CWE-209— Generation of Error Message Containing Sensitive Information

The product generates an error message that includes sensitive information about its environment, users, or associated data.— MITRE CWE catalog

678 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-209page 4 of 14

CVE-2025-12773MEDIUMCVSS 6.5EG 6.5
2026-02-03
A vulnerability in update-reports-purge-settings.sh script logging for Brocade SANnav before 2.4.0a could allow the collection of SANnav database password in the system audit logs. The vulnerability could allow a remote authenticated atta…
CVE-2025-41076MEDIUMCVSS 6.5EG 6.5
2025-11-20
In version 6.13.0 of LimeSurvey, any external user can cause a 500 error in the survey system by sending a malformed session cookie. Instead of displaying a generic error message, the system exposes internal backend information, including …
CVE-2023-47728MEDIUMCVSS 6.5EG 6.5
2024-08-16
IBM QRadar Suite Software 1.10.12.0 through 1.10.22.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the reques…
CVE-2024-35156MEDIUMCVSS 6.5EG 6.5
2024-06-28
IBM MQ 9.3 LTS and 9.3 CD could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force…
CVE-2024-35155MEDIUMCVSS 6.5EG 6.5
2024-06-28
IBM MQ Console 9.3 LTS and 9.3 CD could disclose could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against t…
CVE-2023-45701MEDIUMCVSS 6.5EG 6.5
2023-12-28
HCL Launch could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
CVE-2023-26051MEDIUMCVSS 6.5EG 6.5
2023-03-02
Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive in…
CVE-2022-22760MEDIUMCVSS 6.5EG 6.5
2022-12-22
When importing resources using Web Workers, error messages would distinguish the difference between <code>application/javascript</code> responses and non-script responses. This could have been abused to learn information cross-origin. This…
CVE-2022-39315MEDIUMCVSS 6.5EG 6.5
2022-10-25
Kirby is a Content Management System. Prior to versions 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, a user enumeration vulnerability affects all Kirby sites with user accounts unless Kirby's API and Panel are disabled in the config. It can only …
CVE-2021-39033MEDIUMCVSS 6.5EG 6.5
2022-04-19
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5 and 6.1.0.0 through 6.1.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This informa…
CVE-2022-0504MEDIUMCVSS 6.5EG 6.5
2022-02-08
Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.
CVE-2021-43542MEDIUMCVSS 6.5EG 6.5
2021-12-08
Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.
CVE-2021-39458MEDIUMCVSS 6.5EG 6.5
2021-09-09
Triggering an error page of the import process in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user has to alternate the files of a vaild file backup. This leads of leaking the database credentials in the environmen…
CVE-2021-25958MEDIUMCVSS 6.5EG 6.5
2021-08-30
In Apache Ofbiz, versions v17.12.01 to v17.12.07 implement a try catch exception to handle errors at multiple locations but leaks out sensitive table info which may aid the attacker for further recon. A user can register with a very long p…
CVE-2021-26997MEDIUMCVSS 6.5EG 6.5
2021-06-11
E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploited could allow a remote attacker to discover information via error messaging which may aid in craft…
CVE-2021-20371MEDIUMCVSS 6.5EG 6.5
2021-06-02
IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to obtain sensitive information when an error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Fo…
CVE-2020-23995MEDIUMCVSS 6.5EG 6.5
2021-05-13
An information disclosure vulnerability in ILIAS before 5.3.19, 5.4.12 and 6.0 allows remote authenticated attackers to get the upload data path via a workspace upload.
CVE-2021-23973MEDIUMCVSS 6.5EG 6.5
2021-02-26
When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted, and the content of that error may have revealed information about the resource. This vulnerability affects Firefox < 86, Thunderbird …
CVE-2020-15666MEDIUMCVSS 6.5EG 6.5
2020-10-01
When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500, 412, 403, etc.) was disclosed via the MediaError Message. This level of information leakage is inconsistent with the standardized onerror/…
CVE-2020-6511MEDIUMCVSS 6.5EG 6.5
2020-07-22
Information leak in content security policy in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVE-2020-6503MEDIUMCVSS 6.5EG 6.5
2020-06-03
Inappropriate implementation in accessibility in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
CVE-2020-4085MEDIUMCVSS 6.5EG 6.5
2020-04-22
"HCL Connections is vulnerable to possible information leakage and could disclose sensitive information via stack trace to a local user."
CVE-2019-13697MEDIUMCVSS 6.5EG 6.5
2019-11-25
Insufficient policy enforcement in performance APIs in Google Chrome prior to 77.0.3865.120 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVE-2019-3756MEDIUMCVSS 6.5EG 6.5
2019-09-18
RSA Archer, versions prior to 6.6 P3 (6.6.0.3), contain an information disclosure vulnerability. Information relating to the backend database gets disclosed to low-privileged RSA Archer users' UI under certain error conditions.
CVE-2019-14433MEDIUMCVSS 6.5EG 6.5
2019-08-09
An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2. If an API request from an authenticated user ends in a fault condition due to an external exception, details of the underlying environmen…
