CWE-200 · Information Disclosure (page 25)
Page 25 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-27736 | Medium | 5.5 | 2025-04-08 | Exposure of sensitive information to an unauthorized actor in Windows Power Dependency Coordinator allows an authorized attacker to disclose information locall… |
CVE-2025-26667 | Medium | 6.5 | 2025-04-08 | Exposure of sensitive information to an unauthorized actor in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose info… |
CVE-2025-2883 | Medium | 5.3 | 2025-04-08 | The Accept SagePay Payments Using Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0… |
CVE-2025-2882 | Medium | 5.3 | 2025-04-08 | The GreenPay(tm) by Green.Money plugin for WordPress is vulnerable to Sensitive Information Exposure in versions between 3.0.0 and 3.0.9 through the publicly a… |
CVE-2024-13820 | Medium | 5.3 | 2025-04-08 | The Melhor Envio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.15.11 via the 'run' function, whi… |
CVE-2025-3403 | Low | 2.7 | 2025-04-08 | A vulnerability was found in Vivotek NVR ND8422P, NVR ND9525P and NVR ND9541P 2.4.0.204/3.3.0.104/4.2.0.101. It has been classified as problematic. Affected is… |
CVE-2024-43046 | Medium | 5.5 | 2025-04-07 | There may be information disclosure during memory re-allocation in TZ Secure OS. |
CVE-2025-31492 | | 2025-04-06 | mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party… | |
CVE-2024-13604 | High | 7.5 | 2025-04-05 | The KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all v… |
CVE-2024-42208 | Low | 3.5 | 2025-04-04 | HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, cau… |
CVE-2025-31486 | Medium | 5.3 | 2025-04-03 | Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with s… |
CVE-2025-31127 | Medium | 5.3 | 2025-04-03 | Element X Android is a Matrix Android Client provided by element.io. In Element X Android versions between 0.4.16 and 25.03.3, the entity in control of the ele… |
CVE-2025-31126 | Medium | 5.3 | 2025-04-03 | Element X iOS is a Matrix iOS Client provided by Element. In Element X iOS version between 1.6.13 and 25.03.7, the entity in control of the element.json well-k… |
CVE-2025-30218 | Medium | 5.9 | 2025-04-02 | Next.js is a React framework for building full-stack web applications. To mitigate CVE-2025-29927, Next.js validated the x-middleware-subrequest-id which persi… |
CVE-2025-2842 | Medium | 4.3 | 2025-04-02 | A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Operator, the Operator… |
CVE-2025-2786 | Medium | 4.3 | 2025-04-02 | A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic… |
CVE-2003-20001 | Medium | 5.6 | 2025-04-01 | An issue was discovered on Mitel ICP VoIP 3100 devices. When a remote user attempts to log in via TELNET during the login wait time and an external call comes… |
CVE-2025-30224 | | 2025-04-01 | MyDumper is a MySQL Logical Backup Tool. The MySQL C client library (libmysqlclient) allows authenticated remote actors to read arbitrary files from client sys… | |
CVE-2025-3031 | Medium | 6.5 | 2025-04-01 | An attacker could read 32 bits of values spilled onto the stack in a JIT compiled function. This vulnerability was fixed in Firefox 137 and Thunderbird 137. |
CVE-2024-13567 | High | 7.5 | 2025-04-01 | The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inclu… |
CVE-2025-3059 | Medium | 5.3 | 2025-03-31 | Vulnerability in Drupal Profile Private.This issue affects Profile Private: *.*. |
CVE-2025-31191 | Medium | 5.5 | 2025-03-31 | This issue was addressed through improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ven… |
CVE-2025-31183 | Critical | 9.8 | 2025-03-31 | The issue was addressed with improved restriction of data container access. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 1… |
CVE-2025-30463 | Medium | 5.5 | 2025-03-31 | The issue was addressed with improved restriction of data container access. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. An app may be… |
CVE-2025-30455 | Medium | 5.5 | 2025-03-31 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5. A malicious app may be able to access private inf… |
CVE-2025-30454 | Medium | 5.5 | 2025-03-31 | A path handling issue was addressed with improved validation. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5, tvOS 18… |
CVE-2025-30451 | Medium | 5.5 | 2025-03-31 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.4. An app may be able to access sensitive us… |
CVE-2025-30447 | Medium | 5.5 | 2025-03-31 | The issue was resolved by sanitizing logging. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ve… |
CVE-2025-30443 | Medium | 5.5 | 2025-03-31 | A privacy issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.4, macOS Sequoia 15.5, macOS Sonoma 14.7.5, macOS Ventur… |
CVE-2025-30439 | Medium | 4.6 | 2025-03-31 | The issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4, watchOS 11.4. An attacker with… |
CVE-2025-30435 | Medium | 5.5 | 2025-03-31 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.4. A sandboxed app may be able to access sen… |
CVE-2025-30426 | Critical | 9.8 | 2025-03-31 | This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, tvOS 18.4, vis… |
