CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
classThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (19282)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-20133US | high7.5OT critical | KEV | ||
A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system.
This vulnerability is due… | ||||
| CVE-2026-20128US | —OT critical | KEV | ||
A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affect… | ||||
| CVE-2026-20122US | medium5.4OT critical | KEV | ||
A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vul… | ||||
| CVE-2025-68686US | —OT critical | KEV | ||
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.… | ||||
| CVE-2026-20805US | —OT critical | KEV | ||
Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally. | ||||
| CVE-2025-48633US | medium5.5OT critical | KEV | ||
In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic error in the code. This could lead to lo… | ||||
| CVE-2025-48572US | —OT critical | KEV | ||
In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. This could lead to local escalation of privilege with no additi… | ||||
| CVE-2025-31125US | high7.5OT critical | KEV | ||
Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev serve… | ||||
| CVE-2024-24919US | high8.6OT critical | KEV | ||
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Sof… | ||||
| CVE-2023-50224US | —OT critical | KEV | ||
TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information o… | ||||
| CVE-2024-29059US | —OT critical | KEV | ||
.NET Framework Information Disclosure Vulnerability | ||||
| CVE-2024-23897US | critical9.8OT critical | KEV | ||
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with t… | ||||
| CVE-2023-42916US | medium6.5OT critical | KEV | ||
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content… | ||||
| CVE-2023-49103US | high7.5OT critical | KEV | ||
An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL… | ||||
| CVE-2023-41763US | —OT critical | KEV | ||
Skype for Business Elevation of Privilege Vulnerability | ||||
| CVE-2023-36563US | medium5.5OT critical | KEV | ||
Microsoft WordPad Information Disclosure Vulnerability | ||||
| CVE-2023-36761US | medium6.5OT critical | KEV | ||
Microsoft Word Information Disclosure Vulnerability | ||||
| CVE-2023-21237US | medium5.5OT critical | KEV | ||
In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI. This could lead to loc… | ||||
| CVE-2023-28432US | high7.5OT critical | KEV | ||
Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all env… | ||||
| CVE-2023-23397US | critical9.8OT critical | KEV | ||
Microsoft Outlook Elevation of Privilege Vulnerability | ||||
04
attack patterns (59)
CAPEC attack patterns that exploit this.
05
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan