CVE Database

CVE-2025-62397 Medium · 5.3 CWE-209 Oct 23, 2025

Moodle: router produces json instead of 404 error for invalid course id

The router’s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially aiding reconnaissance.

CVE-2025-62168 High · 7.5 Public exploit CWE-209 Oct 17, 2025

Squid vulnerable to information disclosure via authentication credential leakage in error handling

Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. The vulnerability allows a script to bypass browser security protections and learn the credentials a trusted client uses to authenticate. This potentially allows a remote client to identify security tokens or credentials used internally by a web application using Squid for backend load balancing. These attacks do not require Squid to be configured with HTTP authentication. The vulnerability is fixed in version 7.2. As a workaround, disable debug information in administrator mailto links generated by Squid by configuring squid.conf with email_err_data off.

CVE-2025-55676 Medium · 5.5 CWE-209 Oct 14, 2025

Windows USB Video Class System Driver Information Disclosure Vulnerability

Generation of error message containing sensitive information in Windows USB Video Driver allows an authorized attacker to disclose information locally.

CVE-2025-31998 Critical · 9.8 CWE-209 Oct 12, 2025

HCL Unica Centralized Offer Management is vulnerable to poor unhandled exceptions which exposes sensitive information

HCL Unica Centralized Offer Management is vulnerable to poor unhandled exceptions which exposes sensitive information. An attacker can exploit use this information to exploit known vulnerabilities launch targeted attacks, such as remote code execution or denial of service.

CVE-2025-54291 Medium · 5.3 CWE-209 Oct 2, 2025

Project existence disclosure in LXD images API

Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses.

CVE-2025-26333 High · 7.5 CWE-209 Sep 25, 2025

Information Exposure Through an Error Message in Dell Bsafe Crypto-j

Dell BSAFE Crypto-J generates an error message that includes sensitive information about its environment and associated data. A remote attacker could potentially exploit this vulnerability, leading to information exposure.

CVE-2025-43777 Medium · 5.3 CWE-209 Sep 9, 2025

Information Exposure Through an Error Message in Liferay Digital Experience Platform

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.19 exposes "Internal Server Error" in the response body when a login attempt is made with a deleted Client Secret.

CVE-2025-36003 Medium · 5.3 CWE-209 Aug 28, 2025

IBM Security Verify Governance Identity Manager information disclosure

IBM Security Verify Governance Identity Manager 10.0.2 could allow a remote attacker to obtain sensitive information when detailed technical error messages are returned. This information could be used in further attacks against the system.

CVE-2025-47813 Medium · 4.3 KEV High · 57 Public exploit CWE-209 Jul 10, 2025

Wing FTP Server Information Disclosure Vulnerability

loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.

CVE-2024-35935 Low · 3.3 CWE-209 May 19, 2024

btrfs: send: handle path ref underflow in header iterate_inode_ref()

In the Linux kernel, the following vulnerability has been resolved: btrfs: send: handle path ref underflow in header iterate_inode_ref() Change BUG_ON to proper error handling if building the path buffer fails. The pointers are not printed so we don't accidentally leak kernel addresses.

CVE-2024-29059 High · 7.5 KEV High · 69 Public exploit CWE-209 Mar 22, 2024

Microsoft .NET Framework Information Disclosure Vulnerability

.NET Framework Information Disclosure Vulnerability

CVE-2023-20593 Medium · 5.5 CWE-209 Jul 24, 2023

Information Exposure Through an Error Message in Xen

An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information.

CVE-2022-0563 Medium · 5.5 CWE-209 Feb 21, 2022

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support....

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.

CVE-2018-12886 High · 8.1 CWE-209 May 22, 2019

stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler...

stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against.

CVE-2013-7331 Medium · 6.5 KEV High · 68 Public exploit CWE-209 Feb 26, 2014

Microsoft Internet Explorer Information Disclosure Vulnerability

The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share pathnames, intranet hostnames, and intranet IP addresses by examining error codes, as demonstrated by a res:// URL, and exploited in the wild in February 2014.