CWE-200 · Information Disclosure (page 24)
Page 24 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-33003 | High | 7.4 | 2024-08-13 | Some OCC API endpoints in SAP Commerce Cloud allows Personally Identifiable Information (PII) data, such as passwords, email addresses, mobile numbers, coupon… |
CVE-2024-37924 | Medium | 5.3 | 2024-08-12 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wp2speed WP2Speed Faster allows Accessing Functionality Not Properly Constrained by… |
CVE-2024-7704 | Medium | 5.3 | 2024-08-12 | A vulnerability was found in Weaver e-cology 8. It has been classified as problematic. Affected is an unknown function of the file /cloudstore/ecode/setup/ecol… |
CVE-2024-7697 | High | 7.5 | 2024-08-12 | Logical vulnerability in the mobile application (com.transsion.carlcare) may lead to user information leakage risks. |
CVE-2024-7416 | Medium | 5.3 | 2024-08-12 | The Reveal Template plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.7. This is due to the plugin allowing di… |
CVE-2024-7414 | Medium | 5.3 | 2024-08-12 | The PDF Builder for WPForms plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.116. This is due to the plugin… |
CVE-2024-7413 | Medium | 5.3 | 2024-08-12 | The Obfuscate Email plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.8.1. This is due to the plugin allowing… |
CVE-2024-7412 | Medium | 5.3 | 2024-08-12 | The No Update Nag plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.4.12. This is due to the plugin allowing d… |
CVE-2024-7410 | Medium | 5.3 | 2024-08-12 | The My Custom CSS PHP & ADS plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.3. This is due the plugin not pr… |
CVE-2024-7382 | Medium | 5.3 | 2024-08-12 | The Linkify Text plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.9.1. This is due to the plugin utilizing bo… |
CVE-2024-6562 | Medium | 5.3 | 2024-08-12 | The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.5.5. This… |
CVE-2024-38200 | Medium | 6.5 | 2024-08-12 | Microsoft Office Spoofing Vulnerability |
CVE-2024-42493 | Medium | 5.3 | 2024-08-08 | Dorsett Controls InfoScan is vulnerable due to a leak of possible sensitive information through the response headers and the rendered JavaScript prior to use… |
CVE-2024-39287 | Medium | 5.3 | 2024-08-08 | Dorsett Controls Central Server update server has potential information leaks with an unprotected file that contains passwords and API keys. |
CVE-2024-7554 | Medium | 4.9 | 2024-08-08 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.9 before 17.0.6, all versions starting from 17.1 before 17.1.4, all versio… |
CVE-2024-6552 | Medium | 5.3 | 2024-08-08 | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2… |
CVE-2024-42222 | Medium | 4.3 | 2024-08-07 | In Apache CloudStack 4.19.1.0, a regression in the network listing API allows unauthorised list access of network details for domain admin and normal user acco… |
CVE-2024-34788 | Medium | 6.5 | 2024-08-07 | An improper authentication vulnerability in web component of EPMM prior to 12.1.0.1 allows a remote malicious user to access potentially sensitive information |
CVE-2024-42394 | Critical | 9.8 | 2024-08-06 | There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation coul… |
CVE-2024-39817 | Medium | 6.5 | 2024-08-06 | Insertion of sensitive information into sent data issue exists in Cybozu Office 10.0.0 to 10.8.6, which may allow a user who can login to the product to view d… |
CVE-2024-42010 | High | 7.5 | 2024-08-05 | mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messag… |
CVE-2024-7319 | Medium | 5.0 | 2024-08-02 | An incomplete fix for CVE-2023-1625 was found in openstack-heat. Sensitive information may possibly be disclosed through the OpenStack stack abandon command wi… |
CVE-2024-6567 | Medium | 5.3 | 2024-08-02 | The Ebook Store plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 5.8001. This is due to the plugin utilizing fp… |
CVE-2024-38761 | High | 7.5 | 2024-08-01 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from… |
CVE-2024-41259 | Critical | 9.1 | 2024-08-01 | Use of insecure hashing algorithm in the Gravatar's service in Navidrome v0.52.3 allows attackers to manipulate a user's account information. |
CVE-2024-41264 | High | 7.5 | 2024-08-01 | An issue discovered in casdoor v1.636.0 allows attackers to obtain sensitive information via the ssh.InsecureIgnoreHostKey() method. |
CVE-2024-7339 | Medium | 5.3 | 2024-08-01 | A vulnerability has been found in TVT DVR TD-2104TS-CL, DVR TD-2108TS-HP, Provision-ISR DVR SH-4050A5-5L(MM) and AVISION DVR AV108T and classified as problemat… |
CVE-2024-6687 | Medium | 5.3 | 2024-08-01 | The CTT Expresso para WooCommerce plugin for WordPress is vulnerable to sensitive information exposure in all versions up to and including 3.2.12 via the /wp-c… |
CVE-2024-7328 | Medium | 5.3 | 2024-07-31 | A vulnerability, which was classified as problematic, has been found in YouDianCMS 7. This issue affects some unknown processing of the file /t.php?action=phpi… |
CVE-2024-41108 | High | 7.5 | 2024-07-31 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. The hostinfo page has missing/improper access control since only the host's… |
CVE-2024-41109 | Medium | 6.3 | 2024-07-30 | Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Navigating to `/admin/index/statistics` with a logged in Pimcore user exposes inf… |
CVE-2024-41701 | Medium | 5.3 | 2024-07-30 | AccuPOS - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2024-41696 | High | 7.5 | 2024-07-30 | Priority PRI WEB Portal Add-On for Priority ERP on prem - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2024-41694 | Medium | 5.3 | 2024-07-30 | Cybonet - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2024-40836 | Medium | 5.5 | 2024-07-29 | A logic issue was addressed with improved checks. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, watchOS 10… |
CVE-2024-40823 | Medium | 5.5 | 2024-07-29 | The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. An app may be able to acce… |
CVE-2024-40804 | Medium | 5.5 | 2024-07-29 | The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.6. A malicious application may be able to access private information. |
CVE-2024-40798 | Low | 3.3 | 2024-07-29 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, macOS Monterey 12.7.6, macOS So… |
CVE-2024-40793 | Medium | 5.5 | 2024-07-29 | This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Monterey 12.7.6… |
CVE-2024-40775 | Medium | 5.5 | 2024-07-29 | A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6… |
CVE-2024-27884 | Medium | 5.5 | 2024-07-29 | This issue was addressed with a new entitlement. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. An… |
CVE-2023-42948 | Low | 3.3 | 2024-07-29 | This issue was addressed through improved state management. This issue is fixed in macOS Sonoma 14. A Wi-Fi password may not be deleted when activating a Mac i… |
CVE-2023-42925 | Low | 3.3 | 2024-07-29 | The issue was addressed with improved restriction of data container access. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to… |
CVE-2024-7156 | Medium | 5.3 | 2024-07-28 | A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513 and classified as problematic. Affected by this issue is some unknown functionality of the f… |
CVE-2024-42049 | Critical | 9.1 | 2024-07-28 | TightVNC (Server for Windows) before 2.8.84 allows attackers to connect to the control pipe via a network connection. |
CVE-2024-5614 | Medium | 5.3 | 2024-07-27 | The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.29 via the 'paf… |
CVE-2024-6569 | Medium | 5.3 | 2024-07-27 | The Campaign Monitor for WordPress plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.8.15. This is due the plu… |
CVE-2024-6573 | Medium | 5.3 | 2024-07-27 | The Intelligence plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.4.0. This is due the plugin not preventing… |
CVE-2024-6566 | Medium | 5.3 | 2024-07-27 | The Aramex Shipping WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.1.21. This is due the plugin… |
CVE-2024-6549 | Medium | 5.3 | 2024-07-27 | The Admin Post Navigation plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.1. This is due to the plugin utili… |
CVE-2024-6548 | Medium | 5.3 | 2024-07-27 | The Add Admin JavaScript plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0. This is due to the plugin utiliz… |
CVE-2024-6547 | Medium | 5.3 | 2024-07-27 | The Add Admin CSS plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0.1. This is due to the plugin utilizing… |
CVE-2024-6546 | Medium | 5.3 | 2024-07-27 | The One Click Close Comments plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.7.1. This is due to the plugin… |
CVE-2024-6545 | Medium | 5.3 | 2024-07-27 | The Admin Trim Interface plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.5.1. This is due to the plugin util… |
CVE-2024-7128 | Medium | 5.3 | 2024-07-26 | A flaw was found in the OpenShift console. Several endpoints in the application use the authHandler() and authHandlerWithUser() middleware functions. When the… |
CVE-2024-7091 | Medium | 4.1 | 2024-07-24 | An issue was discovered in GitLab CE/EE affecting all versions starting from 15.6 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and starting from 17.2 p… |
CVE-2024-7060 | Low | 2.6 | 2024-07-24 | An information disclosure vulnerability in GitLab CE/EE in project/group exports affecting all versions from 15.4 prior to 17.0.5, 17.1 prior to 17.1.3, and 17… |
CVE-2024-5067 | Medium | 4.4 | 2024-07-24 | An issue was discovered in GitLab EE affecting all versions starting from 16.11 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and starting from 17.2 pri… |
CVE-2024-41672 | High | 7.5 | 2024-07-24 | DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is accessible for reading using `sniff_csv`, even with `enable_e… |
CVE-2024-39676 | High | 7.5 | 2024-07-24 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Pinot. This issue affects Apache Pinot: from 0.1 before 1.0.0. Users are r… |
CVE-2024-6571 | Medium | 5.3 | 2024-07-24 | The Optimize Images ALT Text (alt tag) & names for SEO using AI plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including… |
CVE-2024-6553 | Medium | 5.3 | 2024-07-24 | The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.3.This is d… |
CVE-2024-23321 | High | 8.8 | 2024-07-22 | For RocketMQ versions 5.2.0 and below, under certain conditions, there is a risk of exposure of sensitive Information to an unauthorized actor even if RocketMQ… |
CVE-2024-6560 | Medium | 5.3 | 2024-07-20 | The Addonify – Quick View For WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.16. This is due… |
CVE-2024-6455 | Medium | 5.3 | 2024-07-18 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.2.0 due to a missing capabi… |
CVE-2024-40647 | Medium | 5.3 | 2024-07-18 | sentry-sdk is the official Python SDK for Sentry.io. A bug in Sentry's Python SDK < 2.8.0 allows the environment variables to be passed to subprocesses despite… |
CVE-2024-29885 | Medium | 4.3 | 2024-07-17 | silverstripe/reports is an API for creating backend reports in the Silverstripe Framework. In affected versions reports can be accessed by their direct URL by… |
CVE-2024-40633 | Medium | 5.3 | 2024-07-17 | Sylius is an Open Source eCommerce Framework on Symfony. A security vulnerability was discovered in the `/api/v2/shop/adjustments/{id}` endpoint, which retriev… |
CVE-2024-20396 | Medium | 5.3 | 2024-07-17 | A vulnerability in the protocol handlers of Cisco Webex App could allow an unauthenticated, remote attacker to gain access to sensitive information. This vu… |
CVE-2024-21152 | High | 8.1 | 2024-07-16 | Vulnerability in the Oracle Process Manufacturing Financials product of Oracle E-Business Suite (component: Allocation Rules). Supported versions that are aff… |
CVE-2024-21147 | High | 7.4 | 2024-07-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versi… |
CVE-2024-21140 | Medium | 4.8 | 2024-07-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versi… |
CVE-2024-21136 | High | 8.6 | 2024-07-16 | Vulnerability in the Oracle Retail Xstore Office product of Oracle Retail Applications (component: Security). Supported versions that are affected are 19.0.5… |
CVE-2024-6395 | Medium | 5.3 | 2024-07-16 | An exposure of sensitive information vulnerability in GitHub Enterprise Server would allow an attacker to enumerate the names of private repositories that util… |
CVE-2024-6336 | Medium | 5.3 | 2024-07-16 | A Security Misconfiguration vulnerability in GitHub Enterprise Server allowed sensitive information disclosure to unauthorized users in GitHub Enterprise Serve… |
CVE-2020-25836 | Medium | 6.3 | 2024-07-16 | Exposure of Sensitive Information to an Unauthorized Access vulnerability in OpenText NetIQ Directory and Resource Administrator. This issue affects NetIQ Dire… |
CVE-2022-45449 | Medium | 6.5 | 2024-07-16 | Sensitive information disclosure due to excessive privileges assigned to Acronis Agent. The following products are affected: Acronis Cyber Protect 15 (Windows… |
CVE-2024-6570 | Medium | 5.3 | 2024-07-16 | The Glossary plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.2.26. This is due the plugin utilizing wpdesk a… |
CVE-2024-6565 | Medium | 5.3 | 2024-07-16 | The AForms — Form Builder for Price Calculator & Cost Estimation plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and includin… |
CVE-2024-6559 | Medium | 5.3 | 2024-07-16 | The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and i… |
CVE-2024-6557 | Medium | 5.3 | 2024-07-16 | The SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher plugin for WordPress is vul… |
CVE-2024-39919 | Low | 3.1 | 2024-07-15 | @jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, o… |
CVE-2024-40554 | High | 7.5 | 2024-07-15 | An access control issue in Tmall_demo v2024.07.03 allows attackers to obtain sensitive information. |
CVE-2024-6398 | Medium | 4.3 | 2024-07-15 | An information disclosure vulnerability in SWG in versions 12.x prior to 12.2.10 and 11.x prior to 11.2.24 allows information stored in a customizable block pa… |
CVE-2024-6574 | Medium | 5.3 | 2024-07-13 | The Laposta plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.12. This is due to the plugin not preventing dir… |
CVE-2024-6555 | Medium | 5.3 | 2024-07-12 | The WP Popups – WordPress Popup builder plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.2.0.1. This is due t… |
CVE-2024-6407 | Critical | 9.8 | 2024-07-11 | CWE-200: Information Exposure vulnerability exists that could cause disclosure of credentials when a specially crafted message is sent to the device. |
CVE-2024-6554 | Medium | 5.3 | 2024-07-11 | The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and includin… |
CVE-2024-6210 | Medium | 5.3 | 2024-07-11 | The Duplicator plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 1.5.9. This makes it possible for unauthenticat… |
CVE-2024-27090 | Medium | 5.3 | 2024-07-10 | Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participati… |
CVE-2024-6646 | Medium | 5.3 | 2024-07-10 | A vulnerability was found in Netgear WN604 up to 20240710. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /… |
CVE-2024-37504 | Medium | 5.3 | 2024-07-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ninja Team FileBird Document Library.This issue affects FileBird Document Library… |
CVE-2024-37498 | Medium | 5.3 | 2024-07-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pauple Table & Contact Form 7 Database – Tablesome.This issue affects Table & Conta… |
CVE-2024-37115 | High | 7.5 | 2024-07-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Automattic Newspack Blocks.This issue affects Newspack Blocks: from n/a through 3.0… |
CVE-2024-37113 | Critical | 9.8 | 2024-07-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/… |
CVE-2024-37110 | High | 7.5 | 2024-07-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/… |
CVE-2024-6556 | Medium | 5.3 | 2024-07-10 | The SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and includi… |
CVE-2024-6550 | Medium | 5.3 | 2024-07-10 | The Gravity Forms: Multiple Form Instances plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.1.1. This is due… |
CVE-2024-32670 | | 2024-07-10 | Exposure of Sensitive Information to an Unauthorized Actor in Samsung Galaxy SmartTag2 prior to 0.20.04 allows attackes to potentially identify the tag's locat… | |
CVE-2024-38970 | Medium | 4.9 | 2024-07-09 | vaeThink 1.0.2 is vulnerable to Information Disclosure via the system backend,access management administrator function. |