IBM InfoSphere Information Server 11.5 and 11.7 is affected by an information disclosure vulnerability. Sensitive information in an error message may be used to conduct further attacks against the system. IBM X-Force ID: 159945.

CVE-2019-4269HIGHCVSS 7.5EG 7.5

2019-06-28

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console could allow a remote attacker to obtain sensitive information when a specially crafted url causes a stack trace to be dumped. IBM X-Force ID: 160202.

CVE-2019-4308MEDIUMCVSS 4.3EG 4.3

2019-08-20

IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 could allow an authenticated user to obtain sensitive information from error messages IBM X-F…

CVE-2019-4377MEDIUMCVSS 4.3EG 4.3

2019-06-25

IBM Sterling B2B Integrator 6.0.0.0 and 6.0.0.1 reveals sensitive information from a stack trace that could be used in further attacks against the system. IBM X-Force ID: 162803.

CVE-2019-4420MEDIUMCVSS 6.2EG 6.2

2019-08-20

IBM Intelligent Operations Center V5.1.0 through V5.2.0 could disclose detailed error messages, revealing sensitive information that could aid in further attacks against the system. IBM X-Force ID: 162738.

CVE-2019-4441MEDIUMCVSS 5.3EG 5.3

2019-10-03

IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and Liberty could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser. IBM X-Force ID: 163177.

CVE-2019-4484MEDIUMCVSS 4.3EG 4.3

2019-08-20

IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive information that could be used in further …

CVE-2019-4485MEDIUMCVSS 4.3EG 4.3

2019-08-20

IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive information that could be used in further …

CVE-2019-4512MEDIUMCVSS 4.3EG 4.3

2019-10-09

IBM Maximo Asset Management 7.6.1.1 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force ID: 164554.

CVE-2019-4547MEDIUMCVSS 5.3EG 5.3

2020-10-29

IBM Security Directory Server 6.4.0 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 165949.

CVE-2019-4570MEDIUMCVSS 5.3EG 5.3

2019-11-22

IBM Tivoli Netcool Impact 7.1.0 through 7.1.0.16 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 166720.

CVE-2019-4583MEDIUMCVSS 4.3EG 4.3

2020-02-20

IBM Maximo Asset Management 7.6.0.10 and 7.6.1.1 could allow an authenticated user to obtain sensitive information from a stack trace that could be used to aid future attacks. IBM X-Force ID: 167289.

CVE-2019-4593MEDIUMCVSS 4.3EG 4.3

2020-04-15

IBM QRadar 7.3.0 to 7.3.3 Patch 2 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-ForceID: 167743.

CVE-2019-4601MEDIUMCVSS 4.3EG 4.3

2020-04-08

IBM Quality Manager (RQM) 6.02, 6.06, and 6.0.6.1 could allow an authenticated user to obtain sensitive information from a stack trace that could aid in further attacks against the system.

CVE-2019-4619MEDIUMCVSS 5.5EG 5.5

2020-03-16

IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive information by inclusion of sensitive data within trace. IBM X-Force ID: 168862.

CVE-2019-4636LOWCVSS 2.7EG 2.7

2020-01-28

IBM Security Secret Server 10.7 could disclose sensitive information to an authenticated user from generated error messages. IBM X-Force ID: 170013.

CVE-2019-4699LOWCVSS 2.7EG 2.7

2020-08-26

IBM Security Guardium Data Encryption (GDE) 3.0.0.2 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 171931.

CVE-2019-4729MEDIUMCVSS 4.3EG 4.3

2020-04-27

IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM …

CVE-2019-5483MEDIUMCVSS 5.3EG 5.3

2019-09-09

Seneca < 3.9.0 contains a vulnerability that could lead to exposing environment variables to unauthorized users.

CVE-2019-6122LOWCVSS 3.1EG 3.1

2019-11-06

A Username Enumeration via Error Message issue was discovered in NiceHash Miner before 2.0.3.0 because an "EMAIL DOES NOT EXIST" error message occurs whenever a submitted email address is incorrect, but there is a different error message f…

CVE-2019-6792MEDIUMCVSS 5.3EG 5.3

2019-09-09

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Path Disclosure. When an error is encountered on project import, the error message will display ins…

CVE-2019-7550MEDIUMCVSS 5.3EG 5.3

2019-02-12

In JForum 2.1.8, an unauthenticated, remote attacker can enumerate whether a user exists by using the "create user" function. If a register/check/username?username= request corresponds to a username that exists, then an "is already in use"…

CVE-2019-7612CRITICALCVSS 9.8EG 9.8

2019-03-25

A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs. If a malformed URL is specified as part of the Logstash configuration, the credentials for the URL could be inadvertently …

CVE-2019-7644CRITICALCVSS 9.8EG 9.8

2019-04-11

Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT signature. If this error message is presented to an attacker, they can forge an arbitrary JWT token …

CVE-2019-7941HIGHCVSS 7.5EG 7.5

2019-07-18

Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Information Exposure Through an Error Message vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user.

CVE-2019-9223HIGHCVSS 7.5EG 7.5

2019-04-17

An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposure.

CVE-2019-9455LOWCVSS 2.3EG 2.3

2019-09-06

In the Android kernel in the video driver there is a kernel pointer leak due to a WARN_ON statement. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.

