Contributors
Jeremiah Grossman
(WhiteHat Security)

Ofer Shezaf
(Breach Security ) [Project Leader]

The Web Hacking Incidents Database
Last update:07 November 2007

List of incidents of class Information Leakage

Other WASC threat classifications:
Abuse of Functionality, Brute Force, Content Spoofing, Credential/Session Prediction, Cross-site Scripting, Defacement, Denial of Service, Directory Indexing, HTTP Response Splitting, Information Leakage, Insufficient Anti-automation, Insufficient Authentication, Insufficient Authorization, Insufficient Process Validation, Insufficient Session Expiration, Known Vulnerabity, Misconfiguration, OS Commanding, Other, Path Traversal, Phishing, Predictable Resource Location, Redirection, SQL Injection, Unknown, Weak Password Recovery Validation, Worm

There are 4 incidents of class Information Leakage
WHID 2005-3: Misconfiguration issues in paid wireless access and billing applications
Date: 01 February 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Directory Indexing, Information Leakage, Insufficient Authentication

Multiple misconfiguration problems such as browsable directories, physical path revealing and default or weak passwords

References:

WHID 2003-5: Car shoppers' credit details exposed in bulk
Date: 25 September 2003
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Information Leakage, Predictable Resource Location

User submitted information was being stored in a publicly available location. The URL found in the source code of a publicly available web page.

References:

WHID 2000-2: IKEA exposes customer information on catalog site
Date: 06 September 2000
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Information Leakage, Insufficient Authentication

Error message revealed a database file location, which could be downloaded.

References:

WHID 2000-3: Gaffe at Amazon leaves email addresses exposed
Date: 06 September 2000
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Information Leakage

E-mail addresses of other customers displayed by mistake, no hacking was required

References:



This work is licensed under the Creative Commons Attribution License. To view a copy of this license, visit http://creativecommons.org/licenses/by/2.5/ or send a letter to Creative Commons, 559 Nathan Abbott Way, Stanford, California 94305, USA.
© Copyright 2005, Web Application Security Consortium. All rights reserved.