CWE-1230 Exposure of Sensitive Information Through Metadata
baseThe product prevents direct access to a resource containing sensitive information, but it does not sufficiently limit access to metadata that is derived from the original, sensitive information.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (27)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-9099US | high8.1 | — | ||
In lunary-ai/lunary version v1.4.29, the GET /projects API endpoint exposes both public and private API keys for all projects to users with minimal permissions, such as Viewers or… | ||||
| CVE-2024-53291US | high7.5 | — | ||
Dell NativeEdge, version(s) 2.1.0.0, contain(s) an Exposure of Sensitive Information Through Metadata vulnerability. An unauthenticated attacker with remote access could potentiall… | ||||
| CVE-2023-1974US | medium6.5 | — | ||
Exposure of Sensitive Information Through Metadata in GitHub repository answerdev/answer prior to 1.0.8. | ||||
| CVE-2014-3562US | medium5.0 | — | ||
Red Hat Directory Server 8 and 389 Directory Server, when debugging is enabled, allows remote attackers to obtain sensitive replicated metadata by searching the directory. | ||||
| CVE-2023-50458US | medium4.3 | — | ||
In Dradis before 4.11.0, the Output Console shows a job queue that may contain information about other users' jobs. | ||||
| CVE-2023-32488US | medium4.3 | — | ||
Dell PowerScale OneFS, 8.2.x-9.5.0.x, contains an information disclosure vulnerability in NFS. A low privileged attacker could potentially exploit this vulnerability, leading to i… | ||||
| CVE-2026-14351US | — | — | ||
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have al… | ||||
| CVE-2025-59601US | — | — | ||
Information Disclosure when resetting device to factory default settings through powerline interface allows unauthorized access to device configuration. | ||||
| CVE-2026-45544US | — | — | ||
Nextcloud is an open source content collaboration platform. From version 0.8.0 to before version 1.0.4, the view filter criteria is exposed to users with read-only permissions in N… | ||||
| CVE-2026-49270US | — | — | ||
Exposure of Sensitive Information Through Metadata vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.
Brokers that are configured with a network connec… | ||||
| CVE-2025-31959US | — | — | ||
HCL BigFix Service Management (SM) application fails to strip EXIF metadata from uploaded images. This could lead to confidentiality and privacy risks if sensitive location inform… | ||||
| CVE-2026-29055US | — | — | ||
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the image processing pipeline in Tandoor Recipes ex… | ||||
| CVE-2026-27661US | — | — | ||
A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application leaks confidential information in metadata, and files such as inform… | ||||
| CVE-2025-13084US | — | — | ||
The users endpoint in the groov View API returns a list of all users and
associated metadata including their API keys. This endpoint requires an
Editor role to access and will di… | ||||
| CVE-2025-30038US | — | — | ||
The vulnerability consists of a session ID leak when saving a file downloaded from CGM CLININET. The identifier is exposed through a built-in Windows security feature that stores a… | ||||
| CVE-2025-8713US | — | — | ||
PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data that a row se… | ||||
| CVE-2025-47324US | — | — | ||
Information disclosure while accessing and modifying the PIB file of a remote device via powerline. | ||||
| CVE-2025-48941US | — | — | ||
MyBB is free and open source forum software. Prior to version 1.8.39, the search component does not validate permissions correctly, which allows attackers to determine the existenc… | ||||
| CVE-2025-0330US | — | — | ||
In berriai/litellm version v1.52.1, an issue in proxy_server.py causes the leakage of Langfuse API keys when an error occurs while parsing team settings. This vulnerability exposes… | ||||
| CVE-2024-9447US | — | — | ||
An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. The `/get/organisation/` endpoint does not verify the user's organization, allo… | ||||
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan