cve.bz

CWE-209: Generation of Error Message Containing Sensitive Information, page 3

Filter

The product generates an error message that includes sensitive information about its environment, users, or associated data.

What the weakness is: CWE-209 at MITRE. OWASP Top 10: A10:2025 Mishandling of Exceptional Conditions

Related attack patterns (CAPEC): 4
  • CAPEC-7 Blind SQL Injection Likelihood: High · Severity: High
  • CAPEC-54 Query System for Information Likelihood: High · Severity: Low
  • CAPEC-215 Fuzzing for application mapping Likelihood: High · Severity: Low
  • CAPEC-463 Padding Oracle Crypto Attack Severity: High

The attack patterns MITRE's CAPEC relates to CWE-209, as MITRE names them. Credits.

Ask an AI about CWE-209

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-209: Generation of Error Message Containing Sensitive Information and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/209.html and https://cve.bz/cve/cwe/209?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.3CVE-2026-56139EPSS 0.6%

    Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Undertow Component. The camel-undertow HTTP server consumer exposes a muteException option that controls what is returned to the client when a rout…

  2. 5.3CVE-2026-49365EPSS 0.6%

    Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Netty HTTP component. The camel-netty-http HTTP server consumer exposes a muteException option that controls what is returned to the client when a …

  3. 5.1CVE-2026-53906EPSS 0.5%

    MCO is vulnerable to Path Disclosure and Path Traversal in file handling functionality related to data export and upload. Improper validation of the filename parameter allows writing files to arbitrary locations as well as indirect disclos…

  4. 6.9CVE-2026-56331EPSS 0.3%

    Capgo before 12.128.2 contains improper error handling in the /private/accept_invitation endpoint that returns HTTP 500 instead of safe 4xx errors when magic_invite_string is invalid. Attackers can trigger this vulnerability using only the…

  5. 4.3CVE-2025-36328EPSS 0.4%

    IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.  This information could be used in further attacks a…

  6. 6.8CVE-2026-47775EPSS 0.2%

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, the OAuth2 HTTP filter's encrypt()/decrypt() functions use AES-256-CBC without an authentication tag (no H…

  7. 5.1CVE-2026-49979EPSS 0.4%

    Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.99, the POST /api/v1/admin/send-test-email endpoint accepts attacker-controlled smtpHost and smtpPort values and establishes a raw JavaMail TCP connec…

  8. 9.8CVE-2025-59872EPSS 0.5%

    HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability, If the server is configured to execute code, then it may be possible to obtain command execution on the server by uploading a file known as a web shell, which allows…

  9. 6.9CVE-2026-47248EPSS 0.3%

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.78 and 9.9.1-alpha.2, Parse Server's GraphQL endpoint discloses schema metadata to unauthenticated callers throug…

  10. 5.3CVE-2026-40997EPSS 0.4%

    Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with g…

  11. 5.3CVE-2026-41730EPSS 0.2%

    Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; …

  12. 4.3CVE-2025-52611EPSS 0.2%

    HCL iControl v4.0.0 was affected by Unhandled Exception - Stack Trace Disclosure vulnerability. The error occurs due to an undefined property being accessed in the application's JavaScript code. Specifically, the code attempts to read the …

  13. 4.3CVE-2025-52606EPSS 0.2%

    HCL iControl was affected by Weak Input Validation vulnerability. This weakness is caused during implementation of an architectural security tactic. Received input that is expected to be of a certain type, but it does not validate or incor…

  14. 5.3CVE-2026-9794EPSS 0.4%

    A flaw was found in Keycloak. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted SOAP requests to the SAML ECP (Security Assertion Markup Language Enhanced Client or Proxy) endpoint with varying …

  15. 7.7CVE-2026-42459EPSS 0.3%

    free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the free5GC UDM component fails to validate the supi path parameter in six GET handlers of the nudm-sdm (Subscriber Data Management) service. An unauthenticat…

  16. 4.3CVE-2026-1248EPSS 0.2%

    IBM Business Automation Workflow containers and traditional may leak information about its database structure in error messages.

  17. 5.3CVE-2024-28765EPSS 0.4%

    IBM SDI 7.2.0.0 through 7.2.0.14 and IBM Security Directory Integrator 10.0.0.0 through 10.0.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This inform…

  18. 2.1CVE-2026-9583EPSS 0.2%

    A weakness has been identified in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This impacts an unknown function of the file /index.php of the component SQL Handler. Executing a manipulation can lead to info…

  19. 7.5CVE-2026-45728EPSS 0.3%

    Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is invoked with a single file path instead of a directory, singleFileMode is set to true and debugMode is forcibly enabled. debugMode activates the Prett…

  20. 4.6CVE-2026-5511EPSS 0.2%

    In the web management interface of Archer AX72 (SG) v1, the network diagnostic feature improperly handles invalid user input, resulting in limited exposure of diagnostic command usage information.  An authenticated attacker with administ…

  21. 1.6CVE-2026-7860EPSS 0.1%

    A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaadin Gradle plugin that exposes the full set of environment variables in build logs whenever the frontend build process exits with a non-zero status. B…

  22. 7.1CVE-2026-41935EPSS 0.3%

    Vvveb before 1.0.8.3 contains an uncontrolled recursion vulnerability in the admin controller dispatch cycle where Base::init() repeatedly invokes permission() on error handlers, causing infinite recursion until PHP memory limits are exhau…

  23. 7.5CVE-2026-42552EPSS 0.3%

    Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the default error handler Engine::_error() writes the full exception message, exception code, and stack trace (including absolute filesystem paths) directly into the HTTP 50…

