Sensitive Data Exposure occurs when an application does not adequately protect sensitive information. The data can vary and anything from passwords, session tokens, credit card data to private health data and more can be exposed. A few examples would include data that someone inadvertently uploaded somewhere, weak crypto that means an attacker would be able to read the data if they successfully compromised the target, or the lack of headers that prevent browser caching. In short, every possible way where it would have been possible to better protect the sensitive data.