CWE-200 · Information Disclosure (page 28)
Page 28 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-0906 | Medium | 5.3 | 2024-03-12 | The f(x) Private Site plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.1 via the API. This makes… |
CVE-2024-28120 | Medium | 6.5 | 2024-03-11 | codeium-chrome is an open source code completion plugin for the chrome web browser. The service worker of the codeium-chrome extension doesn't check the sender… |
CVE-2024-25114 | Low | 2.6 | 2024-03-11 | Collabora Online is a collaborative online office suite based on LibreOffice technology. Each document in Collabora Online is opened by a separate "Kit" instan… |
CVE-2024-26309 | Medium | 5.3 | 2024-03-08 | Archer Platform 6.x before 6.14 P2 HF2 (6.14.0.2.2) contains a sensitive information disclosure vulnerability. An unauthenticated attacker could potentially ob… |
CVE-2024-23292 | Low | 3.3 | 2024-03-08 | This issue was addressed with improved data protection. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4. An app may be able to access inform… |
CVE-2024-23235 | Medium | 4.7 | 2024-03-08 | A race condition was addressed with additional validation. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tv… |
CVE-2023-28826 | Medium | 5.5 | 2024-03-08 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, macOS Monterey 12.7.4, macOS So… |
CVE-2024-1460 | Medium | 5.6 | 2024-03-07 | MSI Afterburner v4.6.5.16370 is vulnerable to a Kernel Memory Leak vulnerability by triggering the 0x80002040 IOCTL code of the RTCore64.sys driver. The handle… |
CVE-2024-24765 | High | 7.5 | 2024-03-06 | CasaOS-UserService provides user management functionalities to CasaOS. Prior to version 0.4.7, path filtering of the URL for user avatar image files was not st… |
CVE-2024-20292 | Medium | 4.4 | 2024-03-06 | A vulnerability in the logging component of Cisco Duo Authentication for Windows Logon and RDP could allow an authenticated, local attacker to view sensitive i… |
CVE-2023-48644 | Medium | 6.1 | 2024-03-05 | An issue was discovered in the Archibus app 4.0.3 for iOS. There is an XSS vulnerability in the create work request feature of the maintenance module, via the… |
CVE-2024-1769 | Medium | 5.3 | 2024-03-05 | The JM Twitter Cards plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 14 via the meta description data. This ma… |
CVE-2022-43890 | Medium | 5.3 | 2024-03-04 | IBM Security Verify Privilege On-Premises 11.5 could disclose sensitive information through an HTTP request that could aid an attacker in further attacks again… |
CVE-2024-20019 | Medium | 5.9 | 2024-03-04 | In wlan driver, there is a possible memory leak due to improper input handling. This could lead to remote denial of service with no additional execution privil… |
CVE-2019-25210 | Medium | 6.5 | 2024-03-03 | An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. It displays values of secrets when the --dry-run flag is used. This is… |
CVE-2024-0765 | Medium | 6.5 | 2024-03-03 | As a default user on a multi-user instance of AnythingLLM, you could execute a call to the `/export-data` endpoint of the system and then unzip and read that e… |
CVE-2024-25839 | High | 7.5 | 2024-03-03 | An issue was discovered in Webbax "Super Newsletter" (supernewsletter) module for PrestaShop versions 1.4.21 and before, allows local attackers to escalate pri… |
CVE-2024-27296 | Medium | 5.3 | 2024-03-01 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 10.8.3, the exact Directus version number was being shipped i… |
CVE-2023-50324 | Medium | 5.3 | 2024-03-01 | IBM Cognos Command Center 10.2.4.1 and 10.2.5 exposes details the X-AspNet-Version Response Header that could allow an attacker to obtain information of the ap… |
CVE-2024-1952 | Low | 3.1 | 2024-02-29 | Mattermost version 8.1.x before 8.1.9 fails to sanitize data associated with permalinks when a plugin updates an ephemeral post, allowing an authenticated atta… |
CVE-2024-1949 | Low | 2.6 | 2024-02-29 | A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized access to individual p… |
CVE-2024-23493 | Medium | 4.3 | 2024-02-29 | Mattermost fails to properly authorize the requests fetching team associated AD/LDAP groups, allowing a user to fetch details of AD/LDAP groups of a team that… |
CVE-2024-26470 | High | 8.1 | 2024-02-29 | A host header injection vulnerability in the forgot password function of FullStackHero's WebAPI Boilerplate v1.0.0 and v1.0.1 allows attackers to leak the pass… |
