IBM Sterling File Gateway 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This …

CVE-2021-39458MEDIUMCVSS 6.5EG 6.5

2021-09-09

Triggering an error page of the import process in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user has to alternate the files of a vaild file backup. This leads of leaking the database credentials in the environmen…

CVE-2021-3986MEDIUMCVSS 4.3EG 4.3

2024-11-15

A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users. This issue occurs in the file shelf.py at line 221, where the name of the shelf is exposed in an error message…

CVE-2021-40126MEDIUMCVSS 4.3EG 4.3

2021-11-04

A vulnerability in the web-based dashboard of Cisco Umbrella could allow an authenticated, remote attacker to perform an email enumeration attack against the Umbrella infrastructure. This vulnerability is due to an overly descriptive error…

CVE-2021-40338LOWCVSS 3.7EG 5.3

2022-01-28

Hitachi Energy LinkOne product, has a vulnerability due to a web server misconfiguration, that enables debug mode and reveals the full path of the filesystem directory when an attacker generates errors during a query operation. This issue …

CVE-2021-4177MEDIUMCVSS 5.3EG 5.3

2021-12-28

livehelperchat is vulnerable to Generation of Error Message Containing Sensitive Information

CVE-2021-42777CRITICALCVSS 9.8EG 9.8

2022-10-29

Stimulsoft (aka Stimulsoft Reports) 2013.1.1600.0, when Compilation Mode is used, allows an attacker to execute arbitrary C# code on any machine that renders a report, including the application server or a user's local machine, as demonstr…

CVE-2021-43206MEDIUMCVSS 4.3EG 4.3

2022-05-04

A server-generated error message containing sensitive information in Fortinet FortiOS 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.x, 6.0.x and FortiProxy 7.0.0 through 7.0.1, 2.0.x allows malicious webservers to retrieve a web proxy's cl…

CVE-2021-43542MEDIUMCVSS 6.5EG 6.5

2021-12-08

Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.

CVE-2021-44155MEDIUMCVSS 5.3EG 5.3

2021-12-13

An issue was discovered in /goform/login_process in Reprise RLM 14.2. When an attacker attempts to login, the response if a username is valid includes Login Failed, but does not include this string if the username is invalid. This allows a…

CVE-2021-46353MEDIUMCVSS 5.3EG 5.3

2022-03-04

An information disclosure in web interface in D-Link DIR-X1860 before 1.03 RevA1 allows a remote unauthenticated attacker to send a specially crafted HTTP request and gain knowledge of different absolute paths that are being used by the we…

CVE-2021-47161MEDIUMCVSS 5.5EG 5.5

2024-03-25

In the Linux kernel, the following vulnerability has been resolved: spi: spi-fsl-dspi: Fix a resource leak in an error handling path 'dspi_request_dma()' should be undone by a 'dspi_release_dma()' call in the error handling path of the p…

CVE-2021-47381MEDIUMCVSS 5.5EG 5.5

2024-05-21

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Fix DSP oops stack dump output contents Fix @buf arg given to hex_dump_to_buffer() and stack address used in dump error output.

CVE-2022-0079MEDIUMCVSS 5.3EG 5.3

2022-01-03

showdoc is vulnerable to Generation of Error Message Containing Sensitive Information

CVE-2022-0083MEDIUMCVSS 5.3EG 5.3

2022-01-04

livehelperchat is vulnerable to Generation of Error Message Containing Sensitive Information

CVE-2022-0504MEDIUMCVSS 6.5EG 6.5

2022-02-08

Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.

CVE-2022-0563MEDIUMCVSS 5.5EG 5.5

2022-02-21

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specifi…

CVE-2022-0622MEDIUMCVSS 5.3EG 5.3

2022-02-17

Generation of Error Message Containing Sensitive Information in Packagist snipe/snipe-it prior to 5.3.11.

CVE-2022-0660HIGHCVSS 7.5EG 7.5

2022-02-18

Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.

CVE-2022-1120MEDIUMCVSS 4.8EG 6.5

2022-04-04

Missing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 exposed sensitive information when an include directive fails in the CI/CD configuration.

CVE-2022-20525LOWCVSS 3.3EG 3.3

2022-12-16

In enforceVisualVoicemailPackage of PhoneInterfaceManager.java, there is a possible leak of visual voicemail package name due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges…

CVE-2022-2062HIGHCVSS 7.5EG 7.5

2022-06-13

Generation of Error Message Containing Sensitive Information in GitHub repository nocodb/nocodb prior to 0.91.7+.

CVE-2022-22162HIGHCVSS 7.3EG 7.3

2022-01-19

A Generation of Error Message Containing Sensitive Information vulnerability in the CLI of Juniper Networks Junos OS allows a locally authenticated attacker with low privileges to elevate these to the level of any other user logged in via …

CVE-2022-22363MEDIUMCVSS 4.3EG 4.3

2025-01-07

IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in furth…

CVE-2022-22449MEDIUMCVSS 5.3EG 5.3

2022-12-24

IBM Security Verify Governance, Identity Manager 10.01 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks aga…

CVE-2022-22760MEDIUMCVSS 6.5EG 6.5

2022-12-22

When importing resources using Web Workers, error messages would distinguish the difference between <code>application/javascript</code> responses and non-script responses. This could have been abused to learn information cross-origin. This…

CVE-2022-23794MEDIUMCVSS 5.3EG 5.3

2022-03-30

An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Uploading a file name of an excess length causes the error. This error brings up the screen with the path of the source code of the web application.

CVE-2022-24731MEDIUMCVSS 6.8EG 6.8

2022-03-23

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal vulnerability, allowing a malicious user with read…

CVE-2022-24906LOWCVSS 3.5EG 3.5

2022-05-20

Nextcloud Deck is a Kanban-style project & personal management tool for Nextcloud, similar to Trello. The full path of the application is exposed to unauthorized users. It is recommended that the Nextcloud Deck app is upgraded to 1.2.11, 1…

CVE-2022-2508MEDIUMCVSS 5.3EG 5.3

2022-10-27

In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to due to verbose error messaging.

CVE-2022-26070MEDIUMCVSS 4.3EG 4.3

2022-05-06

When handling a mismatched pre-authentication cookie, the application leaks the internal error message in the response, which contains the Splunk Enterprise local system path. The vulnerability impacts Splunk Enterprise versions before 8.1…

CVE-2022-26973MEDIUMCVSS 5.3EG 5.3

2022-06-02

Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. By tweaking the license file name, the returned error message exposes internal directory path detai…

CVE-2022-2760MEDIUMCVSS 4.3EG 4.3

2022-09-28

In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an error message when a resource is part of another Space.

CVE-2022-29266HIGHCVSS 7.5EG 7.5

2022-04-20

In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned from the dependency lua-resty-jwt contains sensitive information.

CVE-2022-31023MEDIUMCVSS 5.9EG 5.9

2022-06-02

Play Framework is a web framework for Java and Scala. Verions prior to 2.8.16 are vulnerable to generation of error messages containing sensitive information. Play Framework, when run in dev mode, shows verbose errors for easy debugging, i…

CVE-2022-31047MEDIUMCVSS 5.3EG 5.3

2022-06-14

TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, system internal credentials or keys (e.g. database credentials) can be logged as plaintext in exception h…

CVE-2022-31124HIGHCVSS 7.7EG 7.7

2022-07-06

openssh_key_parser is an open source Python package providing utilities to parse and pack OpenSSH private and public key files. In versions prior to 0.0.6 if a field of a key is shorter than it is declared to be, the parser raises an error…

CVE-2022-31140HIGHCVSS 7.5EG 7.5

2022-07-11

Valinor is a PHP library that helps to map any input into a strongly-typed value object structure. Prior to version 0.12.0, Valinor can use `Throwable#getMessage()` when it should not have permission to do so. This is a problem with cases …

CVE-2022-31189MEDIUMCVSS 5.3EG 5.3

2022-08-01

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. When an "Internal System Error" occurs in the JSPUI, then entire exception (including st…

CVE-2022-31229CRITICALCVSS 9.6EG 4.9

2022-06-28

Dell PowerScale OneFS, 8.2.x through 9.3.0.x, contain an error message with sensitive information. An administrator could potentially exploit this vulnerability, leading to disclosure of sensitive information. This sensitive information ca…

CVE-2022-32756LOWCVSS 2.7EG 2.7

2024-03-22

IBM Security Verify Directory 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. …

CVE-2022-33930MEDIUMCVSS 4.3EG 7.5

2022-08-10

Dell Wyse Management Suite 3.6.1 and below contains Information Disclosure in Devices error pages. An attacker could potentially exploit this vulnerability, leading to the disclosure of certain sensitive information. The attacker may be ab…

CVE-2022-34881LOWCVSS 3.3EG 3.3

2022-12-06

Generation of Error Message Containing Sensitive Information vulnerability in Hitachi JP1/Automatic Operation allows local users to gain sensitive information. This issue affects JP1/Automatic Operation: from 10-00 through 10-54-03, from …

CVE-2022-34882CRITICALCVSS 9.0EG 6.5

2022-09-06

Information Exposure Through an Error Message vulnerability in Hitachi RAID Manager Storage Replication Adapter allows remote authenticated users to gain sensitive information. This issue affects: Hitachi RAID Manager Storage Replication A…

CVE-2022-35640MEDIUMCVSS 4.0EG 4.0

2024-07-16

IBM Sterling Partner Engagement Manager 6.2.2 could allow a local attacker to obtain sensitive information when a detailed technical error message is returned. IBM X-Force ID: 230933.

CVE-2022-35715HIGHCVSS 7.5EG 7.5

2022-08-10

IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in a stack trace. This information could be used in further attacks against the system…

CVE-2022-38107MEDIUMCVSS 5.3EG 5.3

2022-10-19

Sensitive information could be displayed when a detailed technical error message is posted. This information could disclose environmental details.

CVE-2022-39304MEDIUMCVSS 5.0EG 5.0

2022-12-20

ghinstallation provides transport, which implements http.RoundTripper to provide authentication as an installation for GitHub Apps. In ghinstallation version 1, when the request to refresh an installation token failed, the HTTP request and…

CVE-2022-39307MEDIUMCVSS 6.7EG 6.7

2022-11-09

Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the `/api/user/password/sent-reset-email` URL. When the username or email does not exist, a JS…

CVE-2022-39315MEDIUMCVSS 6.5EG 6.5

2022-10-25

Kirby is a Content Management System. Prior to versions 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, a user enumeration vulnerability affects all Kirby sites with user accounts unless Kirby's API and Panel are disabled in the config. It can only …

CWE-209— Generation of Error Message Containing Sensitive Information

CVEs classified under CWE-209page 5 of 11

Map vulnerabilities like CWE-209 to your infrastructure