CWE-209— Generation of Error Message Containing Sensitive Information

The product generates an error message that includes sensitive information about its environment, users, or associated data.— MITRE CWE catalog

680 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-209page 12 of 14

CVE-2021-39018MEDIUMCVSS 4.3EG 4.3
2022-07-14
IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could disclose sensitive information in a SQL error message that could aid in further attacks against the system. IBM X-Force ID: 213726.
CVE-2022-26070MEDIUMCVSS 4.3EG 4.3
2022-05-06
When handling a mismatched pre-authentication cookie, the application leaks the internal error message in the response, which contains the Splunk Enterprise local system path. The vulnerability impacts Splunk Enterprise versions before 8.1…
CVE-2021-43206MEDIUMCVSS 4.3EG 4.3
2022-05-04
A server-generated error message containing sensitive information in Fortinet FortiOS 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.x, 6.0.x and FortiProxy 7.0.0 through 7.0.1, 2.0.x allows malicious webservers to retrieve a web proxy's cl…
CVE-2021-40126MEDIUMCVSS 4.3EG 4.3
2021-11-04
A vulnerability in the web-based dashboard of Cisco Umbrella could allow an authenticated, remote attacker to perform an email enumeration attack against the Umbrella infrastructure. This vulnerability is due to an overly descriptive error…
CVE-2021-20552MEDIUMCVSS 4.3EG 4.3
2021-10-07
IBM Sterling File Gateway 6.0.0.0 through 6.1.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against t…
CVE-2021-20485MEDIUMCVSS 4.3EG 4.3
2021-09-23
IBM Sterling File Gateway 2.2.0.0 through 6.1.0.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against t…
CVE-2020-4941MEDIUMCVSS 4.3EG 4.3
2021-09-23
IBM Edge 4.2 could reveal sensitive version information about the server from error pages that could aid an attacker in further attacks against the system. IBM X-Force ID: 191941.
CVE-2021-20508MEDIUMCVSS 4.3EG 4.3
2021-09-14
IBM Security Secret Server up to 11.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. I…
CVE-2021-22249MEDIUMCVSS 4.3EG 4.3
2021-08-23
A verbose error message in GitLab EE affecting all versions since 12.2 could disclose the private email address of a user invited to a group
CVE-2021-29784MEDIUMCVSS 4.3EG 4.3
2021-07-26
IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. …
CVE-2021-20424MEDIUMCVSS 4.3EG 4.3
2021-07-13
IBM Cloud Pak for Applications 4.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. X-Fo…
CVE-2021-20417MEDIUMCVSS 4.3EG 4.3
2021-07-07
IBM Guardium Data Encryption (GDE) 4.0.0.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the syst…
CVE-2021-20413MEDIUMCVSS 4.3EG 4.3
2021-06-28
IBM Guardium Data Encryption (GDE) 4.0.0.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the syst…
CVE-2021-31341MEDIUMCVSS 4.3EG 4.3
2021-05-12
Uploading a table mapping using a manipulated XML file results in an exception that could expose information about the application-server and the used XML-framework on the Mendix Database Replication Module (All versions prior to v7.0.1).
CVE-2021-31339MEDIUMCVSS 4.3EG 4.3
2021-05-12
A vulnerability has been identified in Mendix Excel Importer Module (All versions < V9.0.3). Uploading a manipulated XML File results in an exception that could expose information about the Application-Server and the used XML-Framework.
CVE-2020-4536MEDIUMCVSS 4.3EG 4.3
2021-05-11
IBM OpenPages GRC Platform 8.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Fo…
CVE-2021-3393MEDIUMCVSS 4.3EG 4.3
2021-04-01
An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user having UPDATE permission but not SELECT permission to a particular column could craft queries which, under some circumstances, m…
CVE-2021-22169MEDIUMCVSS 4.3EG 4.3
2021-03-24
An issue was identified in GitLab EE 13.4 or later which leaked internal IP address via error messages.
CVE-2021-23968MEDIUMCVSS 4.3EG 4.3
2021-02-26
If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation report; as opposed to the original frame URI. This could be used to leak sensitive information contai…
CVE-2020-15219MEDIUMCVSS 4.3EG 4.3
2021-01-13
Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, when a download error is triggered in the user portal, an SQL query is displayed to the user. This is fixed in versions 2.7.2 and 3.0.0.
CVE-2020-4544MEDIUMCVSS 4.3EG 4.3
2021-01-08
IBM Jazz Foundation Products could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Forc…
CVE-2020-4487MEDIUMCVSS 4.3EG 4.3
2021-01-08
IBM Jazz Foundation Products could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Forc…
CVE-2020-4483MEDIUMCVSS 4.3EG 4.3
2020-11-06
IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further a…
CVE-2020-15794MEDIUMCVSS 4.3EG 4.3
2020-10-15
A vulnerability has been identified in Desigo Insight (All versions). Some error messages in the web application show the absolute path to the requested resource. This could allow an authenticated attacker to retrieve additional informatio…
CVE-2018-19947MEDIUMCVSS 4.3EG 4.3
2020-09-11
The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this information exposure vulnerability could disclose sensitive information. QNAP has already fixed the issue in Helpdesk 3.0.3 and later.
CVE-2020-4319MEDIUMCVSS 4.3EG 4.3
2020-07-28
