CWE-200 · Information Disclosure (page 31)
Page 31 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-21136 | High | 8.6 | 2024-07-16 | Vulnerability in the Oracle Retail Xstore Office product of Oracle Retail Applications (component: Security). Supported versions that are affected are 19.0.5… |
CVE-2024-6395 | Medium | 5.3 | 2024-07-16 | An exposure of sensitive information vulnerability in GitHub Enterprise Server would allow an attacker to enumerate the names of private repositories that util… |
CVE-2024-6336 | Medium | 5.3 | 2024-07-16 | A Security Misconfiguration vulnerability in GitHub Enterprise Server allowed sensitive information disclosure to unauthorized users in GitHub Enterprise Serve… |
CVE-2020-25836 | Medium | 6.3 | 2024-07-16 | Exposure of Sensitive Information to an Unauthorized Access vulnerability in OpenText NetIQ Directory and Resource Administrator. This issue affects NetIQ Dire… |
CVE-2022-45449 | Medium | 6.5 | 2024-07-16 | Sensitive information disclosure due to excessive privileges assigned to Acronis Agent. The following products are affected: Acronis Cyber Protect 15 (Windows… |
CVE-2024-6570 | Medium | 5.3 | 2024-07-16 | The Glossary plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.2.26. This is due the plugin utilizing wpdesk a… |
CVE-2024-6565 | Medium | 5.3 | 2024-07-16 | The AForms — Form Builder for Price Calculator & Cost Estimation plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and includin… |
CVE-2024-6559 | Medium | 5.3 | 2024-07-16 | The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and i… |
CVE-2024-6557 | Medium | 5.3 | 2024-07-16 | The SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher plugin for WordPress is vul… |
CVE-2024-39919 | Low | 3.1 | 2024-07-15 | @jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, o… |
CVE-2024-40554 | High | 7.5 | 2024-07-15 | An access control issue in Tmall_demo v2024.07.03 allows attackers to obtain sensitive information. |
CVE-2024-6398 | Medium | 4.3 | 2024-07-15 | An information disclosure vulnerability in SWG in versions 12.x prior to 12.2.10 and 11.x prior to 11.2.24 allows information stored in a customizable block pa… |
CVE-2024-6574 | Medium | 5.3 | 2024-07-13 | The Laposta plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.12. This is due to the plugin not preventing dir… |
CVE-2024-6555 | Medium | 5.3 | 2024-07-12 | The WP Popups – WordPress Popup builder plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.2.0.1. This is due t… |
CVE-2024-6407 | Critical | 9.8 | 2024-07-11 | CWE-200: Information Exposure vulnerability exists that could cause disclosure of credentials when a specially crafted message is sent to the device. |
CVE-2024-6554 | Medium | 5.3 | 2024-07-11 | The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and includin… |
CVE-2024-6210 | Medium | 5.3 | 2024-07-11 | The Duplicator plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 1.5.9. This makes it possible for unauthenticat… |
CVE-2024-27090 | Medium | 5.3 | 2024-07-10 | Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participati… |
CVE-2024-6646 | Medium | 5.3 | 2024-07-10 | A vulnerability was found in Netgear WN604 up to 20240710. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /… |
CVE-2024-37504 | Medium | 5.3 | 2024-07-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ninja Team FileBird Document Library.This issue affects FileBird Document Library… |
CVE-2024-37498 | Medium | 5.3 | 2024-07-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pauple Table & Contact Form 7 Database – Tablesome.This issue affects Table & Conta… |
CVE-2024-37115 | High | 7.5 | 2024-07-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Automattic Newspack Blocks.This issue affects Newspack Blocks: from n/a through 3.0… |
CVE-2024-37113 | Critical | 9.8 | 2024-07-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/… |
CVE-2024-37110 | High | 7.5 | 2024-07-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/… |
CVE-2024-6556 | Medium | 5.3 | 2024-07-10 | The SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and includi… |
CVE-2024-6550 | Medium | 5.3 | 2024-07-10 | The Gravity Forms: Multiple Form Instances plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.1.1. This is due… |
