Browse / Information Disclosure

Information Disclosure

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Information Disclosure1,552
• Privacy Violation83
• Cleartext Storage of Sensitive Information74
• Insecure Storage of Sensitive Information55
• Cleartext Transmission of Sensitive Information45
• Information Exposure Through an Error Message41
• Information Exposure Through Directory Listing36
• Information Exposure Through Debug Information35
• Information Exposure Through Sent Data30
• File and Directory Information Exposure11
• Missing Encryption of Sensitive Data10
• Exposure of Data Element to Wrong Session6
• LLM06: Sensitive Information Disclosure5
• Information Exposure Through Timing Discrepancy3
• Leftover Debug Code (Backdoor)3
• Exposure of Sensitive Information Due to Incompatible Policies2
• Use of Cache Containing Sensitive Information1
• Inclusion of Sensitive Information in an Include File1
• Cleartext Storage in a File or on Disk1
• Insertion of Sensitive Information into Log File1
• Improper Removal of Sensitive Information Before Storage or Transfer1

Often found together with

• Access Control209
• Authentication132
• Misconfiguration123
• Cross-site Scripting120
• Insecure Direct Object Reference66
• SQL Injection63
• Cross-Site Request Forgery61
• Memory Corruption56
• Server-Side Request Forgery53
• Path Traversal51
• Code Execution50
• Business Logic37
• Denial of Service29

Most upvoted Information Disclosure reports

AllValidInformativeN/ADuplicate

1. Subdomain TakeoverN/AInformation Disclosure · critical · Paragon Initiative Enterprises
   83 votes
2. API Key Exposed in JavaScript File on 1Password Developer SiteN/AInformation Disclosure · 1Password - Enterprise Password Manager
   62 votes
3. Hackers Attack Curl Vulnerability Accessing Sensitive InformationN/AInformation Disclosure · medium · curl
   48 votes
4. Unauthenticated API Access Exposing Premium Content and Financial DataN/AInformation Exposure Through Sent Data · XVIDEOS
   46 votes
5. API Data Leakage Vulnerability Report - `xvcams.com`N/AInformation Exposure Through Sent Data · XVIDEOS
   33 votes
6. Exposed .git/config File Leading to Potential Sensitive Information DisclosureN/AInformation Disclosure · low · curl
   32 votes
7. bypass of this Fixed #2437131 [ Inadequate Protocol Restriction Enforcement in curl ]N/ACleartext Transmission of Sensitive Information · low · curl
   30 votes
8. Use-after-free read of the freed referer buffer in `curl_easy_setopt(CURLOPT_REFERER)` — stale heap bytes transmitted in an outbound `Referer:` headeN/AInformation Disclosure · high · curl
   29 votes
9. Timing Attack Vulnerability in curl Digest Authentication via Non-Constant-Time String ComparisonN/AInformation Exposure Through Timing Discrepancy · medium · curl
   28 votes
10. curl leaks destination IP via glibc getaddrinfo() UDP connect, bypassing SOCKS5/TorN/AInformation Disclosure · curl
    28 votes
11. AWS SigV4 Signature Disclosure via Verbose Logging in libcurlN/AInformation Disclosure · curl
    27 votes
12. Exposure of Private RSA Private Key in curl GitHub RepositoryN/AInsecure Storage of Sensitive Information · curl
    26 votes
13. Open API For Username enumerationN/AInformation Disclosure · low · WordPress
    25 votes
14. Vulnerability Report: Public Exposure of Security Audit FileN/AInformation Disclosure · medium · curl
    24 votes
15. AWS hosting bucket for Legal Robots set as public browse and list contents: s3://legalrobotN/AInformation Disclosure · Legal Robot
    21 votes
16. Cookie exposure due to unexpected file permission changeN/AFile and Directory Information Exposure · medium · curl
    20 votes
17. Confirmed Security Misconfigurations on curl.se (BREACH, Missing Security Headers, ETag Info Disclosure)N/AInformation Disclosure · medium · curl
    19 votes
18. Insecure WebSocket Usage in curl Documentation and Examples (CWE-319: Cleartext Transmission of Sensitive Information)N/ACleartext Transmission of Sensitive Information · high · curl
    19 votes
19. CURLOPT_UNRESTRICTED_AUTH Dangerous Default Documentation GapN/AInformation Disclosure · low · curl
    18 votes
20. Proxy-Authorization header is leaked to origin server after redirect from proxied to direct connectionN/AInformation Exposure Through Sent Data · high · curl
    18 votes
21. Secure cookies leaked to HTTP origins through HTTPS forwarding proxyN/AInformation Disclosure · curl
    15 votes
22. Report title and issue information prepopulated N/AInformation Disclosure · HackerOne
    15 votes
23. access notes without permissionN/AInformation Disclosure · curl
    14 votes
24. Alt-Svc bypasses credential leak protection (CVE-2018-1000007)N/AInformation Exposure Through Sent Data · high · curl
    13 votes
25. Authorization Header Leak via --location-trusted in CurlN/AInformation Exposure Through Sent Data · high · curl
    13 votes
26. Failure to strip Proxy-Authorization header on change in originN/AInformation Disclosure · medium · curl
    11 votes
27. Information Disclosure at : https://curl.se/.mailmapN/AInformation Disclosure · high · curl
    11 votes
28. Directory listing vulnerability is disclosing names and emails, widespread (thousands of records, publicly accessible without auth)N/AInformation Exposure Through Directory Listing · critical · curl
    10 votes
29. curl’s persistence files inherit world-readable/writable perms from umask, leaking and tampering with cookies/HSTS/Alt-Svc cachesN/ACleartext Storage of Sensitive Information · medium · curl
    10 votes
30. Git repository foundN/AInformation Disclosure · high · curl
    10 votes
31. information disclosure N/AInformation Disclosure · curl
    10 votes
32. Robots.txt file with potentially sensitive content.N/APrivacy Violation · low · Yelp
    10 votes
33. critical file found etc/passwd on www.reddit.comN/AInformation Disclosure · high · Reddit
    10 votes
34. TFTP upload ignores --continue-at / CURLOPT_RESUME_FROM and leaks skipped local file prefixN/AInformation Exposure Through Sent Data · medium · curl
    9 votes
35. Disclosure of email addressesN/AInformation Disclosure · curl
    9 votes
36. 07: GnuTLS 0-RTT early data bypasses file-backed public-key pin verificationN/AInformation Disclosure · curl
    8 votes
37. State Isolation Failure in Multiplexed Connections (Shared Auth Context)N/AExposure of Data Element to Wrong Session · critical · curl
    8 votes
38. Multiple server ssh usernames leaked in your github repositoryN/AInformation Disclosure · medium · Ian Dunn
    7 votes
39. Path Disclosure VulnerabilityN/AInformation Disclosure · Ian Dunn
    6 votes
40. One Strict-Transport-Security response header empties the victim's entire HSTS store, silently,N/ACleartext Transmission of Sensitive Information · medium · curl
    5 votes
41. sensitive data exposureN/AInsecure Storage of Sensitive Information · high · Reddit
    5 votes
42. OTP reflecting in response sensitive data exposure leads to account take overN/AInformation Disclosure · critical · UPchieve
    5 votes
43. Information Disclosure via ZIP file on AWS Bucket [http://acronis.1.s3.amazonaws.com]N/AInformation Disclosure · medium · Acronis
    5 votes
44. [mattermost.com] CORS Misconfiguration leakage of admin usersN/AInformation Disclosure · Mattermost
    5 votes
45. Guests Will Disclose the Private Project Full Activity Via Project Activity FeedsN/AInformation Disclosure · GitLab
    5 votes
46. Information Exposure Through an Error Message at news.starbucks.comN/AInformation Exposure Through an Error Message · medium · Starbucks
    5 votes
47. Browser Self XSS Protection not implementedN/AInformation Disclosure · PortSwigger Web Security
    5 votes
48. reopen #128853 (Information disclosure at lite.uber.com)N/AInformation Disclosure · Uber
    5 votes
49. ARG_CLEAR credential scrubbing wipes only UTF-8 copies on Windows Unicode buildsN/AInformation Disclosure · low · curl
    4 votes
50. Exposed data of credit card details to hacker or attacker.N/APrivacy Violation · medium · Urban Company
    4 votes
51. Private RSA key and Server key exposed on the GitHub repositoryN/ACleartext Storage of Sensitive Information · medium · Kubernetes
    4 votes
52. Source code disclosed via S3 BucketN/AInformation Exposure Through Directory Listing · high · Ruby
    4 votes
53. twitter api access token leaked on github N/ACleartext Storage of Sensitive Information · Liberapay
    4 votes
54. Reputation gain split by company can be used to track the existence of otherwise undisclosed reportsN/AInformation Disclosure · low · HackerOne
    4 votes
55. If the developer forgets to remove the built in controller welcome.php it helps the attacker to identify that the site is built with CodeigniterN/AInformation Exposure Through Directory Listing · high · CodeIgniter
    4 votes
56. Administrator(s) Information disclosure via JSON on wordpress.orgN/AInformation Disclosure · medium · WordPress
    4 votes
57. Direct IP AccessN/AInformation Disclosure · low · OWOX, Inc.
    4 votes
58. Amazon Bucket Accessible (http://legalrobot.s3.amazonaws.com/)N/AInformation Disclosure · Legal Robot
    4 votes
59. Information disclosureN/AInformation Disclosure · Nextcloud
    4 votes
60. Information Exposure Through Directory ListingN/AInformation Exposure Through Directory Listing · high · Tor
    3 votes
61. ETHEREUM_PRIVATE_KEY leaked N/ACleartext Storage of Sensitive Information · Sifchain
    3 votes
62. Information disclosureN/AInformation Disclosure · high · Brave Software
    2 votes
63. Found a url on source code which was disclosing different juicy informations like ip addresses and available endpontsN/AInformation Exposure Through Directory Listing · Sifchain
    2 votes
64. Sifchain token leak N/AInsecure Storage of Sensitive Information · Sifchain
    2 votes
65. Open S3 Bucket | information leakageN/AInformation Disclosure · Sifchain
    2 votes
66. Proxy-Authorization header carried to a new host on a redirectN/ACleartext Transmission of Sensitive Information · medium · curl
    2 votes
67. Information leakage on django.aspen.ioN/AInformation Disclosure · Aspen
    2 votes
68. Research papers on yelp are getting indexed by google bots.N/AInformation Disclosure · Yelp
    2 votes
69. Brave payments remembers history even after clearing all browser data.N/AInformation Disclosure · low · Brave Software
    2 votes
70. Badoo and Hotornot User DisclosureN/AInformation Disclosure · Bumble
    2 votes
71. Cross-protocol redirect to imap:// or smtp:// uploads the -F/MIMEPOST form and the custom Authorization/Cookie headers to the redirect targetN/AInformation Exposure Through Sent Data · low · curl
    1 votes
72. PRE_PROXY change leaks stale Proxy Digest state across proxy-chain boundaryN/AInformation Disclosure · curl
    1 votes
73. SMTP connection reuse ignores --ssl-reqd / CURLOPT_USE_SSL and reuses a clear-text STARTTLS session on current masterN/ACleartext Transmission of Sensitive Information · low · curl
    1 votes
74. Sifchain Privacy Policy Webpage Uses Wordpress Default Template. Does Not Display Correct Privacy Policy.N/AInformation Disclosure · Sifchain
    1 votes
75. mongodb credentials leaked in githubN/AInformation Disclosure · Sifchain
    1 votes
76. Open aws s3 bucket s3://rubyciN/AInformation Disclosure · critical · Ruby
    1 votes
77. https://www.legalrobot.com/N/AInformation Disclosure · Legal Robot
    1 votes
78. Google Authenticator0.6 - PHP Version DosclosureN/AInformation Disclosure · Ian Dunn
    1 votes
79. information disclosureN/AInformation Disclosure · Sifchain
80. Information Disclosure at one of your subdomainN/AInformation Disclosure · Sifchain
81. Port and service scanning on localhost due to improper URL validation.N/AInformation Disclosure · medium · curl