CWE-209: Generation of Error Message Containing Sensitive Information, page 5
Filter
The product generates an error message that includes sensitive information about its environment, users, or associated data.
What the weakness is: CWE-209 at MITRE. OWASP Top 10: A10:2025 Mishandling of Exceptional Conditions
Related attack patterns (CAPEC): 4
- CAPEC-7 Blind SQL Injection Likelihood: High · Severity: High
- CAPEC-54 Query System for Information Likelihood: High · Severity: Low
- CAPEC-215 Fuzzing for application mapping Likelihood: High · Severity: Low
- CAPEC-463 Padding Oracle Crypto Attack Severity: High
The attack patterns MITRE's CAPEC relates to CWE-209, as MITRE names them. Credits.
Ask an AI about CWE-209
Show the prompt
Explain CWE-209: Generation of Error Message Containing Sensitive Information and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/209.html and https://cve.bz/cve/cwe/209?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 5.3CVE-2025-59016EPSS 0.2%
Error messages containing sensitive information in the File Abstraction Layer in TYPO3 CMS versions 9.0.0-9.5.54, 10.0.0-10.4.53, 11.0.0-11.5.47, 12.0.0-12.4.36, and 13.0.0-13.4.17 allow backend users to disclose full file paths via failed…
- 5.1CVE-2025-43777EPSS 0.2%
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.19 ex…
- 5.0CVE-2025-48562EPSS 0.09%
In writeContent of RemotePrintDocument.java, there is a possible information disclosure due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for ex…
- 5.5CVE-2025-22421EPSS 0.1%
In contentDescForNotification of NotificationContentDescription.kt, there is a possible notification content leak through the lockscreen due to a logic error in the code. This could lead to local information disclosure with no additional e…
- 5.3CVE-2025-36003EPSS 0.3%
IBM Security Verify Governance Identity Manager 10.0.2 could allow a remote attacker to obtain sensitive information when detailed technical error messages are returned. This information could be used in further attacks against the system.
- 5.3CVE-2025-9229EPSS 0.3%
Information disclosure vulnerability in error handling in MiR software prior to version 3.0.0 allows unauthenticated attackers to view detailed error information, such as file paths and other data, via access to verbose error pages.
- 5.3CVE-2025-52619EPSS 0.3%
HCL BigFix SaaS Authentication Service is affected by a sensitive information disclosure. Under certain conditions, error messages disclose sensitive version information about the underlying platform.
- 2.9CVE-2025-9005EPSS 0.6%
A vulnerability was determined in mtons mblog up to 3.5.0. Affected is an unknown function of the file /register. The manipulation leads to information exposure through error message. It is possible to launch the attack remotely. The compl…
- 5.3CVE-2025-54791EPSS 0.3%
OMERO.web provides a web based client and plugin infrastructure. Prior to version 5.29.2, if an error occurred when resetting a user's password using the Forgot Password option in OMERO.web, the error message displayed on the Web page can …
- 2.1CVE-2024-41984EPSS 0.2%
A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SOA Cockpit (All versions >= V13.2 < V2506). The affected application improperly h…
- 5.1CVE-2024-41983EPSS 0.2%
A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SOA Cockpit (All versions >= V13.2 < V2506). The affected application displays SQL…
- 2.1CVE-2025-8852EPSS 0.4%
A vulnerability was identified in WuKongOpenSource WukongCRM 11.0. This affects an unknown part of the file /adminFile/upload of the component API Response Handler. The manipulation leads to information exposure through error message. It i…
- 7.5CVE-2025-23320EPSS 1.0%
NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause the shared memory limit to be exceeded by sending a very large request. A successful exploit of this vulnera…
- 9.8CVE-2025-46658EPSS 0.4%
An issue was discovered in ExonautWeb in 4C Strategies Exonaut 21.6. There are verbose error messages.
- 2.9CVE-2025-8548EPSS 0.5%
A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic. This issue affects the function sendEmailCode of the file src/main/java/co/yiiu/pybbs/controller/api/SettingsApiController.java of the component Registered…
- 4.3CVE-2025-47813KEVExploitEPSS 63%
loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.
- 5.3CVE-2025-36090EPSS 0.3%
IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 could allow a remote attacker to obtain information about the application framework which could be used in reconnaissance to gather information for future attacks from a detailed technical e…
- 5.3CVE-2024-37524EPSS 0.3%
IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.
- 6.9CVE-2025-40718EPSS 0.4%
Improper error handling vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to send malformed payloads to generate error messages containing sensitive information.
- 5.5CVE-2025-5731EPSS 0.2%
A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command string that may expose the data in an error message when a command is not found.
