Exposure of Sensitive Information to an Unauthorized Actor
CWE-200
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
We track 1,371 vulnerabilities of this type. 99% are rated high or critical, and the average CVSS score is 7.9. 18 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Compartmentalize the system to have safe areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Latest Exposure of Sensitive Information to an Unauthorized Actor vulnerabilities
- 8.7 High severity
Umbraco-CMS: Exposure of Sensitive Information to an Unauthorized Actor
Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.0.2, the Content Delivery API applies member and Public Access checks to the directly requested node but not to referenced nodes serialized through Content Picker or Multi-Node Tree Picker properties,
- 7.3 High severity
OpenManage Server Administrator Managed Node…: Exposure of Sensitive Information to an Unauthorized Actor
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Informa
- 10.0 Critical severity
vm2: Exposure of Sensitive Information to an Unauthorized Actor
vm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin: ['*'] configuration, allowing sandbox code to read host process identity and network topology. Attackers can invoke dns.setServers() to hijack the host process DNS resolver gl
- 10.0 Critical severity
vm2: Exposure of Sensitive Information to an Unauthorized Actor
vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small
- 7.5 High severity
grav: Exposure of Sensitive Information to an Unauthorized Actor
Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters (print_r, vardump, json_encode, yaml_encode, string): GravExtension::assertSandboxDumpSafe() determines sandbox state by c
- 7.5 High severity
grav: Exposure of Sensitive Information to an Unauthorized Actor
Grav is a flat-file CMS. In Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger is enabled (system.debugger.enabled: true, which is not the default), the Clockwork profiler endpoint is exposed without authentication: InitializeProcessor::ha
- 7.5 High severity
cms: Exposure of Sensitive Information to an Unauthorized Actor
Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-data scope enforced by Gql::canQueryUsers() (usergroups.*:read), these fields are gated only on the elem
- 8.8 High severity
Cisco Nexus Dashboard: Exposure of Sensitive Information to an Unauthorized Actor
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple int
- 8.4 High severity
RestrictedPython: Exposure of Sensitive Information to an Unauthorized Actor
RestrictedPython is a tool that helps define a subset of the Python language for accepting program input in a trusted environment. Prior to 8.4, RestrictedPython could allow a sandbox escape when a custom import policy or globals exposed the standard library s
- 7.5 High severity
tts-be: Exposure of Sensitive Information to an Unauthorized Actor
`tts-be` is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Control vulnerability across several API endpoints (such as `/api/student/{id}/photo` and `/api/course_u
- 7.1 High severity
Oracle Hyperion Financial Management: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to
- 7.5 High severity
Oracle Hyperion Financial Management: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP t
- 7.1 High severity
Oracle Hyperion Financial Management: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to
- 7.7 High severity
Oracle Purchasing: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: G-Invoicing). Supported versions that are affected are 12.2.10-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compro
- 7.7 High severity
Oracle Engineering: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Change Management). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to
- 8.5 High severity
Oracle Complex Maintenance, Repair and Overhaul: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.12-12.2.15. Easily exploitable vulnerability allows low privileged attacker
- 7.5 High severity
Oracle JDeveloper: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Oracle JDeveloper). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access
- 7.1 High severity
Oracle Communications Cloud Native Core…: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: SEPP). Supported versions that are affected are 26.1.200 and 25.2.201. Easily exploitable vulnerability allows unauthentica
- 7.1 High severity
Oracle XML Gateway: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle XML Gateway product of Oracle E-Business Suite (component: Install). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise
- 7.5 High severity
Siebel CRM Integration: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration). Supported versions that are affected are 25.12-26.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compro
- 8.5 High severity
Oracle BI Publisher: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Publisher Security). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compr
- 7.1 High severity
Oracle XML Gateway: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle XML Gateway product of Oracle E-Business Suite (component: Install). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise
- 7.7 High severity
Oracle Business Intelligence Enterprise Edition: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Presentation Services). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low pri
- 7.3 High severity
Oracle Agile PLM MCAD Connector: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where O
- 7.1 High severity
Oracle Commerce Guided Search / Oracle…: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with networ
- 7.1 High severity
Oracle Commerce Guided Search / Oracle…: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with networ
- 7.1 High severity
Oracle Commerce Guided Search / Oracle…: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with networ
- 7.5 High severity
Oracle Application Object Library: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP
- 7.7 High severity
Oracle Order Management: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Supported versions that are affected are 12.2.5-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access
- 7.1 High severity
EdgeConnect SD-WAN Gateways: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated adjacent attacker to obtain limited information from memory and disrupt the normal operation of the affected service. Successful exploitation could result in a denial
- 9.9 Critical severity
EdgeConnect SD-WAN Gateways: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability exists in the SD-WAN Orchestrator that may lead to the exposure of sensitive configuration information. An authenticated remote attacker with read-only privileges could exploit this vulnerability by sending a specially crafted request to the ca
- 8.8 High severity
Android: Exposure of Sensitive Information to an Unauthorized Actor
In Cellular Modem, there is a possible information disclosure due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- 7.5 High severity
vikunja: Exposure of Sensitive Information to an Unauthorized Actor
Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allowing read-only members to obtain the share's secret credential. Attackers can exchange the disclosed hash for a link-share JWT at the share'
- 7.5 High severity
AVideo: Exposure of Sensitive Information to an Unauthorized Actor
WWBN AVideo through 29.0 fails to enforce user-group restrictions in the plugin/Live/stats.json.php and plugin/Live/calendar.json.php endpoints. Unauthenticated attackers can retrieve restricted live transmission details including stream keys, titles, descript
- 8.7 High severity
design-scuole-wordpress-theme: Exposure of Sensitive Information to an Unauthorized Actor
The "Design Scuole Italia" WordPress theme is affected by multiple Authorization Bypass vulnerabilities in the dsi_pdf_generator and dsi_csv_generator functions, allowing an unauthenticated attacker to access restricted "Circolare" content and registered users
- 7.5 High severity
geolens: Exposure of Sensitive Information to an Unauthorized Actor
GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map builder. Prior to 1.2.3, multiple read and link endpoints authorize only the resource named in the request URL and fail to re-authorize a second caller-influenc
- 7.5 High severity
Firefox: Exposure of Sensitive Information to an Unauthorized Actor
Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- 8.5 High severity
OpenAM: Exposure of Sensitive Information to an Unauthorized Actor
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, SessionRequestHandler in the session management endpoint does not enforce ownership or privilege checks when a low-privileged authenticated user queries session information in d
- 7.5 High severity
iOS and iPadOS: Exposure of Sensitive Information to an Unauthorized Actor
An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watchOS 27. A local app may be able to read a persistent account identifier.
- 9.1 Critical severity
iOS and iPadOS: Exposure of Sensitive Information to an Unauthorized Actor
A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27, watchOS 27. An app may be able to fingerprint the user.