CWE-200 · Information Disclosure (page 23)
Page 23 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-46979 | Medium | 5.3 | 2024-09-18 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to get access to notification filters of… |
CVE-2024-8969 | Medium | 6.5 | 2024-09-18 | OMFLOW from The SYSCOM Group has a vulnerability involving the exposure of sensitive data. This allows remote attackers who have logged into the system to obta… |
CVE-2024-45811 | Medium | 4.8 | 2024-09-17 | Vite a frontend build tooling framework for javascript. In affected versions the contents of arbitrary files can be returned to the browser. `@fs` denies acces… |
CVE-2024-44186 | Medium | 5.5 | 2024-09-17 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access protected user data. |
CVE-2024-44184 | Medium | 5.5 | 2024-09-17 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 15, macOS… |
CVE-2024-44182 | Medium | 5.5 | 2024-09-17 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An a… |
CVE-2024-44181 | Medium | 5.5 | 2024-09-17 | An issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An app may be… |
CVE-2024-44180 | Low | 2.4 | 2024-09-17 | The issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18. An attacker with physical access may be able to access contacts from… |
CVE-2024-44163 | Medium | 5.5 | 2024-09-17 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. A malicious application may be ab… |
CVE-2024-44158 | Medium | 5.5 | 2024-09-17 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 17.7 and iPadOS 17.7, macOS Sequoia 15, macOS Sonoma 14.7… |
CVE-2024-44152 | High | 7.5 | 2024-09-17 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15. An app may be able to access user-… |
CVE-2024-44139 | Low | 2.4 | 2024-09-17 | The issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18. An attacker with physical access may be able to access contacts from… |
CVE-2024-44129 | Medium | 5.5 | 2024-09-17 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15, macOS Ventura 13.7. An app may be able to leak sensitive user informatio… |
CVE-2024-40863 | Medium | 5.5 | 2024-09-17 | This issue was addressed with improved data protection. This issue is fixed in iOS 18 and iPadOS 18. An app may be able to leak sensitive user information. |
CVE-2024-40862 | Medium | 5.3 | 2024-09-17 | A privacy issue was addressed by removing sensitive data. This issue is fixed in Xcode 16. An attacker may be able to determine the Apple ID of the owner of th… |
CVE-2024-40850 | Medium | 5.5 | 2024-09-17 | A file access issue was addressed with improved input validation. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 15, macO… |
CVE-2024-40842 | Medium | 5.5 | 2024-09-17 | An issue was addressed with improved validation of environment variables. This issue is fixed in macOS Sequoia 15. An app may be able to access user-sensitive… |
CVE-2024-40838 | Low | 3.3 | 2024-09-17 | A privacy issue was addressed by moving sensitive data to a protected location. This issue is fixed in macOS Sequoia 15. A malicious app may be able to access… |
CVE-2024-45799 | High | 7.3 | 2024-09-16 | FluxCP is a web-based Control Panel for rAthena servers written in PHP. A javascript injection is possible via venders/buyers list pages and shop names, that a… |
CVE-2024-8780 | Medium | 6.5 | 2024-09-16 | OMFLOW from The SYSCOM Group does not properly restrict the query range of its data query functionality, allowing remote attackers with regular privileges to o… |
CVE-2024-8777 | High | 7.5 | 2024-09-16 | OMFLOW from The SYSCOM Group has an information leakage vulnerability, allowing unauthorized remote attackers to read arbitrary system configurations. If LDAP… |
CVE-2024-46938 | High | 7.5 | 2024-09-15 | An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release through 10.4 Initial Re… |
CVE-2024-39925 | Medium | 6.5 | 2024-09-13 | An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. It lacks an offboarding process for members who leave an organization. As a result, the… |
CVE-2024-44685 | Medium | 5.0 | 2024-09-13 | Titan SFTP and Titan MFT Server 2.0.25.2426 and earlier have a vulnerability a vulnerability where sensitive information, including passwords, is exposed in cl… |
CVE-2024-6544 | Medium | 5.3 | 2024-09-13 | The Custom Post Limits plugin for WordPress is vulnerable to full path disclosure in all versions up to, and including, 4.4.1. This is due to the plugin utiliz… |
CVE-2024-41629 | Medium | 5.5 | 2024-09-12 | An issue in Texas Instruments Fusion Digital Power Designer v.7.10.1 allows a local attacker to obtain sensitive information via the plaintext storage of crede… |
CVE-2024-45624 | High | 7.5 | 2024-09-12 | Exposure of sensitive information due to incompatible policies issue exists in Pgpool-II. If a database user accesses a query cache, table data unauthorized fo… |
CVE-2024-8097 | | 2024-09-11 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Payara Platform Payara Server (Logging modules) allows Sensitive credentials posted… | |
CVE-2024-27113 | Critical | 9.8 | 2024-09-11 | An unauthenticated Insecure Direct Object Reference (IDOR) to the database has been found in the SO Planning tool that occurs when the public view setting is e… |
CVE-2023-37232 | High | 7.5 | 2024-09-10 | Loftware Spectrum through 4.6 exposes Sensitive Information (Logs) to an Unauthorized Actor. |
CVE-2024-31490 | Medium | 4.3 | 2024-09-10 | An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6, For… |
CVE-2024-37991 | Medium | 5.3 | 2024-09-10 | A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions < V4.2), SIMATIC Reader RF610R ETSI (6GT2811-6BC10-0AA0)… |
CVE-2024-42019 | High | 8.0 | 2024-09-07 | A vulnerability that allows an attacker to access the NTLM hash of the Veeam Reporter Service service account. This attack requires user interaction and data c… |
CVE-2024-38650 | Critical | 9.9 | 2024-09-07 | An authentication bypass vulnerability can allow a low privileged attacker to access the NTLM hash of service account on the VSPC server. |
CVE-2024-8538 | Medium | 4.3 | 2024-09-07 | The Big File Uploads – Increase Maximum File Upload Size plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.1.2… |
CVE-2024-44408 | High | 7.5 | 2024-09-06 | D-Link DIR-823G v1.0.2B05_20181207 is vulnerable to Information Disclosure. The device allows unauthorized configuration file downloads, and the downloaded con… |
CVE-2024-45040 | Medium | 5.9 | 2024-09-06 | gnark is a fast zk-SNARK library that offers a high-level API to design circuits. Prior to version 0.11.0, commitments to private witnesses in Groth16 as imple… |
CVE-2024-45039 | Medium | 6.2 | 2024-09-06 | gnark is a fast zk-SNARK library that offers a high-level API to design circuits. Versions prior to 0.11.0 have a soundness issue - in case of multiple commitm… |
CVE-2024-7415 | Medium | 5.3 | 2024-09-06 | The Remember Me Controls plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0.1. This is due to the plugin allo… |
CVE-2024-8461 | Medium | 5.3 | 2024-09-05 | A vulnerability, which was classified as problematic, was found in D-Link DNS-320 2.02b01. This affects an unknown part of the file /cgi-bin/discovery.cgi of t… |
CVE-2024-8460 | Low | 3.7 | 2024-09-05 | A vulnerability, which was classified as problematic, has been found in D-Link DNS-320 2.02b01. Affected by this issue is some unknown functionality of the fil… |
CVE-2024-6835 | Medium | 5.3 | 2024-09-05 | The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 5.5.6 via the ajax_… |
CVE-2024-20503 | Medium | 5.5 | 2024-09-04 | A vulnerability in Cisco Duo Epic for Hyperdrive could allow an authenticated, local attacker to view sensitive information in cleartext on an affected system… |
CVE-2024-44820 | Medium | 6.1 | 2024-09-04 | A sensitive information disclosure vulnerability exists in ZZCMS v.2023 and before within the eginfo.php file located at /3/E_bak5.1/upload/. When accessed wit… |
CVE-2024-8106 | Medium | 6.5 | 2024-09-04 | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0… |
CVE-2024-45447 | Medium | 4.4 | 2024-09-04 | Access control vulnerability in the camera framework module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-45450 | Medium | 4.0 | 2024-09-04 | Permission control vulnerability in the software update module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-45391 | High | 7.5 | 2024-09-03 | Tina is an open-source content management system (CMS). Sites building with Tina CMS's command line interface (CLI) prior to version 1.6.2 that use a search to… |
CVE-2024-43803 | Medium | 4.9 | 2024-09-03 | The Bare Metal Operator (BMO) implements a Kubernetes API for managing bare metal hosts in Metal3. The `BareMetalHost` (BMH) CRD allows the `userData`, `metaDa… |
CVE-2024-45388 | High | 7.5 | 2024-09-02 | Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The `/api/v2/simulation` POST handler allows us… |
CVE-2024-43801 | Medium | 4.6 | 2024-09-02 | Jellyfin is an open source self hosted media server. The Jellyfin user profile image upload accepts SVG files, allowing for a stored XSS attack against an admi… |
CVE-2024-3679 | Medium | 5.3 | 2024-08-29 | The Premium SEO Pack – WP SEO Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.002. This m… |
CVE-2024-2541 | Medium | 5.3 | 2024-08-29 | The Popup Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.6 via the Subscribers Import f… |
CVE-2024-7418 | Medium | 4.3 | 2024-08-29 | The The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid plugin for WordPress is vulnerable to Sensitive Information Exposure in all v… |
CVE-2024-6551 | Medium | 5.3 | 2024-08-29 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.15.1… |
CVE-2024-45054 | Low | 2.8 | 2024-08-28 | Hwameistor is an HA local storage system for cloud-native stateful workloads. This ClusterRole has * verbs of * resources. If a malicious user can access the w… |
CVE-2024-45043 | Medium | 5.3 | 2024-08-28 | The OpenTelemetry Collector module AWS firehose receiver is for ingesting AWS Kinesis Data Firehose delivery stream messages and parsing the records received b… |
CVE-2021-22529 | Medium | 6.3 | 2024-08-28 | A vulnerability identified in NetIQ Advance Authentication that leaks sensitive server information. This issue affects NetIQ Advance Authentication version bef… |
CVE-2024-6448 | Medium | 5.3 | 2024-08-28 | The Mollie Payments for WooCommerce plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 7.7.0. This is due to the… |
CVE-2024-6633 | Critical | 9.8 | 2024-08-27 | The default credentials for the setup HSQL database (HSQLDB) for FileCatalyst Workflow are published in a vendor knowledgebase article. Misuse of these credent… |
CVE-2024-43258 | Medium | 5.3 | 2024-08-26 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Store Locator Plus.This issue affects Store Locator Plus: from n/a through 2311.17… |
CVE-2024-43257 | Medium | 6.5 | 2024-08-26 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Nouthemes Leopard - WordPress offload media.This issue affects Leopard - WordPress… |
CVE-2024-43251 | Medium | 6.5 | 2024-08-26 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Bit Apps Bit Form Pro.This issue affects Bit Form Pro: from n/a through 2.6.4. |
CVE-2024-43319 | Medium | 4.3 | 2024-08-26 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in bPlugins LLC Flash & HTML5 Video.This issue affects Flash & HTML5 Video: from n/a t… |
CVE-2024-43289 | High | 7.5 | 2024-08-26 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in gVectors Team wpForo Forum.This issue affects wpForo Forum: from n/a through 2.3.4. |
CVE-2023-48957 | Medium | 5.3 | 2024-08-25 | PureVPN Linux client 2.0.2-Productions fails to properly handle DNS queries, allowing them to bypass the VPN tunnel and be sent directly to the ISP or default… |
CVE-2024-42339 | Medium | 4.3 | 2024-08-25 | CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2024-42338 | Medium | 4.3 | 2024-08-25 | CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2024-42337 | Medium | 4.3 | 2024-08-25 | CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2024-6499 | Medium | 5.3 | 2024-08-24 | The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 9.7.8. This makes it po… |
CVE-2024-8072 | Medium | 5.3 | 2024-08-22 | Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users |
CVE-2024-39344 | High | 8.1 | 2024-08-21 | An issue was discovered in the Docusign API package 8.142.14 for Salesforce. The Apttus_DocuApi__DocusignAuthentication__mdt object is installed via the market… |
CVE-2022-26327 | | 2024-08-21 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in OpenText Performance Center on Windows allows Retrieve Embedded Sensitive Data.This… | |
CVE-2024-6568 | Medium | 5.3 | 2024-08-21 | The Flamix: Bitrix24 and Contact Form 7 integrations plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.1.0. Th… |
CVE-2024-5880 | Medium | 4.3 | 2024-08-21 | The Hide My Site plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 due to the plugin not restricti… |
CVE-2024-42006 | High | 7.5 | 2024-08-20 | Keyfactor AWS Orchestrator through 2.0 allows Information Disclosure. |
CVE-2024-41700 | High | 7.5 | 2024-08-20 | Barix – CWE-200 Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2024-41698 | Medium | 4.3 | 2024-08-20 | Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2024-7925 | Medium | 4.3 | 2024-08-19 | A vulnerability was found in ZZCMS 2023. It has been rated as problematic. This issue affects some unknown processing of the file 3/E_bak5.1/upload/eginfo.php… |
CVE-2024-42658 | Critical | 9.8 | 2024-08-19 | An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information via the cookie's parameter |
CVE-2024-42657 | High | 7.5 | 2024-08-19 | An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information via the lack of encryption during login… |
CVE-2024-42486 | Medium | 5.4 | 2024-08-16 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In versions on the 1.15.x branch prior to 1.15.8 and the 1.16.x bran… |
CVE-2024-7630 | Medium | 5.3 | 2024-08-16 | The Relevanssi – A Better Search plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.22.2 (Free) and 2.25.1 (Pre… |
CVE-2024-7843 | Medium | 5.3 | 2024-08-15 | A vulnerability, which was classified as problematic, was found in SourceCodester Online Graduate Tracer System 1.0. Affected is an unknown function of the fil… |
CVE-2024-7842 | Medium | 5.3 | 2024-08-15 | A vulnerability, which was classified as problematic, has been found in SourceCodester Online Graduate Tracer System 1.0. This issue affects some unknown proce… |
CVE-2024-27731 | Medium | 6.1 | 2024-08-15 | Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the lack of file type filtering in the f… |
CVE-2024-31799 | Medium | 4.6 | 2024-08-15 | Information Disclosure in GNCC's GC2 Indoor Security Camera 1080P allows an attacker with physical access to read the WiFi passphrase via the UART Debugging Po… |
CVE-2024-7411 | Medium | 5.3 | 2024-08-15 | The Newsletters plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 4.9.9. This is due the plugin not preventing d… |
CVE-2024-7063 | Medium | 4.3 | 2024-08-15 | The ElementsKit Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.6 via the 'render_raw' funct… |
CVE-2024-27120 | High | 7.5 | 2024-08-14 | A Local File Inclusion vulnerability has been found in ComfortKey, a product of Celsius Benelux. Using this vulnerability, an unauthenticated attacker may retr… |
CVE-2024-42435 | Medium | 4.9 | 2024-08-14 | Sensitive information disclosure in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information… |
CVE-2024-39822 | Medium | 6.5 | 2024-08-14 | Sensitive information exposure in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct an informatio… |
CVE-2024-41723 | Medium | 4.3 | 2024-08-14 | Undisclosed requests to BIG-IP iControl REST can lead to information leak of user account names. Note: Software versions which have reached End of Technical S… |
CVE-2024-38760 | Medium | 5.3 | 2024-08-13 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in David Maucher Send Users Email allows Accessing Functionality Not Properly Constrai… |
CVE-2024-38756 | Medium | 5.3 | 2024-08-13 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Weblizar Coming Soon allows Accessing Functionality Not Properly Constrained by ACL… |
CVE-2024-38749 | Medium | 5.3 | 2024-08-13 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Olive Themes Olive One Click Demo Import allows Accessing Functionality Not Properl… |
CVE-2024-38747 | High | 7.5 | 2024-08-13 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HitPay Payment Solutions Pte Ltd HitPay Payment Gateway for WooCommerce allows Acce… |
CVE-2024-38742 | Medium | 5.3 | 2024-08-13 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in MBE Worldwide S.P.A. MBE eShip allows Accessing Functionality Not Properly Constrai… |
CVE-2024-41736 | Medium | 4.3 | 2024-08-13 | Under certain conditions SAP Permit to Work allows an authenticated attacker to access information which would otherwise be restricted causing low impact on th… |
CVE-2024-41733 | Medium | 5.3 | 2024-08-13 | In SAP Commerce, valid user accounts can be identified during the customer registration and login processes. This allows a potential attacker to learn if a giv… |