CWE-200 · Information Disclosure (page 30)
Page 30 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-6727 | Low | 3.1 | 2023-12-12 | Mattermost fails to perform correct authorization checks when creating a playbook action, allowing users without access to the playbook to create playbook acti… |
CVE-2023-46701 | Medium | 6.5 | 2023-12-12 | Mattermost fails to perform authorization checks in the /plugins/playbooks/api/v0/runs/add-to-timeline-dialog endpoint of the Playbooks plugin allowing an att… |
CVE-2023-42884 | Medium | 5.5 | 2023-12-12 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sonoma 14.2, iOS 17.2 and iPadOS 17.2, macOS Ventura 13… |
CVE-2023-6615 | Low | 3.5 | 2023-12-08 | A vulnerability, which was classified as problematic, has been found in Typecho 1.2.1. Affected by this issue is some unknown functionality of the file /admin/… |
CVE-2023-6393 | Medium | 5.3 | 2023-12-06 | A flaw was found in the Quarkus Cache Runtime. When request processing utilizes a Uni cached using @CacheResult and the cached Uni reuses the initial "completi… |
CVE-2023-6459 | Medium | 5.3 | 2023-12-06 | Mattermost is grouping calls in the /metrics endpoint by id and reports that id in the response. Since this id is the channelID, the public /metrics endpoint i… |
CVE-2023-49283 | Medium | 5.4 | 2023-12-05 | microsoft-graph-core the Microsoft Graph Library for PHP. The Microsoft Graph Beta PHP SDK published packages which contained test code that enabled the use of… |
CVE-2023-49282 | Medium | 5.4 | 2023-12-05 | msgraph-sdk-php is the Microsoft Graph Library for PHP. The Microsoft Graph PHP SDK published packages which contained test code that enabled the use of the ph… |
CVE-2023-49292 | Medium | 4.9 | 2023-12-05 | ecies is an Elliptic Curve Integrated Encryption Scheme for secp256k1 in Golang. If funcations Encapsulate(), Decapsulate() and ECDH() could be called by an at… |
CVE-2023-37868 | Medium | 6.5 | 2023-11-30 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Leap13 Premium Addons PRO.This issue affects Premium Addons PRO: from n/a through 2… |
CVE-2023-36523 | Medium | 5.3 | 2023-11-30 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gopi Ramasamy Email download link.This issue affects Email download link: from n/a… |
CVE-2023-36507 | Medium | 5.3 | 2023-11-30 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Repute Infosystems BookingPress – Appointment Booking Calendar Plugin and Online Sc… |
CVE-2023-26533 | Medium | 6.5 | 2023-11-30 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gesundheit Bewegt GmbH Zippy.This issue affects Zippy: from n/a through 1.6.1. |
CVE-2023-25057 | Medium | 5.3 | 2023-11-30 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Libsyn Libsyn Publisher Hub.This issue affects Libsyn Publisher Hub: from n/a throu… |
CVE-2023-48333 | Medium | 6.5 | 2023-11-30 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pluggabl LLC Booster for WooCommerce.This issue affects Booster for WooCommerce: fr… |
CVE-2023-46820 | Medium | 5.3 | 2023-11-30 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Iulia Cazan Image Regenerate & Select Crop.This issue affects Image Regenerate & Se… |
CVE-2023-45834 | Medium | 5.3 | 2023-11-30 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Libsyn Libsyn Publisher Hub.This issue affects Libsyn Publisher Hub: from n/a throu… |
CVE-2023-45066 | Medium | 5.9 | 2023-11-30 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Smackcoders Export All Posts, Products, Orders, Refunds & Users.This issue affects… |
CVE-2023-44150 | High | 7.5 | 2023-11-30 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, Registration Form… |
CVE-2023-41735 | Medium | 5.3 | 2023-11-30 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gopi Ramasamy Email posts to subscribers.This issue affects Email posts to subscrib… |
CVE-2023-40662 | Medium | 5.3 | 2023-11-30 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jonk @ Follow me Darling Cookies and Content Security Policy.This issue affects Coo… |
CVE-2023-40600 | Medium | 5.3 | 2023-11-30 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Exactly WWW EWWW Image Optimizer. It works only when debug.log is turned on.This is… |
CVE-2023-40211 | High | 7.5 | 2023-11-30 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PickPlugins Post Grid Combo – 36+ Gutenberg Blocks.This issue affects Post Grid Com… |
