CWE-200 · Information Disclosure (page 27)
Page 27 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-52975 | Critical | 9.0 | 2025-01-23 | An issue was identified in Fleet Server where Fleet policies that could contain sensitive information were logged on INFO and ERROR log levels. The nature of t… |
CVE-2024-43707 | High | 7.7 | 2025-01-23 | An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of… |
CVE-2025-23047 | Medium | 6.5 | 2025-01-22 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An insecure default `Access-Control-Allow-Origin` header value could… |
CVE-2024-49734 | High | 7.5 | 2025-01-21 | In multiple functions of ConnectivityService.java, there is a possible way for a Wi-Fi AP to determine what site a device has connected to through a VPN due to… |
CVE-2024-49733 | Medium | 5.5 | 2025-01-21 | In reload of ServiceListing.java , there is a possible way to allow a malicious app to hide an NLS from Settings due to a logic error in the code. This could l… |
CVE-2023-40108 | Medium | 5.5 | 2025-01-21 | In multiple locations, there is a possible way to access media content belonging to another user due to a missing permission check. This could lead to local in… |
CVE-2025-24011 | Medium | 5.3 | 2025-01-21 | Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, it's possible to determin… |
CVE-2025-0318 | Medium | 5.3 | 2025-01-18 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Inform… |
CVE-2018-9384 | Medium | 4.4 | 2025-01-17 | In multiple locations, there is a possible way to bypass KASLR due to an unusual root cause. This could lead to local information disclosure with System execut… |
CVE-2018-9379 | Medium | 5.5 | 2025-01-17 | In multiple functions of MiniThumbFile.java, there is a possible way to view the thumbnails of deleted photos due to a confused deputy. This could lead to loca… |
CVE-2024-12142 | High | 8.6 | 2025-01-17 | CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause information disclosure of restricted web page, modifi… |
CVE-2024-12637 | Medium | 5.3 | 2025-01-17 | The Moving Users plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.05 via the export functionality… |
CVE-2024-56136 | Medium | 5.3 | 2025-01-16 | Zulip server provides an open-source team chat that helps teams stay productive and focused. Zulip Server 7.0 and above are vulnerable to an information disclo… |
CVE-2025-0472 | High | 7.5 | 2025-01-16 | Information exposure in the PMB platform affecting versions 4.2.13 and earlier. This vulnerability allows an attacker to upload a file to the environment and e… |
CVE-2024-48125 | High | 7.5 | 2025-01-15 | An issue in the AsDB service of HI-SCAN 6040i Hitrax HX-03-19-I allows attackers to enumerate user credentials via crafted GIOP protocol requests. |
CVE-2025-0481 | Medium | 5.3 | 2025-01-15 | A vulnerability classified as problematic has been found in D-Link DIR-878 1.03. Affected is an unknown function of the file /dllog.cgi of the component HTTP P… |
CVE-2025-0441 | Medium | 6.5 | 2025-01-15 | Inappropriate implementation in Fenced Frames in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to obtain potentially sensitive information fro… |
CVE-2025-23074 | Low | 2.4 | 2025-01-14 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - SocialProfile Extension allows Functionality Misus… |
CVE-2025-23073 | Low | 3.5 | 2025-01-14 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - GlobalBlocking Extension allows Retrieve Embedded… |
CVE-2024-50338 | High | 7.4 | 2025-01-14 | Git Credential Manager (GCM) is a secure Git credential helper built on .NET that runs on Windows, macOS, and Linux. The Git credential protocol is text-based… |
CVE-2025-21308 | Medium | 6.5 | 2025-01-14 | Windows Themes Spoofing Vulnerability |
CVE-2025-21242 | Medium | 5.9 | 2025-01-14 | Windows Kerberos Information Disclosure Vulnerability |
CVE-2025-21214 | Medium | 4.2 | 2025-01-14 | Windows BitLocker Information Disclosure Vulnerability |
CVE-2024-12008 | Medium | 5.3 | 2025-01-14 | The W3 Total Cache plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.8.1 through the publicly exposed debug lo… |
CVE-2025-22138 | | 2025-01-13 | @codidact/qpixel is a Q&A-based community knowledge-sharing software. In affected versions when a category is set to private or limited-visibility within QPixe… | |
CVE-2025-22828 | Medium | 4.3 | 2025-01-13 | CloudStack users can add and read comments (annotations) on resources they are authorised to access. Due to an access validation issue that affects Apache Cl… |
CVE-2025-0403 | Medium | 5.3 | 2025-01-13 | A vulnerability, which was classified as problematic, has been found in 1902756969 reggie 1.0. Affected by this issue is some unknown functionality of the file… |
CVE-2024-42179 | Low | 2.0 | 2025-01-12 | HCL MyXalytics is affected by sensitive information disclosure vulnerability. The HTTP response header exposes the Microsoft-HTTP API∕2.0 as the server's name… |
CVE-2025-21592 | Medium | 5.5 | 2025-01-09 | An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the command-line interface (CLI) of Juniper Networks Junos OS on SRX Series devi… |
CVE-2023-24012 | High | 8.2 | 2025-01-09 | An attacker can arbitrarily craft malicious DDS Participants (or ROS 2 Nodes) with valid certificates to compromise and get full control of the attacked secure… |
CVE-2023-24011 | High | 8.2 | 2025-01-09 | An attacker can arbitrarily craft malicious DDS Participants (or ROS 2 Nodes) with valid certificates to compromise and get full control of the attacked secure… |
CVE-2023-24010 | High | 8.2 | 2025-01-09 | An attacker can arbitrarily craft malicious DDS Participants (or ROS 2 Nodes) with valid certificates to compromise and get full control of the attacked secure… |
CVE-2024-12584 | Medium | 4.3 | 2025-01-08 | The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including… |
CVE-2024-56443 | Medium | 6.2 | 2025-01-08 | Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-12426 | Medium | 6.5 | 2025-01-07 | Exposure of Environmental Variables and arbitrary INI file values to an Unauthorized Actor vulnerability in The Document Foundation LibreOffice. URLs could… |
CVE-2024-12532 | Medium | 4.3 | 2025-01-07 | The BWD Elementor Addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.18 in widgets/bwdeb-con… |
CVE-2024-11282 | Medium | 5.3 | 2025-01-07 | The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4… |
CVE-2024-12159 | Medium | 5.3 | 2025-01-07 | The Optimize Your Campaigns – Google Shopping – Google Ads – Google Adwords plugin for WordPress is vulnerable to Information Exposure in all versions up to, a… |
CVE-2024-12140 | Medium | 4.3 | 2025-01-07 | The Elementor Addons AI Addons – 70 Widgets, Premium Templates, Ultimate Elements plugin for WordPress is vulnerable to Information Exposure in all versions up… |
CVE-2024-11290 | Medium | 5.3 | 2025-01-07 | The Member Access plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.6 via the WordPress core searc… |
CVE-2024-12538 | Medium | 4.3 | 2025-01-07 | The Duplicate Post, Page and Any Custom Post plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.5 v… |
CVE-2025-21620 | High | 7.5 | 2025-01-06 | Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. When you send a request with the Authorization header to one domain, and the re… |
CVE-2025-21615 | Medium | 5.5 | 2025-01-06 | AAT (Another Activity Tracker) is a GPS-tracking application for tracking sportive activities, with emphasis on cycling. Versions lower than v1.26 of AAT are v… |
CVE-2025-0227 | Medium | 4.3 | 2025-01-05 | A vulnerability, which was classified as problematic, was found in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). This affects an unknown part… |
CVE-2025-0226 | Medium | 4.3 | 2025-01-05 | A vulnerability, which was classified as problematic, has been found in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). Affected by this issue… |
CVE-2025-0224 | Medium | 5.3 | 2025-01-05 | A vulnerability was found in Provision-ISR SH-4050A-2, SH-4100A-2L(MM), SH-8100A-2L(MM), SH-16200A-2(1U), SH-16200A-5(1U) and NVR5-8200PX up to 20241220. It ha… |
CVE-2024-13110 | Medium | 4.3 | 2025-01-02 | A vulnerability classified as problematic has been found in Beijing Yunfan Internet Technology Yunfan Learning Examination System 1.9.2. Affected is an unknown… |
CVE-2024-13042 | Medium | 4.3 | 2024-12-30 | A vulnerability was found in Tsinghua Unigroup Electronic Archives Management System 3.2.210802(62532). It has been classified as problematic. Affected is the… |
