CWE-200 · Information Disclosure (page 20)
Page 20 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-21626 | Medium | 5.8 | 2025-02-25 | GLPI is a free asset and IT management software package. Starting in version 0.71 and prior to version 10.0.18, an anonymous user can fetch sensitive informati… |
CVE-2025-1063 | Medium | 5.3 | 2025-02-25 | The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to… |
CVE-2025-1606 | Medium | 4.3 | 2025-02-24 | A vulnerability classified as problematic was found in SourceCodester Best Employee Management System 1.0. This vulnerability affects unknown code of the file… |
CVE-2025-1595 | Medium | 5.3 | 2025-02-23 | A vulnerability has been found in Anhui Xufan Information Technology EasyCVR up to 2.7.0 and classified as problematic. This vulnerability affects unknown code… |
CVE-2025-22973 | High | 7.5 | 2025-02-20 | An issue in QiboSoft QiboCMS X1.0 allows a remote attacker to obtain sensitive information via the http_curl() function in the '/application/common. php' file… |
CVE-2024-54961 | Medium | 6.5 | 2025-02-20 | Nagios XI 2024R1.2.2 has an Information Disclosure vulnerability, which allows unauthenticated users to access multiple pages displaying the usernames and emai… |
CVE-2025-26310 | Medium | 6.5 | 2025-02-20 | Multiple memory leaks have been identified in the ABC file parsing functions (parseABC_CONSTANT_POOL and `parseABC_FILE) in util/parser.c of libming v0.4.8, wh… |
CVE-2025-26309 | Medium | 6.5 | 2025-02-20 | A memory leak has been identified in the parseSWF_DEFINESCENEANDFRAMEDATA function in util/parser.c of libming v0.4.8, which allows attackers to cause a denial… |
CVE-2024-57716 | High | 7.5 | 2025-02-20 | An issue in trenoncourt AutoQueryable v.1.7.0 allows a remote attacker to obtain sensitive information via the Unselectable function. |
CVE-2025-25946 | Medium | 5.5 | 2025-02-19 | An issue in Bento4 v1.6.0-641 allows an attacker to cause a memory leak via Ap4Marlin.cpp and Ap4Processor.cpp, specifically in AP4_MarlinIpmpEncryptingProcess… |
CVE-2025-25945 | Medium | 6.5 | 2025-02-19 | An issue in Bento4 v1.6.0-641 allows an attacker to obtain sensitive information via the the Mp4Fragment.cpp and in AP4_DescriptorFactory::CreateDescriptorFrom… |
CVE-2025-25942 | Medium | 6.5 | 2025-02-19 | An issue in Bento4 v1.6.0-641 allows an attacker to obtain sensitive information via the the mp4fragment tool when processing invalid files. Specifically, memo… |
CVE-2020-13481 | Medium | 6.1 | 2025-02-19 | Certain Lexmark products through 2020-05-25 allow XSS which allows an attacker to obtain session credentials and other sensitive information. |
CVE-2025-20158 | Medium | 4.4 | 2025-02-19 | A vulnerability in the debug shell of Cisco Video Phone 8875 and Cisco Desk Phone 9800 Series could allow an authenticated, local attacker to access sensitive… |
CVE-2025-25468 | Medium | 6.5 | 2025-02-18 | FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/mem.c. |
CVE-2025-26604 | High | 8.3 | 2025-02-18 | Discord-Bot-Framework-Kernel is a Discord bot framework built with interactions.py, featuring modular extension management and secure execution. Because of the… |
CVE-2024-13622 | High | 7.5 | 2025-02-18 | The File Uploads Addon for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1 via the… |
CVE-2024-13609 | Medium | 5.9 | 2025-02-18 | The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up t… |
CVE-2024-13525 | Medium | 6.5 | 2025-02-15 | The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9… |
CVE-2024-13641 | Medium | 5.9 | 2025-02-14 | The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPress is vulnerable to… |
CVE-2025-22961 | High | 8.0 | 2025-02-13 | A critical information disclosure vulnerability exists in the web-based management interface of GatesAir Maxiva UAXT, VAXT transmitters due to Incorrect Access… |
CVE-2025-22960 | High | 8.0 | 2025-02-13 | A session hijacking vulnerability exists in the web-based management interface of GatesAir Maxiva UAXT, VAXT transmitters. Unauthenticated attackers can access… |
CVE-2025-25281 | High | 7.5 | 2025-02-13 | An attacker may modify the URL to discover sensitive information about the target network. |
CVE-2025-25195 | Medium | 4.3 | 2025-02-13 | Zulip is an open source team chat application. A weekly cron job (added in 50256f48314250978f521ef439cafa704e056539) demotes channels to being "inactive" after… |
CVE-2024-13606 | High | 7.5 | 2025-02-13 | The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and incl… |
CVE-2024-51123 | High | 7.5 | 2025-02-12 | An issue in Zertificon Z1 SecureMail Z1 SecureMail Gateway 4.44.2-7240-debian12 allows a remote attacker to obtain sensitive information via the /compose-pdf.x… |
CVE-2024-23563 | Low | 3.9 | 2025-02-12 | HCL Connections Docs is vulnerable to a sensitive information disclosure which could allow a user to obtain sensitive information they are not entitled to, cau… |
CVE-2024-13600 | High | 7.5 | 2025-02-12 | The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all version… |
CVE-2024-44336 | Medium | 5.3 | 2025-02-11 | An issue in AnkiDroid Android Application v2.17.6 allows attackers to retrieve internal files from the /data/data/com.ichi2.anki/ directory and save it into pu… |
CVE-2024-32037 | Unrated | | 2025-02-11 | GeoNetwork is a catalog application to manage spatially referenced resources. In versions prior to 4.2.10 and 4.4.5, the search end-point response headers cont… |
CVE-2025-24408 | Medium | 6.5 | 2025-02-11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Information Exposure vulnerability that could resu… |
CVE-2024-52966 | Low | 2.3 | 2025-02-11 | An exposure of sensitive information to an unauthorized actor in Fortinet FortiAnalyzer 6.4.0 through 7.6.0 allows attacker to cause information disclosure via… |
CVE-2025-0525 | High | 7.5 | 2025-02-11 | In affected versions of Octopus Server the preview import feature could be leveraged to identify the existence of a target file. This could provide an adversar… |
CVE-2024-46437 | Medium | 6.5 | 2025-02-10 | A sensitive information disclosure vulnerability in the Tenda W18E V16.01.0.8(1625) web management portal allows an unauthenticated remote attacker to retrieve… |
CVE-2025-1115 | Low | 3.3 | 2025-02-08 | A vulnerability classified as problematic was found in RT-Thread up to 5.1.0. Affected by this vulnerability is the function sys_device_close/sys_device_contro… |
CVE-2024-55272 | High | 7.5 | 2025-02-07 | An issue in Brainasoft Braina v2.8 allows a remote attacker to obtain sensitive information via the chat window function. |
CVE-2024-43779 | High | 7.7 | 2025-02-06 | An information disclosure vulnerability exists in the Vault API functionality of ClearML Enterprise Server 3.22.5-1533. A specially crafted HTTP request can le… |
CVE-2025-20207 | Medium | 4.3 | 2025-02-05 | A vulnerability in Simple Network Management Protocol (SNMP) polling for Cisco Secure Email and Web Manager, Cisco Secure Email Gateway, and Cisco Secure Web A… |
CVE-2024-13829 | Medium | 5.3 | 2025-02-05 | The WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto plugin for WordPress is vulnerable to Sensitive Information Exposure in all… |
CVE-2024-56197 | Low | 2.2 | 2025-02-04 | Discourse is an open source platform for community discussion. PM titles and metadata can be read by other users when the "PM tags allowed for groups" option i… |
CVE-2025-24373 | Medium | 6.5 | 2025-02-04 | woocommerce-pdf-invoices-packing-slips is an extension which allows users to create, print & automatically email PDF invoices & packing slips for WooCommerce o… |
CVE-2025-24899 | High | 7.5 | 2025-02-03 | reNgine is an automated reconnaissance framework for web applications. A vulnerability was discovered in reNgine, where **an insider attacker with any role** (… |
CVE-2025-22918 | High | 7.5 | 2025-02-03 | Polycom RealPresence Group 500 <=20 has Insecure Permissions due to automatically loaded cookies. This allows for the use of administrator functions, resulting… |
CVE-2024-56902 | High | 7.5 | 2025-02-03 | Information disclosure vulnerability in Geovision GV-ASManager web application with the version v6.1.0.0 or less, which discloses account information, includin… |
CVE-2024-34897 | High | 7.5 | 2025-02-03 | Nedis SmartLife android app v1.4.0 was discovered to contain an API key disclosure vulnerability. |
CVE-2025-23215 | | 2025-01-31 | PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in jar published to Mave… | |
CVE-2024-11741 | Medium | 4.3 | 2025-01-31 | Grafana is an open-source platform for monitoring and observability. The Grafana Alerting VictorOps integration was not properly protected and could be expose… |
CVE-2024-13623 | Medium | 5.9 | 2025-01-31 | The Order Export for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.24 via the 'uploa… |
CVE-2024-23962 | Medium | 5.3 | 2025-01-31 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Alpine Halo9 devices. Authentication is not required… |
CVE-2024-23937 | Medium | 4.3 | 2025-01-31 | This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Silicon Labs Gecko OS. Authentication is no… |
CVE-2025-24886 | High | 7.7 | 2025-01-30 | pwn.college is an education platform to learn about, and practice, core cybersecurity concepts in a hands-on fashion. Incorrect symlink checks on user specifie… |
CVE-2025-23216 | Medium | 6.8 | 2025-01-30 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was discovered in Argo CD that exposed secret values in error message… |
CVE-2024-8494 | Medium | 4.3 | 2025-01-30 | The Elementor Website Builder Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.25.10 via the 'e… |
CVE-2025-24884 | | 2025-01-29 | kube-audit-rest is a simple logger of mutation/creation requests to the k8s api. If the "full-elastic-stack" example vector configuration was used for a real c… | |
CVE-2024-48310 | High | 7.5 | 2025-01-28 | AutoLib Software Systems OPAC v20.10 was discovered to have multiple API keys exposed within the source code. Attackers may use these keys to access the backen… |
CVE-2025-23212 | High | 7.7 | 2025-01-28 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The external storage feature allows any user to enumerate… |
CVE-2025-0659 | | 2025-01-28 | A path traversal vulnerability exists in the Rockwell Automation DataEdge Platform DataMosaix Private Cloud. By specifying the character sequence in the body o… | |
CVE-2025-24174 | High | 7.7 | 2025-01-27 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to bypas… |
CVE-2025-24146 | Critical | 9.8 | 2025-01-27 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3… |
CVE-2025-24138 | Medium | 5.5 | 2025-01-27 | This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. A malicious a… |
CVE-2025-24134 | Medium | 5.5 | 2025-01-27 | An information disclosure issue was addressed with improved privacy controls. This issue is fixed in macOS Sequoia 15.3. An app may be able to access user-sens… |
CVE-2025-24109 | Medium | 5.5 | 2025-01-27 | A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3… |
CVE-2025-24102 | Critical | 9.8 | 2025-01-27 | The issue was addressed with improved checks. This issue is fixed in iPadOS 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may b… |
CVE-2024-54550 | Medium | 4.0 | 2025-01-27 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2. An app may be a… |
CVE-2024-54547 | Medium | 5.5 | 2025-01-27 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be able to acces… |
CVE-2024-54475 | Low | 3.3 | 2025-01-27 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventu… |
CVE-2024-11090 | Medium | 5.3 | 2025-01-26 | The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.13 via… |
CVE-2024-13562 | High | 7.5 | 2025-01-25 | The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, an… |
CVE-2025-24360 | Medium | 5.3 | 2025-01-25 | Nuxt is an open-source web development framework for Vue.js. Starting in version 3.8.1 and prior to version 3.15.3, Nuxt allows any websites to send any reques… |
CVE-2025-24363 | Medium | 4.2 | 2025-01-24 | The HL7 FHIR IG publisher is a tool to take a set of inputs and create a standard FHIR IG. Prior to version 1.8.9, in CI contexts, the IG Publisher CLI uses gi… |
CVE-2025-22612 | Critical | 10.0 | 2025-01-24 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.374, the missing authorization… |
CVE-2025-22607 | Medium | 5.5 | 2025-01-24 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization… |
CVE-2024-52975 | Critical | 9.0 | 2025-01-23 | An issue was identified in Fleet Server where Fleet policies that could contain sensitive information were logged on INFO and ERROR log levels. The nature of t… |
CVE-2024-43707 | High | 7.7 | 2025-01-23 | An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of… |
CVE-2025-23047 | Medium | 6.5 | 2025-01-22 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An insecure default `Access-Control-Allow-Origin` header value could… |
CVE-2024-49734 | High | 7.5 | 2025-01-21 | In multiple functions of ConnectivityService.java, there is a possible way for a Wi-Fi AP to determine what site a device has connected to through a VPN due to… |
CVE-2024-49733 | Medium | 5.5 | 2025-01-21 | In reload of ServiceListing.java , there is a possible way to allow a malicious app to hide an NLS from Settings due to a logic error in the code. This could l… |
CVE-2023-40108 | Medium | 5.5 | 2025-01-21 | In multiple locations, there is a possible way to access media content belonging to another user due to a missing permission check. This could lead to local in… |
CVE-2025-24011 | Medium | 5.3 | 2025-01-21 | Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, it's possible to determin… |
CVE-2025-0318 | Medium | 5.3 | 2025-01-18 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Inform… |
CVE-2018-9384 | Medium | 4.4 | 2025-01-17 | In multiple locations, there is a possible way to bypass KASLR due to an unusual root cause. This could lead to local information disclosure with System execut… |
CVE-2018-9379 | Medium | 5.5 | 2025-01-17 | In multiple functions of MiniThumbFile.java, there is a possible way to view the thumbnails of deleted photos due to a confused deputy. This could lead to loca… |
CVE-2024-12142 | High | 8.6 | 2025-01-17 | CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause information disclosure of restricted web page, modifi… |
CVE-2024-12637 | Medium | 5.3 | 2025-01-17 | The Moving Users plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.05 via the export functionality… |
CVE-2024-56136 | Medium | 5.3 | 2025-01-16 | Zulip server provides an open-source team chat that helps teams stay productive and focused. Zulip Server 7.0 and above are vulnerable to an information disclo… |
CVE-2025-0472 | High | 7.5 | 2025-01-16 | Information exposure in the PMB platform affecting versions 4.2.13 and earlier. This vulnerability allows an attacker to upload a file to the environment and e… |
CVE-2024-48125 | High | 7.5 | 2025-01-15 | An issue in the AsDB service of HI-SCAN 6040i Hitrax HX-03-19-I allows attackers to enumerate user credentials via crafted GIOP protocol requests. |
CVE-2025-0481 | Medium | 5.3 | 2025-01-15 | A vulnerability classified as problematic has been found in D-Link DIR-878 1.03. Affected is an unknown function of the file /dllog.cgi of the component HTTP P… |
CVE-2025-0441 | Medium | 6.5 | 2025-01-15 | Inappropriate implementation in Fenced Frames in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to obtain potentially sensitive information fro… |
CVE-2025-23074 | Low | 2.4 | 2025-01-14 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - SocialProfile Extension allows Functionality Misus… |
CVE-2025-23073 | Low | 3.5 | 2025-01-14 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - GlobalBlocking Extension allows Retrieve Embedded… |
CVE-2024-50338 | High | 7.4 | 2025-01-14 | Git Credential Manager (GCM) is a secure Git credential helper built on .NET that runs on Windows, macOS, and Linux. The Git credential protocol is text-based… |
CVE-2025-21308 | Medium | 6.5 | 2025-01-14 | Windows Themes Spoofing Vulnerability |
CVE-2025-21242 | Medium | 5.9 | 2025-01-14 | Windows Kerberos Information Disclosure Vulnerability |
CVE-2025-21214 | Medium | 4.2 | 2025-01-14 | Windows BitLocker Information Disclosure Vulnerability |
CVE-2024-12008 | Medium | 5.3 | 2025-01-14 | The W3 Total Cache plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.8.1 through the publicly exposed debug lo… |
CVE-2025-22138 | | 2025-01-13 | @codidact/qpixel is a Q&A-based community knowledge-sharing software. In affected versions when a category is set to private or limited-visibility within QPixe… | |
CVE-2025-22828 | Medium | 4.3 | 2025-01-13 | CloudStack users can add and read comments (annotations) on resources they are authorised to access. Due to an access validation issue that affects Apache Cl… |
CVE-2025-0403 | Medium | 5.3 | 2025-01-13 | A vulnerability, which was classified as problematic, has been found in 1902756969 reggie 1.0. Affected by this issue is some unknown functionality of the file… |
CVE-2024-42179 | Low | 2.0 | 2025-01-12 | HCL MyXalytics is affected by sensitive information disclosure vulnerability. The HTTP response header exposes the Microsoft-HTTP API∕2.0 as the server's name… |