CVE-2025-30424 | Critical | 9.8 | 2025-03-31 | A logging issue was addressed with improved data redaction. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. Deleting a co… |
CVE-2025-24283 | Medium | 5.5 | 2025-03-31 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4, watchOS 11.4. An… |
CVE-2025-24282 | Medium | 5.5 | 2025-03-31 | A library injection issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4. An app may be able to modify protected parts o… |
CVE-2025-24281 | Medium | 5.5 | 2025-03-31 | This issue was addressed with improved data protection. This issue is fixed in macOS Sequoia 15.4. An app may be able to access sensitive user data. |
CVE-2025-24280 | Medium | 5.5 | 2025-03-31 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to acces… |
CVE-2025-24279 | Medium | 4.3 | 2025-03-31 | This issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able… |
CVE-2025-24276 | Medium | 5.5 | 2025-03-31 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A malicious app… |
CVE-2025-24263 | Critical | 9.8 | 2025-03-31 | A privacy issue was addressed by moving sensitive data to a protected location. This issue is fixed in macOS Sequoia 15.4. An app may be able to observe unprot… |
CVE-2025-24262 | Medium | 5.5 | 2025-03-31 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.4. A sandboxed app may be able to a… |
CVE-2025-24261 | Medium | 5.5 | 2025-03-31 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to modif… |
CVE-2025-24253 | Critical | 9.8 | 2025-03-31 | This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may b… |
CVE-2025-24250 | Critical | 9.8 | 2025-03-31 | This issue was addressed with improved access restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A malicious a… |
CVE-2025-24246 | Critical | 9.8 | 2025-03-31 | An injection issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be… |
CVE-2025-24244 | Medium | 5.5 | 2025-03-31 | The issue was addressed with improved memory handling. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5… |
CVE-2025-24239 | Medium | 6.5 | 2025-03-31 | A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.4. An app may be able to access protected us… |
CVE-2025-24232 | Critical | 9.8 | 2025-03-31 | This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A malicious a… |
CVE-2025-24226 | Medium | 5.5 | 2025-03-31 | The issue was addressed with improved checks. This issue is fixed in Xcode 16.3. A malicious app may be able to access private information. |
CVE-2025-24217 | Medium | 5.5 | 2025-03-31 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, tvOS 18.4, watc… |
CVE-2025-24204 | Critical | 9.8 | 2025-03-31 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4. An app may be able to access protected user data. |
CVE-2025-24164 | Medium | 5.5 | 2025-03-31 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to m… |
CVE-2024-40864 | Low | 2.7 | 2025-03-31 | The issue was addressed with improved handling of protocols. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, macOS Sonoma 14.7.5, macOS Ve… |
CVE-2025-31124 | Medium | 5.3 | 2025-03-31 | Zitadel is open-source identity infrastructure software. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate a… |
CVE-2025-31125 | Medium | 5.3 | 2025-03-31 | Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposi… |
CVE-2025-2840 | Medium | 5.3 | 2025-03-29 | The DAP to Autoresponders Email Syncing plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0 through… |
CVE-2025-2860 | Medium | 5.3 | 2025-03-28 | SaTECH BCU in its firmware version 2.1.3, allows an authenticated attacker to access information about the credentials that users have within the web (.xml fil… |
CVE-2021-24008 | Medium | 5.3 | 2025-03-28 | An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiDDoS version 5.4.0, version 5.3.2 and below, vers… |
CVE-2025-2578 | Medium | 5.3 | 2025-03-28 | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including… |
CVE-2025-29497 | Medium | 6.5 | 2025-03-27 | libming v0.4.8 was discovered to contain a memory leak via the parseSWF_MORPHFILLSTYLES function. |
CVE-2025-29489 | Medium | 6.5 | 2025-03-27 | libming v0.4.8 was discovered to contain a memory leak via the parseSWF_MORPHLINESTYLES function. |
CVE-2025-29488 | Medium | 6.5 | 2025-03-27 | libming v0.4.8 was discovered to contain a memory leak via the parseSWF_INITACTION function. |
CVE-2025-29486 | Medium | 6.5 | 2025-03-27 | libming v0.4.8 was discovered to contain a memory leak via the parseSWF_PLACEOBJECT3 function. |
CVE-2025-20232 | Medium | 5.7 | 2025-03-26 | In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.3.2408.103, 9.2.2406.108, 9.2.2403.113, 9.1.2312.208 and… |
CVE-2025-20226 | Medium | 5.7 | 2025-03-26 | In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.111, and 9.1.2308.214, a low… |
CVE-2025-26009 | High | 7.5 | 2025-03-26 | Telesquare TLR-2005KSH 1.1.4 has an Information Disclosure vulnerability when requesting systemutilit.cgi. |
CVE-2025-26001 | High | 7.5 | 2025-03-26 | Telesquare TLR-2005KSH 1.1.4 is vulnerable to Information Disclosure via the parameter getUserNamePassword. |
CVE-2025-30353 | High | 8.6 | 2025-03-26 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.5.0, when a Flow with the "… |