CVE-2024-47923 | Medium | 5.3 | 2024-12-30 | Mashov – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2024-47922 | High | 7.5 | 2024-12-30 | Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2024-56509 | High | 8.6 | 2024-12-27 | changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. Improper input validation in the… |
CVE-2024-12984 | Medium | 5.3 | 2024-12-27 | A vulnerability classified as problematic has been found in Amcrest IP2M-841B, IP2M-841W, IPC-IP2M-841B, IPC-IP3M-943B, IPC-IP3M-943S, IPC-IP3M-HX2B and IPC-IP… |
CVE-2020-9089 | Low | 3.3 | 2024-12-27 | There is an information vulnerability in Huawei smartphones. A function in a module can be called without verifying the caller's access. Attackers with user ac… |
CVE-2020-9082 | Low | 3.5 | 2024-12-27 | There is an information disclosure vulnerability in several smartphones. The system has a logic judging error under certain scenario, the attacker should gain… |
CVE-2024-45805 | Medium | 4.3 | 2024-12-26 | OpenCTI is an open-source cyber threat intelligence platform. Before 6.3.0, general users can access information that can only be accessed by users with access… |
CVE-2024-12896 | Medium | 5.3 | 2024-12-22 | A vulnerability was found in Intelbras VIP S3020 G2, VIP S4020 G2, VIP S4020 G3 and VIP S4320 G2 up to 20241222 and classified as problematic. Affected by this… |
CVE-2023-31280 | Medium | 5.3 | 2024-12-21 | An AirVantage online Warranty Checker tool vulnerability could allow an attacker to perform bulk enumeration of IMEI and Serial Numbers pairs. The AirVantage… |
CVE-2024-11297 | Medium | 5.3 | 2024-12-20 | The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inc… |
CVE-2024-54009 | Medium | 4.0 | 2024-12-19 | Remote authentication bypass vulnerability in HPE Alletra Storage MP B10000 in versions prior to version 10.4.5 could be remotely exploited to allow disclosure… |
CVE-2024-53991 | High | 7.5 | 2024-12-19 | Discourse is an open source platform for community discussion. This vulnerability only impacts Discourse instances configured to use `FileStore::LocalStore` wh… |
CVE-2024-52589 | Low | 2.2 | 2024-12-19 | Discourse is an open source platform for community discussion. Moderators can see the Screened emails list in the admin dashboard, and through that can learn t… |
CVE-2024-12560 | Medium | 4.3 | 2024-12-19 | The Button Block – Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to… |
CVE-2024-10548 | Medium | 6.5 | 2024-12-19 | The WP Project Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.15 via the Project Task L… |
CVE-2024-11291 | Medium | 5.3 | 2024-12-18 | The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Sensitive Informatio… |
CVE-2024-12340 | Medium | 4.3 | 2024-12-18 | The Animation Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.6 via the 're… |
CVE-2024-11295 | Medium | 5.3 | 2024-12-18 | The Simple Page Access Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.29 via the Wo… |
CVE-2024-12250 | Medium | 5.3 | 2024-12-18 | The Accept Authorize.NET Payments Using Contact Form 7 plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2 via… |
CVE-2024-10356 | Medium | 4.3 | 2024-12-17 | The ElementsReady Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.4.8 in inc/… |
CVE-2024-11280 | Medium | 5.3 | 2024-12-17 | The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.9.5 via the Word… |
CVE-2024-8326 | High | 8.8 | 2024-12-17 | The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Sensiti… |
CVE-2024-11294 | Medium | 5.3 | 2024-12-17 | The Memberful plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.73.9 via the WordPress core search f… |
CVE-2021-26281 | Medium | 5.5 | 2024-12-17 | Some parameters of the alarm clock module are improperly stored, leaking some sensitive information. |
CVE-2021-26279 | Medium | 5.9 | 2024-12-17 | Some parameters of the weather module are improperly stored, leaking some sensitive information. |
CVE-2024-35230 | Medium | 5.3 | 2024-12-16 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. In affected versions the welcome and about pag… |
CVE-2024-55951 | | 2024-12-16 | Metabase is an open-source data analytics platform. For new sandboxing configurations created in 1.52.0 till 1.52.2.4, sandboxed users are able to see field fi… | |
CVE-2024-12578 | Medium | 5.3 | 2024-12-14 | The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.5.4.8 via the 'ticke… |
CVE-2024-55946 | | 2024-12-13 | Playloom Engine is an open-source, high-performance game development engine. Engine Beta v0.0.1 has a security vulnerability related to data storage, specifica… | |
CVE-2024-9945 | Medium | 5.3 | 2024-12-13 | An information-disclosure vulnerability exists in Fortra's GoAnywhere MFT application prior to version 7.7.0 that allows external access to the resources in ce… |
CVE-2021-32007 | Low | 3.5 | 2024-12-13 | This issue affects: Secomea GateManager Version 9.5 and all prior versions. Protection Mechanism Failure vulnerability in web server of Secomea GateManager to… |
CVE-2024-55875 | Critical | 9.8 | 2024-12-12 | http4k is a functional toolkit for Kotlin HTTP applications. Prior to version 6.50.0.0, there is a potential XXE (XML External Entity Injection) vulnerability… |
CVE-2024-54119 | Medium | 6.2 | 2024-12-12 | Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-54117 | Medium | 6.2 | 2024-12-12 | Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-12564 | | 2024-12-12 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability was discovered in Open Design Alliance CDE inWEB SDK before 2025.3. Installing CDE Ser… | |
CVE-2024-12329 | Medium | 4.3 | 2024-12-12 | The Essential Real Estate plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on several pages/post types in al… |
CVE-2024-12255 | Medium | 5.3 | 2024-12-12 | The Accept Stripe Payments Using Contact Form 7 plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.5 via the cf… |
CVE-2024-11351 | Medium | 5.3 | 2024-12-11 | The Restrict – membership, site, content and user access restrictions for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all… |
CVE-2024-11008 | Medium | 5.3 | 2024-12-11 | The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3… |
CVE-2024-53245 | Low | 3.1 | 2024-12-10 | In Splunk Enterprise versions below 9.3.0, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.1.2312.206, a low-privileged user that does not hold the… |
CVE-2024-53244 | Medium | 5.7 | 2024-12-10 | In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.2.2406.107, 9.2.2403.109, and 9.1.2312.206, a low-privil… |
CVE-2024-53243 | Medium | 4.3 | 2024-12-10 | In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and versions below 3.2.462, 3.7.18, and 3.8.5 of the Splunk Secure Gateway app on Splunk Cloud Plat… |
CVE-2024-11106 | Medium | 5.3 | 2024-12-10 | The Simple Restrict plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.7 via the WordPress core sea… |
CVE-2024-54151 | High | 7.5 | 2024-12-09 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 11.0.0 and prior to version 11.3.0, when setting `WEBSOCKE… |
CVE-2024-54137 | High | 7.4 | 2024-12-06 | liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. A correctness error has been identified in… |
CVE-2024-11292 | Medium | 5.3 | 2024-12-06 | The WP Private Content Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.1 via the WordPress… |
CVE-2024-54134 | | 2024-12-04 | A publish-access account was compromised for `@solana/web3.js`, a JavaScript library that is commonly used by Solana dapps. This allowed an attacker to publish… | |
CVE-2024-53862 | High | 7.5 | 2024-12-02 | Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. When using `--auth-mode=client`, Archived Work… |
CVE-2024-11961 | Medium | 5.3 | 2024-11-28 | A vulnerability was found in Guangzhou Huayi Intelligent Technology Jeewms 3.7. It has been rated as problematic. This issue affects the function preHandle of… |
CVE-2024-53859 | Medium | 6.5 | 2024-11-27 | go-gh is a Go module for interacting with the `gh` utility and the GitHub API from the command line. A security vulnerability has been identified in `go-gh` th… |
CVE-2024-53858 | Medium | 6.5 | 2024-11-27 | The gh cli is GitHub’s official command line tool. A security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cl… |
CVE-2024-52323 | High | 8.1 | 2024-11-27 | Zohocorp ManageEngine Analytics Plus versions below 6100 are vulnerable to authenticated sensitive data exposure which allows the users to retrieve sensitive t… |