Browse / Information Disclosure

Information Disclosure

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Information Disclosure1,552
• Privacy Violation83
• Cleartext Storage of Sensitive Information74
• Insecure Storage of Sensitive Information55
• Cleartext Transmission of Sensitive Information45
• Information Exposure Through an Error Message41
• Information Exposure Through Directory Listing36
• Information Exposure Through Debug Information35
• Information Exposure Through Sent Data30
• File and Directory Information Exposure11
• Missing Encryption of Sensitive Data10
• Exposure of Data Element to Wrong Session6
• LLM06: Sensitive Information Disclosure5
• Information Exposure Through Timing Discrepancy3
• Leftover Debug Code (Backdoor)3
• Exposure of Sensitive Information Due to Incompatible Policies2
• Use of Cache Containing Sensitive Information1
• Inclusion of Sensitive Information in an Include File1
• Cleartext Storage in a File or on Disk1
• Insertion of Sensitive Information into Log File1
• Improper Removal of Sensitive Information Before Storage or Transfer1

Often found together with

• Access Control209
• Authentication132
• Misconfiguration123
• Cross-site Scripting120
• Insecure Direct Object Reference66
• SQL Injection63
• Cross-Site Request Forgery61
• Memory Corruption56
• Server-Side Request Forgery53
• Path Traversal51
• Code Execution50
• Business Logic37
• Denial of Service29

Most upvoted Information Disclosure reports

AllValidInformativeN/ADuplicate

1. fetlife.com/signup_step_profile expose access_token of mapbox.comInformativeCleartext Transmission of Sensitive Information · medium · FetLife
   87 votes
2. Title: Deceptive Manipulation of HTTP to HTTPS with VPN in Burp SuiteInformativeCleartext Transmission of Sensitive Information · medium · PortSwigger Web Security
   71 votes
3. Wordpress users DisclosureInformativeInformation Disclosure · critical · Autodesk
   69 votes
4. Private data related to program exposed via /reports/<id>.json endpoint to external user participantInformativeInformation Disclosure · medium · HackerOne
   68 votes
5. Information Disclosure Due To exposed .env file (Directory Listing) at ████████InformativeInformation Exposure Through Directory Listing · high · AWS VDP
   46 votes
6. Information Disclosure: .dockerignore file is publicly accessibleInformativeInformation Disclosure · Flickr
   45 votes
7. Able to see highest poll result without voting or view resultInformativeInformation Exposure Through Debug Information · low · FetLife
   44 votes
8. Password Reset Token Leak Via ReferrerInformativeInformation Disclosure · medium · Liberapay
   42 votes
9. Credential leak on redirect due to improper state clearing when parsing macdef in netrc.cInformativeInformation Exposure Through Sent Data · low · curl
   41 votes
10. Sensitive API Key LeakageInformativeCleartext Storage of Sensitive Information · medium · AWS VDP
    41 votes
11. Information Disclosure via Logback Configuration Injection in GoCD AgentInformativeInformation Disclosure · GoCD
    37 votes
12. Sensitive information disclosure with malicious netrc fileInformativeLLM06: Sensitive Information Disclosure · medium · curl
    36 votes
13. internal path disclosure via register errorInformativeInformation Exposure Through an Error Message · low · Tennessee Valley Authority
    36 votes
14. Domainless COOKIEFILE cookie leaks to unrelated IP-literal hostsInformativeInformation Exposure Through Sent Data · curl
    31 votes
15. libcurl omits IPv6 zoneid from host identity and leaks credentials/cookies across scoped link-local realmsInformativeInformation Disclosure · medium · curl
    29 votes
16. GraphQL Introspection Enabled on Shopify API Endpoint (Intended Behavior)InformativeInformation Disclosure · Shopify
    28 votes
17. No Confirmation Email For Email ChangeInformativeInformation Disclosure · low · Hiro
    28 votes
18. Potential IP revealing using UNC Path in Windows File PickerInformativeInformation Disclosure · low · Tor
    25 votes
19. private keys exposed on the GitHub repositoryInformativeCleartext Storage of Sensitive Information · medium · MCUboot
    24 votes
20. report id is exposed for undisclosed reports in HacktivityInformativeInformation Disclosure · low · HackerOne
    24 votes
21. Hackerone Email Addresses EnumerationInformativeInformation Disclosure · HackerOne
    24 votes
22. libcurl stale CURLOPT_AUTOREFERER leaks a previous request URL to a different origin on a reused easy handleInformativeInformation Exposure Through Sent Data · low · curl
    22 votes
23. Information DisclosureInformativeInformation Disclosure · medium · Hiro
    21 votes
24. Cookie jar load skips public suffix check on PSL buildsInformativeInformation Exposure Through Sent Data · medium · curl
    20 votes
25. Memory leak of ftp (with proxy reuse)InformativeInformation Disclosure · curl
    20 votes
26. .git file accessibleInformativeInformation Disclosure · low · BlockDev Sp. Z o.o
    20 votes
27. Encryption context keys and values logged at INFO levelInformativeInsertion of Sensitive Information into Log File · AWS VDP
    19 votes
28. Information disclosure on error messageInformativeInformation Exposure Through an Error Message · low · PortSwigger Web Security
    18 votes
29. Exposed Configuration Files at https://www.exodus.io/keybase.txt InformativeInformation Disclosure · low · Exodus
    18 votes
30. Email Not Completely Deleted after Deleting an accountInformativePrivacy Violation · Semmle
    18 votes
31. Exposing hackerone users personally identifiable information by abusing sandbox with swag reward enabledInformativeInformation Disclosure · HackerOne
    18 votes
32. Cookie attribute truncation in curl drops Secure/HttpOnly protectionsInformativeInformation Exposure Through Sent Data · low · curl
    17 votes
33. Leaking Of Sensitive Information on GithubInformativeInformation Disclosure · low · Liberapay
    17 votes
34. 18: Explicit IPv6 proxy zone ID silently ignored — proxy credentials sent to wrong interfaceInformativeInformation Disclosure · curl
    16 votes
35. Improper data update process on UpdatePhabricatorIntegration mutation leads to leak of Phabricator Conduit API token.InformativeInformation Disclosure · critical · HackerOne
    16 votes
36. Hackers can reveal the names of private programs that have an external linkInformativeInformation Disclosure · low · HackerOne
    16 votes
37. Username Information Disclosure via Json response - Using parameter number IntruderInformativeInformation Disclosure · low · Brave Software
    16 votes
38. Submitted reports state logs leakageInformativeInformation Disclosure · medium · HackerOne
    16 votes
39. Vulnerability: XML-RPC Interface Enabled and AccessibleInformativeInformation Disclosure · Tucows (VDP)
    15 votes
40. Information Disclosure via Accessible debug.log on ExactHostingInformativeInformation Disclosure · Tucows (VDP)
    14 votes
41. curl doesn't hide credentials in /proc/XXX/cmdline provided via CLI argumentsInformativeCleartext Transmission of Sensitive Information · medium · curl
    14 votes
42. Wordpress Users Disclosure (/wp-json/wp/v2/users/) on data.govInformativeInformation Disclosure · medium · GSA Bounty
    14 votes
43. Explicit NO_PROXY /0 CIDR rules fail to bypass HTTP proxy for IP-literal requestsInformativeInformation Exposure Through Sent Data · low · curl
    13 votes
44. curl tool: --hsts is ignored for a schemeless URL starting with a slash under --proto-default httpInformativeCleartext Transmission of Sensitive Information · low · curl
    13 votes
45. libcurl reuses a learned RTSP Session header across different hosts on the same easy handle, enabling cross-host session leak and replayInformativeExposure of Data Element to Wrong Session · medium · curl
    13 votes
46. Requestor Email Disclosure via Email NotificationInformativeInformation Disclosure · low · Coinbase
