Browse / Information Disclosure

Information Disclosure

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Information Disclosure1,552
• Privacy Violation83
• Cleartext Storage of Sensitive Information74
• Insecure Storage of Sensitive Information55
• Cleartext Transmission of Sensitive Information45
• Information Exposure Through an Error Message41
• Information Exposure Through Directory Listing36
• Information Exposure Through Debug Information35
• Information Exposure Through Sent Data30
• File and Directory Information Exposure11
• Missing Encryption of Sensitive Data10
• Exposure of Data Element to Wrong Session6
• LLM06: Sensitive Information Disclosure5
• Information Exposure Through Timing Discrepancy3
• Leftover Debug Code (Backdoor)3
• Exposure of Sensitive Information Due to Incompatible Policies2
• Use of Cache Containing Sensitive Information1
• Inclusion of Sensitive Information in an Include File1
• Cleartext Storage in a File or on Disk1
• Insertion of Sensitive Information into Log File1
• Improper Removal of Sensitive Information Before Storage or Transfer1

Often found together with

• Access Control209
• Authentication132
• Misconfiguration123
• Cross-site Scripting120
• Insecure Direct Object Reference66
• SQL Injection63
• Cross-Site Request Forgery61
• Memory Corruption56
• Server-Side Request Forgery53
• Path Traversal51
• Code Execution50
• Business Logic37
• Denial of Service29

Most upvoted Information Disclosure reports

AllValidInformativeN/ADuplicate

1. View any user email using the Team's audit log sectionDuplicateInformation Disclosure · critical · HackerOne
   61 votes
2. Two-factor authentication bypass lead to information disclosure about the program and all hackers participateDuplicateInformation Disclosure · high · HackerOne
   37 votes
3. Timing attack towards endpoints on the web without CSRF DuplicateInformation Disclosure · low · HackerOne
   34 votes
4. Development Application Credentials + Information ExposedDuplicateCleartext Storage of Sensitive Information · high · Kubernetes
   31 votes
5. Able To Check The Exact Bounty Balance of any Bug Bounty ProgramDuplicateInformation Disclosure · medium · HackerOne
   27 votes
6. Visibility Robots.txt fileDuplicateInformation Disclosure · Krisp
   19 votes
7. Lack of cross-origin request blocking allows leaking of sensitive information on several endpointsDuplicateInformation Disclosure · HackerOne
   15 votes
8. private keys exposed on the GitHub repositoryDuplicateCleartext Storage of Sensitive Information · medium · MCUboot
   13 votes
9. GraphQL Query leads to sensitive information disclosureDuplicatePrivacy Violation · medium · GitLab
   12 votes
10. .git folder exposed [HtUS]DuplicateInformation Disclosure · critical · U.S. Dept Of Defense
    11 votes
11. Exposed GIT repo on ██████████[HtUS]DuplicateCleartext Storage of Sensitive Information · critical · U.S. Dept Of Defense
    10 votes
12. Information Disclosure on https://rpc.sifchain.finance/DuplicateInformation Disclosure · Sifchain
    10 votes
13. Get ip and Geo location any user via Clickjacking with inspectlet technologyDuplicateInformation Disclosure · Acronis
    10 votes
14. Exposes a series of other private credentialsDuplicateInformation Disclosure · Legal Robot
    10 votes
15. Wordpress Users DisclosureDuplicateInformation Disclosure · high · Nextcloud
    8 votes
16. Information disclosureDuplicateInformation Disclosure · low · HackerOne
    8 votes
17. Private Program all members disclosed DuplicateInformation Disclosure · HackerOne
    8 votes
18. Transferring incorrect data to the http://gip.rocks/v1 endpoint with correct Content-Type leads to local paths disclosure through the error messageDuplicateInformation Exposure Through an Error Message · low · Gratipay
    7 votes
19. Possible sensitive filesDuplicateInformation Disclosure · Localize
    7 votes
20. HTTPS proxy connection reuse lets one easy handle inherit another handle's mTLS-authenticated proxy sessionDuplicateExposure of Data Element to Wrong Session · medium · curl
    6 votes
21. Wordpress users disclosure on blog.makerdao.conDuplicateInformation Disclosure · low · BlockDev Sp. Z o.o
    5 votes
22. Information disclosure (system username, server info) in the x-amz-meta-s3cmd-attrs response header on data.govDuplicateInformation Disclosure · low · GSA Bounty
    5 votes
23. xmlrpc file enabledDuplicateInformation Disclosure · low · Yelp
    4 votes
24. RSA PRIVATE KEY discloserDuplicateInformation Disclosure · Sifchain
    4 votes
25. Disclosed Version of PORTS SSH|HTTP|SSLDuplicateInformation Disclosure · low · Nextcloud
    4 votes
26. Email Address LeakDuplicateInformation Disclosure · HackerOne
    4 votes
27. Unsubscripe linkes leakedDuplicateInformation Disclosure · Krisp
    3 votes
28. Wordpress Users Disclosure (/wp-json/wp/v2/users/) on sifchain.financeDuplicateInformation Disclosure · low · Sifchain
    3 votes
29. Information Disclosure - Composer.lockDuplicateInformation Disclosure · RBKmoney
    3 votes
30. Possible Database Details stored in values.yamlDuplicateCleartext Storage of Sensitive Information · medium · Sifchain
    2 votes
31. exposed Git Repo at http://api.e2e-kops-aws-canary.test-cncf-aws.canary.k8s.io/.git/DuplicateInformation Disclosure · high · Kubernetes
    2 votes
32. Weak Password Policy on techsupport.teradici.comDuplicatePrivacy Violation · medium · Teradici
    2 votes
33. Information disclosure on a DoD websiteDuplicateInformation Disclosure · low · U.S. Dept Of Defense
    2 votes
34. don't leak Server version for assets.gratipay.comDuplicateInformation Disclosure · Gratipay
    2 votes
35. Enumerating userIDs with phone numbersDuplicateInformation Disclosure · Uber
    2 votes
36. Information disclosure on SifchainDuplicateInformation Disclosure · Sifchain
    1 votes
37. Username disclosure at Main DomainDuplicateInformation Disclosure · low · Sifchain
    1 votes
38. Sensitive Information disclosure Through Config FileDuplicateInformation Disclosure · Kubernetes
    1 votes
39. Information Exposure Through Directory Listing - https://apps.nextcloud.com/static/DuplicateInformation Exposure Through Directory Listing · low · Nextcloud
    1 votes
40. Sensitive information disclosure via response headers on jenkins.brew.shDuplicateInformation Exposure Through an Error Message · low · Homebrew
    1 votes
41. 14: HSTS cache import silently drops a longer-lived child beneath an includeSubDomains parentDuplicateCleartext Transmission of Sensitive Information · curl