CWE-209 · Information Disclosure
Generation of Error Message Containing Sensitive Information
632CVEs
3exploited
5with a public check
5likely (EPSS 10%+)
SortMost likely exploited
632 CVEs with CWE-209 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-29059In CISA KEVExploited.NET Framework - Leaking ObjRefs via HTTP .NET RemotingMicrosoft · Microsoft .NET Framework 4.8 · CVSS 7.5 · 2024-03-22 | 7.5 | 99% | 2024-03-22 |
| CVE-2025-47813In CISA KEVExploitedWing FTP Server <= 7.4.3 - Path Disclosure via Overlong UID Cookiewftpserver · Wing FTP Server · CVSS 4.3 · 2025-07-10 | 4.3 | 63% | 2025-07-10 |
| CVE-2013-7331In CISA KEVExploitedThe Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share pathnames, intranet host…Microsoft · Internet Explorer · CVSS 6.5 · 2014-02-26 | 6.5 | 50% | 2014-02-26 |
| CVE-2024-45440CheckDrupal 11.x-dev - Full Path DisclosureDrupal · Drupal core · CVSS 5.3 · 2024-08-29 | 5.3 | 9.3% | 2024-08-29 |
| CVE-2022-0660CheckMicroweber <1.2.11 - Information Disclosuremicroweber · microweber/microweber · CVSS 9.4 · 2022-02-18 | 9.4 | 6.9% | 2022-02-18 |
| CVE-2023-27587CheckReadToMyShoe - Generation of Error Message Containing Sensitive Informationrozbb · readtomyshoe · CVSS 7.4 · 2023-03-13 | 7.4 | 3.9% | 2023-03-13 |
| CVE-2024-44762CheckUsermin 2.100 - Username EnumerationWebmin · Usermin · CVSS 5.3 · 2024-10-16 | 5.3 | 2.6% | 2024-10-16 |
| CVE-2023-5089CheckDefender Security < 4.1.0 - Protection Bypass (Hidden Login Page)Wpmudev · Defender Security · CVSS 5.3 · 2023-10-16 | 5.3 | 2.5% | 2023-10-16 |
| CVE-2010-3332Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error code…Microsoft · .net Framework · 2010-09-22 | – | 68% | 2010-09-22 |
| CVE-2021-30357SSL Network Extender Client for Linux before build 800008302 reveals part of the contents of the configuration file supplied, which allows partially disclosing files to which the…Checkpoint · SSL Network Extender Client for Linux · 2021-06-08 | – | 23% | 2021-06-08 |
| CVE-2021-31159Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-message generation in the Forgot Password functionality, aka SDPM…Zohocorp · Manageengine Servicedesk Plus Msp · 2021-06-16 | – | 18% | 2021-06-16 |
| CVE-2020-11883In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used in VueStorefront PWA, unexpected HTTP requests lead to an exception that discloses the er…Divante · Storefront-Api · 2020-04-17 | – | 15% | 2020-04-17 |
| CVE-2024-21733Apache Tomcat: Leaking of unrelated request bodies in default error pageApache Software Foundation · Apache Tomcat · CVSS 5.3 · 2024-01-19 | 5.3 | 14% | 2024-01-19 |
| CVE-2018-17961Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving errorhandler setup. NOTE: this issue exists because of an inco…Artifex · Ghostscript · 2018-10-15 | – | 10.0% | 2018-10-15 |
| CVE-2026-29146Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by defaultApache Software Foundation · Apache Tomcat · CVSS 7.5 · 2026-04-09 | 7.5 | 8.8% | 2026-04-09 |
| CVE-2022-29266apisix/jwt-auth may leak secrets in error responseApache Software Foundation · Apache APISIX · 2022-04-20 | – | 8.1% | 2022-04-20 |
| CVE-2023-20593An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information.AMD · Ryzen™ 3000 Series Desktop Processors “Matisse” AM4 · 2023-07-24 | – | 5.1% | 2023-07-24 |
| CVE-2020-15478The Journal theme before 3.1.0 for OpenCart allows exposure of sensitive data via SQL errors.Journal-Theme · Journal · 2020-07-01 | – | 4.7% | 2020-07-01 |
| CVE-2024-39719An issue was discovered in Ollama through 0.3.14. File existence disclosure can occur via api/create. When calling the CreateModel route with a path parameter that does not exist,…Ollama · Ollama · CVSS 7.5 · 2024-10-31 | 7.5 | 4.2% | 2024-10-31 |
| CVE-2018-12536In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and…The Eclipse Foundation · Eclipse Jetty · 2018-06-27 | – | 4.2% | 2018-06-27 |
| CVE-2021-22885A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper with untrusted user i…Rubyonrails · https://github.com/rails/rails · 2021-05-27 | – | 4.0% | 2021-05-27 |
| CVE-2018-11325An issue was discovered in Joomla! Core before 3.8.8. The web install application would autofill password fields after either a form validation error or navigating to a previous i…Joomla · Joomla! · 2018-05-22 | – | 3.1% | 2018-05-22 |
| CVE-2019-7941Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Information Exposure Through an Error Message vulnerability. Successful exploitation could lead to Informa…Adobe · Adobe Campaign · 2019-07-18 | – | 3.1% | 2019-07-18 |
| CVE-2000-1191htsearch program in htDig 3.2 beta, 3.1.6, 3.1.5, and earlier allows remote attackers to determine the physical path of the server by requesting a non-existent configuration file…Htdig Project · Htdig · 2001-09-12 | – | 3.0% | 2001-09-12 |
| CVE-2019-4269IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console could allow a remote attacker to obtain sensitive information when a specially crafted url causes a stack tra…IBM · WebSphere Application Server · CVSS 5.3 · 2019-06-28 | 5.3 | 2.7% | 2019-06-28 |