CVE-2018-10913MEDIUMCVSS 6.5EG 6.5
2018-09-04
An information disclosure vulnerability was discovered in glusterfs server. An attacker could issue a xattr request via glusterfs FUSE to determine the existence of any file.
CVE-2018-10624MEDIUMCVSS 6.5EG 6.5
2018-08-01
In Johnson Controls Metasys System Versions 8.0 and prior and BCPro (BCM) all versions prior to 3.0.2, this vulnerability results from improper error handling in HTTP-based communications with the server, which could allow an attacker to o…
CVE-2018-2379MEDIUMCVSS 6.5EG 6.5
2018-02-14
In SAP HANA Extended Application Services, 1.0, an unauthenticated user could test if a given username is valid by evaluating error messages of a specific endpoint.
CVE-2022-1120MEDIUMCVSS 4.8EG 6.5
2022-04-04
Missing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 exposed sensitive information when an include directive fails in the CI/CD configuration.
CVE-2010-3332MEDIUMCVSS v2 6.4EG 6.4
2010-09-22
Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers …
CVE-2026-112947MEDIUMCVSS 6.3EG 6.3
2026-10-20
Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing …
CVE-2026-105283MEDIUMCVSS 6.3EG 6.3
2026-10-12
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal Elixir terms from an RPC error response by provoking an error the error builder ha…
CVE-2026-105828MEDIUMCVSS 6.3EG 6.3
2026-10-08
Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an information disclosure vulnerability in which GraphQL validation error messages reveal hidden class names when public introspection is disabled. Unauthenticated …
CVE-2026-82733MEDIUMCVSS 6.3EG 6.3
2026-09-01
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal application data from an HTTP 500 response body. When a typed-controller route ha…
CVE-2026-77950MEDIUMCVSS 6.3EG 6.3
2026-09-01
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler …
CVE-2026-66009MEDIUMCVSS 6.3EG 6.3
2026-07-24
Parse Server versions >= 9.0.0 before 9.10.0-alpha.5 and >= 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled (graphQLPublicIntrospection: false, …
CVE-2026-66008MEDIUMCVSS 6.3EG 6.3
2026-07-24
Parse Server versions >= 9.0.0 before 9.10.0-alpha.6 and >= 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled (gra…
CVE-2024-11129MEDIUMCVSS 6.3EG 6.3
2025-04-10
An issue has been discovered in GitLab EE affecting all versions from 17.1 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. This allows attackers to perform targeted searches with sensitive keywords to get the count of issues …
CVE-2026-88467MEDIUMCVSS 6.2EG 6.2
2026-09-21
CRMEB Knowledge-Paid System crmeb_zzff_class 1.4.4 has a backend verification function that returns the wrong type of value, causing errors and leaking sensitive information.
CVE-2026-54561MEDIUMCVSS 6.2EG 6.2
2026-07-17
MCP Memory Keeper is an MCP server for persistent context management in AI coding assistants. Prior to 0.13.0, context_import in src/index.ts passes the caller-controlled filePath directly to fs.readFileSync without restricting the path to…
CVE-2024-52898MEDIUMCVSS 6.2EG 6.2
2025-01-14
IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a local user to obtain sensitive information when a detailed technical error message is returned.
CVE-2024-52897MEDIUMCVSS 6.2EG 6.2
2024-12-19
IBM MQ 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned.
CVE-2024-52896MEDIUMCVSS 6.2EG 6.2
2024-12-19
IBM MQ 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned.
CVE-2023-28514MEDIUMCVSS 6.2EG 6.2
2023-05-19
IBM MQ 8.0, 9.0, and 9.1 could allow a local user to obtain sensitive credential information when a detailed technical error message is returned in a stack trace. IBM X-Force ID: 250398.
CVE-2019-4420MEDIUMCVSS 6.2EG 6.2
2019-08-20
IBM Intelligent Operations Center V5.1.0 through V5.2.0 could disclose detailed error messages, revealing sensitive information that could aid in further attacks against the system. IBM X-Force ID: 162738.
CVE-2016-9459MEDIUMCVSS 6.1EG 6.1
2017-03-28
Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a log pollution vulnerability potentially leading to a local XSS. The download log functionality in the admin screen is delivering the log in JSON format to th…
CVE-2020-25778MEDIUMCVSS 6.0EG 6.0
2020-10-14
Trend Micro Antivirus for Mac 2020 (Consumer) has a vulnerability in a specific kernel extension where an attacker could supply a kernel pointer and leak several bytes of memory. An attacker must first obtain the ability to execute high-pr…
CVE-2024-23945MEDIUMCVSS 5.9EG 5.9
2024-12-23
Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to secur…
CVE-2023-47152MEDIUMCVSS 5.9EG 5.9
2024-01-22
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to an insecure cryptographic algorithm and to information disclosure in stack trace under exceptional conditions.
CVE-2022-31023MEDIUMCVSS 5.9EG 5.9
2022-06-02
Play Framework is a web framework for Java and Scala. Verions prior to 2.8.16 are vulnerable to generation of error messages containing sensitive information. Play Framework, when run in dev mode, shows verbose errors for easy debugging, i…

Map vulnerabilities like CWE-209 to your infrastructure

EchelonGraph correlates every CVE — across CWE-209 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →