CWE-209— Generation of Error Message Containing Sensitive Information

The product generates an error message that includes sensitive information about its environment, users, or associated data.— MITRE CWE catalog

678 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-209page 9 of 14

CVE-2021-38980MEDIUMCVSS 5.3EG 5.3
2021-11-23
IBM Tivoli Key Lifecycle Manager (IBM Security Guardium Key Lifecycle Manager) 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This …
CVE-2021-38981MEDIUMCVSS 5.3EG 5.3
2021-11-15
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks a…
CVE-2021-35060MEDIUMCVSS 5.3EG 5.3
2021-10-11
/way4acs/enroll in OpenWay WAY4 ACS before 1.2.278-2693 allows unauthenticated attackers to leverage response differences to discover whether a specific payment card number is stored in the system.
CVE-2021-32766MEDIUMCVSS 5.3EG 5.3
2021-09-07
Nextcloud Text is an open source plaintext editing application which ships with the nextcloud server. In affected versions the Nextcloud Text application returned different error messages depending on whether a folder existed in a public l…
CVE-2021-35947MEDIUMCVSS 5.3EG 5.3
2021-09-07
The public share controller in the ownCloud server before version 10.8.0 allows a remote attacker to see the internal path and the username of a public share by including invalid characters in the URL.
CVE-2021-29767MEDIUMCVSS 5.3EG 5.3
2021-07-26
IBM i2 Analyst's Notebook Premium 9.2.0, 9.2.1, and 9.2.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks a…
CVE-2021-29766MEDIUMCVSS 5.3EG 5.3
2021-07-26
IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in …
CVE-2021-20430MEDIUMCVSS 5.3EG 5.3
2021-07-26
IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in …
CVE-2021-25809MEDIUMCVSS 5.3EG 5.3
2021-07-23
UCMS 1.5.0 was discovered to contain a physical path leakage via an error message returned by the adminchannelscache() function in top.php.
CVE-2021-33711MEDIUMCVSS 5.3EG 5.3
2021-07-13
A vulnerability has been identified in Teamcenter Active Workspace V4 (All versions < V4.3.9), Teamcenter Active Workspace V5.0 (All versions < V5.0.7), Teamcenter Active Workspace V5.1 (All versions < V5.1.4). The affected application all…
CVE-2021-32712MEDIUMCVSS 5.3EG 5.3
2021-06-24
Shopware is an open source eCommerce platform. Versions prior to 5.6.10 are vulnerable to system information leakage in error handling. Users are recommend to update to version 5.6.10. You can get the update to 5.6.10 regularly via the Aut…
CVE-2020-20470MEDIUMCVSS 5.3EG 5.3
2021-06-21
White Shark System (WSS) 1.3.2 has web site physical path leakage vulnerability.
CVE-2021-31159MEDIUMCVSS 5.3EG 5.3
2021-06-16
Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-message generation in the Forgot Password functionality, aka SDPMSP-15732.
CVE-2021-30357MEDIUMCVSS 5.3EG 5.3
2021-06-08
SSL Network Extender Client for Linux before build 800008302 reveals part of the contents of the configuration file supplied, which allows partially disclosing files to which the user did not have access.
CVE-2021-20428MEDIUMCVSS 5.3EG 5.3
2021-05-24
IBM Security Guardium 11.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force …
CVE-2021-29682MEDIUMCVSS 5.3EG 5.3
2021-05-20
IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM…
CVE-2021-29040MEDIUMCVSS 5.3EG 5.3
2021-05-16
The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provide overly verbose error messages, which allows remote attackers to use the conten…
CVE-2020-19275MEDIUMCVSS 5.3EG 5.3
2021-05-12
An Information Disclosure vulnerability exists in dhcms 2017-09-18 when entering invalid characters after the normal interface, which causes an error that will leak the physical path.
CVE-2021-20289MEDIUMCVSS 5.3EG 5.3
2021-03-26
A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the …
CVE-2020-4628MEDIUMCVSS 5.3EG 5.3
2021-01-27
IBM Cloud Pak for Security (CP4S) 1.3.0.1 and 1.4.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks again…
CVE-2020-4600MEDIUMCVSS 5.3EG 5.3
2021-01-13
IBM Security Guardium Insights 2.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IB…
CVE-2020-4599MEDIUMCVSS 5.3EG 5.3
2021-01-13
IBM Security Guardium Insights 2.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IB…
CVE-2020-4897MEDIUMCVSS 5.3EG 5.3
2021-01-07
IBM Emptoris Contract Management and IBM Emptoris Spend Analysis 10.1.0, 10.1.1, and 10.1.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information …
CVE-2020-4761MEDIUMCVSS 5.3EG 5.3
2021-01-05
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. …
CVE-2020-14270MEDIUMCVSS 5.3EG 5.3
2020-12-22
HCL Domino v9, v10, v11 is susceptible to an Information Disclosure vulnerability in XPages due to improper error handling of user input. An unauthenticated attacker could exploit this vulnerability to obtain information about the XPages s…
CVE-2020-4907MEDIUMCVSS 5.3EG 5.3
2020-12-16
IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used …
CVE-2020-25640MEDIUMCVSS 5.3EG 5.3
2020-11-24
A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensitive information in the log file.
CVE-2019-4547MEDIUMCVSS 5.3EG 5.3
2020-10-29
IBM Security Directory Server 6.4.0 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 165949.
CVE-2020-25633MEDIUMCVSS 5.3EG 5.3
2020-09-18
A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client users to obtain the server's potentially sensitive information when the server got WebApplicationException from the RESTEasy client call…
CVE-2020-4166MEDIUMCVSS 5.3EG 5.3
2020-08-27
IBM Security Guardium Insights 2.0.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IB…
CVE-2020-15132MEDIUMCVSS 5.3EG 5.3
2020-08-05
In Sulu before versions 1.6.35, 2.0.10, and 2.1.1, when the "Forget password" feature on the login screen is used, Sulu asks the user for a username or email address. If the given string is not found, a response with a `400` error code is …
CVE-2020-8213MEDIUMCVSS 5.3EG 5.3
2020-07-30
An information exposure vulnerability exists in UniFi Protect before v1.13.4-beta.5 that allowed unauthenticated attackers access to valid usernames for the UniFi Protect web application via HTTP response code and response timing.
CVE-2020-4572MEDIUMCVSS 5.3EG 5.3
2020-07-29
IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the …
CVE-2020-4341MEDIUMCVSS 5.3EG 5.3
2020-06-24
IBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-F…
CVE-2020-4327MEDIUMCVSS 5.3EG 5.3
2020-06-24
IBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-F…
CVE-2020-4532MEDIUMCVSS 5.3EG 5.3
2020-06-17
IBM Business Automation Workflow and IBM Business Process Manager (IBM Business Process Manager Express 8.5.5, 8.5.6, 8.5.7, and 8.6) could allow a remote attacker to obtain sensitive information when a detailed technical error message is …
CVE-2019-18865MEDIUMCVSS 5.3EG 5.3
2020-05-07
Information disclosure via error message discrepancies in authentication functions in Blaauw Remote Kiln Control through v3.00r4 allows an unauthenticated attacker to enumerate valid usernames.
CVE-2020-11883MEDIUMCVSS 5.3EG 5.3
2020-04-17
In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used in VueStorefront PWA, unexpected HTTP requests lead to an exception that discloses the error stack trace, with absolute file paths and Node.js module…
CVE-2020-4239MEDIUMCVSS 5.3EG 5.3
2020-03-31
IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against …
CVE-2020-10097MEDIUMCVSS 5.3EG 5.3
2020-03-05
An issue was discovered in Zammad 3.0 through 3.2. It may respond with verbose error messages that disclose internal application or infrastructure information. This information could aid attackers in successfully exploiting other vulnerabi…
CVE-2019-19993MEDIUMCVSS 5.3EG 5.3
2020-02-26
An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. Several full path disclosure vulnerability were discovered. A user, even with no authentication, may simply send arbitrary content to the vulnerable pages …
CVE-2020-9351MEDIUMCVSS 5.3EG 5.3
2020-02-23
An issue was discovered in SmartClient 12.0. If an unauthenticated attacker makes a POST request to /tools/developerConsoleOperations.jsp or /isomorphic/IDACall with malformed XML data in the _transaction parameter, the server replies with…
CVE-2020-6189MEDIUMCVSS 5.3EG 5.3
2020-02-12
Certain settings page(s) in SAP Business Objects Business Intelligence Platform (CMC), version 4.2, generates error messages that can give enterprise private-network related information which would otherwise be restricted leading to Inform…
CVE-2020-7231MEDIUMCVSS 5.3EG 5.3
2020-01-19
Evoko Home 1.31 devices provide different error messages for failed login requests depending on whether the username is valid.
CVE-2019-19806MEDIUMCVSS 5.3EG 5.3
2019-12-30
_account_forgot_password.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 displays a message indicating whether an email address is configured for the account name provided. This can be used by an attacker to enumerate accounts by guess…
CVE-2019-19342MEDIUMCVSS 5.3EG 5.3
2019-12-19
A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.4, when /websocket is requested and the password contains the '#' character. This request would cause a socket error in RabbitMQ when parsing the password …
CVE-2013-6879MEDIUMCVSS 5.3EG 5.3
2019-11-22
The Mijosoft MijoSearch component 2.0.1 and earlier for Joomla! allows remote attackers to obtain sensitive information via a request to component/mijosearch/search, which reveals the installation path in an error message.
CVE-2019-4570MEDIUMCVSS 5.3EG 5.3
2019-11-22
IBM Tivoli Netcool Impact 7.1.0 through 7.1.0.16 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 166720.
CVE-2019-4441MEDIUMCVSS 5.3EG 5.3
2019-10-03
IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and Liberty could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser. IBM X-Force ID: 163177.
CVE-2019-12156MEDIUMCVSS 5.3EG 5.3
2019-10-02
Server metadata could be exposed because one of the error messages reflected the whole response back to the client in JetBrains TeamCity versions before 2018.2.5 and UpSource versions before 2018.2 build 1293.

Map vulnerabilities like CWE-209 to your infrastructure

EchelonGraph correlates every CVE — across CWE-209 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →