CWE-209

{
  "affected": [],
  "aliases": [
    "CVE-2021-44155"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-209"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-12-13T04:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in /goform/login_process in Reprise RLM 14.2. When an attacker attempts to login, the response if a username is valid includes Login Failed, but does not include this string if the username is invalid. This allows an attacker to enumerate valid users.",
  "id": "GHSA-5x86-xgvw-j25w",
  "modified": "2023-04-20T18:30:49Z",
  "published": "2021-12-14T00:01:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44155"
    },
    {
      "type": "WEB",
      "url": "https://reprisesoftware.com/admin/rlm-admin-download.php?\u0026euagree=yes"
    },
    {
      "type": "WEB",
      "url": "https://www.reprisesoftware.com/RELEASE_NOTES"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/165182/Reprise-License-Manager-14.2-User-Enumeration.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-31960"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-209"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-06T19:16:35Z",
    "severity": "MODERATE"
  },
  "details": "HCL BigFix Service Management (SM) is vulnerable to information exposure due to improper error handling within its reporting module. It was observed that supplying an invalid or out-of-range value to the consumer_company parameter during a report-viewing request causes the application to trigger an unhandled exception.",
  "id": "GHSA-6282-5cpc-5895",
  "modified": "2026-05-06T21:31:36Z",
  "published": "2026-05-06T21:31:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31960"
    },
    {
      "type": "WEB",
      "url": "https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0128144"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-15526"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-209"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-16T05:16:13Z",
    "severity": "MODERATE"
  },
  "details": "The Fancy Product Designer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 6.4.8. This is due to improper error handling in the PDF upload functionality that exposes server filesystem paths and stack traces in error messages. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.",
  "id": "GHSA-62j9-5xw8-8j5f",
  "modified": "2026-01-16T06:30:15Z",
  "published": "2026-01-16T06:30:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15526"
    },
    {
      "type": "WEB",
      "url": "https://support.fancyproductdesigner.com/support/discussions/topics/13000036024"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9b39b4ce-3885-4ea4-8cf0-84e66e7f6a12?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-40292"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-209"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-10-31T21:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The application allowed for Unauthenticated User Enumeration by interacting with an unsecured endpoint to retrieve information on each account within the system.",
  "id": "GHSA-62xx-cv5c-2cjf",
  "modified": "2022-11-03T12:00:28Z",
  "published": "2022-11-01T12:00:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40292"
    },
    {
      "type": "WEB",
      "url": "https://www.themissinglink.com.au/security-advisories/cve-2022-40292"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-13537"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-209"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-21T04:15:09Z",
    "severity": "MODERATE"
  },
  "details": "The C9 Blocks plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.7.7. This is due the plugin containing a publicly accessible composer-setup.php file with error display enabled. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.",
  "id": "GHSA-65qp-579h-gfwc",
  "modified": "2025-02-21T06:31:09Z",
  "published": "2025-02-21T06:31:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13537"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/c9-blocks/trunk/composer-setup.php"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e3e682fb-e821-45cb-a087-d97d42a3743e?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-20150"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-209"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-16T16:15:29Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to enumerate LDAP user accounts.\n\nThis vulnerability is due to the improper handling of LDAP authentication requests. An attacker could exploit this vulnerability by sending authentication requests to an affected system. A successful exploit could allow an attacker to determine which usernames are valid LDAP user accounts.",
  "id": "GHSA-6938-r83g-5rjp",
  "modified": "2025-04-16T18:31:50Z",
  "published": "2025-04-16T18:31:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20150"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nd-unenum-2xFFh472"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-5617"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-209",
      "CWE-550"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-28T23:15:08Z",
    "severity": "MODERATE"
  },
  "details": "Hitachi Vantara Pentaho Data Integration \u0026 Analytics versions before 10.1.0.0 and 9.3.0.6, including\u00a09.5.x and 8.3.x, display the version of Tomcat when a server error is encountered.",
  "id": "GHSA-69jc-r7p8-4cpg",
