ByteOS

Product

PostgreSQL

Versions

Affected

before 9.0.19
9.1.x before 9.1.15
9.2.x before 9.2.10
9.3.x before 9.3.6
9.4.x before 9.4.1

Problem Types

Type	CWE ID	Description
text	N/A	Path Disclosure

Type: text

CWE ID: N/A

Description: Path Disclosure

References

Hyperlink	Resource
http://www.postgresql.org/docs/9.4/static/release-9-4-1.html	x_refsource_CONFIRM
http://www.postgresql.org/docs/current/static/release-9-0-19.html	x_refsource_CONFIRM
http://www.postgresql.org/docs/current/static/release-9-1-15.html	x_refsource_CONFIRM
http://www.postgresql.org/docs/current/static/release-9-2-10.html	x_refsource_CONFIRM
http://www.postgresql.org/docs/current/static/release-9-3-6.html	x_refsource_CONFIRM
http://www.postgresql.org/about/news/1569/	x_refsource_CONFIRM
http://www.debian.org/security/2015/dsa-3155	x_refsource_CONFIRM

Hyperlink: http://www.postgresql.org/docs/9.4/static/release-9-4-1.html

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.postgresql.org/docs/current/static/release-9-0-19.html

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.postgresql.org/docs/current/static/release-9-1-15.html

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.postgresql.org/docs/current/static/release-9-2-10.html

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.postgresql.org/docs/current/static/release-9-3-6.html

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.postgresql.org/about/news/1569/

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.debian.org/security/2015/dsa-3155

Resource:

x_refsource_CONFIRM

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
http://www.postgresql.org/docs/9.4/static/release-9-4-1.html	x_refsource_CONFIRM x_transferred
http://www.postgresql.org/docs/current/static/release-9-0-19.html	x_refsource_CONFIRM x_transferred
http://www.postgresql.org/docs/current/static/release-9-1-15.html	x_refsource_CONFIRM x_transferred
http://www.postgresql.org/docs/current/static/release-9-2-10.html	x_refsource_CONFIRM x_transferred
http://www.postgresql.org/docs/current/static/release-9-3-6.html	x_refsource_CONFIRM x_transferred
http://www.postgresql.org/about/news/1569/	x_refsource_CONFIRM x_transferred
http://www.debian.org/security/2015/dsa-3155	x_refsource_CONFIRM x_transferred

Hyperlink: http://www.postgresql.org/docs/9.4/static/release-9-4-1.html

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://www.postgresql.org/docs/current/static/release-9-0-19.html

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://www.postgresql.org/docs/current/static/release-9-1-15.html

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://www.postgresql.org/docs/current/static/release-9-2-10.html

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://www.postgresql.org/docs/current/static/release-9-3-6.html

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://www.postgresql.org/about/news/1569/

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://www.debian.org/security/2015/dsa-3155

Resource:

x_refsource_CONFIRM

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secalert@redhat.com

Published At:27 Jan, 2020 | 16:15

Updated At:31 Jan, 2020 | 15:24

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary	2.0	4.0	MEDIUM	AV:N/AC:L/Au:S/C:P/I:N/A:N

Type: Primary

Version: 3.1

Base score: 4.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Type: Primary

Version: 2.0

Base score: 4.0

Base severity: MEDIUM

Vector:

AV:N/AC:L/Au:S/C:P/I:N/A:N

CPE Matches

>>postgresql>>Versions before 9.0.19(exclusive)

>>postgresql>>Versions from 9.1.0(inclusive) to 9.1.15(exclusive)

>>postgresql>>Versions from 9.2.0(inclusive) to 9.2.10(exclusive)

>>postgresql>>Versions from 9.3.0(inclusive) to 9.3.6(exclusive)

>>postgresql>>Versions from 9.4.0(inclusive) to 9.4.1(exclusive)

cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

Debian GNU/Linux

>>debian_linux>>7.0

Debian GNU/Linux

>>debian_linux>>8.0

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-209	Primary	nvd@nist.gov

CWE ID: CWE-209

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://www.debian.org/security/2015/dsa-3155	secalert@redhat.com	Third Party Advisory
http://www.postgresql.org/about/news/1569/	secalert@redhat.com	Vendor Advisory
http://www.postgresql.org/docs/9.4/static/release-9-4-1.html	secalert@redhat.com	Release Notes Vendor Advisory
http://www.postgresql.org/docs/current/static/release-9-0-19.html	secalert@redhat.com	Release Notes Vendor Advisory
http://www.postgresql.org/docs/current/static/release-9-1-15.html	secalert@redhat.com	Release Notes Vendor Advisory
http://www.postgresql.org/docs/current/static/release-9-2-10.html	secalert@redhat.com	Release Notes Vendor Advisory
http://www.postgresql.org/docs/current/static/release-9-3-6.html	secalert@redhat.com	Release Notes Vendor Advisory

Hyperlink: http://www.debian.org/security/2015/dsa-3155

Source: secalert@redhat.com

Resource:

Third Party Advisory

Hyperlink: http://www.postgresql.org/about/news/1569/

Source: secalert@redhat.com

Resource:

Vendor Advisory

Hyperlink: http://www.postgresql.org/docs/9.4/static/release-9-4-1.html

Source: secalert@redhat.com

Resource:

Release Notes

Vendor Advisory

Hyperlink: http://www.postgresql.org/docs/current/static/release-9-0-19.html

Source: secalert@redhat.com

Resource:

Release Notes

Vendor Advisory

Hyperlink: http://www.postgresql.org/docs/current/static/release-9-1-15.html

Source: secalert@redhat.com

Resource:

Release Notes

Vendor Advisory

Hyperlink: http://www.postgresql.org/docs/current/static/release-9-2-10.html

Source: secalert@redhat.com

Resource:

Release Notes

Vendor Advisory

Hyperlink: http://www.postgresql.org/docs/current/static/release-9-3-6.html

Source: secalert@redhat.com

Resource:

Release Notes

Vendor Advisory

Similar CVEs

204Records found

CVE-2023-1210

Matching Score-4

Assigner-GitLab Inc.

Matching Score-4

Assigner-GitLab Inc.

CVSS Score-3.1||LOW

EPSS-0.11% / 30.56%

7 Day CHG~0.00%

Published-01 Aug, 2023 | 23:36

Updated-22 May, 2025 | 04:04

Generation of Error Message Containing Sensitive Information in GitLab

An issue has been discovered in GitLab affecting all versions starting from 12.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible to leak a user's email via an error message for groups that restrict membership by email domain.

Vendor-GitLab Inc.

Product-gitlab GitLab

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2019-4308

Matching Score-4

Assigner-IBM Corporation

Product-emptoris_spend_analysis emptoris_sourcing emptoris_contract_management Emptoris Sourcing Contract Management Emptoris Spend Analysis

Matching Score-4

Assigner-IBM Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.16% / 36.95%

7 Day CHG~0.00%

Published-20 Aug, 2019 | 18:25

Updated-17 Sep, 2024 | 00:40

IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 could allow an authenticated user to obtain sensitive information from error messages IBM X-Force ID: 161034.

Vendor-IBM Corporation

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2019-4377

Matching Score-4

Assigner-IBM Corporation

Vendor-Microsoft Corporation HP Inc.IBM Corporation Linux Kernel Organization, Inc Oracle Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.22% / 45.07%

7 Day CHG~0.00%

Published-25 Jun, 2019 | 15:45

Updated-17 Sep, 2024 | 00:20

IBM Sterling B2B Integrator 6.0.0.0 and 6.0.0.1 reveals sensitive information from a stack trace that could be used in further attacks against the system. IBM X-Force ID: 162803.