CVE-2023-37972 | Medium | 5.3 | 2023-11-30 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in MultiVendorX Product Stock Manager & Notifier for WooCommerce.This issue affects Pr… |
CVE-2023-6136 | Medium | 5.3 | 2023-11-30 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Bowo Debug Log Manager.This issue affects Debug Log Manager: from n/a through 2.3.0. |
CVE-2023-42505 | Medium | 4.3 | 2023-11-28 | An authenticated user with read permissions on database connections metadata could potentially access sensitive information such as the connection's username. … |
CVE-2023-49068 | High | 7.5 | 2023-11-27 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1. … |
CVE-2023-45223 | Medium | 4.3 | 2023-11-27 | Mattermost fails to properly validate the "Show Full Name" option in a few endpoints in Mattermost Boards, allowing a member to get the full name of another us… |
CVE-2023-43754 | Medium | 4.3 | 2023-11-27 | Mattermost fails to check whether the “Allow users to view archived channels” setting is enabled during permalink previews display, allowing members to view… |
CVE-2023-48796 | High | 7.5 | 2023-11-24 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may includ… |
CVE-2021-39008 | Low | 2.7 | 2023-11-23 | IBM QRadar WinCollect Agent 10.0 through 10.1.7 could allow a privileged user to obtain sensitive information due to missing best practices. IBM X-Force ID: 2… |
CVE-2023-47529 | Medium | 5.3 | 2023-11-23 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ThemeIsle Cloud Templates & Patterns collection.This issue affects Cloud Templates… |
CVE-2023-47244 | Medium | 5.3 | 2023-11-23 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Omnisend Email Marketing for WooCommerce by Omnisend.This issue affects Email Marke… |
CVE-2023-41786 | Medium | 6.8 | 2023-11-23 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pandora FMS on all allows File Discovery. This vulnerability allows users with low… |
CVE-2023-43123 | Medium | 5.5 | 2023-11-23 | On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/dir… |
CVE-2023-47668 | Medium | 5.3 | 2023-11-23 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StellarWP Membership Plugin – Restrict Content plugin <= 3.2.7 versions. |
CVE-2023-40002 | Medium | 6.5 | 2023-11-23 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pluggabl LLC Booster for WooCommerce plugin <= 7.1.1 versions. |
CVE-2023-23978 | Medium | 4.3 | 2023-11-23 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SwitchWP WP Client Reports plugin <= 1.0.16 versions. |
CVE-2023-6264 | Medium | 5.3 | 2023-11-22 | Information leak in Content-Security-Policy header in Devolutions Server 2023.3.7.0 allows an unauthenticated attacker to list the configured Devolutions Gatew… |
CVE-2022-36777 | Medium | 4.3 | 2023-11-22 | IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.16.0could allow an authenticated user to obta… |
CVE-2023-2446 | Medium | 6.5 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to sensitive information disclosure via the 'userpro' shortcode in versions up to, and including 5.1.1. This is… |
CVE-2023-47393 | Medium | 5.3 | 2023-11-22 | An access control issue in Mercedes me IOS APP v1.34.0 and below allows attackers to view the maintenance orders of other users and access sensitive user infor… |
CVE-2023-47392 | Medium | 5.3 | 2023-11-22 | An access control issue in Mercedes me IOS APP v1.34.0 and below allows attackers to view the carts of other users via sending a crafted add order request. |
CVE-2021-22143 | Low | 2.1 | 2023-11-22 | The Elastic APM .NET Agent can leak sensitive HTTP header information when logging the details during an application error. Normally, the APM agent will saniti… |
CVE-2023-6248 | Critical | 10.0 | 2023-11-21 | The Syrus4 IoT gateway utilizes an unsecured MQTT server to download and execute arbitrary commands, allowing a remote unauthenticated attacker to execute code… |
CVE-2023-49103 | Critical | 10.0 | 2023-11-21 | An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php librar… |
CVE-2023-47643 | Low | 3.1 | 2023-11-21 | SuiteCRM is a Customer Relationship Management (CRM) software application. Prior to version 8.4.2, Graphql Introspection is enabled without authentication, exp… |
CVE-2023-48294 | Medium | 4.3 | 2023-11-17 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In a… |
CVE-2020-11447 | Medium | 4.3 | 2023-11-17 | An issue was discovered on Bell HomeHub 3000 SG48222070 devices. Remote authenticated users can retrieve the serial number via cgi/json-req - this is an inform… |
CVE-2023-47642 | Medium | 4.3 | 2023-11-16 | Zulip is an open-source team collaboration tool. It was discovered by the Zulip development team that active users who had previously been subscribed to a stre… |
CVE-2023-6105 | Medium | 5.5 | 2023-11-15 | An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user wit… |
CVE-2023-39337 | Critical | 9.1 | 2023-11-15 | A security vulnerability in EPMM Versions 11.10, 11.9 and 11.8 older allows a threat actor with knowledge of an enrolled device identifier to access and extrac… |
CVE-2023-47126 | Low | 3.7 | 2023-11-14 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions the login screen of the standalone install too… |
CVE-2023-28723 | Low | 3.3 | 2023-11-14 | Exposure of sensitive information to an unauthorized actor in some Intel(R) Aptio* V UEFI Firmware Integrator Tools may allow an authenticated user to potentia… |
CVE-2023-24588 | Medium | 5.9 | 2023-11-14 | Exposure of sensitive information to an unauthorized actor in firmware for some Intel(R) Optane(TM) SSD products may allow an unauthenticated user to potential… |
CVE-2022-46646 | Low | 2.2 | 2023-11-14 | Exposure of sensitive information to an unauthorized actor for some Intel Unison software may allow an authenticated user to potentially enable information dis… |
CVE-2023-41676 | Medium | 4.3 | 2023-11-14 | An exposure of sensitive information to an unauthorized actor [CWE-200] in FortiSIEM version 7.0.0 and before 6.7.5 may allow an attacker with access to windo… |
CVE-2023-36043 | Medium | 6.5 | 2023-11-14 | Open Management Infrastructure Information Disclosure Vulnerability |
CVE-2023-47117 | High | 7.5 | 2023-11-13 | Label Studio is an open source data labeling tool. In all current versions of Label Studio prior to 1.9.2post0, the application allows users to insecurely set… |
CVE-2023-6101 | Medium | 5.3 | 2023-11-13 | A vulnerability, which was classified as problematic, has been found in Maiwei Safety Production Control Platform 4.1. This issue affects some unknown processi… |
CVE-2023-6100 | Medium | 5.3 | 2023-11-13 | A vulnerability classified as problematic was found in Maiwei Safety Production Control Platform 4.1. This vulnerability affects unknown code of the file /api/… |
CVE-2023-42781 | Medium | 6.5 | 2023-11-12 | Apache Airflow, versions before 2.7.3, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about… |
CVE-2023-6076 | Medium | 5.3 | 2023-11-10 | A vulnerability classified as problematic was found in PHPGurukul Restaurant Table Booking System 1.0. Affected by this vulnerability is an unknown functionali… |
CVE-2023-47614 | Low | 3.3 | 2023-11-10 | A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion P… |
CVE-2023-45816 | Low | 3.3 | 2023-11-10 | Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-p… |
CVE-2018-8863 | Medium | 5.9 | 2023-11-09 | The HTTP header in Philips EncoreAnywhere contains data an attacker may be able to use to gain sensitive information. |
CVE-2023-5551 | Low | 3.3 | 2023-11-09 | Separate Groups mode restrictions were not honoured in the forum summary report, which would display users from other groups. |
CVE-2023-5545 | Low | 3.3 | 2023-11-09 | H5P metadata automatically populated the author with the user's username, which could be sensitive information. |
CVE-2023-43791 | Critical | 9.8 | 2023-11-09 | Label Studio is a multi-type data labeling and annotation tool with standardized output format. There is a vulnerability that can be chained within the ORM Lea… |
CVE-2023-47616 | Low | 2.4 | 2023-11-09 | A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion P… |
CVE-2023-45875 | High | 7.5 | 2023-11-08 | An issue was discovered in Couchbase Server 7.2.0. There is a private key leak in debug.log while adding a pre-7.0 node to a 7.2 cluster. |
CVE-2023-46757 | High | 7.5 | 2023-11-08 | The remote PIN module has a vulnerability that causes incorrect information storage locations.Successful exploitation of this vulnerability may affect confiden… |