  "modified": "2025-02-14T18:30:43Z",
  "published": "2024-02-29T00:30:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5617"
    },
    {
      "type": "WEB",
      "url": "https://support.pentaho.com/hc/en-us/articles/24313358254861--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Server-generated-Error-Message-Containing-Sensitive-Information-Versions-before-10-1-0-0-and-9-3-0-6-including-all-versions-before-10-0-x-Impacted-CVE-2023-5617"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-16121"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-209"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-11-07T04:15:00Z",
    "severity": "LOW"
  },
  "details": "PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that the user would be unable to determine on its own.",
  "id": "GHSA-6g23-6jw5-9vrf",
  "modified": "2022-05-24T17:33:24Z",
  "published": "2022-05-24T17:33:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-16121"
    },
    {
      "type": "WEB",
      "url": "https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1888887"
    },
    {
      "type": "WEB",
      "url": "https://www.eyecontrol.nl/blog/the-story-of-3-cves-in-ubuntu-desktop.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "surrealdb"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-209"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-01T20:16:52Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "A record user with UPDATE access could read field values that field-level SELECT permissions hid from them. Arithmetic operators and `extend` embedded the raw operand into their error messages, and UPDATE permission checks evaluate against the unreduced document \u2014 so triggering such an error against a hidden field returned its value in the resulting error.\n\n### Impact\n\nA record user issues an UPDATE that performs an incompatible operation against a hidden field \u2014 e.g. `UPDATE person:me SET probe = email + 1` when `email` is a string \u2014 and reads the value from the returned error (`Tried to compute \"alice@example.com\" + 1 \u2026`). One field per operation, but the attacker can repeat against any field on any record they can UPDATE.\n\n### Patches\n\nA patch has been introduced that replaces the raw operand in every `try_*` operator and in `extend` with the operand\u0027s type name (`\"string\"`, `\"int\"`, `\"array\"`, etc.).\n\n- Versions 3.1.0 and later are not affected by this issue.\n\n### Workarounds\n\nAffected users who are unable to update should not grant UPDATE permission on records whose field-level SELECT permissions are expected to hide values from the same caller.",
  "id": "GHSA-6g9v-7gq3-p2c6",
  "modified": "2026-07-01T20:16:52Z",
  "published": "2026-07-01T20:16:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-6g9v-7gq3-p2c6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/surrealdb/surrealdb/commit/0aaa332c79195e4c40275eb5224aed3d52f5cf90"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/surrealdb/surrealdb"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.2.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-27004"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-209",
      "CWE-346"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-18T22:43:53Z",
    "nvd_published_at": "2026-02-20T00:16:17Z",
    "severity": "MODERATE"
  },
  "details": "## Vulnerability\n\nIn some shared-agent deployments, OpenClaw session tools (`sessions_list`, `sessions_history`, `sessions_send`) allowed broader session targeting than some operators intended. This is primarily a configuration/visibility-scoping issue in multi-user environments where peers are not equally trusted.\n\nIn Telegram webhook mode, monitor startup also did not fall back to per-account `webhookSecret` when only the account-level secret was configured.\n\n## Typical Use Case Context\n\nMost regular OpenClaw deployments run a single agent, or run in trusted environments. In those setups, practical risk from this issue is generally low.\n\n## Impact\n\n- Shared-agent, multi-user, less-trusted environments: session-tool access could expose transcript content across peer sessions.\n- Single-agent or trusted environments: practical impact is limited.\n- Telegram webhook mode: account-level secret wiring could be missed unless an explicit monitor webhook secret override was provided.\n\n## Affected Packages / Versions\n\n- Package: npm `openclaw`\n- Affected versions: `\u003c= 2026.2.14`\n- Patched version: `2026.2.15` (planned next release)\n\n## Remediation\n\n- Add and enforce `tools.sessions.visibility` (`self | tree | agent | all`) across session tools, defaulting to `tree`.\n- Keep sandbox clamping behavior so sandboxed runs can be restricted to spawned/session-tree visibility.\n- Resolve Telegram webhook secret from account config fallback in monitor webhook startup.\n\n## Fix Commit(s)\n\n- `c6c53437f7da033b94a01d492e904974e7bda74c`\n\nThanks @aether-ai-agent for reporting.",
  "id": "GHSA-6hf3-mhgc-cm65",
  "modified": "2026-02-20T16:47:17Z",
  "published": "2026-02-18T22:43:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-6hf3-mhgc-cm65"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27004"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/c6c53437f7da033b94a01d492e904974e7bda74c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenClaw session tool visibility hardening and Telegram webhook secret fallback"
}