Product-sterling_b2b_integrator solaris linux_kernel i hp-ux windows aix Sterling B2B Integrator

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2019-4257

Matching Score-4

Assigner-IBM Corporation

Product-infosphere_information_server_on_cloud infosphere_information_governance_catalog infosphere_information_analyzer InfoSphere Information Server

Matching Score-4

Assigner-IBM Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.16% / 36.90%

7 Day CHG~0.00%

Published-06 Jun, 2019 | 20:45

Updated-17 Sep, 2024 | 03:34

IBM InfoSphere Information Server 11.5 and 11.7 is affected by an information disclosure vulnerability. Sensitive information in an error message may be used to conduct further attacks against the system. IBM X-Force ID: 159945.

Vendor-IBM Corporation

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2019-4699

Matching Score-4

Assigner-IBM Corporation

Product-guardium_data_encryption guardium_for_cloud_key_management Security Guardium Data Encryption

Matching Score-4

Assigner-IBM Corporation

CVSS Score-2.7||LOW

EPSS-0.08% / 23.29%

7 Day CHG~0.00%

Published-26 Aug, 2020 | 19:00

Updated-16 Sep, 2024 | 23:31

IBM Security Guardium Data Encryption (GDE) 3.0.0.2 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 171931.

Vendor-IBM Corporation

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2019-4636

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-2.7||LOW

EPSS-0.25% / 47.76%

7 Day CHG~0.00%

Published-28 Jan, 2020 | 18:30

Updated-16 Sep, 2024 | 19:05

IBM Security Secret Server 10.7 could disclose sensitive information to an authenticated user from generated error messages. IBM X-Force ID: 170013.

Vendor-IBM Corporation

Product-security_secret_server Security Secret Server

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2019-4593

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.22% / 44.70%

7 Day CHG~0.00%

Published-15 Apr, 2020 | 15:13

Updated-16 Sep, 2024 | 18:38

IBM QRadar 7.3.0 to 7.3.3 Patch 2 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-ForceID: 167743.

Vendor-IBM Corporation Linux Kernel Organization, Inc

Product-qradar_security_information_and_event_manager linux_kernel QRadar Qradar

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2019-4583

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.22% / 44.74%

7 Day CHG~0.00%

Published-20 Feb, 2020 | 16:45

Updated-16 Sep, 2024 | 22:03

IBM Maximo Asset Management 7.6.0.10 and 7.6.1.1 could allow an authenticated user to obtain sensitive information from a stack trace that could be used to aid future attacks. IBM X-Force ID: 167289.

Vendor-IBM Corporation

Product-maximo_asset_management Maximo Asset Management

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2019-3756

Matching Score-4

Assigner-Dell

Matching Score-4

Assigner-Dell

CVSS Score-6.5||MEDIUM

EPSS-0.23% / 45.29%

7 Day CHG~0.00%

Published-18 Sep, 2019 | 22:23

Updated-16 Sep, 2024 | 17:39

RSA Archer, versions prior to 6.6 P3 (6.6.0.3), contain an information disclosure vulnerability. Information relating to the backend database gets disclosed to low-privileged RSA Archer users' UI under certain error conditions.

Vendor-Dell Inc.RSA Security LLC

Product-archer RSA Archer

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2025-36090

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.04% / 12.16%

7 Day CHG~0.00%

Published-10 Jul, 2025 | 14:12

Updated-24 Aug, 2025 | 11:18

IBM Analytics Content Hub information disclosure

IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 could allow a remote attacker to obtain information about the application framework which could be used in reconnaissance to gather information for future attacks from a detailed technical error message.

Vendor-IBM Corporation

Product-analytics_content_hub Analytics Content Hub

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2019-4512

Matching Score-4

Assigner-IBM Corporation

Product-maximo_for_transportation maximo_for_life_sciences control_desk tivoli_integration_composer maximo_asset_management maximo_for_oil_and_gas maximo_for_utilities maximo_for_nuclear_power maximo_for_aviation smartcloud_control_desk Maximo Asset Management

Matching Score-4

Assigner-IBM Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.12% / 31.49%

7 Day CHG~0.00%

Published-09 Oct, 2019 | 15:00

Updated-17 Sep, 2024 | 02:36

IBM Maximo Asset Management 7.6.1.1 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force ID: 164554.

