CWE-213 Exposure of Sensitive Information Due to Incompatible Policies
Description
The product's intended functionality exposes information to certain actors in accordance with the developer's security policy, but this information is regarded as sensitive according to the intended security policies of other stakeholders such as the product's administrator, users, or others whose information is being processed.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-213 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-q79r-r9xg-r863 | CVE-2026-55425 | MODERATE |
Graylog Server: System Catalog titles endpoint can be used to retrieve values of protected database fields |
2026-08-28 | |
| GHSA-7ch3-7pp7-7cpq | CVE-2023-40570 | MODERATE |
Datasette 1.0 alpha series leaks names of databases and tables to unauthenticated users |
2026-06-09 | |
| GHSA-q475-2pgm-7hvp | CVE-2025-54831 | MODERATE |
Apache Airflow: Connection sensitive details exposed to users with READ permissions |
2026-06-05 | |
| GHSA-f8j4-p5cr-p777 | CVE-2025-32791 | MODERATE |
Permission policy information leakage in Backstage permission system |
2025-04-17 | |
| GHSA-7563-75j9-6h5p | CVE-2022-24742 | MODERATE | - |
Sensitive Information Exposure in Sylius |
2022-03-15 |
| GHSA-r28m-g6j9-r2h5 | CVE-2019-10246 | MODERATE |
Information Exposure vulnerability in Eclipse Jetty |
2021-04-23 | |
| GHSA-xc67-hjx6-cgg6 | CVE-2019-10247 | MODERATE |
Installation information leak in Eclipse Jetty |
2021-04-23 |