  24. 5.8CVE-2026-44002EPSS 0.2%

    vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2's CallSite wrapper class (intended as a safe wrapper for V8's native CallSite) blocks getThis() and getFunction() to prevent host object leakage, but allows getFileName() t…

  25. 7.5CVE-2026-43873EPSS 0.3%

    WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/CloneSite/cloneClient.json.php echoes the local CloneSite shared secret ($objClone->myKey, a constant md5($global['systemRootPath'] . $global['salt'…

  26. 5.3CVE-2026-44226EPSS 0.3%

    pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, pyload-ng WebUI returns full Python traceback details to clients on unhandled exceptions. Because /web/<path:filename> is reachable without authe…

  27. 8.3CVE-2026-41644EPSS 0.3%

    monetr is a budgeting application for recurring expenses. Prior to version 1.12.5, a server-side request forgery (SSRF) vulnerability in monetr's Lunch Flow integration allowed any authenticated user on a self-hosted instance to cause the …

  28. 6.9CVE-2026-41931EPSS 0.3%

    Vvveb before version 1.0.8.2 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain sensitive server information by triggering unhandled exceptions in the password-reset module. Attackers can acces…

  29. 5.3CVE-2025-31960EPSS 0.2%

    HCL BigFix Service Management (SM) is vulnerable to information exposure due to improper error handling within its reporting module. It was observed that supplying an invalid or out-of-range value to the consumer_company parameter during a…

  30. 5.3CVE-2025-59853EPSS 0.2%

    HCL DFXAnalytics is affected by an Improper Error Handling vulnerability where the application exposes detailed stack traces in responses, which could allow an attacker to gain insights into the application's internal structure, code logic…

  31. 5.3CVE-2026-40969EPSS 0.2%

    The raw message of every server-side AuthenticationException is returned to the unauthenticated remote caller in the gRPC status description. This allows an attacker to obtain information about the authentication failure, which may be usef…

  32. 7.1CVE-2026-3259EPSS 0.2%

    A Generation of Error Message Containing Sensitive Information vulnerability in the Materialized View Refresh mechanism in Google BigQuery on Google Cloud Platform allows an authenticated user to potentially disclose sensitive data using a…

  33. 7.5CVE-2026-40245EPSS 0.5%

    Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions 4.2.1 and below contain an information disclosure vulnerability in the UDR (Unified Data Repository) service. The handler for GET /nu…

  34. 5.3CVE-2025-52641EPSS 0.1%

    HCL AION is affected by a vulnerability where certain system behaviours may allow exploration of internal filesystem structures. Exposure of such information may provide insights into the underlying environment, which could potentially aid…

  35. 7.5CVE-2026-29146EPSS 8.8%

    Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 throu…

  36. 5.3CVE-2025-14243EPSS 0.3%

    A flaw was found in the OpenShift Mirror Registry. This vulnerability allows an unauthenticated, remote attacker to enumerate valid usernames and email addresses via different error messages during authentication failures and account creat…

  37. 4.4CVE-2026-24511EPSS 0.2%

    Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.6 and versions 9.11.0.0 through 9.13.0.0, contains a generation of error message containing sensitive information vulnerability. A high privileged attacker with local access could pote…

  38. 9.1CVE-2026-34045EPSS 0.5%

    Podman Desktop is a graphical tool for developing on containers and Kubernetes. Prior to 1.26.2, an unauthenticated HTTP server exposed by Podman Desktop allows any network attacker to remotely trigger denial-of-service conditions and extr…

  39. 8.7CVE-2025-71282EPSS 0.3%

    XenForo before 2.3.7 discloses filesystem paths through exception messages triggered by open_basedir restrictions. This allows an attacker to obtain information about the server's directory structure.

  40. 2.0CVE-2026-4994EPSS 0.2%

    A vulnerability was found in wandb OpenUI up to 1.0/3.5-turb. Affected is the function generic_exception_handler of the file backend/openui/server.py of the component APIStatusError Handler. The manipulation of the argument key results in …

  41. 4.3CVE-2026-28786EPSS 0.6%

    Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.6, an unsanitized filename field in the speech-to-text transcription endpoint allows any authenticated non-admin user t…

  42. 4.3CVE-2026-2484EPSS 0.3%

    IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is affected by an information exposure vulnerability caused by overly verbose error messages

  43. 4.3CVE-2026-1262EPSS 0.2%

    IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is affected by an information disclosure vulnerability.

  44. 4.3CVE-2026-21783EPSS 0.3%

    HCL Traveler is affected by sensitive information disclosure.  The application generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, sensitive tokens, credentials, er…

  45. 3.7CVE-2026-4633EPSS 0.4%

    A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when Organizations are enabled. This vulnerability allows an attacker to determine the existence of users, leading…

  46. 8.7CVE-2026-33192EPSS 0.3%

    Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. In versions prior to 1.4.2, the UDM incorrectly converts a downstream 400 Bad Request (from UDR) into a 500 Internal Server Error when handlin…

  47. 6.9CVE-2026-33065EPSS 0.3%

    Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. In versions prior to 1.4.2, the UDM incorrectly converts a downstream 400 Bad Request (from UDR) into a 500 Internal Server Error when handlin…

  48. 7.5CVE-2025-13726EPSS 0.3%

    IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow a remote attacker to obtain sensitive information when detailed technical error messages are returned. This information could be used i…

  49. 6.9CVE-2026-30835EPSS 0.4%

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.7 and 9.5.0-alpha.6, malformed $regex query parameter (e.g. [abc) causes the database to return a structured err…

  50. 5.3CVE-2026-29110EPSS 0.1%

    Cryptomator encrypts data being stored on cloud infrastructure. Prior to version 1.19.0, in non-debug mode Cryptomator might leak cleartext paths into the log file. This can reveal meta information about the files stored inside a vault at …