| CVE-2018-12886stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction se…Gnu · Gcc · 2019-05-22 | – | 2.7% | 2019-05-22 |
| CVE-2021-25958Generation of Error Message Containing Sensitive Information in Apache OFBizapache · ofbiz-framework · CVSS 6.5 · 2021-08-30 | 6.5 | 2.6% | 2021-08-30 |
| CVE-2014-8161PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values…PostgreSQL Global Development Group · PostgreSQL · 2020-01-27 | – | 2.5% | 2020-01-27 |
| CVE-2019-7612A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs. If a malformed URL is specified as part of the Logstash config…Elastic · Logstash · 2019-03-25 | – | 2.4% | 2019-03-25 |
| CVE-2024-28939Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft · Microsoft SQL Server 2019 (CU 25) · CVSS 8.8 · 2024-04-09 | 8.8 | 2.3% | 2024-04-09 |
| CVE-2021-46353An information disclosure in web interface in D-Link DIR-X1860 before 1.03 RevA1 allows a remote unauthenticated attacker to send a specially crafted HTTP request and gain knowled…Dlink · Dir-X1860 Firmware · 2022-03-04 | – | 2.2% | 2022-03-04 |
| CVE-2021-29688IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This informat…IBM · Security Identity Manager · CVSS 5.3 · 2021-05-20 | 5.3 | 2.0% | 2021-05-20 |
| CVE-2019-14433An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2. If an API request from an authenticated user ends in a fault condition due to…Openstack · Nova · 2019-08-09 | – | 2.0% | 2019-08-09 |
| CVE-2019-9223An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposure.Gitlab · Gitlab · 2019-04-17 | – | 2.0% | 2019-04-17 |
| CVE-2018-10913An information disclosure vulnerability was discovered in glusterfs server. An attacker could issue a xattr request via glusterfs FUSE to determine the existence of any file.Red Hat · glusterfs · CVSS 3.5 · 2018-09-04 | 3.5 | 2.0% | 2018-09-04 |
| CVE-2021-44155An issue was discovered in /goform/login_process in Reprise RLM 14.2. When an attacker attempts to login, the response if a username is valid includes Login Failed, but does not i…Reprisesoftware · Reprise License Manager · 2021-12-13 | – | 1.9% | 2021-12-13 |
| CVE-2017-2594hawtio before versions 2.0-beta-1, 2.0-beta-2 2.0-m1, 2.0-m2, 2.0-m3, and 1.5 is vulnerable to a path traversal that leads to a NullPointerException with a full stacktrace. An att…Hawt · hawtio · CVSS 5.4 · 2018-05-08 | 5.4 | 1.8% | 2018-05-08 |
| CVE-2019-7550In JForum 2.1.8, an unauthenticated, remote attacker can enumerate whether a user exists by using the "create user" function. If a register/check/username?username= request corres…Jforum · Jforum · 2019-02-12 | – | 1.8% | 2019-02-12 |
| CVE-2017-7945The GlobalProtect external interface in Palo Alto Networks PAN-OS before 6.1.17, 7.x before 7.0.15, 7.1.x before 7.1.9, and 8.x before 8.0.2 provides different error messages for…Paloaltonetworks · Pan-Os · 2017-04-29 | – | 1.8% | 2017-04-29 |
| CVE-2021-43542Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols. This vulnerability affects Thunderbird < 9…Mozilla · Thunderbird · 2021-12-08 | – | 1.8% | 2021-12-08 |
| CVE-2018-1073The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and invalid passwords, allowing an attacker to discover the names…Ovirt · ovirt-engine · CVSS 5.3 · 2018-06-19 | 5.3 | 1.8% | 2018-06-19 |
| CVE-2020-4239IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser…IBM · Tivoli Netcool Impact · CVSS 5.3 · 2020-03-31 | 5.3 | 1.8% | 2020-03-31 |
| CVE-2018-8042Apache Ambari, version 2.5.0 to 2.6.2, passwords for Hadoop credential stores are exposed in Ambari Agent informational log messages when the credential store feature is enabled f…Apache Software Foundation · Apache Ambari · 2018-07-18 | – | 1.8% | 2018-07-18 |
| CVE-2020-4572IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. Th…IBM · Security Key Lifecycle Manager · CVSS 5.3 · 2020-07-29 | 5.3 | 1.7% | 2020-07-29 |
| CVE-2019-7644Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT signature. If this error message is pres…Auth0 · Auth0-Wcf-Service-Jwt · 2019-04-11 | – | 1.7% | 2019-04-11 |
| CVE-2020-6511Information leak in content security policy in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page.Google · Chrome · 2020-07-22 | – | 1.7% | 2020-07-22 |
| CVE-2012-0059Spacewalk-backend: spacewalk-backend: information disclosure via cleartext passwords in error messagesRed Hat · Red Hat Network Proxy v 5.4 · CVSS 4.9 · 2014-02-05 | 4.9 | 1.7% | 2014-02-05 |
| CVE-2019-6792An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Path Disclosure. When an error is encou…Gitlab · Gitlab · 2019-09-09 | – | 1.6% | 2019-09-09 |
| CVE-2020-4897IBM Emptoris Contract Management and IBM Emptoris Spend Analysis 10.1.0, 10.1.1, and 10.1.3 could allow a remote attacker to obtain sensitive information when a detailed technical…IBM · Emptoris Contract Management · CVSS 5.3 · 2021-01-07 | 5.3 | 1.6% | 2021-01-07 |
| CVE-2019-4441IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and Liberty could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser. IBM X…IBM · WebSphere Application Server · CVSS 5.3 · 2019-10-03 | 5.3 | 1.6% | 2019-10-03 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.