← Back
CWE-200

10,443 CVEs • Abstraction: Class • Likelihood of Exploit: High

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

JSON object

Loading...

CVEs (10,443)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
1Grafana
1Grafana
Jun 17, 2026
Oct 13, 2022
N/A· v4
7.5 HIGH· v3
N/A· v2
Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The...Show more
Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and plugin proxy endpoints with authentication tokens. The destination plugin could receive a user's Grafana authentication token. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not use API keys, JWT authentication, or any HTTP Header based authentication.Show less
1Dell
1Geodrive
Jun 17, 2026
Oct 12, 2022
N/A· v4
7.8 HIGH· v3
N/A· v2
Dell GeoDrive, versions 2.1 - 2.2, contains an information disclosure vulnerability in GUI. An authenticated non-admin user could potentially exploit this vulnerability and view sensitive information.
1Sap
1Business Objects Business Intelligence Platform
Jun 17, 2026
Oct 11, 2022
N/A· v4
7.6 HIGH· v3
N/A· v2
Under certain conditions an authenticated attacker can get access to OS credentials. Getting access to OS credentials enables the attacker to modify system data and make the system unavailable leading to high impact on c...Show more
Under certain conditions an authenticated attacker can get access to OS credentials. Getting access to OS credentials enables the attacker to modify system data and make the system unavailable leading to high impact on confidentiality and low impact on integrity and availability of the application.Show less
1Sap
1Businessobjects Business Intelligence
Jun 17, 2026
Oct 11, 2022
N/A· v4
4.9 MEDIUM· v3
N/A· v2
Under certain conditions, the application SAP BusinessObjects Business Intelligence Platform (Version Management System) exposes sensitive information to an actor over the network with high privileges that is not explici...Show more
Under certain conditions, the application SAP BusinessObjects Business Intelligence Platform (Version Management System) exposes sensitive information to an actor over the network with high privileges that is not explicitly authorized to have access to that information, leading to a high impact on Confidentiality.Show less
1Siemens
10Desigo Pxm30 1 Firmware
Desigo Pxm30.e FirmwareDesigo Pxm40 1 Firmware+7 more
Jun 17, 2026
Oct 11, 2022
N/A· v4
5.7 MEDIUM· v3
N/A· v2
A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All versions < V02.20.126.11-41), Desigo PXM40.E (All versions <...Show more
A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All versions < V02.20.126.11-41), Desigo PXM40.E (All versions < V02.20.126.11-41), Desigo PXM50-1 (All versions < V02.20.126.11-41), Desigo PXM50.E (All versions < V02.20.126.11-41), PXG3.W100-1 (All versions < V02.20.126.11-37), PXG3.W100-2 (All versions < V02.20.126.11-41), PXG3.W200-1 (All versions < V02.20.126.11-37), PXG3.W200-2 (All versions < V02.20.126.11-41). Endpoints of the “Operation” web application that interpret and execute Axon language queries allow file read access to the device file system with root privileges. By supplying specific I/O related Axon queries, a remote low-privileged attacker can read sensitive files on the device.Show less
1Zoneminder
1Zoneminder
Jun 17, 2026
Oct 7, 2022
N/A· v4
7.5 HIGH· v3
N/A· v2
ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the ZoneMinder API Exposes Database Log contents to user without privileges, allows insertion, modification, deletion...Show more
ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the ZoneMinder API Exposes Database Log contents to user without privileges, allows insertion, modification, deletion of logs without System Privileges. Users are advised yo upgrade as soon as possible. Users unable to upgrade should disable database logging.Show less
1Samsung
1Uphelper Library
Jun 17, 2026
Oct 7, 2022
N/A· v4
3.3 LOW· v3
N/A· v2
Implicit intent hijacking vulnerability in UPHelper library prior to version 3.0.12 allows attackers to access sensitive information via implicit intent.
1Google
1Android
Jun 17, 2026
Oct 7, 2022
N/A· v4
3.3 LOW· v3
N/A· v2
Improper access control vulnerability in imsservice application prior to SMR Oct-2022 Release 1 allows local attackers to access call information.
1Google
1Android
Jun 17, 2026
Oct 7, 2022
N/A· v4
3.3 LOW· v3
N/A· v2
Exposure of sensitive information in AT_Distributor prior to SMR Oct-2022 Release 1 allows local attacker to access SerialNo via log.
1Linuxfoundation
1Dex
Jun 17, 2026
Oct 6, 2022
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex instances with public clients (and by extension, clients accepting tokens issued by those Dex instances) are affected by thi...Show more
Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex instances with public clients (and by extension, clients accepting tokens issued by those Dex instances) are affected by this vulnerability if they are running a version prior to 2.35.0. An attacker can exploit this vulnerability by making a victim navigate to a malicious website and guiding them through the OIDC flow, stealing the OAuth authorization code in the process. The authorization code then can be exchanged by the attacker for a token, gaining access to applications accepting that token. Version 2.35.0 has introduced a fix for this issue. Users are advised to upgrade. There are no known workarounds for this issue.Show less
1Bosch
2Bosch Video Management System
Videojet Decoder 7513 Firmware
Jun 17, 2026
Sep 30, 2022
N/A· v4
5.9 MEDIUM· v3
N/A· v2
Information Disclosure in Operator Client application in BVMS 10.1.1, 11.0 and 11.1.0 and VIDEOJET Decoder VJD-7513 versions 10.23 and 10.30 allows man-in-the-middle attacker to compromise confidential video stream. This...Show more
Information Disclosure in Operator Client application in BVMS 10.1.1, 11.0 and 11.1.0 and VIDEOJET Decoder VJD-7513 versions 10.23 and 10.30 allows man-in-the-middle attacker to compromise confidential video stream. This is only applicable for UDP encryption when target system contains cameras with platform CPP13 or CPP14 and firmware version 8.x.Show less
1Pingidentity
1Pingcentral
Jun 17, 2026
Sep 30, 2022
N/A· v4
4.9 MEDIUM· v3
N/A· v2
PingCentral versions prior to listed versions expose Spring Boot actuator endpoints that with administrative authentication return large amounts of sensitive environmental and application information.
1Tooljet
1Tooljet
Jun 17, 2026
Sep 28, 2022
N/A· v4
4.9 MEDIUM· v3
N/A· v2
Just like in the previous report, an attacker could steal the account of different users. But in this case, it's a little bit more specific, because it is needed to be an editor in the same app as the victim.
1Lcnet
1Smart Evision
Jun 17, 2026
Sep 28, 2022
N/A· v4
5.3 MEDIUM· v3
N/A· v2
Smart eVision has insufficient authorization for task acquisition function. An unauthorized remote attacker can exploit this vulnerability to acquire the Session IDs of other general users only.
1Lcnet
1Smart Evision
Jun 17, 2026
Sep 28, 2022
N/A· v4
7.5 HIGH· v3
N/A· v2
smart eVision has inadequate authorization for system information query function. An unauthenticated remote attacker, who is not explicitly authorized to access the information, can access sensitive information.
1Lcnet
1Smart Evision
Jun 17, 2026
Sep 28, 2022
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Smart eVision has inadequate authorization for the database query function. A remote attacker with general user privilege, who is not explicitly authorized to access the information, can access sensitive information.
1Mailcow
1Mailcow\
Jun 17, 2026
Sep 27, 2022
N/A· v4
8.2 HIGH· v3
N/A· v2
mailcow is a mailserver suite. A vulnerability innversions prior to 2022-09 allows an attacker to craft a custom Swagger API template to spoof Authorize links. This could redirect a victim to an attacker controller place...Show more
mailcow is a mailserver suite. A vulnerability innversions prior to 2022-09 allows an attacker to craft a custom Swagger API template to spoof Authorize links. This could redirect a victim to an attacker controller place to steal Swagger authorization credentials or create a phishing page to steal other information. The issue has been fixed with the 2022-09 mailcow Mootember Update. As a workaround, one may delete the Swapper API Documentation from their e-mail server.Show less
1Rocketchat
1Rocket.chat
Jun 17, 2026
Sep 23, 2022
N/A· v4
4.3 MEDIUM· v3
N/A· v2
A information disclosure vulnerability exists in Rocket.Chat <v5 where the getUserMentionsByChannel meteor server method discloses messages from private channels and direct messages regardless of the users access permiss...Show more
A information disclosure vulnerability exists in Rocket.Chat <v5 where the getUserMentionsByChannel meteor server method discloses messages from private channels and direct messages regardless of the users access permission to the room.Show less
1Rocketchat
1Rocket.chat
Jun 17, 2026
Sep 23, 2022
N/A· v4
4.3 MEDIUM· v3
N/A· v2
A information disclosure vulnerability exists in Rocket.chat <v5, <v4.8.2 and <v4.7.5 where the lack of ACL checks in the getRoomRoles Meteor method leak channel members with special roles to unauthorized clients.
1Rocketchat
1Rocket.chat
Jun 17, 2026
Sep 23, 2022
N/A· v4
4.3 MEDIUM· v3
N/A· v2
A NoSQL-Injection information disclosure vulnerability vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 in the getS3FileUrl Meteor server method that can disclose arbitrary file upload URLs to users that shou...Show more
A NoSQL-Injection information disclosure vulnerability vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 in the getS3FileUrl Meteor server method that can disclose arbitrary file upload URLs to users that should not be able to access.Show less