CWE-200 · Information Disclosure (page 31)
Page 31 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-5920 | Low | 2.9 | 2023-11-02 | Mattermost Desktop for MacOS fails to utilize the secure keyboard input functionality provided by macOS, allowing for other processes to read the keyboard inpu… |
CVE-2023-5516 | Medium | 5.3 | 2023-11-01 | Poorly constructed webap requests and URI components with special characters trigger unhandled errors and exceptions, disclosing information about the underly… |
CVE-2023-5515 | Medium | 5.3 | 2023-11-01 | The responses for web queries with certain parameters disclose internal path of resources. This information can be used to learn internal structure of the app… |
CVE-2023-43796 | Medium | 5.3 | 2023-10-31 | Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be queried from Synapse. This… |
CVE-2023-43041 | Medium | 6.5 | 2023-10-29 | IBM QRadar SIEM 7.5 is vulnerable to information exposure allowing a delegated Admin tenant user with a specific domain security profile assigned to see data f… |
CVE-2022-3611 | High | 7.6 | 2023-10-27 | An information disclosure vulnerability has been identified in the Lenovo App Store which may allow some applications to gain unauthorized access to sensitive… |
CVE-2023-33558 | High | 7.5 | 2023-10-26 | An information disclosure vulnerability in the component users-grid-data.php of Ocomon before v4.0.1 allows attackers to obtain sensitive information such as e… |
CVE-2023-31416 | Medium | 5.3 | 2023-10-26 | Secret token configuration is never applied when using ECK <2.8 with APM Server >=8.0. This could lead to anonymous requests to an APM Server being accepted an… |
CVE-2023-38849 | High | 7.5 | 2023-10-25 | An issue in tire-sales Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. |
CVE-2023-38847 | High | 7.5 | 2023-10-25 | An issue in CHRISTINA JAPAN Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. |
CVE-2023-38846 | High | 7.5 | 2023-10-25 | An issue in Marbre Lapin Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. |
CVE-2023-38845 | High | 7.5 | 2023-10-25 | An issue in Anglaise Company Anglaise.Company v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. |
CVE-2023-42846 | Medium | 5.3 | 2023-10-25 | This issue was addressed by removing the vulnerable code. This issue is fixed in watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, tvOS 17.1, iOS 17.1 and iPadOS 17… |
CVE-2023-41988 | Medium | 6.8 | 2023-10-25 | This issue was addressed by restricting options offered on a locked device. This issue is fixed in macOS Sonoma 14.1, watchOS 10.1, iOS 17.1 and iPadOS 17.1. A… |
CVE-2023-46128 | Medium | 6.5 | 2023-10-25 | Nautobot is a Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 2.0.x, c… |
CVE-2023-46125 | Medium | 6.5 | 2023-10-25 | Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of pri… |
CVE-2023-42490 | High | 7.5 | 2023-10-25 | EisBaer Scada - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2023-39739 | High | 8.2 | 2023-10-25 | The leakage of the client secret in REGINA SWEETS&BAKERY Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages. |
CVE-2023-39737 | High | 8.2 | 2023-10-25 | The leakage of the client secret in Matsuya Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages. |
CVE-2023-39736 | High | 8.2 | 2023-10-25 | The leakage of the client secret in Fukunaga_memberscard Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages. |
CVE-2023-39735 | High | 8.2 | 2023-10-25 | The leakage of the client secret in Uomasa_Saiji_news Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages. |
CVE-2023-46288 | Medium | 4.3 | 2023-10-23 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.4.0 to 2.7.0. Sensitive co… |
CVE-2023-5718 | Medium | 4.3 | 2023-10-23 | The Vue.js Devtools extension was found to leak screenshot data back to a malicious web page via the standard `postMessage()` API. By creating a malicious web… |
CVE-2023-46315 | High | 7.5 | 2023-10-22 | The zanllp sd-webui-infinite-image-browsing (aka Infinite Image Browsing) extension before 977815a for stable-diffusion-webui (aka Stable Diffusion web UI), if… |
CVE-2023-5070 | Medium | 6.5 | 2023-10-20 | The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2… |