Vendor-IBM Corporation

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2019-4729

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.13% / 33.34%

7 Day CHG~0.00%

Published-27 Apr, 2020 | 13:25

Updated-16 Sep, 2024 | 22:08

IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 172519.

Vendor-IBM Corporation NetApp, Inc.

Product-cognos_analytics oncommand_insight Cognos Analytics

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2019-16768

Matching Score-4

Assigner-GitHub, Inc.

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-3.5||LOW

EPSS-0.35% / 56.59%

7 Day CHG~0.00%

Published-05 Dec, 2019 | 20:00

Updated-05 Aug, 2024 | 01:24

Internal exception message exposure for login action in Sylius

In affected versions of Sylius, exception messages from internal exceptions (like database exception) are wrapped by \Symfony\Component\Security\Core\Exception\AuthenticationServiceException and propagated through the system to UI. Therefore, some internal system information may leak and be visible to the customer. A validation message with the exception details will be presented to the user when one will try to log into the shop. This has been patched in versions 1.3.14, 1.4.10, 1.5.7, and 1.6.3.

Vendor-sylius Sylius

Product-sylius Sylius

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2019-4601

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.12% / 31.55%

7 Day CHG~0.00%

Published-08 Apr, 2020 | 14:05

Updated-16 Sep, 2024 | 23:11

IBM Quality Manager (RQM) 6.02, 6.06, and 6.0.6.1 could allow an authenticated user to obtain sensitive information from a stack trace that could aid in further attacks against the system.

Vendor-IBM Corporation

Product-rational_quality_manager Rational Quality Manager

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2019-4485

Matching Score-4

Assigner-IBM Corporation

Product-emptoris_spend_analysis emptoris_sourcing emptoris_contract_management Emptoris Sourcing Contract Management Emptoris Spend Analysis

Matching Score-4

Assigner-IBM Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.16% / 36.90%

7 Day CHG~0.00%

Published-20 Aug, 2019 | 18:25

Updated-17 Sep, 2024 | 01:50

IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force ID: 164069.

Vendor-IBM Corporation

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2025-32238

Matching Score-4

Assigner-Patchstack

Product-online_booking_\&_scheduling_calendar_for_wordpress_by_vcita Online Booking & Scheduling Calendar for WordPress by vcita

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.05% / 14.92%

7 Day CHG~0.00%

Published-04 Apr, 2025 | 15:59

Updated-09 Jun, 2025 | 19:21

WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5.2 - Sensitive Data Exposure vulnerability

Generation of Error Message Containing Sensitive Information vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita allows Retrieve Embedded Sensitive Data. This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through 4.5.2.

Vendor-vcita vcita

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2019-12903

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.23% / 45.33%

7 Day CHG~0.00%

Published-19 Jun, 2019 | 23:06

Updated-04 Aug, 2024 | 23:32

Pydio Cells before 1.5.0, when supplied with a Name field in an unexpected Unicode format, fails to handle this and includes the database column/table name as pert of the error message, exposing sensitive information.

Vendor-pydio n/a

Product-cells n/a

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2019-12215

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.23% / 45.28%

7 Day CHG~0.00%

Published-20 May, 2019 | 15:47

Updated-04 Aug, 2024 | 23:17

A full path disclosure vulnerability was discovered in Matomo v3.9.1 where a user can trigger a particular error to discover the full path of Matomo on the disk, because lastError.file is used in plugins/CorePluginsAdmin/templates/safemode.twig. NOTE: the vendor disputes the significance of this issue, stating "avoid reporting path disclosures, as we don't consider them as security vulnerabilities.