IBM MQ, IBM MQ Appliance, and IBM MQ for HPE NonStop 8.0, 9.1 LTS, and 9.1 CD could allow under special circumstances, an authenticated user to obtain sensitive information due to a data leak from an error message within the pre-v7 pubsub …
CVE-2020-4357MEDIUMCVSS 4.3EG 4.3
2020-05-27
IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the syst…
CVE-2019-4729MEDIUMCVSS 4.3EG 4.3
2020-04-27
IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM …
CVE-2019-4593MEDIUMCVSS 4.3EG 4.3
2020-04-15
IBM QRadar 7.3.0 to 7.3.3 Patch 2 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-ForceID: 167743.
CVE-2020-6438MEDIUMCVSS 4.3EG 4.3
2020-04-13
Insufficient policy enforcement in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Ch…
CVE-2019-4601MEDIUMCVSS 4.3EG 4.3
2020-04-08
IBM Quality Manager (RQM) 6.02, 6.06, and 6.0.6.1 could allow an authenticated user to obtain sensitive information from a stack trace that could aid in further attacks against the system.
CVE-2019-4583MEDIUMCVSS 4.3EG 4.3
2020-02-20
IBM Maximo Asset Management 7.6.0.10 and 7.6.1.1 could allow an authenticated user to obtain sensitive information from a stack trace that could be used to aid future attacks. IBM X-Force ID: 167289.
CVE-2018-21032MEDIUMCVSS 4.3EG 4.3
2020-02-14
A vulnerability in Hitachi Command Suite prior to 8.7.1-00 and Hitachi Automation Director prior to 8.5.0-00 allow authenticated remote users to expose technical information through error messages. Hitachi Command Suite includes Hitachi De…
CVE-2014-8161MEDIUMCVSS 4.3EG 4.3
2020-01-27
PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the erro…
CVE-2019-4512MEDIUMCVSS 4.3EG 4.3
2019-10-09
IBM Maximo Asset Management 7.6.1.1 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force ID: 164554.
CVE-2019-11662MEDIUMCVSS 4.3EG 4.3
2019-09-18
Class and method names in error message in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. This vulnerability could be exploited in some special cases to allo…
CVE-2019-4485MEDIUMCVSS 4.3EG 4.3
2019-08-20
IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive information that could be used in further …
CVE-2019-4484MEDIUMCVSS 4.3EG 4.3
2019-08-20
IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive information that could be used in further …
CVE-2019-4308MEDIUMCVSS 4.3EG 4.3
2019-08-20
IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 could allow an authenticated user to obtain sensitive information from error messages IBM X-F…
CVE-2019-4377MEDIUMCVSS 4.3EG 4.3
2019-06-25
IBM Sterling B2B Integrator 6.0.0.0 and 6.0.0.1 reveals sensitive information from a stack trace that could be used in further attacks against the system. IBM X-Force ID: 162803.
CVE-2019-12903MEDIUMCVSS 4.3EG 4.3
2019-06-20
Pydio Cells before 1.5.0, when supplied with a Name field in an unexpected Unicode format, fails to handle this and includes the database column/table name as pert of the error message, exposing sensitive information.
CVE-2019-4257MEDIUMCVSS 4.3EG 4.3
2019-06-06
IBM InfoSphere Information Server 11.5 and 11.7 is affected by an information disclosure vulnerability. Sensitive information in an error message may be used to conduct further attacks against the system. IBM X-Force ID: 159945.
CVE-2019-12215MEDIUMCVSS 4.3EG 4.3
2019-05-20
A full path disclosure vulnerability was discovered in Matomo v3.9.1 where a user can trigger a particular error to discover the full path of Matomo on the disk, because lastError.file is used in plugins/CorePluginsAdmin/templates/safemode…
CVE-2018-14623MEDIUMCVSS 4.3EG 4.3
2018-12-14
A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an inco…
CVE-2017-0885MEDIUMCVSS 4.3EG 4.3
2017-04-05
Nextcloud Server before 9.0.55 and 10.0.2 suffers from a error message disclosing existence of file in write-only share. Due to an error in the application logic an adversary with access to a write-only share may enumerate the names of exi…
CVE-2025-23185MEDIUMCVSS 4.1EG 4.1
2025-03-11
Due to improper error handling in SAP Business Objects Business Intelligence Platform, technical details of the application are revealed in exceptions thrown to the user and in stack traces. Only an attacker with administrator level privil…
CVE-2025-49128MEDIUMCVSS 4.0EG 4.0
2025-06-06
Jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. Starting in version 2.0.0 and prior to version 2.13.0, a flaw in jackson-core's `JsonLocation._appendSourceDes…
CVE-2022-35640MEDIUMCVSS 4.0EG 4.0
2024-07-16
IBM Sterling Partner Engagement Manager 6.2.2 could allow a local attacker to obtain sensitive information when a detailed technical error message is returned. IBM X-Force ID: 230933.
CVE-2023-40725MEDIUMCVSS 4.0EG 4.0
2023-09-12
A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application returns inconsistent error messages in response to invalid user credentials during login session. This allows an attacker to enumerate …
CVE-2026-21809LOWCVSS 3.9EG 3.9
2026-08-26
HCL BigFix Quantum Risk Analyzer has a certain validation process that provides overly descriptive error messages when it encounters malformed input which can allow an attacker to conduct more efficient reconnaissance and fine-tune automat…

Map vulnerabilities like CWE-209 to your infrastructure

EchelonGraph correlates every CVE — across CWE-209 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →