Information to an Unauthorized Actor
Information leak in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)
- 8.8 High severity
Chrome: Exposure of Sensitive Information to an Unauthorized Actor
Information leak in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Exposure of Sensitive Information to an Unauthorized Actor
Information leak in ContextualSearch in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak sensitive information via crafted network traffic. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Exposure of Sensitive Information to an Unauthorized Actor
Information leak in ContentCapture in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker to leak sensitive information via a co-installed app. (Chromium security severity: Low)
- 8.8 High severity
Chrome: Exposure of Sensitive Information to an Unauthorized Actor
Information leak in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via crafted network traffic. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Exposure of Sensitive Information to an Unauthorized Actor
Information leak in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Exposure of Sensitive Information to an Unauthorized Actor
Information leak in PerformanceAPIs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
- 8.8 High severity
Chrome: Exposure of Sensitive Information to an Unauthorized Actor
Information leak in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
- 8.8 High severity
Chrome: Exposure of Sensitive Information to an Unauthorized Actor
Information leak in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Exposure of Sensitive Information to an Unauthorized Actor
Information leak in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Chrome: Exposure of Sensitive Information to an Unauthorized Actor
Information leak in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
- 7.1 High severity
Installed Base: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Data Provider UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compr
- 7.6 High severity
Installed Base: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Create Item Instance). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to c
- 7.5 High severity
Oracle Bills of Material: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access vi
- 7.2 High severity
Helidon: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-cors). Supported versions that are affected are 3.0.0-3.2.21. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helid
- 7.2 High severity
Helidon: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-grpc-server). Supported versions that are affected are 3.0.0-3.2.21. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to comprom
- 7.5 High severity
Oracle Agile PLM: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Acollect). The supported version that is affected is 2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile
- 7.5 High severity
Oracle Applications Manager: Missing Authentication for Critical Functionality
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with netwo
- 7.7 High severity
Oracle Capacity: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to c
- 7.7 High severity
Oracle Capacity: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to c
- 7.5 High severity
Oracle Business Intelligence Enterprise Edition: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker
- 7.7 High severity
Oracle Trusted Answer Search: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in Oracle Trusted Answer Search (component: Application expert UI). The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trusted Answer S
- 7.7 High severity
Oracle REST Data Services: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.2.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. While th
- 7.5 High severity
Siebel CRM Deployment: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Cloud Gateway). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise
- 7.5 High severity
Siebel CRM Deployment: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to com
- 9.1 Critical severity
curl: Exposure of Sensitive Information to an Unauthorized Actor
When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect cont
- 8.1 High severity
curl: Exposure of Sensitive Information to an Unauthorized Actor
libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that for
- 8.2 High severity
follow-redirects: Exposure of Sensitive Information to an Unauthorized Actor
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-de
- 8.2 High severity
follow-redirects: Incorrect Regular Expression
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose
- 8.5 High severity
Archibus: Exposure of Sensitive Information to an Unauthorized Actor
A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workflow rule. The authentication bypass vulnerability can be chained with this vulnerability to perform database reads without authentication. Da
- 7.5 High severity
Apache Camel: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Two paths handed credentials to a redirect target, which is a host ch