- 7.5CVE-2025-44203EPSS 0.6%
In HotelDruid 3.0.0 and 3.0.7, the unauthenticated database-setup endpoint creadb.php can be reached before setup is completed and performs database creation without locking. By sending many concurrent requests, an attacker can trigger a r…
- 4.0CVE-2025-49128EPSS 0.4%
Jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. Starting in version 2.0.0 and prior to version 2.13.0, a flaw in jackson-core's `JsonLocation._appendSourceDes…
- 5.3CVE-2024-56342EPSS 0.3%
IBM Verify Identity Access Digital Credentials 24.06 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks again…
- 5.3CVE-2025-25025EPSS 0.4%
IBM Security Guardium 12.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
- 6.9CVE-2025-40653EPSS 0.4%
User enumeration vulnerability in M3M Printer Server Web. This issue occurs during user authentication, where a difference in error messages could allow an attacker to determine whether a username is valid or not, allowing a brute force at…
- 6.3CVE-2025-41441EPSS 0.4%
Mailform Pro CGI prior to 4.3.4 generates error messages containing sensitive information, which may allow a remote unauthenticated attacker to obtain coupon codes. This vulnerability only affects products that use the coupon feature.
- 5.8CVE-2025-46746EPSS 0.3%
An administrator could discover another account's credentials.
- 6.5CVE-2025-4166EPSS 0.5%
Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault R…
- 4.3CVE-2025-0049EPSS 0.3%
When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error message includes the absolute server path which may allow Fuzzing for application mapping. This issue affects GoAnywhe…
- 7.5CVE-2025-46575EPSS 0.4%
There is an information disclosure vulnerability in the GoldenDB database product. Attackers can exploit error messages to obtain the system's sensitive information.
- 4.3CVE-2025-25045EPSS 0.3%
IBM InfoSphere Information 11.7 Server authenticated user to obtain sensitive information when a detailed technical error message is returned in a request. This information could be used in further attacks against the system.
- 5.3CVE-2025-20150EPSS 0.5%
A vulnerability in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to enumerate LDAP user accounts. This vulnerability is due to the improper handling of LDAP authentication requests. An attacker could exploit this…
- 7.5CVE-2024-11129EPSS 0.4%
An issue has been discovered in GitLab EE affecting all versions from 17.1 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. This allows attackers to perform targeted searches with sensitive keywords to get the count of issues …
- 4.3CVE-2025-32238EPSS 0.5%
Generation of Error Message Containing Sensitive Information vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Retrieve Embedded Sensitive Data.This issue affects Online Bo…
- 4.3CVE-2025-0279EPSS 0.3%
HCL Traveler generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, sensitive tokens, credentials, error codes, or stack traces. Attackers could exploit this informat…
- 5.3CVE-2023-47639EPSS 0.4%
API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. From 3.2.0 until 3.2.4, exception messages, that are not HTTP exceptions, are visible in the JSON error response. This vulnerability is fixed in 3.2.5.
- 5.3CVE-2024-55895EPSS 0.4%
IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
- 7.5CVE-2025-31141EPSS 0.4%
In JetBrains TeamCity before 2025.03 exception could lead to credential leakage on Cloud Profiles page
- 7.5CVE-2024-12380EPSS 0.6%
An issue was discovered in GitLab EE/CE affecting all versions starting from 11.5 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2. Certain user inputs in repository mirroring sett…
- 5.3CVE-2025-2239EPSS 0.4%
Generation of Error Message Containing Sensitive Information vulnerability in Hillstone Networks Hillstone Next Generation FireWall.This issue affects Hillstone Next Generation FireWall: from 5.5R8P1 before 5.5R8P23.
- 4.1CVE-2025-23185EPSS 0.3%
Due to improper error handling in SAP Business Objects Business Intelligence Platform, technical details of the application are revealed in exceptions thrown to the user and in stack traces. Only an attacker with administrator level privil…
- 6.9CVE-2025-20002EPSS 0.3%
After attempting to upload a file that does not meet prerequisites, GMOD Apollo will respond with local path information disclosure
- 5.5CVE-2024-56812EPSS 0.1%
IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system.
- 3.3CVE-2024-56811EPSS 0.1%
IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system.
- 3.3CVE-2024-56810EPSS 0.1%
IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system.
- 3.3CVE-2024-56496EPSS 0.1%
IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system.
- 3.3CVE-2024-56495EPSS 0.1%
IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system.
- 3.3CVE-2024-56494EPSS 0.1%
IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system.
- 3.3CVE-2024-56493EPSS 0.1%
IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system.
- 5.8CVE-2025-0941EPSS 0.2%
MET ONE 3400+ instruments running software v1.0.41 can, under rare conditions, temporarily store credentials in plain text within the system. This data is not available to unauthenticated users.