CWE-200 · Information Disclosure (page 25)
Page 25 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-6550 | Medium | 5.3 | 2024-07-10 | The Gravity Forms: Multiple Form Instances plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.1.1. This is due… |
CVE-2024-32670 | | 2024-07-10 | Exposure of Sensitive Information to an Unauthorized Actor in Samsung Galaxy SmartTag2 prior to 0.20.04 allows attackes to potentially identify the tag's locat… | |
CVE-2024-38970 | Medium | 4.9 | 2024-07-09 | vaeThink 1.0.2 is vulnerable to Information Disclosure via the system backend,access management administrator function. |
CVE-2024-27362 | Medium | 4.4 | 2024-07-09 | A vulnerability was discovered in Samsung Mobile Processors Exynos 1280, Exynos 2200, Exynos 1330, Exynos 1380, and Exynos 2400 where they do not properly chec… |
CVE-2024-38041 | Medium | 5.5 | 2024-07-09 | Windows Kernel Information Disclosure Vulnerability |
CVE-2024-38030 | Medium | 6.5 | 2024-07-09 | Windows Themes Spoofing Vulnerability |
CVE-2024-38020 | Medium | 6.5 | 2024-07-09 | Microsoft Outlook Spoofing Vulnerability |
CVE-2024-38017 | Medium | 5.5 | 2024-07-09 | Microsoft Message Queuing Information Disclosure Vulnerability |
CVE-2024-30081 | High | 7.1 | 2024-07-09 | Windows NTLM Spoofing Vulnerability |
CVE-2024-6612 | Medium | 5.3 | 2024-07-09 | CSP violations generated links in the console tab of the developer tools, pointing to the violating resource. This caused a DNS prefetch which leaked that a CS… |
CVE-2023-52238 | Medium | 4.3 | 2024-07-09 | A vulnerability has been identified in RUGGEDCOM RST2228 (All versions < V5.9.0), RUGGEDCOM RST2228P (All versions < V5.9.0). The web server of the affected sy… |
CVE-2023-52237 | High | 7.5 | 2024-07-09 | A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RU… |
CVE-2024-3228 | Medium | 5.3 | 2024-07-09 | The Social Sharing Plugin – Kiwi plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.1.7 via the 'kiwi-nw-pinter… |
CVE-2024-39600 | Medium | 5.0 | 2024-07-09 | Under certain conditions, the memory of SAP GUI for Windows contains the password used to log on to an SAP system, which might allow an attacker to get hold of… |
CVE-2024-37180 | Medium | 4.1 | 2024-07-09 | Under certain conditions SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to access remote-enabled function module with no furthe… |
CVE-2024-39593 | Medium | 6.9 | 2024-07-09 | SAP Landscape Management allows an authenticated user to read confidential data disclosed by the REST Provider Definition response. Successful exploitation can… |
CVE-2024-39896 | High | 7.5 | 2024-07-08 | Directus is a real-time API and App dashboard for managing SQL database content. When relying on SSO providers in combination with local authentication it can… |
CVE-2024-23562 | Medium | 5.3 | 2024-07-08 | A security vulnerability in HCL Domino could allow disclosure of sensitive configuration information. A remote unauthenticated attacker could exploit this vul… |
CVE-2024-40597 | High | 7.5 | 2024-07-07 | An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. It can expose suppressed information for log events. (The log_deleted attribut… |
CVE-2024-39182 | High | 7.5 | 2024-07-05 | An information disclosure vulnerability in ISPmanager v6.98.0 allows attackers to access sensitive details of the root user's session via an arbitrary command… |
CVE-2024-39210 | High | 7.5 | 2024-07-05 | Best House Rental Management System v1.0 was discovered to contain an arbitrary file read vulnerability via the Page parameter at index.php. This vulnerability… |
CVE-2024-6506 | High | 8.2 | 2024-07-04 | Information exposure vulnerability in the MRW plugin, in its 5.4.3 version, affecting the "mrw_log" functionality. This vulnerability could allow a remote atta… |
CVE-2024-32754 | Low | 3.1 | 2024-07-04 | Under certain circumstances, when the controller is in factory reset mode waiting for initial setup, it will broadcast its MAC address, serial number, and firm… |
CVE-2024-39683 | Medium | 5.7 | 2024-07-03 | ZITADEL is an open-source identity infrastructure tool. ZITADEL provides users the ability to list all user sessions of the current user agent (browser). Start… |
CVE-2024-36122 | Low | 2.4 | 2024-07-03 | Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branche… |
CVE-2024-6426 | High | 8.1 | 2024-07-03 | Information exposure vulnerability in MESbook 20221021.03 version, the exploitation of which could allow a local attacker, with user privileges, to access diff… |
CVE-2024-39807 | Low | 3.1 | 2024-07-03 | Mattermost versions 9.5.x <= 9.5.5 and 9.8.0 fail to properly sanitize the recipients of a webhook event which allows an attacker monitoring webhook events to… |
CVE-2024-39353 | Low | 2.7 | 2024-07-03 | Mattermost versions 9.5.x <= 9.5.5 and 9.8.0 fail to sanitize the RemoteClusterFrame payloads before audit logging them which allows a high privileged attacker… |
CVE-2024-39314 | Medium | 4.7 | 2024-07-01 | toy-blog is a headless content management system implementation. Starting in version 0.4.3 and prior to version 0.5.0, the administrative password was leaked t… |
CVE-2024-39313 | Medium | 6.5 | 2024-07-01 | toy-blog is a headless content management system implementation. Starting in version 0.5.4 and prior to version 0.6.1, articles with private visibility can be… |
CVE-2024-36986 | Medium | 6.3 | 2024-07-01 | In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, an authenticated user coul… |
CVE-2024-34696 | Medium | 4.5 | 2024-07-01 | GeoServer is an open source server that allows users to share and edit geospatial data. Starting in version 2.10.0 and prior to versions 2.24.4 and 2.25.1, Geo… |
CVE-2024-30135 | Low | 3.3 | 2024-06-28 | HCL DRYiCE AEX is potentially impacted by disclosure of sensitive information in the mobile application when a snapshot is taken. |
CVE-2024-2795 | Medium | 5.3 | 2024-06-28 | The SEO SIMPLE PACK plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.2.1 via META description. This makes it… |
CVE-2024-22260 | Medium | 6.8 | 2024-06-27 | VMware Workspace One UEM update addresses an information exposure vulnerability. A malicious actor with network access to the Workspace One UEM may be able t… |
CVE-2024-36829 | High | 7.5 | 2024-06-26 | Incorrect access control in Teldat M1 v11.00.05.50.01 allows attackers to obtain sensitive information via a crafted query string. |
CVE-2024-5010 | High | 7.5 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, a vulnerability exists in the TestController functionality. A specially crafted unauthenticated HTTP req… |
CVE-2024-6294 | Low | 3.9 | 2024-06-25 | udn News Android APP stores the user session in logcat file when user log into the APP. A malicious APP or an attacker with physical access to the Android devi… |
CVE-2024-34991 | High | 7.5 | 2024-06-24 | In the module "Axepta" (axepta) before 1.3.4 from Quadra Informatique for PrestaShop, a guest can download partial credit card information (expiry date) / post… |
CVE-2024-33881 | Medium | 5.3 | 2024-06-24 | An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. The Virto.SharePoint.FileDownloader/Api/Download.ashx isCompleted… |
CVE-2024-33880 | Medium | 5.3 | 2024-06-24 | An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. It discloses full pathnames via Virto.SharePoint.FileDownloader/A… |
CVE-2024-5059 | Medium | 5.3 | 2024-06-21 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in A WP Life Event Management Tickets Booking.This issue affects Event Management Tick… |
CVE-2024-35776 | Medium | 5.3 | 2024-06-21 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Exeebit phpinfo() WP.This issue affects phpinfo() WP: from n/a through 5.0. |
CVE-2024-22002 | High | 7.8 | 2024-06-18 | CORSAIR iCUE 5.9.105 with iCUE Murals on Windows allows unprivileged users to insert DLL files in the cuepkg-1.2.6 subdirectory of the installation directory. |
CVE-2024-21685 | Medium | 6.5 | 2024-06-18 | This High severity Information Disclosure vulnerability was introduced in versions 9.4.0, 9.12.0, and 9.15.0 of Jira Core Data Center. This Information D… |
CVE-2024-37895 | Medium | 5.7 | 2024-06-17 | Lobe Chat is an open-source LLMs/AI chat framework. In affected versions if an attacker can successfully authenticate through SSO/Access Code, they can obtain… |
CVE-2024-38467 | High | 7.5 | 2024-06-16 | Shenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized user information retrieval via the queryUser API. |
CVE-2024-5464 | Medium | 4.0 | 2024-06-14 | Vulnerability of insufficient permission verification in the NearLink module Impact: Successful exploitation of this vulnerability may affect service confident… |
CVE-2024-0093 | Medium | 6.5 | 2024-06-13 | NVIDIA GPU software for Linux contains a vulnerability where it can expose sensitive information to an actor that is not explicitly authorized to have access t… |
CVE-2024-37307 | High | 7.9 | 2024-06-13 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.13.0 and prior to versions 1.13.7, 1.14.12, an… |
CVE-2024-30472 | High | 7.5 | 2024-06-13 | Telemetry Dashboard v1.0.0.8 for Dell ThinOS 2402 contains a sensitive information disclosure vulnerability. An unauthenticated user with local access to the d… |
CVE-2024-30300 | Critical | 9.8 | 2024-06-13 | Adobe Framemaker Publishing Server versions 2020.3, 2022.2 and earlier are affected by an Information Exposure vulnerability (CWE-200) that could lead to privi… |
CVE-2024-37325 | High | 8.1 | 2024-06-11 | Azure Science Virtual Machine (DSVM) Elevation of Privilege Vulnerability |
CVE-2024-35263 | Medium | 5.7 | 2024-06-11 | Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability |
CVE-2024-30096 | Medium | 5.5 | 2024-06-11 | Windows Cryptographic Services Information Disclosure Vulnerability |
CVE-2024-5813 | Medium | 5.9 | 2024-06-11 | A medium severity vulnerability in BIPS has been identified where an authenticated attacker with high privileges can access the SSH private keys via an informa… |
CVE-2024-4266 | Medium | 5.3 | 2024-06-11 | The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions… |
CVE-2020-11843 | Medium | 6.5 | 2024-06-11 | This allows the information exposure to unauthorized users. This issue affects NetIQ Access Manager using version 4.5 or before |
CVE-2024-34684 | Low | 3.7 | 2024-06-11 | On Unix, SAP BusinessObjects Business Intelligence Platform (Scheduling) allows an authenticated attacker with administrator access on the local server to acce… |
CVE-2024-28164 | Medium | 5.3 | 2024-06-11 | SAP NetWeaver AS Java (CAF - Guided Procedures) allows an unauthenticated user to access non-sensitive information about the server which would otherwise be re… |
CVE-2024-36471 | High | 7.5 | 2024-06-10 | Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL. Project administrators can run these imports, whic… |
CVE-2024-36307 | Medium | 4.7 | 2024-06-10 | A security agent link following vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to disclose sensitive information… |
CVE-2024-27814 | Low | 2.4 | 2024-06-10 | This issue was addressed through improved state management. This issue is fixed in watchOS 10.5. A person with physical access to a device may be able to view… |
CVE-2024-27806 | Medium | 5.5 | 2024-06-10 | This issue was addressed with improved environment sanitization. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey… |
CVE-2022-32933 | Medium | 5.3 | 2024-06-10 | An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in macOS Monterey 12.5. A website may be able to track the w… |
CVE-2024-35691 | Medium | 6.5 | 2024-06-08 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Marketing Fire, LLC Widget Options - Extended.This issue affects Widget Options - E… |
CVE-2024-35682 | Medium | 4.3 | 2024-06-08 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Themeisle Otter Blocks PRO.This issue affects Otter Blocks PRO: from n/a through 2… |
CVE-2024-35710 | Medium | 5.3 | 2024-06-08 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Podlove Podlove Web Player.This issue affects Podlove Web Player: from n/a through… |
CVE-2024-5133 | High | 8.1 | 2024-06-06 | In lunary-ai/lunary version 1.2.4, an account takeover vulnerability exists due to the exposure of password recovery tokens in API responses. Specifically, whe… |
CVE-2024-37150 | High | 7.6 | 2024-06-06 | An issue in `.npmrc` support in Deno 1.44.0 was discovered where Deno would send `.npmrc` credentials for the scope to the tarball URL when the registry provid… |
CVE-2024-35178 | High | 7.5 | 2024-06-06 | The Jupyter Server provides the backend for Jupyter web applications. Jupyter Server on Windows has a vulnerability that lets unauthenticated attackers leak th… |
CVE-2024-5615 | Medium | 5.3 | 2024-06-06 | The Open Graph plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.11.2 via the 'opengraph_default_des… |
CVE-2024-0910 | Medium | 5.3 | 2024-06-06 | The Restrict for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.7 due to improper res… |
CVE-2024-3716 | Medium | 6.2 | 2024-06-05 | A flaw was found in foreman-installer when puppet-candlepin is invoked cpdb with the --password parameter. This issue leaks the password in the process list an… |
CVE-2024-5483 | Medium | 5.3 | 2024-06-05 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.6.8 due to… |
CVE-2024-36121 | Medium | 5.9 | 2024-06-04 | netty-incubator-codec-ohttp is the OHTTP implementation for netty. BoringSSLAEADContext keeps track of how many OHTTP responses have been sent and uses this s… |
CVE-2024-4220 | Medium | 4.3 | 2024-06-04 | Prior to 23.1, an information disclosure vulnerability exists within BeyondInsight which can allow an attacker to enumerate usernames. |
CVE-2023-52147 | Low | 3.7 | 2024-06-04 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in All In One WP Security & Firewall Team All In One WP Security & Firewall allows Acc… |
CVE-2023-49822 | Low | 3.7 | 2024-06-04 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in David Vongries Ultimate Dashboard allows Accessing Functionality Not Properly Const… |
CVE-2023-49774 | Medium | 5.3 | 2024-06-04 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus allows Accessing Functionality No… |
CVE-2023-49748 | Low | 3.7 | 2024-06-04 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPServeur, NicolasKulka, wpformation WPS Hide Login allows Accessing Functionality… |
CVE-2023-48335 | Low | 3.7 | 2024-06-04 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Webcraftic Hide login page allows Accessing Functionality Not Properly Constrained… |
CVE-2023-47818 | Low | 3.7 | 2024-06-04 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in LWS LWS Hide Login allows Accessing Functionality Not Properly Constrained by ACLs… |
CVE-2024-34754 | Medium | 5.3 | 2024-06-03 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in A WP Life Contact Form Widget.This issue affects Contact Form Widget: from n/a thro… |
CVE-2024-23107 | Medium | 5.5 | 2024-06-03 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiWeb version 7.4.0, version 7.2.4 and below, version 7.0.8 and bel… |
CVE-2024-34005 | Medium | 6.5 | 2024-05-31 | In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore database activit… |
CVE-2024-34004 | Medium | 6.5 | 2024-05-31 | In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore wiki modules and… |
CVE-2024-34003 | Medium | 5.9 | 2024-05-31 | In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore workshop modules… |
CVE-2024-34002 | Medium | 6.5 | 2024-05-31 | In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore feedback modules… |
CVE-2021-44534 | Medium | 6.5 | 2024-05-31 | Insufficient user input filtering leads to arbitrary file read by non-authenticated attacker, which results in sensitive information disclosure. |
CVE-2024-5524 | Medium | 5.3 | 2024-05-31 | Information exposure vulnerability in Astrotalks affecting version 10/03/2023. This vulnerability allows unregistered users to access all internal links of the… |
CVE-2024-35189 | Medium | 6.5 | 2024-05-30 | Fides is an open-source privacy engineering platform. The Fides webserver has a number of endpoints that retrieve `ConnectionConfiguration` records and their a… |
CVE-2024-36118 | Low | 3.5 | 2024-05-30 | MeterSphere is a test management and interface testing tool. In affected versions users without workspace permissions can view functional test cases of other w… |
CVE-2024-36955 | High | 7.7 | 2024-05-30 | In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node() The documentation f… |
CVE-2024-36910 | High | 8.4 | 2024-05-30 | In the Linux kernel, the following vulnerability has been resolved: uio_hv_generic: Don't free decrypted memory In CoCo VMs it is possible for the untrusted… |
CVE-2024-36107 | Medium | 5.3 | 2024-05-28 | MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. `If-Modified-Since` and `If-Unmodified-Since` headers when us… |
CVE-2024-24919 | High | 8.6 | 2024-05-28 | Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN… |
CVE-2024-35343 | Critical | 9.8 | 2024-05-28 | Certain Anpviz products allow unauthenticated users to download arbitrary files from the device's filesystem via a HTTP GET request to the /playback/ URI. This… |
CVE-2024-35341 | High | 7.5 | 2024-05-28 | Certain Anpviz products allow unauthenticated users to download the running configuration of the device via a HTTP GET request to /ConfigFile.ini or /config.xm… |
CVE-2024-34029 | Medium | 4.3 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1 and 8.1.x <= 8.1.12 fail to perform a proper authorization check in the /api/v4/groups/<group-id>/channels/<… |