Skip to content
Noroxi

CWE-200 · 11,599 records

Exposure of sensitive information to an unauthorized actor

Why does it happen?

The extension requests broader permissions than its function needs and sends the data it collects out for purposes beyond its stated function.

How to prevent it

  1. 01Request only the permissions the function requires.
  2. 02Document collected data clearly and keep it to a minimum.
  3. 03Manage extensions with an allowlist in corporate browsers.

Vulnerable and fixed code

A representative teaching example. Highlighted lines mark where the bug and the fix are.

Vulnerable

json
{  "permissions": ["tabs", "<all_urls>"],  "background": { "service_worker": "analytics.js" }}

Fixed

json
{  "permissions": ["activeTab"],  "host_permissions": ["https://yildiz.example/*"]}

Is this pattern in your code?

We look for this class specifically as part of our Web and API penetration testing service. Findings are delivered with line numbers.

Web and API penetration testingRequest a quote

CVEs in this class

10,000 records

  • CVE-2024-24919
    94Now

    Information disclosure

    HighCVSS 8.6KEVWeaponizedEPSS 99%

    checkpoint · quantum spark firmwareMay 28, 2024

  • CVE-2021-41277
    89Now

    GeoJSON URL validation can expose server files and environment variables to unauthorized users

    HighCVSS 7.5KEVWeaponizedEPSS 97%

    metabase · metabaseNov 17, 2021

  • CVE-2016-6415
    86Now

    The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5

    HighCVSS 7.5KEVWeaponizedEPSS 87%

    cisco · iosSep 18, 2016

  • CVE-2023-28432
    85Now

    Minio Information Disclosure in Cluster Deployment

    HighCVSS 7.5KEVWeaponizedEPSS 83%

    minio · minioMar 22, 2023

  • CVE-2023-49103
    83Now

    An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1.

    HighCVSS 7.5KEVWeaponizedEPSS 77%

    owncloud · graph apiNov 21, 2023

  • CVE-2025-31125
    82Now

    Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query

    HighCVSS 7.5KEVWeaponizedEPSS 74%

    vitejs · viteMar 31, 2025

  • CVE-2020-3259
    81Now

    Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Information Disclosure Vulnerability

    HighCVSS 7.5KEVWeaponizedEPSS 71%

    cisco · secure firewall threat defenseMay 6, 2020

  • CVE-2008-0655
    76This week

    Multiple unspecified vulnerabilities in Adobe Reader and Acrobat before 8.1.2 have unknown impact and attack vectors.

    HighCVSS 8.8KEVWeaponizedEPSS 37%

    adobe · acrobatFeb 7, 2008

  • CVE-2026-20133
    71This week

    A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affect

    HighCVSS 7.5KEVWeaponizedEPSS 35%

    cisco · catalyst sd-wan managerFeb 25, 2026

  • CVE-2021-27850
    67This week

    Bypass of the fix for CVE-2019-0195

    CriticalCVSS 9.8WeaponizedEPSS 93%

    apache · tapestryApr 15, 2021

  • CVE-2016-2388
    67This week

    The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted

    MediumCVSS 5.3KEVWeaponizedEPSS 52%

    sap · netweaver application server javaFeb 16, 2016

  • CVE-2015-5317
    67This week

    The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name in

    HighCVSS 7.5KEVWeaponizedEPSS 23%

    jenkins · jenkinsNov 25, 2015

  • CVE-2015-0310
    66This week

    Adobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before 11.2.202.438 on Linux does not p

    HighCVSS 7.8KEVWeaponizedEPSS 15%

    adobe · flash playerJan 23, 2015

  • CVE-2018-1000600
    62This week

    A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCredentialsCreator.java t

    HighCVSS 8.8Proof of conceptEPSS 90%

    jenkins · githubJun 26, 2018

  • CVE-2018-0127
    62This week

    A vulnerability in the web interface of Cisco RV132W ADSL2+ Wireless-N VPN Routers and Cisco RV134W VDSL2 Wireless-AC VPN Routers could allo

    CriticalCVSS 9.8Proof of conceptEPSS 77%

    cisco · rv132w firmwareFeb 8, 2018

  • CVE-2025-68686
    62This week

    An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1,

    MediumCVSS 5.9KEVWeaponizedEPSS 29%

    fortinet · fortiosFeb 10, 2026

  • CVE-2025-11749
    61This week

    AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation

    CriticalCVSS 9.8WeaponizedEPSS 74%

    tigroumeow · ai engine – the chatbot, ai framework & mcp for wordpressNov 5, 2025

  • CVE-2018-7251
    61This week

    An issue was discovered in config/error.php in Anchor 0.12.3.

    CriticalCVSS 9.8Proof of conceptEPSS 71%

    anchorcms · anchorFeb 19, 2018

  • CVE-2020-14181
    60This week

    Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vu

    MediumCVSS 5.3WeaponizedEPSS 99%

    atlassian · data centerSep 16, 2020

  • CVE-2021-34429
    60This week

    For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the con

    MediumCVSS 5.3WeaponizedEPSS 99%

    eclipse · jettyJul 15, 2021

  • CVE-2018-11409
    60This week

    Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, as demon

    MediumCVSS 5.3WeaponizedEPSS 98%

    splunk · splunkJun 8, 2018

  • CVE-2016-6210
    60This week

    sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the us

    MediumCVSS 5.9WeaponizedEPSS 88%

    openbsd · opensshFeb 13, 2017

  • CVE-2017-16894
    60This week

    In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct re

    HighCVSS 7.5WeaponizedEPSS 86%

    laravel · laravelNov 19, 2017

  • CVE-2018-4993
    60This week

    Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have an NTLM SSO ha

    HighCVSS 7.5WeaponizedEPSS 86%

    adobe · acrobat dcJul 9, 2018

  • CVE-2016-10073
    60This week

    The from method in library/core/class.email.php in Vanilla Forums before 2.3.1 allows remote attackers to spoof the email domain in sent mes

    HighCVSS 7.5WeaponizedEPSS 83%

    vanillaforums · vanillaMay 23, 2017

All vulnerability classes