CWE-209— Generation of Error Message Containing Sensitive Information
The product generates an error message that includes sensitive information about its environment, users, or associated data.— MITRE CWE catalog
680 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-209page 14 of 14
- CVE-2026-79777LOWCVSS 2.7EG 2.72026-08-25
rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses.
- CVE-2026-49979LOWCVSS 2.7EG 2.72026-06-24
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.99, the POST /api/v1/admin/send-test-email endpoint accepts attacker-controlled smtpHost and smtpPort values and establishes a raw JavaMail TCP connec…
- CVE-2026-45723LOWCVSS 2.7EG 2.72026-06-05
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go passes the caller-controlled TalosVersion field to imageFactoryClient…
- CVE-2026-5511LOWCVSS 2.7EG 2.72026-05-19
In the web management interface of Archer AX72 (SG) v1, the network diagnostic feature improperly handles invalid user input, resulting in limited exposure of diagnostic command usage information. An authenticated attacker with adminis…
- CVE-2025-66549LOWCVSS 2.7EG 2.72025-12-05
Nextcloud Desktop is the desktop sync client for Nextcloud. Prior to 3.16.5, when trying to manually lock a file inside an end-to-end encrypted directory, the path of the file was sent to the server unencrypted, making it possible for admi…
- CVE-2025-13596LOWCVSS 2.7EG 2.72025-11-24
A sensitive information disclosure vulnerability exists in the error handling component of ATISoluciones CIGES Application version 2.15.6 and earlier. When certain unexpected conditions trigger unhandled exceptions, the application returns…
- CVE-2024-55895LOWCVSS 2.7EG 2.72025-03-29
IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
- CVE-2025-31141LOWCVSS 2.7EG 2.72025-03-27
In JetBrains TeamCity before 2025.03 exception could lead to credential leakage on Cloud Profiles page
- CVE-2024-45658LOWCVSS 2.7EG 2.72025-02-04
IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks a…
- CVE-2022-32756LOWCVSS 2.7EG 2.72024-03-22
IBM Security Verify Directory 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. …
- CVE-2022-43891LOWCVSS 2.7EG 2.72023-10-17
IBM Security Verify Privilege On-Premises 11.5 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against th…
- CVE-2023-34110LOWCVSS 2.7EG 2.72023-06-22
Flask-AppBuilder is an application development framework, built on top of Flask. Prior to version 4.3.2, an authenticated malicious actor with Admin privileges, could by adding a special character on the add, edit User forms trigger a data…
- CVE-2021-38894LOWCVSS 2.7EG 2.72022-01-10
IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against …
- CVE-2021-20377LOWCVSS 2.7EG 2.72021-09-23
IBM Security Guardium 11.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force …
- CVE-2021-20523LOWCVSS 2.7EG 2.72021-07-15
IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system…
- CVE-2021-20499LOWCVSS 2.7EG 2.72021-07-15
IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system…
- CVE-2020-1717LOWCVSS 2.7EG 2.72021-02-11
A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack.
- CVE-2021-20402LOWCVSS 2.7EG 2.72021-02-11
IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks again…
- CVE-2020-4846LOWCVSS 2.7EG 2.72020-12-17
IBM Security Key Lifecycle Manager 3.0.1 and 4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against th…
- CVE-2019-4699LOWCVSS 2.7EG 2.72020-08-26
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 171931.
- CVE-2020-4248LOWCVSS 2.7EG 2.72020-05-28
IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks aga…
- CVE-2020-4164LOWCVSS 2.7EG 2.72020-04-08
IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could expose sensitive information from applicatino errors which could be used in further attacks against the system. IBM X-Force ID: 174400.
- CVE-2019-4636LOWCVSS 2.7EG 2.72020-01-28
IBM Security Secret Server 10.7 could disclose sensitive information to an authenticated user from generated error messages. IBM X-Force ID: 170013.
- CVE-2024-41984LOWCVSS 2.6EG 2.62025-08-12
A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SOA Cockpit (All versions >= V13.2 < V2506). The affected application improperly h…
- CVE-2026-82727LOWCVSS 2.3EG 2.32026-08-31
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, cr…
- CVE-2020-2505LOWCVSS 2.3EG 2.32020-12-24
If exploited, this vulnerability could allow attackers to gain sensitive information via generation of error messages. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later.
- CVE-2019-9455LOWCVSS 2.3EG 2.32019-09-06
In the Android kernel in the video driver there is a kernel pointer leak due to a WARN_ON statement. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
- CVE-2026-82739LOWCVSS 2.1EG 2.12026-09-01
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who fails its confirmation check. Ash.Resource.Validation.Confirm's atomic implement…
- CVE-2026-7860LOWCVSS 1.6EG 1.62026-05-19
A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaadin Gradle plugin that exposes the full set of environment variables in build logs whenever the frontend build process exits with a non-zero status. B…
- CVE-2023-40457UnratedEG not assessed2024-11-11
The BGP daemon in Extreme Networks ExtremeXOS (aka EXOS) 30.7.1.1 allows an attacker (who is not on a directly connected network) to cause a denial of service (BGP session reset) because of BGP attribute error mishandling (for attribute 21…
Map vulnerabilities like CWE-209 to your infrastructure
EchelonGraph correlates every CVE — across CWE-209 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →