CWE-209— Generation of Error Message Containing Sensitive Information

The product generates an error message that includes sensitive information about its environment, users, or associated data.— MITRE CWE catalog

678 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-209page 3 of 14

CVE-2021-22885HIGHCVSS 7.5EG 7.5
2021-05-27
A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper with untrusted user input.
CVE-2021-29688HIGHCVSS 7.5EG 7.5
2021-05-20
IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM…
CVE-2021-20393HIGHCVSS 7.5EG 7.5
2021-05-14
IBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks agai…
CVE-2020-4584HIGHCVSS 7.5EG 7.5
2020-10-30
IBM i2 iBase 8.9.13 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 184…
CVE-2020-24925HIGHCVSS 7.5EG 7.5
2020-09-15
A Sensitive Source Code Path Disclosure vulnerability is found in ElkarBackup v1.3.3. An attacker is able to view the path of the source code jobs/sort where entire source code path is displayed in the browser itself helping the attacker i…
CVE-2020-13997HIGHCVSS 7.5EG 7.5
2020-07-28
In Shopware before 6.2.3, the database password is leaked to an unauthenticated user when a DriverException occurs and verbose error handling is enabled.
CVE-2020-15478HIGHCVSS 7.5EG 7.5
2020-07-01
The Journal theme before 3.1.0 for OpenCart allows exposure of sensitive data via SQL errors.
CVE-2020-4277HIGHCVSS 7.5EG 7.5
2020-04-17
IBM TRIRIGA Application Platform 3.5.3 and 3.6.1 discloses sensitive information in error messages that could aid an attacker formulate future attacks. IBM X-Force ID: 175993.
CVE-2020-11594HIGHCVSS 7.5EG 7.5
2020-04-06
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request that causes a stack error to be shown providing the full file path.
CVE-2019-12446HIGHCVSS 7.5EG 7.5
2020-03-10
An issue was discovered in GitLab Community and Enterprise Edition 8.3 through 11.11. It allows Information Exposure through an Error Message.
CVE-2019-0404HIGHCVSS 7.5EG 7.5
2019-12-11
SAP Enable Now, before version 1911, leaks information about network configuration in the server error messages, leading to Information Disclosure.
CVE-2019-3730HIGHCVSS 7.5EG 7.5
2019-09-30
RSA BSAFE Micro Edition Suite versions prior to 4.1.6.3 (in 4.1.x) and prior to 4.4 (in 4.2.x and 4.3.x), are vulnerable to an Information Exposure Through an Error Message vulnerability, also known as a “padding oracle attack vulnerabil…
CVE-2019-7941HIGHCVSS 7.5EG 7.5
2019-07-18
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Information Exposure Through an Error Message vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user.
CVE-2019-4269HIGHCVSS 7.5EG 7.5
2019-06-28
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console could allow a remote attacker to obtain sensitive information when a specially crafted url causes a stack trace to be dumped. IBM X-Force ID: 160202.
CVE-2019-9223HIGHCVSS 7.5EG 7.5
2019-04-17
An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposure.
CVE-2017-2594HIGHCVSS 5.4EG 7.5
2018-05-08
hawtio before versions 2.0-beta-1, 2.0-beta-2 2.0-m1, 2.0-m2, 2.0-m3, and 1.5 is vulnerable to a path traversal that leads to a NullPointerException with a full stacktrace. An attacker could use this flaw to gather undisclosed information …
CVE-2025-36003HIGHCVSS 5.3EG 7.5
2025-08-28
IBM Security Verify Governance Identity Manager 10.0.2 could allow a remote attacker to obtain sensitive information when detailed technical error messages are returned. This information could be used in further attacks against the system.
CVE-2017-2659HIGHCVSS 5.3EG 7.5
2019-03-21
It was found that dropbear before version 2013.59 with GSSAPI leaks whether given username is valid or invalid. When an invalid username is given, the GSSAPI authentication failure was incorrectly counted towards the maximum allowed number…
CVE-2020-5026HIGHCVSS 4.3EG 7.5
2023-03-01
IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.2.0 through 3.2.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This informati…
CVE-2022-33930HIGHCVSS 4.3EG 7.5
2022-08-10
Dell Wyse Management Suite 3.6.1 and below contains Information Disclosure in Devices error pages. An attacker could potentially exploit this vulnerability, leading to the disclosure of certain sensitive information. The attacker may be ab…
CVE-2015-10012HIGHCVSS 3.5EG 7.5
2023-01-03
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in sumocoders FrameworkUserBundle up to 1.3.x. It has been rated as problematic. Affected by this issue is some unknown functionality of the file Resources/views/Security/login.html…
CVE-2023-27587HIGHCVSS 7.4EG 7.4
2023-03-13
ReadtoMyShoe, a web app that lets users upload articles and listen to them later, generates an error message containing sensitive information prior to commit 8533b01. If an error occurs when adding an article, the website shows the user an…
CVE-2024-45817HIGHCVSS 7.3EG 7.3
2024-09-25
In x86's APIC (Advanced Programmable Interrupt Controller) architecture, error conditions are reported in a status register. Furthermore, the OS can opt to receive an interrupt when a new error occurs. It is possible to configure the err…
CVE-2022-22162HIGHCVSS 7.3EG 7.3
2022-01-19
A Generation of Error Message Containing Sensitive Information vulnerability in the CLI of Juniper Networks Junos OS allows a locally authenticated attacker with low privileges to elevate these to the level of any other user logged in via …
CVE-2023-6944HIGHCVSS 5.7EG 7.3
2024-01-04
A flaw was found in the Red Hat Developer Hub (RHDH). The catalog-import function leaks GitLab access tokens on the frontend when the base64 encoded GitLab token includes a newline at the end of the string. The sanitized error can display …
CVE-2026-4638HIGHCVSS 7.1EG 7.1
2026-09-24
PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. If a non-numeric value is passed instead, cscript.exe raises a 'Type mismatch' runtime error that in…
CVE-2026-75760HIGHCVSS 7.1EG 7.1
2026-08-31
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses provider request state and credentials in a user-facing validation error. In AshAi.Changes.Vectorize, when the embedding provider c…
CVE-2026-41935HIGHCVSS 7.1EG 7.1
2026-05-14
Vvveb before 1.0.8.3 contains an uncontrolled recursion vulnerability in the admin controller dispatch cycle where Base::init() repeatedly invokes permission() on error handlers, causing infinite recursion until PHP memory limits are exhau…
CVE-2026-41644HIGHCVSS 7.1EG 7.1
2026-05-07
monetr is a budgeting application for recurring expenses. Prior to version 1.12.5, a server-side request forgery (SSRF) vulnerability in monetr's Lunch Flow integration allowed any authenticated user on a self-hosted instance to cause the …
CVE-2026-3259HIGHCVSS 7.1EG 7.1
2026-04-23
A Generation of Error Message Containing Sensitive Information vulnerability in the Materialized View Refresh mechanism in Google BigQuery on Google Cloud Platform allows an authenticated user to potentially disclose sensitive data using a…
CVE-2026-115496MEDIUMCVSS 6.9EG 6.9
2026-10-22
Overly informative error messages in the catalog functionality of KNIME Business Hub prior to version 1.18.5 may allow an authenticated remote attacker to see workflow names if their ID is known. A workaround is not possible.
CVE-2026-78693MEDIUMCVSS 6.9EG 6.9
2026-08-30
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_graphql allows a remote client to read internal field names that an application configured its error_handler to redact. In AshGraphql.Errors, ea…
CVE-2026-64627MEDIUMCVSS 6.9EG 6.9
2026-07-21
Parse Server versions >= 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled (graphQLPublicIntrospection: false, the default),…
CVE-2026-47248MEDIUMCVSS 6.9EG 6.9
2026-05-29
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.78 and 9.9.1-alpha.2, Parse Server's GraphQL endpoint discloses schema metadata to unauthenticated callers throug…
CVE-2025-40653MEDIUMCVSS 6.9EG 6.9
2025-05-26
User enumeration vulnerability in M3M Printer Server Web. This issue occurs during user authentication, where a difference in error messages could allow an attacker to determine whether a username is valid or not, allowing a brute force at…
CVE-2025-59177MEDIUMCVSS 6.8EG 6.8
2026-07-27
Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a vulnerability in Configuration Management, allowing an attacker to execute specifically crafted commands to reveal system secret through error messages.
CVE-2026-47775MEDIUMCVSS 6.8EG 6.8
2026-06-26
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, the OAuth2 HTTP filter's encrypt()/decrypt() functions use AES-256-CBC without an authentication tag (no H…
CVE-2025-23216MEDIUMCVSS 6.8EG 6.8
2025-01-30
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a…
CVE-2022-24731MEDIUMCVSS 6.8EG 6.8
2022-03-23
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal vulnerability, allowing a malicious user with read…
CVE-2022-39307MEDIUMCVSS 6.7EG 6.7
2022-11-09
Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the `/api/user/password/sent-reset-email` URL. When the username or email does not exist, a JS…
CVE-2026-67080MEDIUMCVSS 6.5EG 6.5
2026-10-28
HCL BigFix AEX is affected by an Information Disclosure vulnerability due to improper handling of errors or exceptional conditions. This could allow an attacker to obtain sensitive technical information, including stack traces, system deta…
CVE-2026-14909MEDIUMCVSS 6.5EG 6.5
2026-10-13
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by an information disclosure vulnerability that allows an authenticated attacker to obtain sensitive information when restConnector-2.0 is enbabled.
CVE-2026-66306MEDIUMCVSS 6.5EG 6.5
2026-09-08
Generation of error message containing sensitive information in Skype for Business allows an unauthorized attacker to disclose information over a network.
CVE-2026-67383MEDIUMCVSS 6.5EG 6.5
2026-09-08
Generation of error message containing sensitive information in SQL Server allows an authorized attacker to disclose information over a network.
CVE-2026-11873MEDIUMCVSS 6.5EG 6.5
2026-09-01
An Apache-proxied Dogtag CA REST endpoint exposed by IdM (POST /ca/rest/certrequests) returns HTTP 500 with internal Java stack traces for unauthenticated malformed requests. The same unauthenticated error path emits large multi-line stack…
CVE-2026-59271MEDIUMCVSS 6.5EG 6.5
2026-08-27
When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earli…
CVE-2026-77076MEDIUMCVSS 6.5EG 6.5
2026-08-20
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an information disclosure vulnerability in the GraphQL node. When a GraphQL request fails at the connection level, the node re-throws the underlying HTTP client error unchanged inste…
CVE-2026-43630MEDIUMCVSS 6.5EG 6.5
2026-08-06
llama.cpp builds b4882 before b8487 contain an out-of-bounds read vulnerability in the recurrent memory state restore path that allows attackers with write access to the slot save directory to read memory past the end of the allocated cell…
CVE-2025-65995MEDIUMCVSS 6.5EG 6.5
2026-02-21
When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs contained sensitive values (such as secrets), they might be exposed in the UI tracebacks to auth…
CVE-2026-23598MEDIUMCVSS 6.5EG 6.5
2026-02-17
Vulnerabilities in the API error handling of an HPE Aruba Networking 5G Core server API could allow an unauthenticated remote attacker to obtain sensitive information. Successful exploitation could allow an attacker to access details such…

Map vulnerabilities like CWE-209 to your infrastructure

EchelonGraph correlates every CVE — across CWE-209 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →