Generation of Error Message Containing Sensitive Information
CWE-209
The product generates an error message that includes sensitive information about its environment, users, or associated data.
We track 89 vulnerabilities of this type. 98% are rated high or critical, and the average CVSS score is 8.0. 3 have been exploited in real attacks.
How this weakness is prevented
- Implementation: Handle exceptions internally and do not display errors containing potentially sensitive information to a user.
- Implementation: Use naming conventions and strong types to make it easier to spot when sensitive data is being used. When creating structures, objects, or other complex entities, separate the sensitive and non-sensitive data as much as possible.
- Implementation Build and Compilation: Debugging information should not make its way into a production release.
- Implementation Build and Compilation: Debugging information should not make its way into a production release.
- System Configuration: Where available, configure the environment to use less verbose error messages. For example, in PHP, disable the display_errors setting during configuration, or at runtime using the error_reporting() function.
Latest Generation of Error Message Containing Sensitive Information vulnerabilities
- 7.5 High severity
Hoteldruid: Generation of Error Message Containing Sensitive Information
In HotelDruid 3.0.0 and 3.0.7, the unauthenticated database-setup endpoint creadb.php can be reached before setup is completed and performs database creation without locking. By sending many concurrent requests, an attacker can trigger a race condition during
- 7.5 High severity
GoldenDB: Generation of Error Message Containing Sensitive Information
There is an information disclosure vulnerability in the GoldenDB database product. Attackers can exploit error messages to obtain the system's sensitive information.
- 7.5 High severity
GitLab: Generation of Error Message Containing Sensitive Information
An issue has been discovered in GitLab EE affecting all versions from 17.1 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. This allows attackers to perform targeted searches with sensitive keywords to get the count of issues containing the searche
- 7.5 High severity
GitLab: Generation of Error Message Containing Sensitive Information
An issue was discovered in GitLab EE/CE affecting all versions starting from 11.5 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2. Certain user inputs in repository mirroring settings could potentiall
- 7.7 High severity
VMware Aria Operations for Logs: Generation of Error Message Containing Sensitive Information
VMware Aria Operations for Logs contains an information disclosure vulnerability. A malicious actor with View Only Admin permissions may be able to read the credentials of a VMware product integrated with VMware Aria Operations for Logs
- 7.5 High severity
Cloud Pak System: Generation of Error Message Containing Sensitive Information
IBM Cloud Pak System 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, and 2.3.4.0 could disclose sensitive information about the system that could aid in further attacks against the system.
- 7.5 High severity
Cloud Pak System: Generation of Error Message Containing Sensitive Information
IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information about the system that could aid in further attacks against the system.
- 7.5 High severity
Cloud Pak System: Generation of Error Message Containing Sensitive Information
IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information about the system that could aid in further attacks against the system.
- 7.5 High severity
phpMyFAQ: Generation of Error Message Containing Sensitive Information
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Prior to 4.0.0, phpMyFAQ exposes the database (ie postgreSQL) server's credential when connection to DB fails. This vulnerability is fixed in 4.0.0.
- 7.5 High severity
ollama: Generation of Error Message Containing Sensitive Information
An issue was discovered in Ollama through 0.3.14. File existence disclosure can occur via api/create. When calling the CreateModel route with a path parameter that does not exist, it reflects the "File does not exist" error message to the attacker, providing a
- 7.3 High severity
Xen: Generation of Error Message Containing Sensitive Information
In x86's APIC (Advanced Programmable Interrupt Controller) architecture, error conditions are reported in a status register. Furthermore, the OS can opt to receive an interrupt when a new error occurs. It is possible to configure the error interrupt with an il
- 7.5 High severity
QRadar Suite Software: Generation of Error Message Containing Sensitive Information
IBM QRadar Suite Software 1.10.12.0 through 1.10.22.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the request. This information c
- 9.8 Critical severity
GravityZone Update Server: Server-Side Request Forgery
A verbose error handling issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This issue only affects GravityZone Console versions before 6.38.1-5 running only on premise.
- 9.8 Critical severity
crypto\+\+: Generation of Error Message Containing Sensitive Information
A Fault Injection vulnerability in the SymmetricDecrypt function in cryptopp/elgamal.h of Cryptopp Crypto++ 8.9, allows an attacker to co-reside in the same system with a victim process to disclose information and escalate privileges.
- 7.5 High severity
Microsoft .NET Framework Information Disclosure Exploited
.NET Framework Information Disclosure Vulnerability
- 7.5 High severity
Nway Pro: Generation of Error Message Containing Sensitive Information
A vulnerability was found in Nway Pro 9. It has been rated as problematic. Affected by this issue is the function ajax_login_submit_form of the file login\index.php of the component Argument Handler. The manipulation of the argument rsargs[] leads to informati
- 7.5 High severity
Junos OS: Generation of Error Message Containing Sensitive Information
A Missing Authentication for Critical Function vulnerability combined with a Generation of Error Message Containing Sensitive Information vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX Series allows an unauthenticated, network-based a
- 7.5 High severity
Db2 for Linux, UNIX and Windows: Generation of Error Message Containing Sensitive Information
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to an insecure cryptographic algorithm and to information disclosure in stack trace under exceptional conditions.