CVE-2023-44098 | High | 7.5 | 2023-11-08 | Vulnerability of missing encryption in the card management module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-44115 | High | 7.5 | 2023-11-08 | Vulnerability of improper permission control in the Booster module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-4061 | Medium | 6.5 | 2023-11-08 | A flaw was found in wildfly-core. A management user could use the resolve-expression in the HAL Interface to read possible sensitive information from the Wildf… |
CVE-2023-6001 | Medium | 5.3 | 2023-11-08 | Prometheus metrics are available without authentication. These expose detailed and sensitive information about the YugabyteDB Anywhere environment. |
CVE-2023-4272 | Medium | 5.5 | 2023-11-07 | A local non-privileged user can make GPU processing operations that expose sensitive data from previously freed memory. |
CVE-2023-46851 | Medium | 4.9 | 2023-11-07 | Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Project administrators can run these imports, which could c… |
CVE-2023-38547 | Critical | 9.8 | 2023-11-07 | A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its configuration data… |
CVE-2023-46254 | Medium | 4.3 | 2023-11-06 | capsule-proxy is a reverse proxy for Capsule kubernetes multi-tenancy framework. A bug in the RoleBinding reflector used by `capsule-proxy` gives ServiceAccoun… |
CVE-2023-5968 | Medium | 4.9 | 2023-11-06 | Mattermost fails to properly sanitize the user object when updating the username, resulting in the password hash being included in the response body. |
CVE-2021-4430 | Low | 3.5 | 2023-11-06 | A vulnerability classified as problematic has been found in Ortus Solutions ColdBox Elixir 3.1.6. This affects an unknown part of the file src/defaultConfig.js… |
CVE-2023-45189 | Medium | 6.5 | 2023-11-03 | A vulnerability in IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.10, 23.0.0 through 23.0.10 may result… |
CVE-2023-41354 | Medium | 4.0 | 2023-11-03 | Chunghwa Telecom NOKIA G-040W-Q Firewall function does not block ICMP TIMESTAMP requests by default, an unauthenticated remote attacker can exploit this vulner… |
CVE-2023-45024 | High | 7.5 | 2023-11-03 | Best Practical Request Tracker (RT) 5 before 5.0.5 allows Information Disclosure via a transaction search in the transaction query builder. |
CVE-2023-41260 | High | 7.5 | 2023-11-03 | Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Exposure in responses to mail-gateway REST API calls. |
CVE-2023-41259 | High | 7.5 | 2023-11-03 | Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure via fake or spoofed RT email headers in an email message or… |
CVE-2023-34261 | Medium | 5.3 | 2023-11-03 | Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow identification of valid user accounts via username enumeration because they lead to a "nicht ei… |
CVE-2023-39057 | High | 7.5 | 2023-11-02 | An information leak in hirochanKAKIwaiting v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39054 | High | 7.5 | 2023-11-02 | An information leak in Tokudaya.ekimae_mc v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39053 | High | 7.5 | 2023-11-02 | An information leak in Hattoriya v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39051 | High | 7.5 | 2023-11-02 | An information leak in VISION MEAT WORKS Track Diner 10/10mbl v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39050 | High | 7.5 | 2023-11-02 | An information leak in Daiky-value.Fukueten v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39048 | High | 7.5 | 2023-11-02 | An information leak in Tokudaya.honten v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39047 | High | 7.5 | 2023-11-02 | An information leak in shouzu sweets oz v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39042 | High | 7.5 | 2023-11-02 | An information leak in Gyouza-newhushimi v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-5920 | Low | 2.9 | 2023-11-02 | Mattermost Desktop for MacOS fails to utilize the secure keyboard input functionality provided by macOS, allowing for other processes to read the keyboard inpu… |
CVE-2023-5516 | Medium | 5.3 | 2023-11-01 | Poorly constructed webap requests and URI components with special characters trigger unhandled errors and exceptions, disclosing information about the underly… |
CVE-2023-5515 | Medium | 5.3 | 2023-11-01 | The responses for web queries with certain parameters disclose internal path of resources. This information can be used to learn internal structure of the app… |
CVE-2023-43796 | Medium | 5.3 | 2023-10-31 | Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be queried from Synapse. This… |