CVE-2023-4796 | Medium | 4.3 | 2023-10-20 | The Booster for WooCommerce for WordPress is vulnerable to Information Disclosure via the 'wcj_wp_option' shortcode in versions up to, and including, 7.1.0 due… |
CVE-2023-5576 | High | 8.0 | 2023-10-20 | The Migration, Backup, Staging - WPvivid plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 0.9.91 via Goog… |
CVE-2023-46115 | High | 8.4 | 2023-10-20 | Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a… |
CVE-2023-41893 | Medium | 4.3 | 2023-10-20 | Home assistant is an open source home automation. The audit team’s analyses confirmed that the `redirect_uri` and `client_id` are alterable when logging in. Co… |
CVE-2023-45809 | Low | 2.7 | 2023-10-19 | Wagtail is an open source content management system built on Django. A user with a limited-permission editor account for the Wagtail admin can make a direct UR… |
CVE-2023-42666 | Medium | 5.3 | 2023-10-19 | The affected product is vulnerable to an exposure of sensitive information to an unauthorized actor vulnerability, which may allow an attacker to… |
CVE-2023-5254 | Medium | 5.3 | 2023-10-19 | The ChatBot plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.8.9 via the qcld_wb_chatbot_check_user fun… |
CVE-2023-34437 | High | 7.5 | 2023-10-19 | Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a vulnerability in their password retrieval functionality which could allow an at… |
CVE-2023-45912 | High | 7.5 | 2023-10-18 | WIPOTEC GmbH ComScale v4.3.29.21344 and v4.4.12.723 fails to validate user sessions, allowing unauthenticated attackers to read files from the underlying opera… |
CVE-2023-5642 | Critical | 9.8 | 2023-10-18 | Advantech R-SeeNet v2.4.23 allows an unauthenticated remote attacker to read from and write to the snmpmon.ini file, which contains sensitive information. |
CVE-2023-5552 | High | 7.1 | 2023-10-18 | A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to decrypt PDFs in Sophos Firewall version… |
CVE-2023-22086 | High | 7.5 | 2023-10-17 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2023-22019 | High | 7.5 | 2023-10-17 | Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affected is 12.2.1.4.0… |
CVE-2023-45803 | Medium | 4.2 | 2023-10-17 | urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status… |
CVE-2023-5339 | Medium | 4.7 | 2023-10-17 | Mattermost Desktop fails to set an appropriate log level during initial run after fresh installation resulting in logging all keystrokes including password ent… |
CVE-2023-41752 | High | 7.5 | 2023-10-17 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through… |
CVE-2022-43889 | Medium | 5.3 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could disclose sensitive information through an HTTP request that could aid an attacker in further attacks agai… |
CVE-2021-38859 | Medium | 4.3 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow a user to obtain version number information using a specially crafted HTTP request that could be us… |
CVE-2012-10016 | Medium | 4.3 | 2023-10-17 | A vulnerability classified as problematic has been found in Halulu simple-download-button-shortcode Plugin 1.0 on WordPress. Affected is an unknown function of… |
CVE-2023-45131 | High | 7.5 | 2023-10-16 | Discourse is an open source platform for community discussion. New chat messages can be read by making an unauthenticated POST request to MessageBus. This issu… |
CVE-2023-44394 | Medium | 4.3 | 2023-10-16 | MantisBT is an open source bug tracker. Due to insufficient access-level checks on the Wiki redirection page, any user can reveal private Projects' names, by a… |
CVE-2023-44391 | Medium | 5.3 | 2023-10-16 | Discourse is an open source platform for community discussion. User summaries are accessible for anonymous users even when `hide_user_profiles_from_public` is… |
CVE-2023-43814 | Low | 3.7 | 2023-10-16 | Discourse is an open source platform for community discussion. Attackers with details specific to a poll in a topic can use the `/polls/grouped_poll_results` e… |
CVE-2023-45147 | Medium | 4.9 | 2023-10-16 | Discourse is an open source community platform. In affected versions any user can create a topic and add arbitrary custom fields to a topic. The severity of th… |
CVE-2023-38059 | Medium | 5.3 | 2023-10-16 | The loading of external images is not blocked, even if configured, if the attacker uses protocol-relative URL in the payload. This can be used to retreive the… |