- 8.8 High severity
Java Libraries: Generation of Error Message Containing Sensitive Information
Exposure of sensitive information in exceptions in ClichHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickhouse-client versions less than 0.4.6 allows unauthorized users to gain access to client certificate passwords via client
- 7.5 High severity
Hitachi Device Manager: Generation of Error Message Containing Sensitive Information
Generation of Error Message Containing Sensitive Information vulnerability in Hitachi Device Manager on Windows, Linux (Device Manager Agent modules).This issue affects Hitachi Device Manager: before 8.8.5-04.
- 7.5 High severity
CodeIgniter4: Generation of Error Message Containing Sensitive Information
CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error report is displayed even if in the production environment. As a result, confidential information may be leaked. Version 4.4.3
- 7.5 High severity
google-sheets-datasource: Generation of Error Message Containing Sensitive Information
Grafana is an open-source platform for monitoring and observability. The Google Sheets data source plugin for Grafana, versions 0.9.0 to 1.2.2 are vulnerable to an information disclosure vulnerability. The plugin did not properly sanitize error messages, makin
- 8.8 High severity
RX4-1500: Generation of Error Message Containing Sensitive Information
Credential disclosure in the '/webs/userpasswd.htm' endpoint in Juplink RX4-1500 Wifi router firmware versions V1.0.4 and V1.0.5 allows an authenticated attacker to leak the password for the administrative account via requests to the vulnerable endpoint.
- 7.5 High severity
Security Verify Information Queue: Generation of Error Message Containing Sensitive Information
IBM Security Verify Information Queue 10.0.4 and 10.0.5 could allow a remote attacker to obtain sensitive information that could aid in further attacks against the system. IBM X-Force ID: 256015.
- 9.8 Critical severity
Make An Offer Widget: Generation of Error Message Containing Sensitive Information
User enumeration is found in in PHPJabbers Make an Offer Widget v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- 9.8 Critical severity
Ticket Support Script: Generation of Error Message Containing Sensitive Information
User enumeration is found in in PHPJabbers Ticket Support Script v3.2. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- 9.8 Critical severity
Event Booking Calendar: Generation of Error Message Containing Sensitive Information
User enumeration is found in PHPJabbers Event Booking Calendar v4.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- 9.8 Critical severity
Car Rental Script: Generation of Error Message Containing Sensitive Information
User enumeration is found in PHP Jabbers Car Rental Script v3.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- 9.8 Critical severity
Taxi Booking Script: Generation of Error Message Containing Sensitive Information
User enumeration is found in PHPJabbers Taxi Booking Script v2.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- 9.8 Critical severity
Fundraising Script: Generation of Error Message Containing Sensitive Information
User enumeration is found in PHPJabbers Fundraising Script v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- 9.8 Critical severity
Yacht Listing Script: Generation of Error Message Containing Sensitive Information
User enumeration is found in PHPJabbers Yacht Listing Script v2.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- 9.8 Critical severity
Hotel Booking System: Generation of Error Message Containing Sensitive Information
User enumeration is found in PHP Jabbers Hotel Booking System v4.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- 9.8 Critical severity
Restaurant Booking Script: Generation of Error Message Containing Sensitive Information
User enumeration is found in PHP Jabbers Restaurant Booking Script v3.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users
- 9.8 Critical severity
Document Creator: Generation of Error Message Containing Sensitive Information
User enumeration is found in PHPJabbers Document Creator v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- 9.8 Critical severity
Food Delivery Script: Generation of Error Message Containing Sensitive Information
User enumeration is found in PHPJabbers Food Delivery Script v3.1. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- 7.5 High severity
dispatch: Generation of Error Message Containing Sensitive Information
Dispatch is an open source security incident management tool. The server response includes the JWT Secret Key used for signing JWT tokens in error message when the `Dispatch Plugin - Basic Authentication Provider` plugin encounters an error when attempting to
- 7.5 High severity
Experion Server: Generation of Error Message Containing Sensitive Information
Server information leak of configuration data when an error is generated in response to a specially crafted message. See Honeywell Security Notification for recommendations on upgrading and versioning.
- 7.5 High severity
oauth2-server: Generation of Error Message Containing Sensitive Information
league/oauth2-server is an implementation of an OAuth 2.0 authorization server written in PHP. Starting in version 8.3.2 and prior to version 8.5.3, servers that passed their keys to the CryptKey constructor as as string instead of a file path will have had th
- 7.5 High severity
Misp: Generation of Error Message Containing Sensitive Information
MISP 2.4.172 mishandles different certificate file extensions in server sync. An attacker can obtain sensitive information because of the nature of the error messages.
- 7.5 High severity
spicedb: Generation of Error Message Containing Sensitive Information
SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. The `spicedb serve` command contains a flag named `--grpc-preshared-key` which is used to protect the gRPC API from being