CVE-2020-10097MEDIUMCVSS 5.3EG 5.3

2020-03-05

An issue was discovered in Zammad 3.0 through 3.2. It may respond with verbose error messages that disclose internal application or infrastructure information. This information could aid attackers in successfully exploiting other vulnerabi…

CVE-2020-11594HIGHCVSS 7.5EG 7.5

2020-04-06

An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request that causes a stack error to be shown providing the full file path.

CVE-2020-11883MEDIUMCVSS 5.3EG 5.3

2020-04-17

In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used in VueStorefront PWA, unexpected HTTP requests lead to an exception that discloses the error stack trace, with absolute file paths and Node.js module…

CVE-2020-13997HIGHCVSS 7.5EG 7.5

2020-07-28

In Shopware before 6.2.3, the database password is leaked to an unauthenticated user when a DriverException occurs and verbose error handling is enabled.

CVE-2020-14270MEDIUMCVSS 5.3EG 5.3

2020-12-22

HCL Domino v9, v10, v11 is susceptible to an Information Disclosure vulnerability in XPages due to improper error handling of user input. An unauthenticated attacker could exploit this vulnerability to obtain information about the XPages s…

CVE-2020-14337MEDIUMCVSS 5.8EG 5.8

2020-07-31

A data exposure flaw was found in Tower, where sensitive data was revealed from the HTTP return error codes. This flaw allows an unauthenticated, remote attacker to retrieve pages from the default organization and verify existing usernames…

CVE-2020-15125HIGHCVSS 7.7EG 7.7

2020-07-29

In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used. The key for Authorization header is not sanitized and in certain cases the A…

CVE-2020-15132MEDIUMCVSS 5.3EG 5.3

2020-08-05

In Sulu before versions 1.6.35, 2.0.10, and 2.1.1, when the "Forget password" feature on the login screen is used, Sulu asks the user for a username or email address. If the given string is not found, a response with a `400` error code is …

CVE-2020-15219MEDIUMCVSS 4.3EG 4.3

2021-01-13

Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, when a download error is triggered in the user portal, an SQL query is displayed to the user. This is fixed in versions 2.7.2 and 3.0.0.

CVE-2020-15478HIGHCVSS 7.5EG 7.5

2020-07-01

The Journal theme before 3.1.0 for OpenCart allows exposure of sensitive data via SQL errors.

CVE-2020-15666MEDIUMCVSS 6.5EG 6.5

2020-10-01

When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500, 412, 403, etc.) was disclosed via the MediaError Message. This level of information leakage is inconsistent with the standardized onerror/…

CVE-2020-15794MEDIUMCVSS 4.3EG 4.3

2020-10-15

A vulnerability has been identified in Desigo Insight (All versions). Some error messages in the web application show the absolute path to the requested resource. This could allow an authenticated attacker to retrieve additional informatio…

CVE-2020-16121LOWCVSS 3.3EG 3.3

2020-11-07

PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that the user would be unable to determine on its own.

CVE-2020-16128LOWCVSS 3.8EG 3.8

2020-12-09

The aptdaemon DBus interface disclosed file existence disclosure by setting Terminal/DebconfSocket properties, aka GHSL-2020-192 and GHSL-2020-196. This affected versions prior to 1.1.1+bzr982-0ubuntu34.1, 1.1.1+bzr982-0ubuntu32.3, 1.1.1+b…

CVE-2020-1717LOWCVSS 2.7EG 2.7

2021-02-11

A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack.

CVE-2020-19275MEDIUMCVSS 5.3EG 5.3

2021-05-12

An Information Disclosure vulnerability exists in dhcms 2017-09-18 when entering invalid characters after the normal interface, which causes an error that will leak the physical path.

CVE-2020-20470MEDIUMCVSS 5.3EG 5.3

2021-06-21

White Shark System (WSS) 1.3.2 has web site physical path leakage vulnerability.

CVE-2020-23995MEDIUMCVSS 6.5EG 6.5

2021-05-13

An information disclosure vulnerability in ILIAS before 5.3.19, 5.4.12 and 6.0 allows remote authenticated attackers to get the upload data path via a workspace upload.

CVE-2020-24925HIGHCVSS 7.5EG 7.5

2020-09-15

A Sensitive Source Code Path Disclosure vulnerability is found in ElkarBackup v1.3.3. An attacker is able to view the path of the source code jobs/sort where entire source code path is displayed in the browser itself helping the attacker i…

CVE-2020-2505LOWCVSS 2.3EG 2.3

2020-12-24

If exploited, this vulnerability could allow attackers to gain sensitive information via generation of error messages. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later.

CVE-2020-25633MEDIUMCVSS 5.3EG 5.3

2020-09-18

A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client users to obtain the server's potentially sensitive information when the server got WebApplicationException from the RESTEasy client call…

CVE-2020-25640MEDIUMCVSS 5.3EG 5.3

2020-11-24

A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensitive information in the log file.

CVE-2020-25778MEDIUMCVSS 6.0EG 6.0

2020-10-14

Trend Micro Antivirus for Mac 2020 (Consumer) has a vulnerability in a specific kernel extension where an attacker could supply a kernel pointer and leak several bytes of memory. An attacker must first obtain the ability to execute high-pr…

CWE-209— Generation of Error Message Containing Sensitive Information

CVEs classified under CWE-209page 2 of 11

Map vulnerabilities like CWE-209 to your infrastructure