cve.bz

CWE-209: Generation of Error Message Containing Sensitive Information, page 2

Filter

The product generates an error message that includes sensitive information about its environment, users, or associated data.

What the weakness is: CWE-209 at MITRE. OWASP Top 10: A10:2025 Mishandling of Exceptional Conditions

Related attack patterns (CAPEC): 4
  • CAPEC-7 Blind SQL Injection Likelihood: High · Severity: High
  • CAPEC-54 Query System for Information Likelihood: High · Severity: Low
  • CAPEC-215 Fuzzing for application mapping Likelihood: High · Severity: Low
  • CAPEC-463 Padding Oracle Crypto Attack Severity: High

The attack patterns MITRE's CAPEC relates to CWE-209, as MITRE names them. Credits.

Ask an AI about CWE-209

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-209: Generation of Error Message Containing Sensitive Information and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/209.html and https://cve.bz/cve/cwe/209?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.2CVE-2026-88467EPSS 0.1%

    CRMEB Knowledge-Paid System crmeb_zzff_class 1.4.4 has a backend verification function that returns the wrong type of value, causing errors and leaking sensitive information.

  2. 4.3CVE-2026-1030EPSS 0.3%

    IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 generates an error message that includes sensitive information about its environment, users, or associated data.

  3. 5.3CVE-2025-1350EPSS 0.4%

    IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in fur…

  4. 2.7CVE-2026-45723EPSS 0.5%

    Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go passes the caller-controlled TalosVersion field to imageFactoryClient…

  5. 6.9CVE-2026-92936EPSS 0.5%

    vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can force the host-realm source transformer to throw a SyntaxError (for example by calling eval…

  6. 5.3CVE-2026-55375EPSS 0.4%

    canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams() places app_id, app_secret, refresh_token, and code in the URL query string of token POST requests, allowing ac…

  7. 6.2CVE-2026-54561EPSS 0.2%

    MCP Memory Keeper is an MCP server for persistent context management in AI coding assistants. Prior to 0.13.0, context_import in src/index.ts passes the caller-controlled filePath directly to fs.readFileSync without restricting the path to…

  8. 5.8CVE-2026-55102EPSS 0.2%

    hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, every API method in src/Vault.js passes failed requests through parseAxiosError(), which rethrows the raw AxiosError while retaining AxiosErro…

  9. 6.5CVE-2026-66306EPSS 0.9%

    Generation of error message containing sensitive information in Skype for Business allows an unauthorized attacker to disclose information over a network.

  10. 5.5CVE-2026-69684EPSS 0.5%

    Generation of error message containing sensitive information in Windows Error Reporting allows an authorized attacker to disclose information locally.

  11. 5.7CVE-2026-69552EPSS 0.9%

    Generation of error message containing sensitive information in Windows Print Spooler Components allows an authorized attacker to disclose information over a network.

  12. 5.5CVE-2026-69294EPSS 0.5%

    Generation of error message containing sensitive information in Microsoft COM for Windows allows an authorized attacker to disclose information locally.

  13. 5.5CVE-2026-68886EPSS 0.5%

    Use after free in Windows Network Connection Broker allows an authorized attacker to disclose information locally.

  14. 6.5CVE-2026-67383EPSS 1.0%

    Generation of error message containing sensitive information in SQL Server allows an authorized attacker to disclose information over a network.

  15. 6.5CVE-2026-11873EPSS 0.5%

    An Apache-proxied Dogtag CA REST endpoint exposed by IdM (POST /ca/rest/certrequests) returns HTTP 500 with internal Java stack traces for unauthenticated malformed requests. The same unauthenticated error path emits large multi-line stack…

  16. 2.1CVE-2026-82739EPSS 0.2%

    Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who fails its confirmation check. Ash.Resource.Validation.Confirm's atomic implement…

  17. 6.3CVE-2026-82733EPSS 0.5%

    Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal application data from an HTTP 500 response body. When a typed-controller route ha…

  18. 6.3CVE-2026-77950EPSS 0.5%

    Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler …

  19. 2.3CVE-2026-82727EPSS 0.5%

    Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, cr…

  20. 5.3CVE-2026-82580EPSS 0.5%

    Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses internal error text to chat users. In AshAi.ToolLoop and AshAi.Tools, an exception raised while executing a tool was serialized ver…

  21. 7.1CVE-2026-75760EPSS 0.5%

    Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses provider request state and credentials in a user-facing validation error. In AshAi.Changes.Vectorize, when the embedding provider c…

  22. 6.9CVE-2026-78693EPSS 0.5%

    Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_graphql allows a remote client to read internal field names that an application configured its error_handler to redact. In AshGraphql.Errors, ea…

  23. 6.5CVE-2026-59271EPSS 0.3%

    When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earli…

  24. 7.5CVE-2026-47893EPSS 0.5%

    A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Fr…

  25. 3.9CVE-2026-21809EPSS 0.1%

    HCL BigFix Quantum Risk Analyzer has a certain validation process that provides overly descriptive error messages when it encounters malformed input which can allow an attacker to conduct more efficient reconnaissance and fine-tune automat…

  26. 5.1CVE-2026-79777EPSS 0.3%

    rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses.

  27. 5.3CVE-2026-8173EPSS 0.3%

    The web GUI of affected Murrelektronik Xelity switches logs MAC addresses from the devices MAC address table when an authenticated administrator uses the 'Copy learned MAC Addresses' function. Due to improper generation of error messages, …

  28. 3.5CVE-2026-33333EPSS 0.3%

    Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is sensitive information disclosure in the error messages. This issue has been fixed in version 3.2.3.

  29. 7.1CVE-2026-77076EPSS 0.5%

    n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an information disclosure vulnerability in the GraphQL node. When a GraphQL request fails at the connection level, the node re-throws the underlying HTTP client error unchanged inste…

  30. 5.3CVE-2026-53458EPSS 0.5%

    Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio backend API handlers in custom_components/blueprint_studio/backend/api.py returned raw exception strings to authenticat…

  31. 8.7CVE-2026-74879EPSS 0.4%

    openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitiv…

  32. 3.7CVE-2026-73844EPSS 0.4%

    CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server i…

  33. 5.3CVE-2026-73555EPSS 0.4%

    vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validation_exception_handler in vllm/entrypoints/openai/server_utils.py converts FastAPI RequestValidationError objects with str(exc), and sanitize_mes…

  34. 4.3CVE-2026-56620EPSS 0.3%

    HCL BigFix Mobile is vulnerable to information disclosure due to improper handling of exceptions and verbose error reporting.

  35. 6.3CVE-2026-43630EPSS 0.5%

    llama.cpp builds b4882 before b8487 contain an out-of-bounds read vulnerability in the recurrent memory state restore path that allows attackers with write access to the slot save directory to read memory past the end of the allocated cell…

  36. 5.3CVE-2026-47622EPSS 0.5%

    NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause the generation of error messages that contain sensitive information. A successful exploit of this vulnerability might lead to information disclosure.

  37. 8.2CVE-2026-69247EPSS 0.3%

    cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime reported the outcome of decrypting a RecipientI…

  38. 5.3CVE-2026-56571EPSS 0.3%

    HCL iControl was affected by Improper Error Handling vulnerabilities. It involves Out of memory, null pointer exceptions, system call failure, database unavailable, network timeout, and hundreds of other common conditions can cause errors …

  39. 5.3CVE-2026-56568EPSS 0.3%

    HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It involves application displays raw server/API error messages to users instead of generic error messages and exposes interna…

  40. 5.3CVE-2026-11904EPSS 0.4%

    IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 and IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 could allow a r…

  41. 6.3CVE-2026-59943EPSS 0.4%

    Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rende…

  42. 6.8CVE-2025-59177EPSS 0.2%

    Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a vulnerability in Configuration Management, allowing an attacker to execute specifically crafted commands to reveal system secret through error messages.

  43. 3.5CVE-2026-56537EPSS 0.3%

    HCL Connections is vulnerable to information disclosure which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data.they are not entitled to, caused by improper handling of…

  44. 6.3CVE-2026-66009EPSS 0.4%

    Parse Server versions >= 9.0.0 before 9.10.0-alpha.5 and >= 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled (graphQLPublicIntrospection: false, …

  45. 6.3CVE-2026-66008EPSS 0.6%

    Parse Server versions >= 9.0.0 before 9.10.0-alpha.6 and >= 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled (gra…

  46. 7.5CVE-2026-13182EPSS 0.5%

    In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that reveals protected metadata values to remote attackers.

  47. 6.9CVE-2026-64627EPSS 0.5%

    Parse Server versions >= 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled (graphQLPublicIntrospection: false, the default),…

  48. 5.3CVE-2026-63748EPSS 0.3%

    SurrealDB versions before 3.1.0 contain an information disclosure vulnerability where authenticated users with UPDATE access can read field values hidden by field-level SELECT permissions through error messages. Attackers can trigger arith…

  49. 5.3CVE-2026-8861EPSS 0.4%

    IBM Security Verify could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.  This information could be used in further attacks against the system.

  50. 5.3CVE-2024-23575EPSS 0.3%

    HCL Aftermarket EPC is vulnerable to attack since the application returns detailed error messages that leak information about the processing on the server. An attacker may use the contents of error messages to help launch another ,more foc…