CVE-2022-43868 | Medium | 5.3 | 2023-10-14 | IBM Security Verify Access OIDC Provider could disclose directory information that could aid attackers in further attacks against the system. IBM X-Force ID… |
CVE-2023-5579 | Low | 3.5 | 2023-10-14 | A vulnerability was found in yhz66 Sandbox 6.1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /im/user/… |
CVE-2023-45348 | Medium | 4.3 | 2023-10-14 | Apache Airflow, versions 2.7.0 and 2.7.1, is affected by a vulnerability that allows an authenticated user to retrieve sensitive configuration information when… |
CVE-2023-42780 | Medium | 6.5 | 2023-10-14 | Apache Airflow, versions prior to 2.7.2, contains a security vulnerability that allows authenticated users of Airflow to list warnings for all DAGs, even if th… |
CVE-2023-42663 | Medium | 6.5 | 2023-10-14 | Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about… |
CVE-2023-39999 | Medium | 4.3 | 2023-10-13 | Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through… |
CVE-2023-45143 | Low | 3.9 | 2023-10-12 | Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects… |
CVE-2023-44187 | Medium | 5.9 | 2023-10-11 | An Exposure of Sensitive Information vulnerability in the 'file copy' command of Junos OS Evolved allows a local, authenticated attacker with shell access to v… |
CVE-2023-41881 | Low | 3.7 | 2023-10-11 | vantage6 is privacy preserving federated learning infrastructure. When a collaboration is deleted, the linked resources (such as tasks from that collaboration)… |
CVE-2023-44097 | High | 7.5 | 2023-10-11 | Vulnerability of the permission to access device SNs being improperly managed.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-44093 | High | 7.5 | 2023-10-11 | Vulnerability of package names' public keys not being verified in the security module.Successful exploitation of this vulnerability may affect service confiden… |
CVE-2023-29348 | High | 7.5 | 2023-10-10 | Windows Remote Desktop Gateway (RD Gateway) Information Disclosure Vulnerability |
CVE-2023-37939 | Low | 3.3 | 2023-10-10 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClient for Windows 7.2.0, 7.0 all versions, 6.4 all versions, 6.2… |
CVE-2023-30804 | Medium | 4.9 | 2023-10-10 | The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authenticated file disclosure vulnerability. A remote and authenticated attack… |
CVE-2023-45219 | Medium | 4.4 | 2023-10-10 | Exposure of Sensitive Information vulnerability exist in an undisclosed BIG-IP TMOS shell (tmsh) command which may allow an authenticated attacker with resour… |
CVE-2022-34355 | Medium | 4.0 | 2023-10-06 | IBM Jazz Foundation (IBM Engineering Lifecycle Management 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2) could disclose sensitive version information to a user that co… |
CVE-2023-43804 | Medium | 5.9 | 2023-10-04 | urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies o… |
CVE-2023-3361 | High | 7.7 | 2023-10-04 | A flaw was found in Red Hat OpenShift Data Science. When exporting a pipeline from the Elyra notebook pipeline editor as Python DSL or YAML, it reads S3 creden… |
CVE-2023-1584 | High | 7.5 | 2023-10-04 | A flaw was found in Quarkus. Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, which can a… |
CVE-2022-22447 | Medium | 4.0 | 2023-10-04 | IBM Disconnected Log Collector 1.0 through 1.8.2 is vulnerable to potential security misconfigurations that could disclose unintended information. IBM X-Force… |
CVE-2023-4886 | Medium | 6.7 | 2023-10-03 | A sensitive information exposure vulnerability was found in foreman. Contents of tomcat's server.xml file, which contain passwords to candlepin's keystore and… |
CVE-2023-3349 | High | 8.2 | 2023-10-03 | Information exposure vulnerability in IBERMATICA RPS 2019, which exploitation could allow an unauthenticated user to retrieve sensitive information, such as us… |
CVE-2022-47892 | Medium | 5.3 | 2023-10-03 | All versions of NetMan 204 could allow an unauthenticated remote attacker to read a file (config.cgi) containing sensitive information, like credentials. |
CVE-2023-5160 | Medium | 4.3 | 2023-10-02 | Mattermost fails to check the Show Full Name option at the /api/v4/teams/TEAM_ID/top/team_members endpoint allowing a member to get the full name of another us… |
CVE-2023-5256 | High | 7.5 | 2023-09-28 | In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and ma… |
CVE-2023-42820 | High | 7.0 | 2023-09-27 | JumpServer is an open source bastion host. This vulnerability is due to exposing the random number seed to the API, potentially allowing the randomly generated… |
CVE-2023-41323 | Medium | 5.3 | 2023-09-27 | GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses… |
CVE-2023-41321 | Medium | 4.9 | 2023-09-27 | GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses… |
CVE-2023-40049 | Medium | 5.3 | 2023-09-27 | In WS_FTP Server version prior to 8.8.2, an unauthenticated user could enumerate files under the 'WebServiceHost' directory listing. |
CVE-2023-23958 | Medium | 6.8 | 2023-09-27 | Symantec Protection Engine, prior to 9.1.0, may be susceptible to a Hash Leak vulnerability. |
CVE-2023-5166 | High | 8.0 | 2023-09-25 | Docker Desktop before 4.23.0 allows Access Token theft via a crafted extension icon URL. This issue affects Docker Desktop: before 4.23.0. |
CVE-2023-41293 | High | 7.5 | 2023-09-25 | Data security classification vulnerability in the DDMP module. Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2023-1633 | Medium | 6.6 | 2023-09-24 | A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to sens… |
CVE-2023-5134 | Medium | 4.3 | 2023-09-23 | The Easy Registration Forms for WordPress is vulnerable to Information Disclosure via the 'erforms_user_meta' shortcode in versions up to, and including, 2.1.1… |
CVE-2023-38344 | Medium | 6.5 | 2023-09-21 | An issue was discovered in Ivanti Endpoint Manager before 2022 SU4. A file disclosure vulnerability exists in the GetFileContents SOAP action exposed via /land… |
CVE-2023-39677 | High | 7.5 | 2023-09-20 | MyPrestaModules Prestashop Module v6.2.9 and UpdateProducts Prestashop Module v3.6.9 were discovered to contain a PHPInfo information disclosure vulnerability… |
CVE-2023-39052 | Medium | 6.5 | 2023-09-20 | An information leak in Earthgarden_waiting 13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39045 | Medium | 6.5 | 2023-09-20 | An information leak in kokoroe_members card Line 13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-38718 | Low | 3.7 | 2023-09-20 | IBM Robotic Process Automation 21.0.0 through 21.0.7.8 could disclose sensitive information from access to RPA scripts, workflows and related data. IBM X-Forc… |
CVE-2023-40368 | Medium | 4.4 | 2023-09-20 | IBM Storage Protect 8.1.0.0 through 8.1.19.0 could allow a privileged user to obtain sensitive information from the administrative command line client. IBM X-… |
CVE-2023-43617 | Medium | 5.3 | 2023-09-20 | An issue was discovered in Croc through 9.6.5. When a custom shared secret is used, the sender and receiver may divulge parts of this secret to an untrusted Re… |
CVE-2022-47554 | High | 8.2 | 2023-09-19 | Exposure of sensitive information in ekorCCP and ekorRCI, potentially allowing a remote attacker to obtain critical information from various .xml files, includ… |
CVE-2023-42454 | Critical | 10.0 | 2023-09-18 | SQLpage is a SQL-only webapp builder. Someone using SQLpage versions prior to 0.11.1, whose SQLpage instance is exposed publicly, with a database connection st… |
CVE-2023-42387 | High | 7.5 | 2023-09-18 | An issue in TDSQL Chitu management platform v.10.3.19.5.0 allows a remote attacker to obtain sensitive information via get_db_info function in install.php. |
CVE-2023-37263 | Medium | 6.8 | 2023-09-15 | Strapi is the an open-source headless content management system. Prior to version 4.12.1, field level permissions are not respected in the relationship title… |
CVE-2023-36472 | Medium | 5.8 | 2023-09-15 | Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if the… |
CVE-2023-36551 | Medium | 4.3 | 2023-09-13 | A exposure of sensitive information to an unauthorized actor in Fortinet FortiSIEM version 6.7.0 through 6.7.5 allows attacker to information disclosure via a… |
CVE-2021-44172 | Medium | 4.3 | 2023-09-13 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClientEMS versions 7.0.0 through 7.0.4, 7.0.6 through 7.0.7, in a… |
CVE-2023-4917 | Medium | 5.3 | 2023-09-13 | The Leyka plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.30.7 via the 'leyka_ajax_get_env_and_options… |
CVE-2023-36763 | High | 7.5 | 2023-09-12 | Microsoft Outlook Information Disclosure Vulnerability |