CVE-2024-32670 | | 2024-07-10 | Exposure of Sensitive Information to an Unauthorized Actor in Samsung Galaxy SmartTag2 prior to 0.20.04 allows attackes to potentially identify the tag's locat… | |
CVE-2024-38970 | Medium | 4.9 | 2024-07-09 | vaeThink 1.0.2 is vulnerable to Information Disclosure via the system backend,access management administrator function. |
CVE-2024-27362 | Medium | 4.4 | 2024-07-09 | A vulnerability was discovered in Samsung Mobile Processors Exynos 1280, Exynos 2200, Exynos 1330, Exynos 1380, and Exynos 2400 where they do not properly chec… |
CVE-2024-38041 | Medium | 5.5 | 2024-07-09 | Windows Kernel Information Disclosure Vulnerability |
CVE-2024-38030 | Medium | 6.5 | 2024-07-09 | Windows Themes Spoofing Vulnerability |
CVE-2024-38020 | Medium | 6.5 | 2024-07-09 | Microsoft Outlook Spoofing Vulnerability |
CVE-2024-38017 | Medium | 5.5 | 2024-07-09 | Microsoft Message Queuing Information Disclosure Vulnerability |
CVE-2024-30081 | High | 7.1 | 2024-07-09 | Windows NTLM Spoofing Vulnerability |
CVE-2024-6612 | Medium | 5.3 | 2024-07-09 | CSP violations generated links in the console tab of the developer tools, pointing to the violating resource. This caused a DNS prefetch which leaked that a CS… |
CVE-2023-52238 | Medium | 4.3 | 2024-07-09 | A vulnerability has been identified in RUGGEDCOM RST2228 (All versions < V5.9.0), RUGGEDCOM RST2228P (All versions < V5.9.0). The web server of the affected sy… |
CVE-2023-52237 | High | 7.5 | 2024-07-09 | A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RU… |
CVE-2024-3228 | Medium | 5.3 | 2024-07-09 | The Social Sharing Plugin – Kiwi plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.1.7 via the 'kiwi-nw-pinter… |
CVE-2024-39600 | Medium | 5.0 | 2024-07-09 | Under certain conditions, the memory of SAP GUI for Windows contains the password used to log on to an SAP system, which might allow an attacker to get hold of… |
CVE-2024-37180 | Medium | 4.1 | 2024-07-09 | Under certain conditions SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to access remote-enabled function module with no furthe… |
CVE-2024-39593 | Medium | 6.9 | 2024-07-09 | SAP Landscape Management allows an authenticated user to read confidential data disclosed by the REST Provider Definition response. Successful exploitation can… |
CVE-2024-39896 | High | 7.5 | 2024-07-08 | Directus is a real-time API and App dashboard for managing SQL database content. When relying on SSO providers in combination with local authentication it can… |
CVE-2024-23562 | Medium | 5.3 | 2024-07-08 | A security vulnerability in HCL Domino could allow disclosure of sensitive configuration information. A remote unauthenticated attacker could exploit this vul… |
CVE-2024-40597 | High | 7.5 | 2024-07-07 | An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. It can expose suppressed information for log events. (The log_deleted attribut… |
CVE-2024-39182 | High | 7.5 | 2024-07-05 | An information disclosure vulnerability in ISPmanager v6.98.0 allows attackers to access sensitive details of the root user's session via an arbitrary command… |
CVE-2024-39210 | High | 7.5 | 2024-07-05 | Best House Rental Management System v1.0 was discovered to contain an arbitrary file read vulnerability via the Page parameter at index.php. This vulnerability… |
CVE-2024-6506 | High | 8.2 | 2024-07-04 | Information exposure vulnerability in the MRW plugin, in its 5.4.3 version, affecting the "mrw_log" functionality. This vulnerability could allow a remote atta… |
CVE-2024-32754 | Low | 3.1 | 2024-07-04 | Under certain circumstances, when the controller is in factory reset mode waiting for initial setup, it will broadcast its MAC address, serial number, and firm… |
CVE-2024-39683 | Medium | 5.7 | 2024-07-03 | ZITADEL is an open-source identity infrastructure tool. ZITADEL provides users the ability to list all user sessions of the current user agent (browser). Start… |
CVE-2024-36122 | Low | 2.4 | 2024-07-03 | Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branche… |
CVE-2024-6426 | High | 8.1 | 2024-07-03 | Information exposure vulnerability in MESbook 20221021.03 version, the exploitation of which could allow a local attacker, with user privileges, to access diff… |
CVE-2024-39807 | Low | 3.1 | 2024-07-03 | Mattermost versions 9.5.x <= 9.5.5 and 9.8.0 fail to properly sanitize the recipients of a webhook event which allows an attacker monitoring webhook events to… |
CVE-2024-39353 | Low | 2.7 | 2024-07-03 | Mattermost versions 9.5.x <= 9.5.5 and 9.8.0 fail to sanitize the RemoteClusterFrame payloads before audit logging them which allows a high privileged attacker… |
CVE-2024-39314 | Medium | 4.7 | 2024-07-01 | toy-blog is a headless content management system implementation. Starting in version 0.4.3 and prior to version 0.5.0, the administrative password was leaked t… |
CVE-2024-39313 | Medium | 6.5 | 2024-07-01 | toy-blog is a headless content management system implementation. Starting in version 0.5.4 and prior to version 0.6.1, articles with private visibility can be… |
CVE-2024-36986 | Medium | 6.3 | 2024-07-01 | In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, an authenticated user coul… |
CVE-2024-34696 | Medium | 4.5 | 2024-07-01 | GeoServer is an open source server that allows users to share and edit geospatial data. Starting in version 2.10.0 and prior to versions 2.24.4 and 2.25.1, Geo… |
CVE-2024-30135 | Low | 3.3 | 2024-06-28 | HCL DRYiCE AEX is potentially impacted by disclosure of sensitive information in the mobile application when a snapshot is taken. |
CVE-2024-2795 | Medium | 5.3 | 2024-06-28 | The SEO SIMPLE PACK plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.2.1 via META description. This makes it… |
CVE-2024-22260 | Medium | 6.8 | 2024-06-27 | VMware Workspace One UEM update addresses an information exposure vulnerability. A malicious actor with network access to the Workspace One UEM may be able t… |
CVE-2024-36829 | High | 7.5 | 2024-06-26 | Incorrect access control in Teldat M1 v11.00.05.50.01 allows attackers to obtain sensitive information via a crafted query string. |
CVE-2024-5010 | High | 7.5 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, a vulnerability exists in the TestController functionality. A specially crafted unauthenticated HTTP req… |
CVE-2024-6294 | Low | 3.9 | 2024-06-25 | udn News Android APP stores the user session in logcat file when user log into the APP. A malicious APP or an attacker with physical access to the Android devi… |
CVE-2024-34991 | High | 7.5 | 2024-06-24 | In the module "Axepta" (axepta) before 1.3.4 from Quadra Informatique for PrestaShop, a guest can download partial credit card information (expiry date) / post… |
CVE-2024-33881 | Medium | 5.3 | 2024-06-24 | An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. The Virto.SharePoint.FileDownloader/Api/Download.ashx isCompleted… |
CVE-2024-33880 | Medium | 5.3 | 2024-06-24 | An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. It discloses full pathnames via Virto.SharePoint.FileDownloader/A… |
CVE-2024-5059 | Medium | 5.3 | 2024-06-21 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in A WP Life Event Management Tickets Booking.This issue affects Event Management Tick… |
CVE-2024-35776 | Medium | 5.3 | 2024-06-21 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Exeebit phpinfo() WP.This issue affects phpinfo() WP: from n/a through 5.0. |
CVE-2024-22002 | High | 7.8 | 2024-06-18 | CORSAIR iCUE 5.9.105 with iCUE Murals on Windows allows unprivileged users to insert DLL files in the cuepkg-1.2.6 subdirectory of the installation directory. |
CVE-2024-21685 | Medium | 6.5 | 2024-06-18 | This High severity Information Disclosure vulnerability was introduced in versions 9.4.0, 9.12.0, and 9.15.0 of Jira Core Data Center. This Information D… |
CVE-2024-37895 | Medium | 5.7 | 2024-06-17 | Lobe Chat is an open-source LLMs/AI chat framework. In affected versions if an attacker can successfully authenticate through SSO/Access Code, they can obtain… |
CVE-2024-38467 | High | 7.5 | 2024-06-16 | Shenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized user information retrieval via the queryUser API. |
CVE-2024-5464 | Medium | 4.0 | 2024-06-14 | Vulnerability of insufficient permission verification in the NearLink module Impact: Successful exploitation of this vulnerability may affect service confident… |
CVE-2024-0093 | Medium | 6.5 | 2024-06-13 | NVIDIA GPU software for Linux contains a vulnerability where it can expose sensitive information to an actor that is not explicitly authorized to have access t… |
CVE-2024-37307 | High | 7.9 | 2024-06-13 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.13.0 and prior to versions 1.13.7, 1.14.12, an… |
CVE-2024-30472 | High | 7.5 | 2024-06-13 | Telemetry Dashboard v1.0.0.8 for Dell ThinOS 2402 contains a sensitive information disclosure vulnerability. An unauthenticated user with local access to the d… |
CVE-2024-30300 | Critical | 9.8 | 2024-06-13 | Adobe Framemaker Publishing Server versions 2020.3, 2022.2 and earlier are affected by an Information Exposure vulnerability (CWE-200) that could lead to privi… |
CVE-2024-37325 | High | 8.1 | 2024-06-11 | Azure Science Virtual Machine (DSVM) Elevation of Privilege Vulnerability |
CVE-2024-35263 | Medium | 5.7 | 2024-06-11 | Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability |
CVE-2024-30096 | Medium | 5.5 | 2024-06-11 | Windows Cryptographic Services Information Disclosure Vulnerability |
CVE-2024-5813 | Medium | 5.9 | 2024-06-11 | A medium severity vulnerability in BIPS has been identified where an authenticated attacker with high privileges can access the SSH private keys via an informa… |
CVE-2024-4266 | Medium | 5.3 | 2024-06-11 | The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions… |
CVE-2020-11843 | Medium | 6.5 | 2024-06-11 | This allows the information exposure to unauthorized users. This issue affects NetIQ Access Manager using version 4.5 or before |
CVE-2024-34684 | Low | 3.7 | 2024-06-11 | On Unix, SAP BusinessObjects Business Intelligence Platform (Scheduling) allows an authenticated attacker with administrator access on the local server to acce… |
CVE-2024-28164 | Medium | 5.3 | 2024-06-11 | SAP NetWeaver AS Java (CAF - Guided Procedures) allows an unauthenticated user to access non-sensitive information about the server which would otherwise be re… |
CVE-2024-36471 | High | 7.5 | 2024-06-10 | Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL. Project administrators can run these imports, whic… |
CVE-2024-36307 | Medium | 4.7 | 2024-06-10 | A security agent link following vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to disclose sensitive information… |
CVE-2024-27814 | Low | 2.4 | 2024-06-10 | This issue was addressed through improved state management. This issue is fixed in watchOS 10.5. A person with physical access to a device may be able to view… |
CVE-2024-27806 | Medium | 5.5 | 2024-06-10 | This issue was addressed with improved environment sanitization. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey… |
CVE-2022-32933 | Medium | 5.3 | 2024-06-10 | An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in macOS Monterey 12.5. A website may be able to track the w… |
CVE-2024-35691 | Medium | 6.5 | 2024-06-08 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Marketing Fire, LLC Widget Options - Extended.This issue affects Widget Options - E… |
CVE-2024-35682 | Medium | 4.3 | 2024-06-08 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Themeisle Otter Blocks PRO.This issue affects Otter Blocks PRO: from n/a through 2… |
CVE-2024-35710 | Medium | 5.3 | 2024-06-08 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Podlove Podlove Web Player.This issue affects Podlove Web Player: from n/a through… |
CVE-2024-5133 | High | 8.1 | 2024-06-06 | In lunary-ai/lunary version 1.2.4, an account takeover vulnerability exists due to the exposure of password recovery tokens in API responses. Specifically, whe… |
CVE-2024-37150 | High | 7.6 | 2024-06-06 | An issue in `.npmrc` support in Deno 1.44.0 was discovered where Deno would send `.npmrc` credentials for the scope to the tarball URL when the registry provid… |
CVE-2024-35178 | High | 7.5 | 2024-06-06 | The Jupyter Server provides the backend for Jupyter web applications. Jupyter Server on Windows has a vulnerability that lets unauthenticated attackers leak th… |
CVE-2024-5615 | Medium | 5.3 | 2024-06-06 | The Open Graph plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.11.2 via the 'opengraph_default_des… |
CVE-2024-0910 | Medium | 5.3 | 2024-06-06 | The Restrict for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.7 due to improper res… |
CVE-2024-3716 | Medium | 6.2 | 2024-06-05 | A flaw was found in foreman-installer when puppet-candlepin is invoked cpdb with the --password parameter. This issue leaks the password in the process list an… |
CVE-2024-5483 | Medium | 5.3 | 2024-06-05 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.6.8 due to… |