Generation of Error Message Containing Sensitive Information
CWE-209
The product generates an error message that includes sensitive information about its environment, users, or associated data.
We track 89 vulnerabilities of this type. 98% are rated high or critical, and the average CVSS score is 8.0. 3 have been exploited in real attacks.
How this weakness is prevented
- Implementation: Handle exceptions internally and do not display errors containing potentially sensitive information to a user.
- Implementation: Use naming conventions and strong types to make it easier to spot when sensitive data is being used. When creating structures, objects, or other complex entities, separate the sensitive and non-sensitive data as much as possible.
- Implementation Build and Compilation: Debugging information should not make its way into a production release.
- Implementation Build and Compilation: Debugging information should not make its way into a production release.
- System Configuration: Where available, configure the environment to use less verbose error messages. For example, in PHP, disable the display_errors setting during configuration, or at runtime using the error_reporting() function.
Latest Generation of Error Message Containing Sensitive Information vulnerabilities
- 7.5 High severity
SAP Cloud SDK for AI(JavaScript): Generation of Error Message Containing Sensitive Information
SAP Cloud SDK for AI (Node.js) could inadvertently include sensitive authentication credentials in error messages generated by certain internal operations under specific failure conditions. An attacker with low privileges and access to application logs or forw
- 8.1 High severity
API Connect: Generation of Error Message Containing Sensitive Information
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and cause a denial of service due to the generation of error messages containing sensitive information.
- 10.0 Critical severity
Apache Juneau: Generation of Error Message Containing Sensitive Information
Generation of Error Message Containing Sensitive Information vulnerability in Apache Juneau. The REST server sends the internal exception class and message to clients in a "Thrown" response header on every error response, and can include internal exception mes
- 8.4 High severity
jack: Exposure of Sensitive Information to an Unauthorized Actor
jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, `middleware/handle-error.ts` serializes raw `FetchError` objects into HTTP responses. `lib/servers/base.ts` attaches outbound request headers on upstream non
- 8.2 High severity
n8n: Generation of Error Message Containing Sensitive Information
n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 stores credential secrets in execution error data when operations fail in the Git, MongoDB Atlas Vector Store, and Google Cloud Storage nodes. Users who can view a workflow's executions but canno
- 7.5 High severity
Gantry 5 Framework: Generation of Error Message Containing Sensitive Information
Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrieve Embedded Sensitive Data.This issue affects Gantry 5 Framework: from n/a through 5.6.4.
- 8.6 High severity
Terraform Provider for OME: Generation of Error Message Containing Sensitive Information
Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in the API client error handling component. An unauthenticated attacker with remote access
- 7.1 High severity
PRTG Network Monitor: Generation of Error Message Containing Sensitive Information
PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. If a non-numeric value is passed instead, cscript.exe raises a 'Type mismatch' runtime error that includes the offending
- 7.7 High severity
Red Hat Ansible Automation Platform 2.5 for…: Generation of Error Message Containing Sensitive Information
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Survey questions of type password are write-only and stored encrypted, displayed only as a placeholder on read. When a schedule or workflow job template node is revalidated again
- 7.1 High severity
ash_ai: Generation of Error Message Containing Sensitive Information
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses provider request state and credentials in a user-facing validation error. In AshAi.Changes.Vectorize, when the embedding provider call fails the change a
- 7.5 High severity
Spring Framework: Generation of Error Message Containing Sensitive Information
A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.2
- 7.5 High severity
openssl_encrypt: Generation of Error Message Containing Sensitive Information
openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information includi
- 8.2 High severity
cryptography: Observable Timing Discrepancy
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime reported the outcome of decrypting a RecipientInfo's encryptedKey in
- 7.5 High severity
Telerik UI for ASP.NET AJAX: Generation of Error Message Containing Sensitive Information
In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that reveals protected metadata values to remote attackers.
- 8.2 High severity
MCO: Improper Limitation of a Pathname to a Restricted Directory
MCO is vulnerable to Path Disclosure and Path Traversal in file handling functionality related to data export and upload. Improper validation of the filename parameter allows writing files to arbitrary locations as well as indirect disclosure of absolute serve
- 9.8 Critical severity
ZIE: Unrestricted Upload of File with Dangerous Type
HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability, If the server is configured to execute code, then it may be possible to obtain command execution on the server by uploading a file known as a web shell, which allows you to execute arbit
- 7.5 High severity
free5GC is an open-source implementation of the 5G core network.
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the free5GC UDM component fails to validate the supi path parameter in six GET handlers of the nudm-sdm (Subscriber Data Management) service. An unauthenticated attacker can injec
- 7.5 High severity
algernon: Generation of Error Message Containing Sensitive Information
Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is invoked with a single file path instead of a directory, singleFileMode is set to true and debugMode is forcibly enabled. debugMode activates the PrettyError renderer, whic
- 7.1 High severity
Vvveb: Generation of Error Message Containing Sensitive Information
Vvveb before 1.0.8.3 contains an uncontrolled recursion vulnerability in the admin controller dispatch cycle where Base::init() repeatedly invokes permission() on error handlers, causing infinite recursion until PHP memory limits are exhausted. Attackers can s
- 7.5 High severity
core: Generation of Error Message Containing Sensitive Information
Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the default error handler Engine::_error() writes the full exception message, exception code, and stack trace (including absolute filesystem paths) directly into the HTTP 500 response, with no d
- 7.5 High severity
AVideo: Generation of Error Message Containing Sensitive Information
WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/CloneSite/cloneClient.json.php echoes the local CloneSite shared secret ($objClone->myKey, a constant md5($global['systemRootPath'] . $global['salt'])) into the HTTP res
- 7.1 High severity
monetr: Server-Side Request Forgery
monetr is a budgeting application for recurring expenses. Prior to version 1.12.5, a server-side request forgery (SSRF) vulnerability in monetr's Lunch Flow integration allowed any authenticated user on a self-hosted instance to cause the monetr server to issu
- 7.1 High severity
BigQuery: Generation of Error Message Containing Sensitive Information
A Generation of Error Message Containing Sensitive Information vulnerability in the Materialized View Refresh mechanism in Google BigQuery on Google Cloud Platform allows an authenticated user to potentially disclose sensitive data using a crafted materialized
- 7.5 High severity
free5gc: Exposure of Sensitive Information to an Unauthorized Actor
Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions 4.2.1 and below contain an information disclosure vulnerability in the UDR (Unified Data Repository) service. The handler for GET /nudr-dr/v2/application-
- 7.5 High severity
Apache Tomcat: Generation of Error Message Containing Sensitive Information
Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.1
- 9.1 Critical severity
podman-desktop: Generation of Error Message Containing Sensitive Information
Podman Desktop is a graphical tool for developing on containers and Kubernetes. Prior to 1.26.2, an unauthenticated HTTP server exposed by Podman Desktop allows any network attacker to remotely trigger denial-of-service conditions and extract sensitive informa
- 7.5 High severity
XenForo: Generation of Error Message Containing Sensitive Information
XenForo before 2.3.7 discloses filesystem paths through exception messages triggered by open_basedir restrictions. This allows an attacker to obtain information about the server's directory structure.
- 7.5 High severity
Sterling Partner Engagement Manager: Generation of Error Message Containing Sensitive Information
IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow a remote attacker to obtain sensitive information when detailed technical error messages are returned. This information could be used in further attacks aga
- 9.8 Critical severity
vllm: Insertion of Sensitive Information into Log File
vLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1, when an invalid image is sent to vLLM's multimodal endpoint, PIL throws an error. vLLM returns this error to the client, leaking a heap address. With this le
- 8.2 High severity
HeyGarson: Generation of Error Message Containing Sensitive Information
Generation of Error Message Containing Sensitive Information vulnerability in Codriapp Innovation and Software Technologies Inc. HeyGarson allows Fuzzing for application mapping. This issue affects HeyGarson: through 30012026. NOTE: The vendor was contacted an
- 7.5 High severity
prime: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability was identified in birkir prime up to 0.4.0.beta.0. This impacts an unknown function of the file /graphql of the component GraphQL Directive Handler. Such manipulation leads to information exposure through error message. The attack may be perfor
- 7.5 High severity
Incoming Goods Suite: Generation of Error Message Containing Sensitive Information
Certain error messages returned by the application expose internal system details that should not be visible to end users, providing attackers with valuable reconnaissance information (like file paths, database errors, or software versions) that can be used to
- 7.5 High severity
Xperience: Generation of Error Message Containing Sensitive Information
An information disclosure vulnerability in Kentico Xperience allows attackers to view sensitive stack trace details via Portal Engine form control error messages. Detailed error messages can expose internal system information and potentially reveal implementat
- 8.8 High severity
CRM: Generation of Error Message Containing Sensitive Information
ChurchCRM is an open-source church management system. Versions prior to 6.5.3 may disclose database information in an error message including the host, ip, username, and password. Version 6.5.3 fixes the issue.
- 7.5 High severity
squid: Generation of Error Message Containing Sensitive Information
Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. The vulnerability allows a script to bypass browser security protections and learn the cr
- 9.8 Critical severity
Unica Centralized Offer Management: Generation of Error Message Containing Sensitive Information
HCL Unica Centralized Offer Management is vulnerable to poor unhandled exceptions which exposes sensitive information. An attacker can exploit use this information to exploit known vulnerabilities launch targeted attacks, such as remote code execution or denia
- 7.5 High severity
BSAFE Crypto-J: Generation of Error Message Containing Sensitive Information
Dell BSAFE Crypto-J generates an error message that includes sensitive information about its environment and associated data. A remote attacker could potentially exploit this vulnerability, leading to information exposure.
- 7.5 High severity
Triton Inference Server: Generation of Error Message Containing Sensitive Information
NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause the shared memory limit to be exceeded by sending a very large request. A successful exploit of this vulnerability might lead to
- 4.3 Medium severity
Wing FTP Server Information Disclosure Exploited
loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.
- 7.5 High severity
Quiter Gateway (Java WAR on Apache Tomcat): Generation of Error Message Containing Sensitive Information
Improper error handling vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to send malformed payloads to generate error messages containing sensitive information.