"the error message gives information which should be undisclosed, such as passwords."
You mean that when you try and connect giving an invalid password, the error message that QGIS issues informing you about the connection failure shows the invalid password you just typed ? That is not really a security breach since you just entered that incorrect password. You need to be more specific and explain precisely what you observe.
Connecting to an Oracle database requires a username and password. Those (at least the password) should always be prompted from the user. That said, I have seen many client tools (not just GIS tools) that offer to remember the password you entered, so you don't have to reenter again later on. That is fine as long as the client stores that password in a safe way (i.e. not in clear text in a config file). If QGIS does that, then this is a serious bug that needs addressing.
"Also, I'm able to view databases I shouldn't have access too."
The data a user of the database can see depends on the rights that your DBA has given to that user. They can be restricted or wide open. In real life, that user should only have the rights that are strictly needed, i.e. the user only sees those tables that he/she is allowed to access: nothing else. If you see something different, then you need to take that up with your DBA and tell him to setup proper security.
The database has powerful capabilities. There are "system" user names such as SYSTEM or SYS. Your QGIS users must never connect using such a user name: those are strictly for use by the DBA only (just like the root password for Unix is only used by a system administrator). It is possible to give a user massive rights by granting it the dba role. That again is a big NO-NO. Only DBAs can use that right.
Finally, there is the MDSYS account, a "system" user for Oracle Spatial. Do not connect using that account (it is disabled by default). Never store any user data in that account!
All security-related questions I have seen with databases (not just Oracle) always came down to mis-configuration, mis-use, or lack of proper understanding of security rules.