CWE-201 Insertion of Sensitive Information Into Sent Data
baseThe code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (513)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-38039US | high7.5 | Exploit | ||
When curl retrieves an HTTP response, it stores the incoming headers so that
they can be accessed later via the libcurl headers API.
However, curl did not have a limit in how many… | ||||
| CVE-2020-26085US | critical9.9 | — | ||
Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying oper… | ||||
| CVE-2020-27134US | critical9.9 | — | ||
Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying oper… | ||||
| CVE-2020-27132US | critical9.9 | — | ||
Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying oper… | ||||
| CVE-2015-1820US | critical9.8 | — | ||
REST client for Ruby (aka rest-client) before 1.8.0 allows remote attackers to conduct session fixation attacks or obtain sensitive cookie information by leveraging passage of cook… | ||||
| CVE-2026-5483US | critical9.9 | — | ||
A flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in the `odh-dashboard` component of Red Hat OpenShift AI (RHOAI) allows for the disclosure of Kubernet… | ||||
| CVE-2024-50633US | high7.5OT elevated | Exploit | ||
A Broken Object Level Authorization (BOLA) vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted POST request to the component /api/princi… | ||||
| CVE-2020-27133US | critical9.9 | — | ||
Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying oper… | ||||
| CVE-2020-27127US | critical9.9 | — | ||
Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying oper… | ||||
| CVE-2018-17245US | critical9.8 | — | ||
Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are used when generating PDF reports. If a report requests externa… | ||||
| CVE-2020-12352US | medium6.5 | Exploit | ||
Improper access control in BlueZ may allow an unauthenticated user to potentially enable information disclosure via adjacent access. | ||||
| CVE-2021-26566US | critical9.0 | — | ||
Insertion of sensitive information into sent data vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to execu… | ||||
| CVE-2026-4525US | high8.8 | — | ||
If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to… | ||||
| CVE-2024-8890US | high8.8 | — | ||
An attacker with access to the network where the CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could obtain legitimate credentials or steal sessions due to the fact that… | ||||
| CVE-2023-48240US | high8.8 | — | ||
XWiki Platform is a generic wiki platform. The rendered diff in XWiki embeds images to be able to compare the contents and not display a difference for an actually unchanged image.… | ||||
| CVE-2018-8292US | high7.5 | — | ||
An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure Vulnerabil… | ||||
| CVE-2025-47775US | high8.6 | — | ||
Bullfrog is a GithHb Action to block unauthorized outbound traffic in GitHub workflows. Prior to version 0.8.4, using tcp breaks blocking and allows DNS exfiltration. This can resu… | ||||
| CVE-2026-105849US | high8.3OT elevated | — | ||
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read acce… | ||||
| CVE-2024-3502US | high8.1 | — | ||
In lunary-ai/lunary versions up to and including 1.2.5, an information disclosure vulnerability exists where account recovery hashes of users are inadvertently exposed to unauthori… | ||||
| CVE-2024-25148US | high8.1 | — | ||
In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions the `doAsUs… | ||||
04
attack patterns (9)
CAPEC attack patterns that exploit this.
05
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan