CWE-200 · Information Disclosure (page 28)
Page 28 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-52323 | High | 8.1 | 2024-11-27 | Zohocorp ManageEngine Analytics Plus versions below 6100 are vulnerable to authenticated sensitive data exposure which allows the users to retrieve sensitive t… |
CVE-2024-11083 | Medium | 5.3 | 2024-11-27 | The ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.15.18 via the WordPress core sear… |
CVE-2017-18307 | High | 8.4 | 2024-11-26 | Information disclosure possible while audio playback. |
CVE-2017-18306 | High | 8.4 | 2024-11-26 | Information disclosure due to uninitialized variable. |
CVE-2024-8899 | Medium | 4.3 | 2024-11-26 | The Jeg Elementor Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.9 via the render_content f… |
CVE-2024-11265 | Medium | 4.3 | 2024-11-23 | The Increase Maximum Upload File Size | Increase Execution Time plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including… |
CVE-2024-7391 | Medium | 5.7 | 2024-11-22 | ChargePoint Home Flex Bluetooth Low Energy Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive inf… |
CVE-2024-38647 | High | 7.5 | 2024-11-22 | An exposure of sensitive information vulnerability has been reported to affect QNAP AI Core. If exploited, the vulnerability could allow remote attackers to co… |
CVE-2024-8929 | Medium | 5.8 | 2024-11-22 | In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap… |
CVE-2024-11089 | Medium | 5.3 | 2024-11-21 | The Anonymous Restricted Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.5 via the WordP… |
CVE-2024-11088 | Medium | 5.3 | 2024-11-21 | The Simple Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.5 via the WordPress core s… |
CVE-2024-9542 | Medium | 4.3 | 2024-11-21 | The Sky Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 via the render fu… |
CVE-2024-10316 | Medium | 4.3 | 2024-11-21 | The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.4 in includes/te… |
CVE-2024-51163 | High | 7.5 | 2024-11-20 | A Local File Inclusion vulnerability in Vegam Solutions Vegam 4i versions 6.3.47.0 and earlier allows a remote attacker to obtain sensitive information through… |
CVE-2024-10365 | Medium | 4.3 | 2024-11-20 | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Sensitive Informati… |
CVE-2024-52506 | Medium | 6.5 | 2024-11-18 | Graylog is a free and open log management platform. The reporting functionality in Graylog allows the creation and scheduling of reports which contain dashboar… |
CVE-2024-43416 | High | 7.5 | 2024-11-18 | GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an unauthenticated user can use an application… |
CVE-2020-3525 | Medium | 4.3 | 2024-11-18 | A vulnerability in the Admin portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to recover service account passw… |
CVE-2024-45791 | High | 7.5 | 2024-11-18 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat: before 1.6.1. Users are re… |
CVE-2024-52513 | Low | 2.6 | 2024-11-15 | Nextcloud Server is a self hosted personal cloud system. After receiving a "Files drop" or "Password protected" share link a malicious user was able to downloa… |
CVE-2024-52508 | High | 8.2 | 2024-11-15 | Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. When a user is trying to set up a mail account with an email address like us… |
CVE-2024-52523 | Medium | 4.6 | 2024-11-15 | Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credentials, the API retu… |
CVE-2024-52517 | Medium | 4.6 | 2024-11-15 | Nextcloud Server is a self hosted personal cloud system. After storing "Global credentials" on the server, the API returns them and adds them into the frontend… |
CVE-2022-20648 | Medium | 5.3 | 2024-11-15 | A vulnerability in a debug function for Cisco RCM for Cisco StarOS Software could allow an unauthenticated, remote attacker to perform debug actions… |
CVE-2024-8979 | High | 8.0 | 2024-11-15 | The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Sensitive Info… |
CVE-2024-8978 | Medium | 5.7 | 2024-11-15 | The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Sensitive Info… |
CVE-2024-47915 | High | 7.5 | 2024-11-14 | VaeMendis - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2024-48900 | Medium | 4.3 | 2024-11-13 | A vulnerability was found in Moodle. Additional checks are required to ensure users with permission to view badge recipients can only access lists of those the… |
CVE-2024-52297 | Critical | 9.8 | 2024-11-12 | Tolgee is an open-source localization platform. Tolgee 3.81.1 included the all configuration properties in the PublicConfiguratioDTO publicly exposed to users… |
CVE-2024-10971 | Medium | 4.3 | 2024-11-12 | Improper access control in the Password History feature in Devolutions DVLS 2024.3.6 and earlier allows a malicious authenticated user to obtain sensitive data… |
CVE-2024-46894 | Medium | 6.3 | 2024-11-12 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly validate authorization of a use… |
CVE-2024-52032 | Medium | 4.3 | 2024-11-09 | Mattermost versions 10.0.x <= 10.0.0 and 9.11.x <= 9.11.2 fail to properly query ElasticSearch when searching for the channel name in channel switcher which al… |
CVE-2024-10352 | Medium | 4.3 | 2024-11-09 | The Magical Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.4 via the get_c… |
CVE-2024-8756 | Medium | 5.3 | 2024-11-09 | The Quform - WordPress Form Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.20.0 via the '… |
CVE-2024-10285 | Critical | 9.8 | 2024-11-09 | The CE21 Suite plugin for WordPress is vulnerable to sensitive information disclosure via the plugin-log.txt in versions up to, and including, 2.2.0. This make… |
CVE-2024-52001 | Medium | 4.3 | 2024-11-08 | Combodo iTop is a simple, web based IT Service Management tool. In affected versions portal users are able to access forbidden services information. This issue… |
CVE-2024-48011 | Low | 3.1 | 2024-11-08 | Dell PowerProtect DD, versions prior to 7.7.5.50, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. A low privileged attack… |
CVE-2024-10965 | Medium | 4.3 | 2024-11-07 | A vulnerability classified as problematic was found in emqx neuron up to 2.10.0. Affected by this vulnerability is an unknown functionality of the file /api/v2… |
CVE-2024-50342 | Low | 3.1 | 2024-11-06 | symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously. When us… |
CVE-2024-20507 | Medium | 4.3 | 2024-11-06 | A vulnerability in the logging subsystem of Cisco Meeting Management could allow an authenticated, remote attacker to view sensitive information in clear text… |
CVE-2024-20457 | Medium | 6.5 | 2024-11-06 | A vulnerability in the logging component of Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an authenticated… |
CVE-2024-20445 | Medium | 5.3 | 2024-11-06 | A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 could allow an unauthenticated… |
CVE-2024-6861 | High | 7.5 | 2024-11-06 | A disclosure of sensitive information flaw was found in foreman via the GraphQL API. If the introspection feature is enabled, it is possible for attackers to r… |
CVE-2024-10916 | Medium | 5.3 | 2024-11-06 | A vulnerability classified as problematic has been found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. This affects an unknown part of the… |
CVE-2024-10084 | Medium | 4.3 | 2024-11-05 | The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Basic Information Disclosure in all versions up to, and including, 4.5 via th… |
CVE-2024-51739 | High | 7.5 | 2024-11-05 | Combodo iTop is a simple, web based IT Service Management tool. Unauthenticated user can perform users enumeration, which can make it easier to bruteforce a va… |
CVE-2023-29116 | Medium | 4.3 | 2024-11-05 | Under certain conditions, through a request directed to the Waybox Enel X web management application, information like Waybox OS version or service configurati… |
CVE-2023-29114 | Medium | 5.7 | 2024-11-05 | System logs could be accessed through web management application due to a lack of access control. An attacker can obtain the following sensitive information… |
CVE-2024-10329 | Medium | 4.3 | 2024-11-05 | The Ultimate Bootstrap Elements for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6… |
CVE-2024-10319 | Medium | 4.3 | 2024-11-05 | The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including… |
