Generation of Error Message Containing Sensitive Information

The product generates an error message that includes sensitive information about its environment, users, or associated data.

CVEs (575)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-20371 1Ibm 9Collaborative Lifecycle Management Engineering Lifecycle ManagementEngineering Lifecycle Optimization Engineering Insights+6 more Jun 17, 2026 Jun 2, 2021 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to obtain sensitive information when an error message is returned in the browser. This information could be used in further attacks against t...Show more IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to obtain sensitive information when an error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 195516.Show less
CVE-2021-22885 2Debian Rubyonrails 3Actionpack Page Caching Debian LinuxRails Jun 17, 2026 May 27, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper with untrusted user input.
CVE-2021-20428 1Ibm 1Security Guardium Jun 17, 2026 May 24, 2021 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 IBM Security Guardium 11.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the s...Show more IBM Security Guardium 11.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196315.Show less
CVE-2021-29688 1Ibm 1Security Identity Manager Jun 17, 2026 May 20, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks agai...Show more IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 200102.Show less
CVE-2021-29682 1Ibm 1Security Identity Manager Jun 17, 2026 May 20, 2021 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks agai...Show more IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 199997Show less
CVE-2021-29040 1Liferay 2Digital Experience Platform Liferay Portal Jul 9, 2026 May 16, 2021 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provide overly verbose error messages, which allows remote attacker...Show more The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provide overly verbose error messages, which allows remote attackers to use the contents of error messages to help launch another, more focused attacks via crafted inputs.Show less
CVE-2021-20393 1Ibm 1Qradar User Behavior Analytics Jun 17, 2026 May 14, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 IBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in f...Show more IBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196001.Show less
CVE-2020-23995 1Ilias 1Ilias Jun 17, 2026 May 13, 2021 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 An information disclosure vulnerability in ILIAS before 5.3.19, 5.4.12 and 6.0 allows remote authenticated attackers to get the upload data path via a workspace upload.
CVE-2021-23135 1Argoproj 1Argo Cd Jun 17, 2026 May 12, 2021 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 Exposure of System Data to an Unauthorized Control Sphere vulnerability in web UI of Argo CD allows attacker to cause leaked secret data into web UI error messages and logs. This issue affects Argo CD 1.8 versions prior...Show more Exposure of System Data to an Unauthorized Control Sphere vulnerability in web UI of Argo CD allows attacker to cause leaked secret data into web UI error messages and logs. This issue affects Argo CD 1.8 versions prior to 1.8.7; 1.7 versions prior to 1.7.14.Show less
CVE-2020-19275 1Dhcms Project 1Dhcms Jun 17, 2026 May 12, 2021 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 An Information Disclosure vulnerability exists in dhcms 2017-09-18 when entering invalid characters after the normal interface, which causes an error that will leak the physical path.
CVE-2021-31341 1Mendix 1Database Replication Jun 17, 2026 May 12, 2021 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 Uploading a table mapping using a manipulated XML file results in an exception that could expose information about the application-server and the used XML-framework on the Mendix Database Replication Module (All versions...Show more Uploading a table mapping using a manipulated XML file results in an exception that could expose information about the application-server and the used XML-framework on the Mendix Database Replication Module (All versions prior to v7.0.1).Show less
CVE-2021-31339 1Mendix 1Excel Importer Jun 17, 2026 May 12, 2021 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 A vulnerability has been identified in Mendix Excel Importer Module (All versions < V9.0.3). Uploading a manipulated XML File results in an exception that could expose information about the Application-Server and the use...Show more A vulnerability has been identified in Mendix Excel Importer Module (All versions < V9.0.3). Uploading a manipulated XML File results in an exception that could expose information about the Application-Server and the used XML-Framework.Show less
CVE-2020-4536 1Ibm 1Openpages Grc Platform Jun 17, 2026 May 11, 2021 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 IBM OpenPages GRC Platform 8.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against t...Show more IBM OpenPages GRC Platform 8.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 182907.Show less
CVE-2021-21421 1Node Etsy Client Project 1Node Etsy Client Jun 17, 2026 Apr 1, 2021 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 node-etsy-client is a NodeJs Etsy ReST API Client. Applications that are using node-etsy-client and reporting client error to the end user will offer api key value too This is fixed in node-etsy-client v0.3.0 and later.
CVE-2021-21416 1Django Registration Project 1Django Registration Jun 17, 2026 Apr 1, 2021 N/A· v4 2.6 LOW· v3 3.5 LOW· v2 django-registration is a user registration package for Django. The django-registration package provides tools for implementing user-account registration flows in the Django web framework. In django-registration prior to...Show more django-registration is a user registration package for Django. The django-registration package provides tools for implementing user-account registration flows in the Django web framework. In django-registration prior to 3.1.2, the base user-account registration view did not properly apply filters to sensitive data, with the result that sensitive data could be included in error reports rather than removed automatically by Django. Triggering this requires: A site is using django-registration < 3.1.2, The site has detailed error reports (such as Django's emailed error reports to site staff/developers) enabled and a server-side error (HTTP 5xx) occurs during an attempt by a user to register an account. Under these conditions, recipients of the detailed error report will see all submitted data from the account-registration attempt, which may include the user's proposed credentials (such as a password).Show less
CVE-2021-3393 2Postgresql Redhat 3Enterprise Linux PostgresqlSoftware Collections Jun 17, 2026 Apr 1, 2021 N/A· v4 4.3 MEDIUM· v3 3.5 LOW· v2 An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user having UPDATE permission but not SELECT permission to a particular column could craft queries which, under so...Show more An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user having UPDATE permission but not SELECT permission to a particular column could craft queries which, under some circumstances, might disclose values from that column in error messages. An attacker could use this flaw to obtain information stored in a column they are allowed to write but not read.Show less
CVE-2021-20289 4Netapp OracleQuarkus+1 more 4Communications Cloud Native Core Console Oncommand InsightQuarkus+1 more Jun 17, 2026 Mar 26, 2021 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or q...Show more A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. The highest threat from this vulnerability is to data confidentiality.Show less
CVE-2021-22169 1Gitlab 1Gitlab Jun 17, 2026 Mar 24, 2021 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 An issue was identified in GitLab EE 13.4 or later which leaked internal IP address via error messages.
CVE-2021-22193 1Gitlab 1Gitlab Jun 17, 2026 Mar 24, 2021 N/A· v4 3.5 LOW· v3 3.5 LOW· v2 An issue has been discovered in GitLab affecting all versions starting with 7.1. A member of a private group was able to validate the use of a specific name for private project.
CVE-2019-18947 1Microfocus 1Solutions Business Manager Jun 17, 2026 Feb 26, 2021 N/A· v4 3.5 LOW· v3 2.7 LOW· v2 Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to information disclosure.

Previous 1...212223...29 Next