CWE-200 · Information Disclosure (page 30)
Page 30 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-26327 | | 2024-08-21 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in OpenText Performance Center on Windows allows Retrieve Embedded Sensitive Data.This… | |
CVE-2024-6568 | Medium | 5.3 | 2024-08-21 | The Flamix: Bitrix24 and Contact Form 7 integrations plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.1.0. Th… |
CVE-2024-5880 | Medium | 4.3 | 2024-08-21 | The Hide My Site plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 due to the plugin not restricti… |
CVE-2024-42006 | High | 7.5 | 2024-08-20 | Keyfactor AWS Orchestrator through 2.0 allows Information Disclosure. |
CVE-2024-41700 | High | 7.5 | 2024-08-20 | Barix – CWE-200 Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2024-41698 | Medium | 4.3 | 2024-08-20 | Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2024-7925 | Medium | 4.3 | 2024-08-19 | A vulnerability was found in ZZCMS 2023. It has been rated as problematic. This issue affects some unknown processing of the file 3/E_bak5.1/upload/eginfo.php… |
CVE-2024-42658 | Critical | 9.8 | 2024-08-19 | An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information via the cookie's parameter |
CVE-2024-42657 | High | 7.5 | 2024-08-19 | An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information via the lack of encryption during login… |
CVE-2024-42486 | Medium | 5.4 | 2024-08-16 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In versions on the 1.15.x branch prior to 1.15.8 and the 1.16.x bran… |
CVE-2024-7630 | Medium | 5.3 | 2024-08-16 | The Relevanssi – A Better Search plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.22.2 (Free) and 2.25.1 (Pre… |
CVE-2024-7843 | Medium | 5.3 | 2024-08-15 | A vulnerability, which was classified as problematic, was found in SourceCodester Online Graduate Tracer System 1.0. Affected is an unknown function of the fil… |
CVE-2024-7842 | Medium | 5.3 | 2024-08-15 | A vulnerability, which was classified as problematic, has been found in SourceCodester Online Graduate Tracer System 1.0. This issue affects some unknown proce… |
CVE-2024-27731 | Medium | 6.1 | 2024-08-15 | Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the lack of file type filtering in the f… |
CVE-2024-31799 | Medium | 4.6 | 2024-08-15 | Information Disclosure in GNCC's GC2 Indoor Security Camera 1080P allows an attacker with physical access to read the WiFi passphrase via the UART Debugging Po… |
CVE-2024-7411 | Medium | 5.3 | 2024-08-15 | The Newsletters plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 4.9.9. This is due the plugin not preventing d… |
CVE-2024-7063 | Medium | 4.3 | 2024-08-15 | The ElementsKit Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.6 via the 'render_raw' funct… |
CVE-2024-27120 | High | 7.5 | 2024-08-14 | A Local File Inclusion vulnerability has been found in ComfortKey, a product of Celsius Benelux. Using this vulnerability, an unauthenticated attacker may retr… |
CVE-2024-42435 | Medium | 4.9 | 2024-08-14 | Sensitive information disclosure in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information… |
CVE-2024-39822 | Medium | 6.5 | 2024-08-14 | Sensitive information exposure in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct an informatio… |
CVE-2024-41723 | Medium | 4.3 | 2024-08-14 | Undisclosed requests to BIG-IP iControl REST can lead to information leak of user account names. Note: Software versions which have reached End of Technical S… |
CVE-2024-38760 | Medium | 5.3 | 2024-08-13 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in David Maucher Send Users Email allows Accessing Functionality Not Properly Constrai… |
CVE-2024-38756 | Medium | 5.3 | 2024-08-13 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Weblizar Coming Soon allows Accessing Functionality Not Properly Constrained by ACL… |
CVE-2024-38749 | Medium | 5.3 | 2024-08-13 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Olive Themes Olive One Click Demo Import allows Accessing Functionality Not Properl… |
CVE-2024-38747 | High | 7.5 | 2024-08-13 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HitPay Payment Solutions Pte Ltd HitPay Payment Gateway for WooCommerce allows Acce… |
CVE-2024-38742 | Medium | 5.3 | 2024-08-13 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in MBE Worldwide S.P.A. MBE eShip allows Accessing Functionality Not Properly Constrai… |
CVE-2024-41736 | Medium | 4.3 | 2024-08-13 | Under certain conditions SAP Permit to Work allows an authenticated attacker to access information which would otherwise be restricted causing low impact on th… |
CVE-2024-41733 | Medium | 5.3 | 2024-08-13 | In SAP Commerce, valid user accounts can be identified during the customer registration and login processes. This allows a potential attacker to learn if a giv… |
CVE-2024-33003 | High | 7.4 | 2024-08-13 | Some OCC API endpoints in SAP Commerce Cloud allows Personally Identifiable Information (PII) data, such as passwords, email addresses, mobile numbers, coupon… |
CVE-2024-37924 | Medium | 5.3 | 2024-08-12 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wp2speed WP2Speed Faster allows Accessing Functionality Not Properly Constrained by… |
CVE-2024-7704 | Medium | 5.3 | 2024-08-12 | A vulnerability was found in Weaver e-cology 8. It has been classified as problematic. Affected is an unknown function of the file /cloudstore/ecode/setup/ecol… |
CVE-2024-7697 | High | 7.5 | 2024-08-12 | Logical vulnerability in the mobile application (com.transsion.carlcare) may lead to user information leakage risks. |
CVE-2024-7416 | Medium | 5.3 | 2024-08-12 | The Reveal Template plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.7. This is due to the plugin allowing di… |
CVE-2024-7414 | Medium | 5.3 | 2024-08-12 | The PDF Builder for WPForms plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.116. This is due to the plugin… |
CVE-2024-7413 | Medium | 5.3 | 2024-08-12 | The Obfuscate Email plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.8.1. This is due to the plugin allowing… |
CVE-2024-7412 | Medium | 5.3 | 2024-08-12 | The No Update Nag plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.4.12. This is due to the plugin allowing d… |
CVE-2024-7410 | Medium | 5.3 | 2024-08-12 | The My Custom CSS PHP & ADS plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.3. This is due the plugin not pr… |
CVE-2024-7382 | Medium | 5.3 | 2024-08-12 | The Linkify Text plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.9.1. This is due to the plugin utilizing bo… |
CVE-2024-6562 | Medium | 5.3 | 2024-08-12 | The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.5.5. This… |
CVE-2024-38200 | Medium | 6.5 | 2024-08-12 | Microsoft Office Spoofing Vulnerability |
CVE-2024-42493 | Medium | 5.3 | 2024-08-08 | Dorsett Controls InfoScan is vulnerable due to a leak of possible sensitive information through the response headers and the rendered JavaScript prior to use… |
CVE-2024-39287 | Medium | 5.3 | 2024-08-08 | Dorsett Controls Central Server update server has potential information leaks with an unprotected file that contains passwords and API keys. |
CVE-2024-7554 | Medium | 4.9 | 2024-08-08 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.9 before 17.0.6, all versions starting from 17.1 before 17.1.4, all versio… |
CVE-2024-6552 | Medium | 5.3 | 2024-08-08 | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2… |
CVE-2024-42222 | Medium | 4.3 | 2024-08-07 | In Apache CloudStack 4.19.1.0, a regression in the network listing API allows unauthorised list access of network details for domain admin and normal user acco… |
CVE-2024-34788 | Medium | 6.5 | 2024-08-07 | An improper authentication vulnerability in web component of EPMM prior to 12.1.0.1 allows a remote malicious user to access potentially sensitive information |
CVE-2024-42394 | Critical | 9.8 | 2024-08-06 | There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation coul… |
CVE-2024-39817 | Medium | 6.5 | 2024-08-06 | Insertion of sensitive information into sent data issue exists in Cybozu Office 10.0.0 to 10.8.6, which may allow a user who can login to the product to view d… |
CVE-2024-42010 | High | 7.5 | 2024-08-05 | mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messag… |
CVE-2024-7319 | Medium | 5.0 | 2024-08-02 | An incomplete fix for CVE-2023-1625 was found in openstack-heat. Sensitive information may possibly be disclosed through the OpenStack stack abandon command wi… |
CVE-2024-6567 | Medium | 5.3 | 2024-08-02 | The Ebook Store plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 5.8001. This is due to the plugin utilizing fp… |
CVE-2024-38761 | High | 7.5 | 2024-08-01 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from… |
CVE-2024-41259 | Critical | 9.1 | 2024-08-01 | Use of insecure hashing algorithm in the Gravatar's service in Navidrome v0.52.3 allows attackers to manipulate a user's account information. |
CVE-2024-41264 | High | 7.5 | 2024-08-01 | An issue discovered in casdoor v1.636.0 allows attackers to obtain sensitive information via the ssh.InsecureIgnoreHostKey() method. |
CVE-2024-7339 | Medium | 5.3 | 2024-08-01 | A vulnerability has been found in TVT DVR TD-2104TS-CL, DVR TD-2108TS-HP, Provision-ISR DVR SH-4050A5-5L(MM) and AVISION DVR AV108T and classified as problemat… |
CVE-2024-6687 | Medium | 5.3 | 2024-08-01 | The CTT Expresso para WooCommerce plugin for WordPress is vulnerable to sensitive information exposure in all versions up to and including 3.2.12 via the /wp-c… |
CVE-2024-7328 | Medium | 5.3 | 2024-07-31 | A vulnerability, which was classified as problematic, has been found in YouDianCMS 7. This issue affects some unknown processing of the file /t.php?action=phpi… |
CVE-2024-41108 | High | 7.5 | 2024-07-31 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. The hostinfo page has missing/improper access control since only the host's… |
CVE-2024-41109 | Medium | 6.3 | 2024-07-30 | Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Navigating to `/admin/index/statistics` with a logged in Pimcore user exposes inf… |
CVE-2024-41701 | Medium | 5.3 | 2024-07-30 | AccuPOS - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2024-41696 | High | 7.5 | 2024-07-30 | Priority PRI WEB Portal Add-On for Priority ERP on prem - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2024-41694 | Medium | 5.3 | 2024-07-30 | Cybonet - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2024-40836 | Medium | 5.5 | 2024-07-29 | A logic issue was addressed with improved checks. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, watchOS 10… |
CVE-2024-40823 | Medium | 5.5 | 2024-07-29 | The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. An app may be able to acce… |
CVE-2024-40804 | Medium | 5.5 | 2024-07-29 | The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.6. A malicious application may be able to access private information. |
CVE-2024-40798 | Low | 3.3 | 2024-07-29 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, macOS Monterey 12.7.6, macOS So… |
CVE-2024-40793 | Medium | 5.5 | 2024-07-29 | This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Monterey 12.7.6… |
CVE-2024-40775 | Medium | 5.5 | 2024-07-29 | A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6… |
CVE-2024-27884 | Medium | 5.5 | 2024-07-29 | This issue was addressed with a new entitlement. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. An… |
CVE-2023-42948 | Low | 3.3 | 2024-07-29 | This issue was addressed through improved state management. This issue is fixed in macOS Sonoma 14. A Wi-Fi password may not be deleted when activating a Mac i… |
CVE-2023-42925 | Low | 3.3 | 2024-07-29 | The issue was addressed with improved restriction of data container access. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to… |
CVE-2024-7156 | Medium | 5.3 | 2024-07-28 | A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513 and classified as problematic. Affected by this issue is some unknown functionality of the f… |
CVE-2024-42049 | Critical | 9.1 | 2024-07-28 | TightVNC (Server for Windows) before 2.8.84 allows attackers to connect to the control pipe via a network connection. |
CVE-2024-5614 | Medium | 5.3 | 2024-07-27 | The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.29 via the 'paf… |
CVE-2024-6569 | Medium | 5.3 | 2024-07-27 | The Campaign Monitor for WordPress plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.8.15. This is due the plu… |
CVE-2024-6573 | Medium | 5.3 | 2024-07-27 | The Intelligence plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.4.0. This is due the plugin not preventing… |
CVE-2024-6566 | Medium | 5.3 | 2024-07-27 | The Aramex Shipping WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.1.21. This is due the plugin… |
CVE-2024-6549 | Medium | 5.3 | 2024-07-27 | The Admin Post Navigation plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.1. This is due to the plugin utili… |
CVE-2024-6548 | Medium | 5.3 | 2024-07-27 | The Add Admin JavaScript plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0. This is due to the plugin utiliz… |
CVE-2024-6547 | Medium | 5.3 | 2024-07-27 | The Add Admin CSS plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0.1. This is due to the plugin utilizing… |
CVE-2024-6546 | Medium | 5.3 | 2024-07-27 | The One Click Close Comments plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.7.1. This is due to the plugin… |
CVE-2024-6545 | Medium | 5.3 | 2024-07-27 | The Admin Trim Interface plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.5.1. This is due to the plugin util… |
CVE-2024-7128 | Medium | 5.3 | 2024-07-26 | A flaw was found in the OpenShift console. Several endpoints in the application use the authHandler() and authHandlerWithUser() middleware functions. When the… |
CVE-2024-7091 | Medium | 4.1 | 2024-07-24 | An issue was discovered in GitLab CE/EE affecting all versions starting from 15.6 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and starting from 17.2 p… |
CVE-2024-7060 | Low | 2.6 | 2024-07-24 | An information disclosure vulnerability in GitLab CE/EE in project/group exports affecting all versions from 15.4 prior to 17.0.5, 17.1 prior to 17.1.3, and 17… |
CVE-2024-5067 | Medium | 4.4 | 2024-07-24 | An issue was discovered in GitLab EE affecting all versions starting from 16.11 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and starting from 17.2 pri… |
CVE-2024-41672 | High | 7.5 | 2024-07-24 | DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is accessible for reading using `sniff_csv`, even with `enable_e… |
CVE-2024-39676 | High | 7.5 | 2024-07-24 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Pinot. This issue affects Apache Pinot: from 0.1 before 1.0.0. Users are r… |
CVE-2024-6571 | Medium | 5.3 | 2024-07-24 | The Optimize Images ALT Text (alt tag) & names for SEO using AI plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including… |
CVE-2024-6553 | Medium | 5.3 | 2024-07-24 | The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.3.This is d… |
CVE-2024-23321 | High | 8.8 | 2024-07-22 | For RocketMQ versions 5.2.0 and below, under certain conditions, there is a risk of exposure of sensitive Information to an unauthorized actor even if RocketMQ… |
CVE-2024-6560 | Medium | 5.3 | 2024-07-20 | The Addonify – Quick View For WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.16. This is due… |
CVE-2024-6455 | Medium | 5.3 | 2024-07-18 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.2.0 due to a missing capabi… |
CVE-2024-40647 | Medium | 5.3 | 2024-07-18 | sentry-sdk is the official Python SDK for Sentry.io. A bug in Sentry's Python SDK < 2.8.0 allows the environment variables to be passed to subprocesses despite… |
CVE-2024-29885 | Medium | 4.3 | 2024-07-17 | silverstripe/reports is an API for creating backend reports in the Silverstripe Framework. In affected versions reports can be accessed by their direct URL by… |
CVE-2024-40633 | Medium | 5.3 | 2024-07-17 | Sylius is an Open Source eCommerce Framework on Symfony. A security vulnerability was discovered in the `/api/v2/shop/adjustments/{id}` endpoint, which retriev… |
CVE-2024-20396 | Medium | 5.3 | 2024-07-17 | A vulnerability in the protocol handlers of Cisco Webex App could allow an unauthenticated, remote attacker to gain access to sensitive information. This vu… |
CVE-2024-21152 | High | 8.1 | 2024-07-16 | Vulnerability in the Oracle Process Manufacturing Financials product of Oracle E-Business Suite (component: Allocation Rules). Supported versions that are aff… |
CVE-2024-21147 | High | 7.4 | 2024-07-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versi… |
CVE-2024-21140 | Medium | 4.8 | 2024-07-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versi… |