CVE-2024-32870 | Medium | 5.8 | 2024-11-05 | Combodo iTop is a simple, web based IT Service Management tool. Server, OS, DBMS, PHP, and iTop info (name, version and parameters) can be read by anyone havin… |
CVE-2024-8553 | Medium | 6.3 | 2024-10-31 | A vulnerability was found in Foreman's loader macros introduced with report templates. These macros may allow an authenticated user with permissions to view an… |
CVE-2024-33626 | Medium | 5.3 | 2024-10-30 | The LevelOne WBR-6012 router contains a vulnerability within its web application that allows unauthenticated disclosure of sensitive information, such as the W… |
CVE-2024-33603 | Medium | 5.3 | 2024-10-30 | The LevelOne WBR-6012 router has an information disclosure vulnerability in its web application, which allows unauthenticated users to access a verbose system… |
CVE-2024-10360 | Medium | 4.3 | 2024-10-29 | The Move Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.5 via the render f… |
CVE-2024-10312 | Medium | 4.3 | 2024-10-29 | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.4 via the ren… |
CVE-2024-30106 | Low | 3.5 | 2024-10-28 | HCL Connections is vulnerable to an information disclosure vulnerability, due to an IBM WebSphere Application Server error, which could allow a user to obtain… |
CVE-2024-10357 | Medium | 4.3 | 2024-10-26 | The Clever Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.1 via the getTem… |
CVE-2024-49357 | High | 7.5 | 2024-10-24 | ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoints in Zi… |
CVE-2024-10050 | Medium | 4.3 | 2024-10-24 | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 1.6.43 via the hfe_tem… |
CVE-2024-10290 | Medium | 5.3 | 2024-10-23 | A vulnerability, which was classified as problematic, was found in ZZCMS 2023. This affects an unknown part of the file 3/qq-connect2.0/API/com/inc.php. The ma… |
CVE-2024-9530 | Medium | 4.3 | 2024-10-23 | The Qi Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.0 via private templa… |
CVE-2024-50312 | Medium | 5.3 | 2024-10-22 | A vulnerability was found in GraphQL due to improper access controls on the GraphQL introspection query. This flaw allows unauthorized users to retrieve a comp… |
CVE-2024-9541 | Medium | 4.3 | 2024-10-22 | The News Kit Elementor Addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.1 via the render f… |
CVE-2024-9627 | High | 8.6 | 2024-10-22 | The TeploBot - Telegram Bot for WP plugin for WordPress is vulnerable to sensitive information disclosure due to missing authorization checks on the 'service_p… |
CVE-2024-8852 | Medium | 5.3 | 2024-10-22 | The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.86 through… |
CVE-2024-45309 | High | 7.5 | 2024-10-21 | OneDev is a Git server with CI/CD, kanban, and packages. A vulnerability in versions prior to 11.0.9 allows unauthenticated users to read arbitrary files acces… |
CVE-2024-9889 | Medium | 4.3 | 2024-10-19 | The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.9 via th… |
CVE-2024-42508 | Medium | 5.5 | 2024-10-18 | This vulnerability could be exploited, leading to unauthorized disclosure of information to authenticated users. |
CVE-2024-49284 | Medium | 5.3 | 2024-10-17 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in BogdanFix WP SendFox wp-sendfox allows Retrieve Embedded Sensitive Data.This issue… |
CVE-2024-7417 | Medium | 4.3 | 2024-10-17 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.3.986 via the data_… |
CVE-2024-22032 | Medium | 6.5 | 2024-10-16 | A vulnerability has been identified in which an RKE1 cluster keeps constantly reconciling when secrets encryption configuration is enabled. When reconciling… |
CVE-2024-9540 | Medium | 4.3 | 2024-10-16 | The Sina Extension for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.7 via the rende… |
CVE-2017-20194 | Medium | 5.3 | 2024-10-16 | The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.05.03 via the frm_forms_preview A… |
CVE-2020-36835 | Medium | 4.9 | 2024-10-16 | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to sensitive information disclosure of a WordPress site's database due to missing c… |
CVE-2024-21209 | Low | 2.0 | 2024-10-15 | Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are affected are 8.4.2 and prior and 9.0.1… |
CVE-2024-21205 | Medium | 6.5 | 2024-10-15 | Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: OSB Core Functionality). The supported version that is affected is 12… |
CVE-2024-47824 | | 2024-10-15 | matrix-react-sdk is react-based software development kit for inserting a Matrix chat/VOIP client into a web page. Starting in version 3.18.0 and before 3.102.0… | |
CVE-2024-47779 | | 2024-10-15 | Element is a Matrix web client built using the Matrix React SDK. Element Web versions 1.11.70 through 1.11.80 contain a vulnerability which can, under speciall… | |
CVE-2024-47771 | | 2024-10-15 | Element Desktop is a Matrix client for desktop platforms. Element Desktop versions 1.11.70 through 1.11.80 contain a vulnerability which can, under specially c… | |
CVE-2024-47080 | | 2024-10-15 | matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. In matrix-js-sdk versions versions 9.11.0 through 34.7.0, the method `MatrixClient… | |
CVE-2024-6757 | Medium | 4.3 | 2024-10-15 | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and inclu… |
CVE-2024-9546 | Medium | 5.3 | 2024-10-15 | The WPIDE – File Manager & Code Editor plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.9. This is due to t… |
CVE-2024-48824 | High | 7.5 | 2024-10-14 | An issue in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to obtain sensitive information via… |
CVE-2024-48789 | High | 7.5 | 2024-10-14 | An issue in INATRONIC com.inatronic.drivedeck.home 2.6.23 allows a remote attacker to obtain sensitve information via the firmware update process. |
CVE-2024-48799 | High | 7.5 | 2024-10-14 | An issue in LOREX TECHNOLOGY INC com.lorexcorp.lorexping 1.4.22 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48798 | High | 7.5 | 2024-10-14 | An issue in Hubble Connected (com.hubbleconnected.vervelife) 2.00.81 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48797 | High | 7.5 | 2024-10-14 | An issue in PCS Engineering Preston Cinema (com.prestoncinema.app) 0.2.0 allows a remote attacker to obtain sensitive information via the firmware update proce… |
CVE-2024-48796 | High | 7.5 | 2024-10-14 | An issue in EQUES com.eques.plug 1.0.1 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-45739 | Medium | 4.9 | 2024-10-14 | In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes plaintext passwords for local native authentication Splunk users… |
CVE-2024-45738 | Medium | 4.9 | 2024-10-14 | In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes sensitive HTTP parameters to the `_internal` index. This exposure… |
CVE-2024-8902 | Medium | 4.3 | 2024-10-12 | The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.8 via the render_c… |
CVE-2024-9821 | High | 8.8 | 2024-10-12 | The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to sensitive information disclosure due to missing authorization checks on the 'stm_wpcf… |
CVE-2024-9539 | Medium | 4.3 | 2024-10-11 | An information disclosure vulnerability was identified in GitHub Enterprise Server via attacker uploaded asset URL allowing the attacker to retrieve metadata i… |
CVE-2024-39527 | Medium | 5.5 | 2024-10-11 | An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the command-line interface (CLI) of Juniper Networks Junos OS on SRX Series devi… |
CVE-2024-9538 | Medium | 4.3 | 2024-10-11 | The ShopLentor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.8 via the 'render' function in in… |
CVE-2024-8913 | Medium | 4.3 | 2024-10-11 | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Sensitive Informati… |
CVE-2024-47868 | High | 7.5 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This is a **data validation vulnerability** affecting several Gradio components, which… |
CVE-2024-45134 | Low | 2.7 | 2024-10-10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Information Exposure vulnerability that could result in a securi… |
CVE-2024-6747 | Medium | 5.3 | 2024-10-10 | Information leakage in mknotifyd in Checkmk before 2.3.0p18, 2.2.0p36, 2.1.0p49 and in 2.0.0p39 (EOL) allows attacker to get potentially sensitive data |