CVE-2024-26132 | Medium | 4.0 | 2024-02-29 | Element Android is an Android Matrix Client. A third-party malicious application installed on the same phone can force Element Android, version 0.91.0 through… |
CVE-2024-23302 | High | 7.5 | 2024-02-29 | Couchbase Server before 7.2.4 has a private key leak in goxdcr.log. |
CVE-2024-0620 | Medium | 5.3 | 2024-02-29 | The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.9 via API. Thi… |
CVE-2024-0616 | Medium | 5.3 | 2024-02-29 | The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4… |
CVE-2023-6922 | Medium | 4.3 | 2024-02-28 | The Under Construction / Maintenance Mode from Acurax plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2… |
CVE-2024-26144 | Medium | 5.3 | 2024-02-27 | Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active… |
CVE-2024-27905 | Critical | 9.1 | 2024-02-27 | ** UNSUPPORTED WHEN ASSIGNED ** Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Aurora. An endpoint exposing internals to u… |
CVE-2024-27356 | High | 7.5 | 2024-02-27 | An issue was discovered on certain GL-iNet devices. Attackers can download files such as logs via commands, potentially obtaining critical user information. Th… |
CVE-2024-24720 | Medium | 5.3 | 2024-02-27 | An issue was discovered in the Forgot password function in Innovaphone PBX before 14r1 devices. It provides information about whether a user exists on a system. |
CVE-2024-27456 | Critical | 9.1 | 2024-02-26 | rack-cors (aka Rack CORS Middleware) 2.0.1 has 0666 permissions for the .rb files. |
CVE-2024-1436 | Medium | 5.3 | 2024-02-26 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wiloke WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit.This issue affects… |
CVE-2024-21501 | Medium | 5.3 | 2024-02-24 | Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allow… |
CVE-2024-24309 | High | 7.5 | 2024-02-23 | In the module "Survey TMA" (ecomiz_survey_tma) up to version 2.0.0 from Ecomiz for PrestaShop, a guest can download personal information without restriction. |
CVE-2021-33146 | Medium | 5.3 | 2024-02-23 | Improper input validation in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow an unauthenticated user to… |
CVE-2024-25130 | Medium | 5.4 | 2024-02-22 | Tuleap is an open source suite to improve management of software developments and collaboration. Prior to version 15.5.99.76 of Tuleap Community Edition and pr… |
CVE-2024-24817 | Medium | 4.3 | 2024-02-22 | Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on the open-source discussion platform Discourse. Prior to versio… |
CVE-2024-26136 | High | 7.5 | 2024-02-20 | kedi ElectronCord is a bot management tool for Discord. Commit aaaeaf4e6c99893827b2eea4dd02f755e1e24041 exposes an account access token in the `config.json` fi… |
CVE-2023-52097 | High | 7.5 | 2024-02-18 | Vulnerability of foreground service restrictions being bypassed in the NMS module.Successful exploitation of this vulnerability may affect service confidential… |
CVE-2024-20937 | Medium | 4.3 | 2024-02-17 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affe… |
CVE-2023-21833 | Medium | 4.3 | 2024-02-17 | Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Object Store). The supported version that is affected is 8.8. Eas… |
CVE-2024-24758 | Low | 3.9 | 2024-02-16 | Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Prox… |
CVE-2024-0020 | Medium | 5.5 | 2024-02-16 | In onActivityResult of NotificationSoundPreference.java, there is a possible way to hear audio files belonging to a different user due to a confused deputy. Th… |
CVE-2024-1591 | Low | 3.3 | 2024-02-16 | Prior to version 24.1, a local authenticated attacker can view Sysvol when Privilege Management for Windows is configured to use a GPO policy. This allows them… |
CVE-2023-44253 | Medium | 5.0 | 2024-02-15 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiManager version 7.4.0 through 7.4.1 and before 7.2.5, Fo… |
CVE-2024-0708 | Medium | 5.3 | 2024-02-15 | The Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions… |
CVE-2023-51787 | High | 7.5 | 2024-02-15 | An issue was discovered in Wind River VxWorks 7 22.09 and 23.03. If a VxWorks task or POSIX thread that uses OpenSSL exits, limited per-task memory is not free… |
CVE-2024-25121 | High | 7.1 | 2024-02-13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions of TYPO3 entities of the File Abstraction Laye… |
CVE-2024-25120 | Medium | 4.3 | 2024-02-13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. The TYPO3-specific `t3://` URI scheme could be used to access resou… |
CVE-2024-25119 | Medium | 4.9 | 2024-02-13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. The plaintext value of `$GLOBALS['SYS']['encryptionKey']` was displ… |
CVE-2024-25118 | Medium | 4.3 | 2024-02-13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. Password hashes were being reflected in the editing forms of the TY… |
CVE-2024-21380 | High | 8.0 | 2024-02-13 | Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability |
CVE-2022-22506 | Medium | 4.6 | 2024-02-12 | IBM Robotic Process Automation 21.0.2 contains a vulnerability that could allow user ids may be exposed across tenants. IBM X-Force ID: 227293. |
CVE-2024-1431 | Medium | 4.3 | 2024-02-11 | A vulnerability was found in Netgear R7000 1.0.11.136_10.2.120 and classified as problematic. Affected by this issue is some unknown functionality of the file… |
CVE-2024-1430 | Medium | 4.3 | 2024-02-11 | A vulnerability has been found in Netgear R7000 1.0.11.136_10.2.120 and classified as problematic. Affected by this vulnerability is an unknown functionality o… |
CVE-2024-1406 | Medium | 4.3 | 2024-02-10 | A vulnerability was found in Linksys WRT54GL 4.30.18. It has been declared as problematic. This vulnerability affects unknown code of the file /SysInfo1.htm of… |
CVE-2024-1405 | Medium | 4.3 | 2024-02-10 | A vulnerability was found in Linksys WRT54GL 4.30.18. It has been classified as problematic. This affects an unknown part of the file /wlaninfo.htm of the comp… |
CVE-2023-28077 | Medium | 4.4 | 2024-02-10 | Dell BSAFE SSL-J, versions prior to 6.5, and versions 7.0 and 7.1 contain a debug message revealing unnecessary information vulnerability. This may lead to di… |
CVE-2024-21624 | Medium | 5.7 | 2024-02-09 | nonebot2 is a cross-platform Python asynchronous chatbot framework written in Python. This security advisory pertains to a potential information leak (e.g., en… |
CVE-2024-1404 | Medium | 4.3 | 2024-02-09 | A vulnerability was found in Linksys WRT54GL 4.30.18 and classified as problematic. Affected by this issue is some unknown functionality of the file /SysInfo.h… |
CVE-2023-50298 | High | 7.5 | 2024-02-09 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 b… |
CVE-2024-24825 | Critical | 9.1 | 2024-02-09 | DIRAC is a distributed resource framework. In affected versions any user could get a token that has been requested by another user/agent. This may expose resou… |
CVE-2024-0242 | High | 7.3 | 2024-02-08 | Under certain circumstances IQ Panel4 and IQ4 Hub panel software prior to version 4.4.2 could allow unauthorized access to settings. |
CVE-2024-24215 | Medium | 5.3 | 2024-02-08 | An issue in the component /cgi-bin/GetJsonValue.cgi of Cellinx NVT Web Server 5.0.0.014 allows attackers to leak configuration information via a crafted POST r… |
CVE-2024-24304 | High | 7.5 | 2024-02-07 | In the module "Mailjet" (mailjet) from Mailjet for PrestaShop before versions 3.5.1, a guest can download technical information without restriction. |
CVE-2024-22022 | High | 8.8 | 2024-02-07 | Vulnerability CVE-2024-22022 allows a Veeam Recovery Orchestrator user that has been assigned a low-privileged role to access the NTLM hash of the service acco… |
CVE-2024-1255 | Medium | 5.3 | 2024-02-06 | A vulnerability has been found in sepidz SepidzDigitalMenu up to 7.1.0728.1 and classified as problematic. This vulnerability affects unknown code of the file… |
CVE-2024-22331 | Medium | 6.2 | 2024-02-06 | IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.19, 7.1 through 7.1.2.15, 7.2 through 7.2.3.8, 7.3 through 7.3.2.3, and IBM UrbanCode Deploy (UCD) - IBM DevOps De… |
CVE-2024-23344 | Medium | 5.3 | 2024-02-06 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. Some users might get access to restricted information when a p… |
CVE-2023-46183 | Medium | 5.3 | 2024-02-06 | IBM PowerVM Hypervisor FW950.00 through FW950.90, FW1020.00 through FW1020.40, and FW1030.00 through FW1030.30 could allow a system administrator to obtain sen… |
CVE-2024-1210 | Medium | 5.3 | 2024-02-05 | The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via API. This makes it poss… |
CVE-2024-1209 | Medium | 5.3 | 2024-02-05 | The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via direct file access due… |
CVE-2024-1208 | Medium | 5.3 | 2024-02-05 | The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.2 via API. This makes it poss… |
CVE-2023-33851 | Medium | 5.3 | 2024-02-04 | IBM PowerVM Hypervisor FW950.00 through FW950.90, FW1020.00 through FW1020.40, and FW1030.00 through FW1030.30 could reveal sensitive partition data to a syste… |
CVE-2024-23550 | Medium | 6.2 | 2024-02-03 | HCL DevOps Deploy / HCL Launch (UCD) could disclose sensitive user information when installing the Windows agent. |
CVE-2024-0909 | Medium | 5.3 | 2024-02-03 | The Anonymous Restricted Content plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 1.6.2. This is due to insuf… |
CVE-2024-1200 | Medium | 5.3 | 2024-02-03 | A vulnerability was found in Jspxcms 10.2.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /template/1/default… |
CVE-2024-24757 | High | 7.6 | 2024-02-02 | open-irs is an issue response robot that reponds to issues in the installed repository. The `.env` file was accidentally uploaded when working with git actions… |
CVE-2024-24755 | Medium | 4.3 | 2024-02-01 | discourse-group-membership-ip-block is a discourse plugin that adds support for adding users to groups based on their IP address. discourse-group-membership-ip… |
CVE-2024-24548 | Medium | 6.5 | 2024-02-01 | Payment EX Ver1.1.5b and earlier allows a remote unauthenticated attacker to obtain the information of the user who purchases merchandise using Payment EX. |
CVE-2024-21626 | High | 8.6 | 2024-01-31 | runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descrip… |
CVE-2024-1098 | Medium | 4.3 | 2024-01-31 | A vulnerability was found in Rebuild up to 3.5.5 and classified as problematic. This issue affects the function QiniuCloud.getStorageFile of the file /filex/pr… |
CVE-2023-44312 | Medium | 5.8 | 2024-01-31 | Exposure of Sensitive Information to an Unauthorized Actor in Apache ServiceComb Service-Center.This issue affects Apache ServiceComb Service-Center before… |
CVE-2024-22200 | Low | 3.3 | 2024-01-30 | vantage6-UI is the User Interface for vantage6. The docker image used to run the UI leaks the nginx version. To mitigate the vulnerability, users can run the U… |
CVE-2024-1033 | Medium | 4.3 | 2024-01-30 | A vulnerability, which was classified as problematic, has been found in openBI up to 1.0.8. Affected by this issue is the function agent of the file /applicati… |
CVE-2023-52187 | Medium | 5.3 | 2024-01-27 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Thomas Maier Image Source Control Lite – Show Image Credits and Captions.This issue… |
CVE-2023-48129 | Medium | 5.4 | 2024-01-26 | An issue in kimono-oldnew mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-48135 | Medium | 5.4 | 2024-01-26 | An issue in mimasaka_farm mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-48132 | Medium | 5.4 | 2024-01-26 | An issue in kosei entertainment esportsstudioLegends mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the chann… |
CVE-2023-48131 | Medium | 5.4 | 2024-01-26 | An issue in CHIGASAKI BAKERY mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-48130 | Medium | 5.4 | 2024-01-26 | An issue in GINZA CAFE mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2024-23649 | High | 7.5 | 2024-01-24 | Lemmy is a link aggregator and forum for the fediverse. Starting in version 0.17.0 and prior to version 0.19.1, users can report private messages, even when th… |
CVE-2024-22141 | Medium | 6.5 | 2024-01-24 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Cozmoslabs Profile Builder Pro.This issue affects Profile Builder Pro: from n/a thr… |
CVE-2024-22154 | High | 7.5 | 2024-01-24 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SNP Digital SalesKing.This issue affects SalesKing: from n/a through 1.6.15. |
CVE-2024-22301 | Medium | 5.3 | 2024-01-24 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ignazio Scimone Albo Pretorio On line.This issue affects Albo Pretorio On line: fro… |
CVE-2024-22294 | Medium | 5.3 | 2024-01-24 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in IP2Location IP2Location Country Blocker.This issue affects IP2Location Country Bloc… |
CVE-2023-43998 | Medium | 5.4 | 2024-01-24 | An issue in Books-futaba mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43997 | Medium | 5.4 | 2024-01-24 | An issue in Yoruichi hobby base mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |