Vulnerabilities (CVE)

Filtered by CWE-209
Total 277 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2022-4870 1 Octopus 1 Octopus Server 2023-12-10 N/A 5.3 MEDIUM
In affected versions of Octopus Deploy it is possible to discover network details via error message
CVE-2023-37306 1 Misp-project 1 Malware Information Sharing Platform 2023-12-10 N/A 7.5 HIGH
MISP 2.4.172 mishandles different certificate file extensions in server sync. An attacker can obtain sensitive information because of the nature of the error messages.
CVE-2023-33181 1 Xibosignage 1 Xibo 2023-12-10 N/A 5.3 MEDIUM
Xibo is a content management system (CMS). Starting in version 3.0.0 and prior to version 3.3.5, some API routes will print a stack trace when called with missing or invalid parameters revealing sensitive information about the locations of paths that the server is using. Users should upgrade to version 3.3.5, which fixes this issue. There are no known workarounds aside from upgrading.
CVE-2023-34110 1 Flask-appbuilder Project 1 Flask-appbuilder 2023-12-10 N/A 2.7 LOW
Flask-AppBuilder is an application development framework, built on top of Flask. Prior to version 4.3.2, an authenticated malicious actor with Admin privileges, could by adding a special character on the add, edit User forms trigger a database error, this error is surfaced back to this actor on the UI. On certain database engines this error can include the entire user row including the pbkdf2:sha256 hashed password. This vulnerability has been fixed in version 4.3.2.
CVE-2022-4769 1 Hitachi 1 Vantara Pentaho Business Analytics Server 2023-12-10 N/A 4.3 MEDIUM
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the target path on host when a file is uploaded with an invalid character in its name. 
CVE-2023-27860 1 Ibm 1 Maximo Asset Management 2023-12-10 N/A 5.3 MEDIUM
IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 could disclose sensitive information in an error message. This information could be used in further attacks against the system. IBM X-Force ID: 249207.
CVE-2022-4770 1 Hitachi 1 Vantara Pentaho Business Analytics Server 2023-12-10 N/A 4.3 MEDIUM
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the full parametrized SQL query in an error message when an invalid character is used within a Pentaho Report (*.prpt). 
CVE-2023-28514 5 Hp, Ibm, Linux and 2 more 7 Hp-ux, Aix, I and 4 more 2023-12-10 N/A 5.5 MEDIUM
IBM MQ 8.0, 9.0, and 9.1 could allow a local user to obtain sensitive credential information when a detailed technical error message is returned in a stack trace. IBM X-Force ID: 250398.
CVE-2023-22626 1 Pghero Project 1 Pghero 2023-12-10 N/A 7.5 HIGH
PgHero before 3.1.0 allows Information Disclosure via EXPLAIN because query results may be present in an error message. (Depending on database user privileges, this may only be information from the database, or may be information from file contents on the database server.)
CVE-2023-0655 1 Sonicwall 1 Email Security 2023-12-10 N/A 5.3 MEDIUM
SonicWall Email Security contains a vulnerability that could permit a remote unauthenticated attacker access to an error page that includes sensitive information about users email addresses.
CVE-2022-39304 1 Ghinstallation Project 1 Ghinstallation 2023-12-10 N/A 4.7 MEDIUM
ghinstallation provides transport, which implements http.RoundTripper to provide authentication as an installation for GitHub Apps. In ghinstallation version 1, when the request to refresh an installation token failed, the HTTP request and response would be returned for debugging. The request contained the bearer JWT for the App, and was returned back to clients. This token is short lived (10 minute maximum). This issue has been patched and is available in version 2.0.0.
CVE-2022-46675 1 Dell 1 Wyse Management Suite 2023-12-10 N/A 5.3 MEDIUM
Wyse Management Suite Repository 3.8 and below contain an information disclosure vulnerability. A unauthenticated attacker could potentially discover the internal structure of the application and its components and use this information for further vulnerability research.
CVE-2023-26051 1 Saleor 1 Saleor 2023-12-10 N/A 4.3 MEDIUM
Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like user email address in staff-authenticated requests.
CVE-2022-46371 1 Alotceriot 2 Ar7088h-a, Ar7088h-a Firmware 2023-12-10 N/A 5.3 MEDIUM
Alotcer - AR7088H-A firmware version 16.10.3 Information disclosure. Unspecified error message contains the default administrator user name.
CVE-2022-22760 1 Mozilla 3 Firefox, Firefox Esr, Thunderbird 2023-12-10 N/A 6.5 MEDIUM
When importing resources using Web Workers, error messages would distinguish the difference between <code>application/javascript</code> responses and non-script responses. This could have been abused to learn information cross-origin. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.
CVE-2022-20525 1 Google 1 Android 2023-12-10 N/A 3.3 LOW
In enforceVisualVoicemailPackage of PhoneInterfaceManager.java, there is a possible leak of visual voicemail package name due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-229742768
CVE-2022-34881 3 Hitachi, Linux, Microsoft 3 Jp1\/automatic Operation, Linux Kernel, Windows 2023-12-10 N/A 3.3 LOW
Generation of Error Message Containing Sensitive Information vulnerability in Hitachi JP1/Automatic Operation allows local users to gain sensitive information. This issue affects JP1/Automatic Operation: from 10-00 through 10-54-03, from 11-00 before 11-51-09, from 12-00 before 12-60-01.
CVE-2023-25956 1 Apache 1 Apache-airflow-providers-amazon 2023-12-10 N/A 7.5 HIGH
Generation of Error Message Containing Sensitive Information vulnerability in the Apache Airflow AWS Provider. This issue affects Apache Airflow AWS Provider versions before 7.2.1.
CVE-2020-5026 1 Ibm 1 Financial Transaction Manager 2023-12-10 N/A 7.5 HIGH
IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.2.0 through 3.2.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 193662.
CVE-2023-27587 1 Readtomyshoe Project 1 Readtomyshoe 2023-12-10 N/A 6.5 MEDIUM
ReadtoMyShoe, a web app that lets users upload articles and listen to them later, generates an error message containing sensitive information prior to commit 8533b01. If an error occurs when adding an article, the website shows the user an error message. If the error originates from the Google Cloud TTS request, then it will include the full URL of the request. The request URL contains the Google Cloud API key. This has been patched in commit 8533b01. Upgrading should be accompanied by deleting the current GCP API key and issuing a new one. There are no known workarounds.