CVE-2025-30352 | Medium | 5.3 | 2025-03-26 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0-alpha.4 and prior to version 11.5.0, the `search` qu… |
CVE-2025-23203 | Medium | 5.5 | 2025-03-26 | Icinga Director is an Icinga config deployment tool. A Security vulnerability has been found starting in version 1.0.0 and prior to 1.10.4 and 1.11.4 on severa… |
CVE-2025-2228 | Medium | 5.7 | 2025-03-26 | The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Sensitive Information Exposure… |
CVE-2025-30222 | | 2025-03-25 | Shescape is a simple shell escape library for JavaScript. Versions 1.7.2 through 2.1.1 are vulnerable to potential environment variable exposure on Windows wit… | |
CVE-2025-30214 | High | 7.5 | 2025-03-25 | Frappe is a full-stack web application framework. Prior to versions 14.89.0 and 15.51.0, making crafted requests could lead to information disclosure that coul… |
CVE-2025-2252 | Medium | 5.3 | 2025-03-25 | The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Sensitive Information Exposure in all version… |
CVE-2025-30208 | Medium | 5.3 | 2025-03-24 | Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to fil… |
CVE-2025-30474 | Medium | 5.0 | 2025-03-23 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS. The FtpFileObject class can throw an exception when a file is… |
CVE-2025-2331 | Medium | 5.3 | 2025-03-22 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including… |
CVE-2025-27785 | High | 7.5 | 2025-03-19 | Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file read in train.py's `export_index` function. This issue may… |
CVE-2025-27784 | High | 7.5 | 2025-03-19 | Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file read in train.py's `export_pth` function. This issue may le… |
CVE-2025-26485 | Medium | 5.8 | 2025-03-19 | A vulnerability in Beta80 Life 1st enables the retrieval of different error messages for failed authentication attempts (in case of the usage of a wrong passw… |
CVE-2025-29781 | Medium | 6.5 | 2025-03-17 | The Bare Metal Operator (BMO) implements a Kubernetes API for managing bare metal hosts in Metal3. Baremetal Operator enables users to load Secret from arbitra… |
CVE-2020-29010 | Medium | 5.0 | 2025-03-17 | An exposure of sensitive information to an unauthorized actor vulnerability in FortiOS version 6.2.4 and below, version 6.0.10 and belowmay allow remote authen… |
CVE-2025-2348 | Medium | 4.3 | 2025-03-16 | A vulnerability was found in IROAD Dash Cam FX2 up to 20250308. It has been classified as problematic. Affected is an unknown function of the file /mnt/extsd/e… |
CVE-2025-2277 | High | 7.5 | 2025-03-13 | Exposure of password in web-based SSH authentication component in Devolutions Server 2024.3.13 and earlier allows a user to unadvertently leak his SSH password… |
CVE-2025-1636 | Medium | 6.5 | 2025-03-13 | Exposure of sensitive information in My Personal Credentials password history component in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows… |
CVE-2025-1635 | Medium | 6.5 | 2025-03-13 | Exposure of sensitive information in hub data source export feature in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows allows a user export… |
CVE-2025-25975 | High | 7.5 | 2025-03-12 | An issue in parse-git-config v.3.0.0 allows an attacker to obtain sensitive information via the expandKeys function |
CVE-2024-13498 | Medium | 5.3 | 2025-03-12 | The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to… |
CVE-2025-24071 | Medium | 6.5 | 2025-03-11 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network. |
CVE-2023-40723 | High | 8.1 | 2025-03-11 | An exposure of sensitive information to an unauthorized actor in Fortinet FortiSIEM version 6.7.0 through 6.7.4 and 6.6.0 through 6.6.3 and 6.5.0 through 6.5.1… |
CVE-2022-48610 | Medium | 5.5 | 2025-03-10 | This issue was addressed through improved state management. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2. An app may be abl… |
CVE-2025-27615 | High | 8.2 | 2025-03-10 | umatiGateway is software for connecting OPC Unified Architecture servers with an MQTT broker utilizing JSON messages. The user interface may possibly be public… |
CVE-2024-54473 | Medium | 5.5 | 2025-03-10 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15. An app may be able to access user-sensitive… |
CVE-2024-54469 | Medium | 5.5 | 2025-03-10 | The issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7, visionOS 2… |
CVE-2024-54467 | Medium | 6.5 | 2025-03-10 | A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visi… |
CVE-2024-54463 | Medium | 5.5 | 2025-03-10 | This issue was addressed with improved entitlements. This issue is fixed in macOS Sequoia 15. An app may be able to access removable volumes without user conse… |
CVE-2024-44179 | Low | 2.4 | 2025-03-10 | This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoi… |
CVE-2025-1322 | Medium | 4.3 | 2025-03-08 | The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 16.26.1… |
CVE-2024-10321 | Medium | 4.3 | 2025-03-08 | The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5… |
CVE-2024-13640 | Medium | 5.9 | 2025-03-08 | The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5… |