Vendor-matomo n/a

Product-matomo n/a

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2024-27315

Matching Score-4

Assigner-Apache Software Foundation

Matching Score-4

Assigner-Apache Software Foundation

CVSS Score-4.3||MEDIUM

EPSS-0.09% / 26.34%

7 Day CHG~0.00%

Published-28 Feb, 2024 | 10:06

Updated-31 Dec, 2024 | 16:16

Apache Superset: Improper error handling on alerts

An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an error on the database. This error is not properly handled by Apache Superset and may inadvertently surface in the error log of the Alert exposing possibly sensitive data. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue.

Vendor-The Apache Software Foundation

Product-superset Apache Superset

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2022-4769

Matching Score-4

Assigner-Hitachi Vantara

Matching Score-4

Assigner-Hitachi Vantara

CVSS Score-4.3||MEDIUM

EPSS-0.19% / 41.50%

7 Day CHG~0.00%

Published-03 Apr, 2023 | 18:53

Updated-11 Feb, 2025 | 14:28

Hitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the target path on host when a file is uploaded with an invalid character in its name.

Vendor-Hitachi Vantara LLC Hitachi, Ltd.

Product-vantara_pentaho_business_analytics_server Pentaho Business Analytics Server

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2025-25025

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.05% / 13.46%

7 Day CHG~0.00%

Published-28 May, 2025 | 01:10

Updated-26 Aug, 2025 | 14:56

IBM Security Guardium information disclosure

IBM Security Guardium 12.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.

Vendor-IBM Corporation

Product-Security Guardium

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2025-25045

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.05% / 13.93%

7 Day CHG+0.01%

Published-23 Apr, 2025 | 22:23

Updated-28 Aug, 2025 | 15:04

IBM InfoSphere Information Server information disclosure

IBM InfoSphere Information 11.7 Server authenticated user to obtain sensitive information when a detailed technical error message is returned in a request. This information could be used in further attacks against the system.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-windows infosphere_information_server linux_kernel aix InfoSphere Information Server

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2021-31339

Matching Score-4

Assigner-Siemens

Matching Score-4

Assigner-Siemens

CVSS Score-4.3||MEDIUM

EPSS-0.18% / 39.60%

7 Day CHG~0.00%

Published-12 May, 2021 | 13:18

Updated-03 Aug, 2024 | 22:55

A vulnerability has been identified in Mendix Excel Importer Module (All versions < V9.0.3). Uploading a manipulated XML File results in an exception that could expose information about the Application-Server and the used XML-Framework.

Vendor-mendix Siemens AG

Product-excel_importer Mendix Excel Importer Module

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2019-11662

Matching Score-4

Assigner-OpenText (formerly Micro Focus)

Matching Score-4

Assigner-OpenText (formerly Micro Focus)

CVSS Score-4.3||MEDIUM

EPSS-0.20% / 42.19%

7 Day CHG~0.00%

Published-18 Sep, 2019 | 21:55

Updated-04 Aug, 2024 | 23:03

Class and method names in error message in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. This vulnerability could be exploited in some special cases to allow information exposure through an error message.

Vendor-Micro Focus International Limited

Product-service_manager Service Manager

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2021-31341

Matching Score-4

Assigner-Siemens

Matching Score-4

Assigner-Siemens

CVSS Score-4.3||MEDIUM

EPSS-0.20% / 42.19%

7 Day CHG~0.00%

Published-12 May, 2021 | 13:18

Updated-03 Aug, 2024 | 22:55

Uploading a table mapping using a manipulated XML file results in an exception that could expose information about the application-server and the used XML-framework on the Mendix Database Replication Module (All versions prior to v7.0.1).

Vendor-mendix n/a

Product-database_replication Mendix Database Replication Module

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2021-29784

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.09% / 26.32%

7 Day CHG~0.00%

Published-26 Jul, 2021 | 12:10

Updated-16 Sep, 2024 | 18:17

IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 203168.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-windows i2_analyze linux_kernel i2 Analyze

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2021-26997

Matching Score-4

Assigner-NetApp, Inc.

Matching Score-4

Assigner-NetApp, Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.24% / 46.67%

7 Day CHG~0.00%

Published-11 Jun, 2021 | 12:44

Updated-03 Aug, 2024 | 20:40

E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploited could allow a remote attacker to discover information via error messaging which may aid in crafting more complex attacks.

Vendor-n/a NetApp, Inc.

Product-e-series_santricity_os_controller E-Series SANtricity OS Controller Software 11.x

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2025-0049

Matching Score-4

Assigner-Fortra, LLC

Matching Score-4

Assigner-Fortra, LLC

CVSS Score-3.5||LOW

EPSS-0.05% / 15.96%

7 Day CHG+0.01%

Published-28 Apr, 2025 | 20:55

Updated-10 May, 2025 | 00:55

Disclosure of sensitive information in an error message in GoAnywhere prior to version 7.8.0

When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error message includes the absolute server path which may allow Fuzzing for application mapping. This issue affects GoAnywhere: before 7.8.0.

Vendor-Fortra LLC

Product-goanywhere_managed_file_transfer GoAnywhere

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2025-0279

Matching Score-4

Assigner-HCL Software

Matching Score-4

Assigner-HCL Software

CVSS Score-4.3||MEDIUM

EPSS-0.05% / 14.92%

7 Day CHG~0.00%

Published-03 Apr, 2025 | 21:48

Updated-07 Apr, 2025 | 16:31

HCL Traveler is affected by generation of error messages containing sensitive information

HCL Traveler generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, sensitive tokens, credentials, error codes, or stack traces. Attackers could exploit this information to gain insights into the system's architecture and potentially launch targeted attacks.

Vendor-HCL Technologies Ltd.

Product-HCL Traveler

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2022-4770

Matching Score-4

Assigner-Hitachi Vantara

Matching Score-4

Assigner-Hitachi Vantara

CVSS Score-4.3||MEDIUM

EPSS-0.19% / 41.50%

7 Day CHG~0.00%

Published-03 Apr, 2023 | 18:56

Updated-11 Feb, 2025 | 14:28

Hitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the full parametrized SQL query in an error message when an invalid character is used within a Pentaho Report (*.prpt).

Vendor-Hitachi Vantara LLC Hitachi, Ltd.

Product-vantara_pentaho_business_analytics_server Pentaho Business Analytics Server

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2024-5591

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.05% / 14.22%

7 Day CHG~0.00%

Published-03 Jan, 2025 | 14:33

Updated-21 Mar, 2025 | 15:35

IBM Jazz Foundation information disclosure

IBM Jazz Foundation 7.0.2, 7.0.3, and 7.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.

Vendor-IBM Corporation Microsoft Corporation Linux Kernel Organization, Inc

Product-linux_kernel jazz_foundation windows Jazz Foundation

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2024-48896

Matching Score-4

Assigner-Red Hat, Inc.

Matching Score-4

Assigner-Red Hat, Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.10% / 28.30%

7 Day CHG~0.00%

Published-18 Nov, 2024 | 11:13

Updated-20 Nov, 2024 | 14:47

Moodle: users' names returned in messaging error message

A vulnerability was found in Moodle. It is possible for users with the "send message" capability to view other users' names that they may not otherwise have access to via an error message in Messaging. Note: The name returned follows the full name format configured on the site.

Vendor-Moodle Pty Ltd

Product-moodle

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2024-47803

Matching Score-4

Assigner-Jenkins Project

Matching Score-4

Assigner-Jenkins Project

CVSS Score-4.3||MEDIUM

EPSS-0.06% / 19.39%

7 Day CHG~0.00%

Published-02 Oct, 2024 | 15:35

Updated-19 Mar, 2025 | 18:15

Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissions involving the `secretTextarea` form field.

Vendor-Jenkins

Product-jenkins Jenkins

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2020-23995

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.5||MEDIUM

EPSS-0.37% / 58.16%

7 Day CHG~0.00%

Published-13 May, 2021 | 19:49

Updated-04 Aug, 2024 | 15:05

An information disclosure vulnerability in ILIAS before 5.3.19, 5.4.12 and 6.0 allows remote authenticated attackers to get the upload data path via a workspace upload.

Vendor-ilias n/a

Product-ilias n/a

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2024-43376

Matching Score-4

Assigner-GitHub, Inc.

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.15% / 36.78%

7 Day CHG~0.00%

Published-20 Aug, 2024 | 14:40

Updated-26 Aug, 2024 | 18:24

Umbraco CMS vulnerable to Generation of Error Message Containing Sensitive Information

Umbraco is an ASP.NET CMS. Some endpoints in the Management API can return stack trace information, even when Umbraco is not in debug mode. This vulnerability is fixed in 14.1.2.

Vendor-Umbraco A/S (Umbraco)

Product-umbraco_cms Umbraco-CMS

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2024-39751

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.09% / 26.36%

7 Day CHG~0.00%

Published-06 Aug, 2024 | 15:17

Updated-29 Aug, 2024 | 16:56

IBM InfoSphere Information Server information disclosure

IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 297429

Vendor-IBM Corporation

Product-infosphere_information_server InfoSphere Information Server

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2024-36106

Matching Score-4

Assigner-GitHub, Inc.

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.47% / 63.67%

7 Day CHG~0.00%

Published-06 Jun, 2024 | 15:09

Updated-03 Sep, 2024 | 15:39

Argo CD allows authenticated users to enumerate clusters by name

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It’s possible for authenticated users to enumerate clusters by name by inspecting error messages. It’s also possible to enumerate the names of projects with project-scoped clusters if you know the names of the clusters. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.

Vendor-argoproj argoproj

Product-argo_cd argo-cd

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2024-35112

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.04% / 9.66%

7 Day CHG~0.00%

Published-25 Jan, 2025 | 13:31

Updated-04 Mar, 2025 | 16:58

IBM Control Center cross-site scripting

IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.

Vendor-IBM Corporation

Product-control_center Control Center

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CWE ID-CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CVE-2024-35111

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.04% / 12.10%

7 Day CHG~0.00%

Published-25 Jan, 2025 | 13:29

Updated-04 Mar, 2025 | 16:58

IBM Control Center information disclosure

Vendor-IBM Corporation

Product-control_center Control Center

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2024-32046

Matching Score-4

Assigner-Mattermost, Inc.

Matching Score-4

Assigner-Mattermost, Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.10% / 27.74%

7 Day CHG~0.00%

Published-26 Apr, 2024 | 08:24

Updated-12 May, 2025 | 13:39

Detailed error discloses full file path with dev mode off

Mattermost versions 9.6.x <= 9.6.0, 9.5.x <= 9.5.2, 9.4.x <= 9.4.4 and 8.1.x <= 8.1.11 fail to remove detailed error messages in API requests even if the developer mode is off which allows an attacker to get information about the server such as the full path were files are stored

Vendor-Mattermost, Inc.

Product-mattermost_server Mattermost mattermost

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2024-25037

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.05% / 14.34%

7 Day CHG~0.00%

Published-07 Jan, 2025 | 15:51

Updated-03 Jul, 2025 | 20:49

IBM Cognos Controller information disclosure

IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser.

Vendor-Microsoft Corporation IBM Corporation

Product-controller windows cognos_controller Controller Cognos Controller

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2018-21032

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.21% / 43.48%

7 Day CHG~0.00%

Published-14 Feb, 2020 | 15:51

Updated-05 Aug, 2024 | 12:19

A vulnerability in Hitachi Command Suite prior to 8.7.1-00 and Hitachi Automation Director prior to 8.5.0-00 allow authenticated remote users to expose technical information through error messages. Hitachi Command Suite includes Hitachi Device Manager and Hitachi Compute Systems Manager.

Vendor-n/a Oracle Corporation Linux Kernel Organization, Inc Hitachi, Ltd.Microsoft Corporation

Product-solaris linux_kernel compute_systems_manager automation_director windows device_manager n/a

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2018-19947

Matching Score-4

Assigner-QNAP Systems, Inc.

Matching Score-4

Assigner-QNAP Systems, Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.31% / 53.65%

7 Day CHG~0.00%

Published-11 Sep, 2020 | 14:14

Updated-05 Aug, 2024 | 11:51

The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this information exposure vulnerability could disclose sensitive information. QNAP has already fixed the issue in Helpdesk 3.0.3 and later.

Vendor-QNAP Systems, Inc.

Product-helpdesk Helpdesk

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CWE ID-CWE-210

Self-generated Error Message Containing Sensitive Information

CVE-2024-56342

Matching Score-4

Assigner-IBM Corporation

Product-verify_identity_access_digital_credentials Verify Identity Access Digital Credentials

Matching Score-4

Assigner-IBM Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.05% / 13.46%

7 Day CHG~0.00%

Published-06 Jun, 2025 | 01:27

Updated-24 Aug, 2025 | 11:58

IBM Verify Identity Access Digital Credentials information disclosure

IBM Verify Identity Access Digital Credentials 24.06 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.

Vendor-IBM Corporation

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2024-51460

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.08% / 24.01%

7 Day CHG+0.02%

Published-11 Dec, 2024 | 12:15

Updated-14 Jan, 2025 | 19:40

IBM InfoSphere Information Server information disclosure

IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information when a detailed technical error message is returned in a stack trace. This information could be used in further attacks against the system.

Vendor-IBM Corporation

Product-infosphere_information_server InfoSphere Information Server

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2024-51560

Matching Score-4

Assigner-Indian Computer Emergency Response Team (CERT-In)

Matching Score-4

Assigner-Indian Computer Emergency Response Team (CERT-In)

CVSS Score-7.1||HIGH

EPSS-0.10% / 28.89%

7 Day CHG~0.00%

Published-04 Nov, 2024 | 12:23

Updated-08 Nov, 2024 | 15:18

Improper Error Handling Vulnerability in Wave 2.0

This vulnerability exists in the Wave 2.0 due to improper exception handling for invalid inputs at certain API endpoint. An authenticated remote attacker could exploit this vulnerability by providing invalid inputs for “userId” parameter in the API request leading to generation of error message containing sensitive information on the targeted system.

Vendor-63moons Brokerage Technology Solutions

Product-wave_2.0 aero Wave 2.0

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2024-49818

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.05% / 15.90%

7 Day CHG~0.00%

Published-17 Dec, 2024 | 17:35

Updated-07 Jan, 2025 | 17:20

IBM Security Guardium Key Lifecycle Manager information disclosure

IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.

Vendor-IBM Corporation

Product-security_guardium_key_lifecycle_manager Security Guardium Key Lifecycle Manager

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2024-49798

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.05% / 14.25%

7 Day CHG~0.00%

Published-05 Feb, 2025 | 23:50

Updated-22 Feb, 2025 | 22:06

IBM ApplinX Information Disclosure

IBM ApplinX 11.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.

Vendor-IBM Corporation

Product-applinx ApplinX

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2021-32775

Matching Score-4

Assigner-GitHub, Inc.

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-7.7||HIGH

EPSS-0.29% / 51.82%

7 Day CHG~0.00%

Published-21 Jul, 2021 | 20:20

Updated-03 Aug, 2024 | 23:33

Any user can see any fields (including mailbox password) with GroupBy Dashlet

Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, a non admin user can get access to many class/field values through GroupBy Dashlet error message. This issue is fixed in versions 2.7.4 and 3.0.0.

Vendor-combodo Combodo

Product-itop iTop

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2021-20523

Matching Score-4

Assigner-IBM Corporation