    13 votes
47. http://████/data.json showing users sensitive information via json fileInformativeInformation Disclosure · medium · U.S. Dept Of Defense
    13 votes
48. Server version disclosureInformativeInformation Disclosure · Uber
    13 votes
49. 41: `main_checkfds()` pipe reuse leaks proxy credentials into HTTPS upload bodyInformativeInformation Exposure Through Sent Data · curl
    12 votes
50. Postgres Admin Username and Password in Plain textInformativeInsecure Storage of Sensitive Information · low · UPchieve
    12 votes
51. The response shows the nginx versionInformativeInformation Exposure Through Sent Data · Judge.me
    12 votes
52. Username enumeration via Openssh 7.6InformativeInformation Disclosure · medium · Kubernetes
    12 votes
53. don't leak Server version for assets.gratipay.comInformativeInformation Disclosure · Gratipay
    12 votes
54. Full Path disclosure on 500 errorInformativeInformation Disclosure · low · Liberapay
    11 votes
55. Production secret key leak in config/secrets.ymlInformativeCleartext Storage of Sensitive Information · high · Grab
    11 votes
56. Leaking Username and Password in the URLs via Virustotal, can leads to account takeoverInformativeInformation Exposure Through Sent Data · Chaturbate
    11 votes
57. The session token in the URLInformativeInformation Disclosure · medium · Nextcloud
    11 votes
58. Generating Unlimited Free Travel Gift Invites | IDORInformativeInformation Disclosure · Airbnb
    11 votes
59. RTSP Digest auth state leaks across origins on reused libcurl easy handleInformativeInformation Exposure Through Sent Data · medium · curl
    10 votes
60. Public Github Repo Leaking Internal Credentials InformativeInformation Disclosure · critical · Yelp
    10 votes
61. Visibility Robots.txt fileInformativeInformation Disclosure · Eternal
    10 votes
62. Reward Money LeakageInformativeInformation Disclosure · HackerOne
    10 votes
63. Redirect to imap/pop3/smtp (SASL) or sftp/scp (libssh) authenticates to the attacker's host with the user's ambient Kerberos credentialsInformativeInformation Exposure Through Sent Data · low · curl
    9 votes
64. HSTS multi-trailing-dot bypass-ish: possible incomplete fix for CVE-2022-30115InformativeCleartext Transmission of Sensitive Information · medium · curl
    9 votes
65. Recaptcha Secret key LeakedInformativeInformation Disclosure · high · Paragon Initiative Enterprises
    9 votes
66. User Enumeration InformativeInformation Disclosure · low · Liberapay
    9 votes
67. help.nextcloud Email Address/Username enumerationInformativeInformation Disclosure · Nextcloud
    9 votes
68. "early preview" programs disclosureInformativeInformation Disclosure · HackerOne
    9 votes
69. Multiple Path DisclosureInformativeInformation Disclosure · Ian Dunn
    9 votes
70. libcurl: Secure=1 cookie flag bypasses the 8.22.0 fix and leaks over HTTPInformativeInformation Exposure Through Sent Data · low · curl
    8 votes
71. Google Maps API Key LeakageInformativeInformation Disclosure · Uber
    8 votes
72. Blockstack Browser For Mac leaks "Core API Password" to 3rd partiesInformativeInformation Disclosure · low · Hiro
    8 votes
73. Leakage badges on disabled userInformativeInformation Disclosure · low · HackerOne
    8 votes
74. stack trace exposed on https://receipts.uber.com/InformativeInformation Disclosure · medium · Uber
    8 votes
75. Information leakage - Private reports cached by Google InformativeInformation Disclosure · HackerOne
    8 votes
76. Email enumerationInformativeInformation Disclosure · Slack
    8 votes
77. Private RSA key for Vagrant exposed in GitHub repositoryInformativeInsecure Storage of Sensitive Information · Sifchain
    7 votes
78. Responsible Disclosure of Privacy Leakage IssueInformativePrivacy Violation · high · GitLab
    7 votes
79. Expose relay IP in the debug (The source is different from the rendering)InformativeInformation Disclosure · Tor
    7 votes
80. Session Fixation disclosing email addressInformativeInformation Disclosure · Slack
    7 votes
81. libcurl 8.20.0 ignores HTTP Digest domain protection space and preemptively leaks Digest auth outside the declared scopeInformativeInformation Disclosure · medium · curl
    6 votes
82. installed.json sensitive file was publicly accessible on your web application which discloses information about authors and admins InformativeInformation Disclosure · low · Yelp
    6 votes
83. Secret_key in GitHubInformativeInformation Disclosure · Weblate
    6 votes
84. Public and secret api key leaked via omise github repo(owned by omise)InformativeInformation Disclosure · Omise
    6 votes
85. Open DirectoryInformativeInformation Exposure Through Directory Listing · medium · RATELIMITED
    6 votes
86. Information disclosure through search engines (password reset token)InformativeInformation Disclosure · medium · Upserve
    6 votes
87. Partial disclosure of undisclosed programs through <meta> tagsInformativeInformation Disclosure · HackerOne
    6 votes
88. Wordpress Version Disclosure Bug On NextcloudInformativeInformation Disclosure · low · Nextcloud
    6 votes
89. Low priority HSTS bypass in curl_easy_duphandle()InformativeInformation Exposure Through Sent Data · low · curl
    5 votes
90. Remote memory disclosure vulnerability in libcurl on 64 Bit WindowsInformativeInformation Exposure Through Sent Data · high · curl
    5 votes
91. Talk discloses turn server to anybodyInformativeInformation Disclosure · low · Nextcloud
    5 votes
92. Full Path DisclosureInformativeInformation Disclosure · medium · Unikrn
    5 votes
93. Session Cookie Without Secure Flag,InformativeInformation Disclosure · Ed
    5 votes
94. Information Disclosure which violate program privacyInformativePrivacy Violation · low · HackerOne
    5 votes
95. Banner Grabbing - Apache Server Version DisclousureInformativeInformation Disclosure · Nextcloud
    5 votes
96. Tor Project - Full Path DisclosureInformativeInformation Exposure Through an Error Message · low · Tor
    5 votes
97. Open port leads to information disclosureInformativeInformation Disclosure · low · Weblate
    5 votes
98. The special code in editor has no Authority control and can lead to Information DisclosureInformativeInformation Disclosure · medium · Phabricator
    5 votes
99. Ngnix Server version disclosure 404 Page!InformativeInformation Disclosure · Yelp
    5 votes
100. API OAuth Public Key disclosure in mobile appInformativeInformation Disclosure · Instacart
     5 votes