CWE-200 · Information Disclosure (page 29)
Page 29 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-30118 | Low | 3.5 | 2024-10-09 | HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to beca… |
CVE-2024-3656 | High | 8.1 | 2024-10-09 | A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allo… |
CVE-2024-43610 | High | 7.4 | 2024-10-09 | Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network at… |
CVE-2024-43609 | Medium | 6.5 | 2024-10-08 | Microsoft Office Spoofing Vulnerability |
CVE-2024-33506 | Low | 3.3 | 2024-10-08 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiManager 7.4.2 and below, 7.2.5 and below, 7.0.12 and below allows… |
CVE-2024-8884 | Critical | 9.8 | 2024-10-08 | CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause exposure of credentials when attacker has access to a… |
CVE-2024-47344 | Medium | 5.3 | 2024-10-07 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Stylemix uListing ulisting.This issue affects uListing: from n/a through <= 2.1.5. |
CVE-2024-45250 | Medium | 4.3 | 2024-10-06 | ZKteco – CWE 200 Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2024-45245 | High | 7.8 | 2024-10-06 | Diebold Nixdorf – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2024-47848 | | 2024-10-05 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - PageTriage allows Authentication Bypass.This i… | |
CVE-2024-20491 | Medium | 6.3 | 2024-10-02 | A vulnerability in a logging function of Cisco Nexus Dashboard Insights could allow an attacker with access to a tech support file to view sensitive informatio… |
CVE-2024-20490 | Medium | 6.3 | 2024-10-02 | A vulnerability in a logging function of Cisco Nexus Dashboard Fabric Controller (NDFC) and Cisco Nexus Dashboard Orchestrator (NDO) could allow an attacker wi… |
CVE-2024-46548 | Medium | 6.3 | 2024-09-30 | TP-Link Tapo P125M and Kasa KP125M v1.0.3 was discovered to improperly validate certificates, allowing attackers to eavesdrop on communications and access sens… |
CVE-2024-47532 | Medium | 6.5 | 2024-09-30 | RestrictedPython is a restricted execution environment for Python to run untrusted code. A user can gain access to protected (and potentially sensible) informa… |
CVE-2024-45792 | Medium | 6.5 | 2024-09-30 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. Using a crafted POST request, an unprivileged, registered user is able to retrieve information a… |
CVE-2024-46471 | High | 7.5 | 2024-09-27 | The Directory Listing in /uploads/ Folder in CodeAstro Membership Management System 1.0 exposes the structure and contents of directories, potentially revealin… |
CVE-2024-47197 | High | 7.5 | 2024-09-26 | Exposure of Sensitive Information to an Unauthorized Actor, Insecure Storage of Sensitive Information vulnerability in Maven Archetype Plugin. This issue affe… |
CVE-2024-43237 | Medium | 5.3 | 2024-09-25 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Steve Burge WordPress Tag Cloud Plugin – Tag Groups tag-groups.This issue affects W… |
CVE-2024-8516 | Medium | 4.3 | 2024-09-25 | The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.1 via the render() fun… |
CVE-2024-8483 | Medium | 4.3 | 2024-09-25 | The MAS Static Content plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.8 via the static_content() function… |
CVE-2024-7426 | Medium | 5.3 | 2024-09-25 | The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Full Path Disclosure in all versions up… |
CVE-2024-8801 | Medium | 4.3 | 2024-09-25 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.2 via the Conten… |
CVE-2023-5359 | Low | 3.7 | 2024-09-25 | The W3 Total Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.5 via Google OAuth API secrets st… |
CVE-2024-42351 | Medium | 6.5 | 2024-09-20 | Galaxy is a free, open-source system for analyzing data, authoring workflows, training and education, publishing tools, managing infrastructure, and more. An a… |
CVE-2024-8612 | Low | 3.8 | 2024-09-20 | A flaw was found in QEMU, in the virtio-scsi, virtio-blk, and virtio-crypto devices. The size for virtqueue_push as set in virtio_scsi_complete_req / virtio_bl… |
CVE-2024-47060 | Medium | 4.3 | 2024-09-20 | Zitadel is an open source identity management platform. In Zitadel, even after an organization is deactivated, associated projects, respectively their applicat… |
CVE-2024-47059 | Medium | 4.3 | 2024-09-18 | When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak. However when an in… |
CVE-2024-46987 | High | 7.7 | 2024-09-18 | Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. A path traversal vulnerability accessible via MediaController's downlo… |
CVE-2024-46979 | Medium | 5.3 | 2024-09-18 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to get access to notification filters of… |
CVE-2024-8969 | Medium | 6.5 | 2024-09-18 | OMFLOW from The SYSCOM Group has a vulnerability involving the exposure of sensitive data. This allows remote attackers who have logged into the system to obta… |
CVE-2024-45811 | Medium | 4.8 | 2024-09-17 | Vite a frontend build tooling framework for javascript. In affected versions the contents of arbitrary files can be returned to the browser. `@fs` denies acces… |
CVE-2024-44186 | Medium | 5.5 | 2024-09-17 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access protected user data. |
CVE-2024-44184 | Medium | 5.5 | 2024-09-17 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 15, macOS… |
CVE-2024-44182 | Medium | 5.5 | 2024-09-17 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An a… |
CVE-2024-44181 | Medium | 5.5 | 2024-09-17 | An issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An app may be… |
CVE-2024-44180 | Low | 2.4 | 2024-09-17 | The issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18. An attacker with physical access may be able to access contacts from… |
CVE-2024-44163 | Medium | 5.5 | 2024-09-17 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. A malicious application may be ab… |
CVE-2024-44158 | Medium | 5.5 | 2024-09-17 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 17.7 and iPadOS 17.7, macOS Sequoia 15, macOS Sonoma 14.7… |
CVE-2024-44152 | High | 7.5 | 2024-09-17 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15. An app may be able to access user-… |
CVE-2024-44139 | Low | 2.4 | 2024-09-17 | The issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18. An attacker with physical access may be able to access contacts from… |
CVE-2024-44129 | Medium | 5.5 | 2024-09-17 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15, macOS Ventura 13.7. An app may be able to leak sensitive user informatio… |
CVE-2024-40863 | Medium | 5.5 | 2024-09-17 | This issue was addressed with improved data protection. This issue is fixed in iOS 18 and iPadOS 18. An app may be able to leak sensitive user information. |
CVE-2024-40862 | Medium | 5.3 | 2024-09-17 | A privacy issue was addressed by removing sensitive data. This issue is fixed in Xcode 16. An attacker may be able to determine the Apple ID of the owner of th… |
CVE-2024-40850 | Medium | 5.5 | 2024-09-17 | A file access issue was addressed with improved input validation. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 15, macO… |
CVE-2024-40842 | Medium | 5.5 | 2024-09-17 | An issue was addressed with improved validation of environment variables. This issue is fixed in macOS Sequoia 15. An app may be able to access user-sensitive… |
CVE-2024-40838 | Low | 3.3 | 2024-09-17 | A privacy issue was addressed by moving sensitive data to a protected location. This issue is fixed in macOS Sequoia 15. A malicious app may be able to access… |
CVE-2024-45799 | High | 7.3 | 2024-09-16 | FluxCP is a web-based Control Panel for rAthena servers written in PHP. A javascript injection is possible via venders/buyers list pages and shop names, that a… |
CVE-2024-8780 | Medium | 6.5 | 2024-09-16 | OMFLOW from The SYSCOM Group does not properly restrict the query range of its data query functionality, allowing remote attackers with regular privileges to o… |
CVE-2024-8777 | High | 7.5 | 2024-09-16 | OMFLOW from The SYSCOM Group has an information leakage vulnerability, allowing unauthorized remote attackers to read arbitrary system configurations. If LDAP… |
CVE-2024-46938 | High | 7.5 | 2024-09-15 | An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release through 10.4 Initial Re… |
CVE-2024-39925 | Medium | 6.5 | 2024-09-13 | An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. It lacks an offboarding process for members who leave an organization. As a result, the… |
CVE-2024-44685 | Medium | 5.0 | 2024-09-13 | Titan SFTP and Titan MFT Server 2.0.25.2426 and earlier have a vulnerability a vulnerability where sensitive information, including passwords, is exposed in cl… |
CVE-2024-6544 | Medium | 5.3 | 2024-09-13 | The Custom Post Limits plugin for WordPress is vulnerable to full path disclosure in all versions up to, and including, 4.4.1. This is due to the plugin utiliz… |
CVE-2024-41629 | Medium | 5.5 | 2024-09-12 | An issue in Texas Instruments Fusion Digital Power Designer v.7.10.1 allows a local attacker to obtain sensitive information via the plaintext storage of crede… |
CVE-2024-45624 | High | 7.5 | 2024-09-12 | Exposure of sensitive information due to incompatible policies issue exists in Pgpool-II. If a database user accesses a query cache, table data unauthorized fo… |
CVE-2024-8097 | | 2024-09-11 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Payara Platform Payara Server (Logging modules) allows Sensitive credentials posted… | |
CVE-2024-27113 | Critical | 9.8 | 2024-09-11 | An unauthenticated Insecure Direct Object Reference (IDOR) to the database has been found in the SO Planning tool that occurs when the public view setting is e… |
CVE-2023-37232 | High | 7.5 | 2024-09-10 | Loftware Spectrum through 4.6 exposes Sensitive Information (Logs) to an Unauthorized Actor. |
CVE-2024-31490 | Medium | 4.3 | 2024-09-10 | An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6, For… |
CVE-2024-37991 | Medium | 5.3 | 2024-09-10 | A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions < V4.2), SIMATIC Reader RF610R ETSI (6GT2811-6BC10-0AA0)… |
CVE-2024-42019 | High | 8.0 | 2024-09-07 | A vulnerability that allows an attacker to access the NTLM hash of the Veeam Reporter Service service account. This attack requires user interaction and data c… |
CVE-2024-38650 | Critical | 9.9 | 2024-09-07 | An authentication bypass vulnerability can allow a low privileged attacker to access the NTLM hash of service account on the VSPC server. |
CVE-2024-8538 | Medium | 4.3 | 2024-09-07 | The Big File Uploads – Increase Maximum File Upload Size plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.1.2… |
CVE-2024-44408 | High | 7.5 | 2024-09-06 | D-Link DIR-823G v1.0.2B05_20181207 is vulnerable to Information Disclosure. The device allows unauthorized configuration file downloads, and the downloaded con… |
CVE-2024-45040 | Medium | 5.9 | 2024-09-06 | gnark is a fast zk-SNARK library that offers a high-level API to design circuits. Prior to version 0.11.0, commitments to private witnesses in Groth16 as imple… |
CVE-2024-45039 | Medium | 6.2 | 2024-09-06 | gnark is a fast zk-SNARK library that offers a high-level API to design circuits. Versions prior to 0.11.0 have a soundness issue - in case of multiple commitm… |
CVE-2024-7415 | Medium | 5.3 | 2024-09-06 | The Remember Me Controls plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0.1. This is due to the plugin allo… |
CVE-2024-8461 | Medium | 5.3 | 2024-09-05 | A vulnerability, which was classified as problematic, was found in D-Link DNS-320 2.02b01. This affects an unknown part of the file /cgi-bin/discovery.cgi of t… |
CVE-2024-8460 | Low | 3.7 | 2024-09-05 | A vulnerability, which was classified as problematic, has been found in D-Link DNS-320 2.02b01. Affected by this issue is some unknown functionality of the fil… |
CVE-2024-6835 | Medium | 5.3 | 2024-09-05 | The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 5.5.6 via the ajax_… |
CVE-2024-20503 | Medium | 5.5 | 2024-09-04 | A vulnerability in Cisco Duo Epic for Hyperdrive could allow an authenticated, local attacker to view sensitive information in cleartext on an affected system… |
CVE-2024-44820 | Medium | 6.1 | 2024-09-04 | A sensitive information disclosure vulnerability exists in ZZCMS v.2023 and before within the eginfo.php file located at /3/E_bak5.1/upload/. When accessed wit… |
CVE-2024-8106 | Medium | 6.5 | 2024-09-04 | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0… |
CVE-2024-45447 | Medium | 4.4 | 2024-09-04 | Access control vulnerability in the camera framework module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-45450 | Medium | 4.0 | 2024-09-04 | Permission control vulnerability in the software update module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-45391 | High | 7.5 | 2024-09-03 | Tina is an open-source content management system (CMS). Sites building with Tina CMS's command line interface (CLI) prior to version 1.6.2 that use a search to… |
CVE-2024-43803 | Medium | 4.9 | 2024-09-03 | The Bare Metal Operator (BMO) implements a Kubernetes API for managing bare metal hosts in Metal3. The `BareMetalHost` (BMH) CRD allows the `userData`, `metaDa… |
CVE-2024-45388 | High | 7.5 | 2024-09-02 | Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The `/api/v2/simulation` POST handler allows us… |
CVE-2024-43801 | Medium | 4.6 | 2024-09-02 | Jellyfin is an open source self hosted media server. The Jellyfin user profile image upload accepts SVG files, allowing for a stored XSS attack against an admi… |
CVE-2024-3679 | Medium | 5.3 | 2024-08-29 | The Premium SEO Pack – WP SEO Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.002. This m… |
CVE-2024-2541 | Medium | 5.3 | 2024-08-29 | The Popup Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.6 via the Subscribers Import f… |
CVE-2024-7418 | Medium | 4.3 | 2024-08-29 | The The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid plugin for WordPress is vulnerable to Sensitive Information Exposure in all v… |
CVE-2024-6551 | Medium | 5.3 | 2024-08-29 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.15.1… |
CVE-2024-45054 | Low | 2.8 | 2024-08-28 | Hwameistor is an HA local storage system for cloud-native stateful workloads. This ClusterRole has * verbs of * resources. If a malicious user can access the w… |
CVE-2024-45043 | Medium | 5.3 | 2024-08-28 | The OpenTelemetry Collector module AWS firehose receiver is for ingesting AWS Kinesis Data Firehose delivery stream messages and parsing the records received b… |
CVE-2021-22529 | Medium | 6.3 | 2024-08-28 | A vulnerability identified in NetIQ Advance Authentication that leaks sensitive server information. This issue affects NetIQ Advance Authentication version bef… |
CVE-2024-6448 | Medium | 5.3 | 2024-08-28 | The Mollie Payments for WooCommerce plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 7.7.0. This is due to the… |
CVE-2024-6633 | Critical | 9.8 | 2024-08-27 | The default credentials for the setup HSQL database (HSQLDB) for FileCatalyst Workflow are published in a vendor knowledgebase article. Misuse of these credent… |
CVE-2024-43258 | Medium | 5.3 | 2024-08-26 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Store Locator Plus.This issue affects Store Locator Plus: from n/a through 2311.17… |
CVE-2024-43257 | Medium | 6.5 | 2024-08-26 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Nouthemes Leopard - WordPress offload media.This issue affects Leopard - WordPress… |
CVE-2024-43251 | Medium | 6.5 | 2024-08-26 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Bit Apps Bit Form Pro.This issue affects Bit Form Pro: from n/a through 2.6.4. |
CVE-2024-43319 | Medium | 4.3 | 2024-08-26 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in bPlugins LLC Flash & HTML5 Video.This issue affects Flash & HTML5 Video: from n/a t… |
CVE-2024-43289 | High | 7.5 | 2024-08-26 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in gVectors Team wpForo Forum.This issue affects wpForo Forum: from n/a through 2.3.4. |
CVE-2023-48957 | Medium | 5.3 | 2024-08-25 | PureVPN Linux client 2.0.2-Productions fails to properly handle DNS queries, allowing them to bypass the VPN tunnel and be sent directly to the ISP or default… |
CVE-2024-42339 | Medium | 4.3 | 2024-08-25 | CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2024-42338 | Medium | 4.3 | 2024-08-25 | CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2024-42337 | Medium | 4.3 | 2024-08-25 | CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2024-6499 | Medium | 5.3 | 2024-08-24 | The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 9.7.8. This makes it po… |
CVE-2024-8072 | Medium | 5.3 | 2024-08-22 | Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users |
CVE-2024-39344 | High | 8.1 | 2024-08-21 | An issue was discovered in the Docusign API package 8.142.14 for Salesforce. The Apttus_DocuApi__DocusignAuthentication__mdt object is installed via the market… |