← Back
CWE-200

11,522 CVEs • Abstraction: Class • Likelihood of Exploit: High

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

JSON object

Loading...

CVEs (11,522)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2009-0143
1Apple
1Itunes
Apr 23, 2026
Mar 14, 2009
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Apple iTunes before 8.1 does not properly inform the user about the origin of an authentication request, which makes it easier for remote podcast servers to trick a user into providing a username and password when subscr...Show more
Apple iTunes before 8.1 does not properly inform the user about the origin of an authentication request, which makes it easier for remote podcast servers to trick a user into providing a username and password when subscribing to a crafted podcast.Show less
CVE-2009-0867
1Fujitsu
1Enhanced Support Facility
Apr 23, 2026
Mar 10, 2009
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The HRM-S service in Fujitsu Enhanced Support Facility 3.0 and 3.0.1 allows remote attackers to obtain (1) hardware and (2) software information via unspecified requests in a client connection.
CVE-2009-0852
1Stewart Howe
1Celerbb
Apr 23, 2026
Mar 9, 2009
N/A· v4
N/A· v3
5.0 MEDIUM· v2
showme.php in CelerBB 0.0.2 allows remote attackers to obtain "reserved information" via the user parameter.
CVE-2008-6420
1Socialsitegenerator
1Social Site Generator
Apr 23, 2026
Mar 6, 2009
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Social Site Generator (SSG) 2.0 allows remote attackers to read arbitrary files via the file parameter to (1) filedload.php, (2) webadmin/download.php, and (3) webadmin/download_file.php.
CVE-2009-0815
1Typo3
1Typo3
Apr 23, 2026
Mar 5, 2009
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alpha1 leaks a hash secret (juHash) in an error message, which allows remote attack...Show more
The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alpha1 leaks a hash secret (juHash) in an error message, which allows remote attackers to read arbitrary files by including the hash in a request.Show less
CVE-2009-0776
1Mozilla
3Firefox
SeamonkeyThunderbird
Apr 23, 2026
Mar 5, 2009
N/A· v4
N/A· v3
7.1 HIGH· v2
nsIRDFService in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allows remote attackers to bypass the same-origin policy and read XML data from another domain via a cross-domain re...Show more
nsIRDFService in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allows remote attackers to bypass the same-origin policy and read XML data from another domain via a cross-domain redirect.Show less
CVE-2008-6387
1Activewebsoftwares
1Quick Tree View .net
Apr 23, 2026
Mar 2, 2009
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Quick Tree View .NET 3.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request to qtv.mdb.
CVE-2008-6342
1Lobacher Patrick
1Simplefilebrowser
Apr 23, 2026
Feb 27, 2009
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Unspecified vulnerability in the TYPO3 Simple File Browser (simplefilebrowser) extension 1.0.2 and earlier allows remote attackers to obtain sensitive information via unknown attack vectors.
CVE-2008-4308
1Apache
1Tomcat
Apr 23, 2026
Feb 26, 2009
N/A· v4
N/A· v3
2.6 LOW· v2
The doRead method in Apache Tomcat 4.1.32 through 4.1.34 and 5.5.10 through 5.5.20 does not return a -1 to indicate when a certain error condition has occurred, which can cause Tomcat to send POST content from one reques...Show more
The doRead method in Apache Tomcat 4.1.32 through 4.1.34 and 5.5.10 through 5.5.20 does not return a -1 to indicate when a certain error condition has occurred, which can cause Tomcat to send POST content from one request to a different request.Show less
CVE-2009-0521
1Adobe
1Flash Player For Linux
Apr 23, 2026
Feb 26, 2009
N/A· v4
N/A· v3
4.6 MEDIUM· v2
Untrusted search path vulnerability in Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 on Linux allows local users to obtain sensitive information or gain privileges via a crafted library in a director...Show more
Untrusted search path vulnerability in Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 on Linux allows local users to obtain sensitive information or gain privileges via a crafted library in a directory contained in the RPATH.Show less
CVE-2008-6279
1Rakhisoftware
1Rakhisoftware Shopping Cart
Apr 23, 2026
Feb 25, 2009
N/A· v4
N/A· v3
7.8 HIGH· v2
RakhiSoftware Price Comparison Script (aka Shopping Cart) allows remote attackers to obtain sensitive information via an invalid PHPSESSID cookie, which reveals the installation path in an error message.
CVE-2009-0711
1Vlad Alexa Mancini
1Phpfootball
Apr 23, 2026
Feb 23, 2009
N/A· v4
N/A· v3
5.0 MEDIUM· v2
filter.php in PHPFootball 1.6 and earlier allows remote attackers to retrieve password hashes via a request with an Accounts value for the dbtable parameter, in conjunction with a Password value for the dbfield parameter...Show more
filter.php in PHPFootball 1.6 and earlier allows remote attackers to retrieve password hashes via a request with an Accounts value for the dbtable parameter, in conjunction with a Password value for the dbfield parameter. NOTE: this has been reported as a SQL injection vulnerability by some sources, but the provenance of that information is unknown.Show less
CVE-2009-0678
1Ravenphpscripts
1Ravennuke
Apr 23, 2026
Feb 22, 2009
N/A· v4
N/A· v3
5.0 MEDIUM· v2
images/captcha.php in RavenNuke 2.30 allows remote attackers to obtain sensitive information via an aFonts array parameter value that does not correspond to a valid font file, which reveals the installation path in an er...Show more
images/captcha.php in RavenNuke 2.30 allows remote attackers to obtain sensitive information via an aFonts array parameter value that does not correspond to a valid font file, which reveals the installation path in an error message.Show less
CVE-2008-6159
1Hans Oesterholt
1Cmme
Apr 23, 2026
Feb 18, 2009
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Content Management Made Easy (CMME) 1.19 allows remote attackers to obtain system information via a direct request to info.php, which invokes the phpinfo function.
CVE-2009-0612
1Trendmicro
2Interscan Web Security Suite
Interscan Web Security Virtual Appliance
Apr 23, 2026
Feb 17, 2009
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 3.x and InterScan Web Security Suite (IWSS) 3.x, when basic authorization is enabled on the standalone proxy, forwards the Proxy-Authorization header from Wind...Show more
Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 3.x and InterScan Web Security Suite (IWSS) 3.x, when basic authorization is enabled on the standalone proxy, forwards the Proxy-Authorization header from Windows Media Player, which allows remote web servers to obtain credentials by offering a media stream and then capturing this header.Show less
CVE-2009-0504
1Ibm
1Websphere Application Server
Apr 23, 2026
Feb 17, 2009
N/A· v4
N/A· v3
2.1 LOW· v2
WSPolicy in the Web Services component in IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.1 does not properly recognize the IDAssertion.isUsed binding property, which allows local users to discover a password b...Show more
WSPolicy in the Web Services component in IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.1 does not properly recognize the IDAssertion.isUsed binding property, which allows local users to discover a password by reading a SOAP message.Show less
CVE-2009-0437
1Ibm
1Websphere Application Server
Apr 23, 2026
Feb 10, 2009
N/A· v4
N/A· v3
1.9 LOW· v2
The Installation Factory installation process for IBM WebSphere Application Server (WAS) 6.0.2 on Windows, when WAS is registered as a Windows service, allows local users to obtain sensitive information by reading the lo...Show more
The Installation Factory installation process for IBM WebSphere Application Server (WAS) 6.0.2 on Windows, when WAS is registered as a Windows service, allows local users to obtain sensitive information by reading the logs/instconfigifwas6.log log file.Show less
CVE-2009-0434
1Ibm
1Websphere Application Server
Apr 23, 2026
Feb 10, 2009
N/A· v4
N/A· v3
1.9 LOW· v2
PerfServlet in the PMI/Performance Tools component in IBM WebSphere Application Server (WAS) 6.0.x before 6.0.2.31, 6.1.x before 6.1.0.21, and 7.0.x before 7.0.0.1, when Performance Monitoring Infrastructure (PMI) is ena...Show more
PerfServlet in the PMI/Performance Tools component in IBM WebSphere Application Server (WAS) 6.0.x before 6.0.2.31, 6.1.x before 6.1.0.21, and 7.0.x before 7.0.0.1, when Performance Monitoring Infrastructure (PMI) is enabled, allows local users to obtain sensitive information by reading the (1) systemout.log and (2) ffdc files. NOTE: this is probably a duplicate of CVE-2008-5413.Show less
CVE-2009-0453
1Onlinegrades
1Online Grades
Apr 23, 2026
Feb 10, 2009
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Online Grades 3.2.4 allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function.
CVE-2008-4560
1Hp
1Openview Network Node Manager
Apr 23, 2026
Feb 8, 2009
N/A· v4
N/A· v3
7.8 HIGH· v2
HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to obtain sensitive information via (1) a crafted request to the nnmRptConfig.exe CGI program, which reveals the pathname of log dire...Show more
HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to obtain sensitive information via (1) a crafted request to the nnmRptConfig.exe CGI program, which reveals the pathname of log directories; or (2) a crafted parameter in a request to the ovlaunch.exe CGI program, which reveals configuration details. NOTE: this issue may be partially covered by CVE-2009-0205.Show less