CWE-200 · Information Disclosure (page 32)
Page 32 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-40712 | Medium | 6.5 | 2023-09-12 | Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a… |
CVE-2023-4877 | High | 7.5 | 2023-09-10 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository hamza417/inure prior to build92. |
CVE-2023-4876 | High | 7.5 | 2023-09-10 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository hamza417/inure prior to build92. |
CVE-2022-22409 | Medium | 5.3 | 2023-09-08 | IBM Aspera Faspex 5.0.5 could allow a remote attacker to gather sensitive information about the web application, caused by an insecure configuration. IBM X-Fo… |
CVE-2023-28010 | Medium | 4.0 | 2023-09-08 | In some configuration scenarios, the Domino server host name can be exposed. This information could be used to target future attacks. |
CVE-2023-39620 | High | 7.5 | 2023-09-08 | An Issue in Buffalo America, Inc. TeraStation NAS TS5410R v.5.00 thru v.0.07 allows a remote attacker to obtain sensitive information via the guest account fun… |
CVE-2023-40029 | Critical | 9.9 | 2023-09-07 | Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a resul… |
CVE-2023-41050 | Medium | 6.8 | 2023-09-06 | AccessControl provides a general security framework for use in Zope. Python's "format" functionality allows someone controlling the format string to "read" obj… |
CVE-2023-32271 | Medium | 6.5 | 2023-09-05 | An information disclosure vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OAS Platform v18.00.0072. A… |
CVE-2023-4714 | Medium | 4.3 | 2023-09-01 | A vulnerability was found in PlayTube 3.0.1 and classified as problematic. This issue affects some unknown processing of the component Redirect Handler. The ma… |
CVE-2023-23763 | Medium | 5.3 | 2023-09-01 | An authorization/sensitive information disclosure vulnerability was identified in GitHub Enterprise Server that allowed a fork to retain read access to an upst… |
CVE-2022-4343 | Medium | 5.0 | 2023-09-01 | An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions… |
CVE-2023-41749 | High | 7.5 | 2023-08-31 | Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Agent (Windows) before build 3… |
CVE-2023-41745 | Medium | 5.5 | 2023-08-31 | Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Agent (Linux, macOS, Windows)… |
CVE-2021-32050 | Medium | 4.2 | 2023-08-29 | Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published ev… |
CVE-2023-0238 | Low | 3.9 | 2023-08-29 | Due to lack of a security policy, the WARP Mobile Client (<=6.29) for Android was susceptible to this vulnerability which allowed a malicious app installed on… |
CVE-2023-24959 | Medium | 5.3 | 2023-08-28 | IBM InfoSphere Information Systems 11.7 could expose information about the host system and environment configuration. IBM X-Force ID: 246332. |
CVE-2023-39289 | High | 7.5 | 2023-08-25 | A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2208.101 could allow an unauthenticated attacker to conduct an ac… |
CVE-2023-40580 | High | 8.1 | 2023-08-25 | Freighter is a Stellar chrome extension. It may be possible for a malicious website to access the recovery mnemonic phrase when the Freighter wallet is unlocke… |
CVE-2023-39519 | High | 7.5 | 2023-08-24 | Cloud Explorer Lite is an open source cloud management platform. Prior to version 1.4.0, there is a risk of sensitive information leakage in the user informati… |
CVE-2023-3705 | High | 7.5 | 2023-08-24 | The vulnerability exists in CP-Plus NVR due to an improper input handling at the web-based management interface of the affected product. An unauthenticated rem… |
CVE-2023-4230 | Medium | 5.3 | 2023-08-24 | A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, which has the potential to facilitate the collecti… |
CVE-2022-3745 | Medium | 4.4 | 2023-08-23 | A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to vi… |
CVE-2022-3743 | Medium | 4.4 | 2023-08-23 | A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges under… |
CVE-2023-37379 | High | 8.1 | 2023-08-23 | Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privile… |
CVE-2023-25913 | High | 7.5 | 2023-08-21 | Because of an authentication flaw an attacker would be capable of generating a web report that discloses sensitive information such as internal IP addresses, u… |
CVE-2023-38158 | Low | 3.1 | 2023-08-21 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability |
CVE-2023-40735 | High | 7.5 | 2023-08-21 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Cavo – Connecting for a Safer World BUTTERFLY BUTTON (Architecture flaw) allows los… |
CVE-2023-39974 | Medium | 5.3 | 2023-08-17 | Exposure of Sensitive Information vulnerability in AcyMailing Enterprise component for Joomla. It allows unauthorized actors to get the number of subscribers i… |
CVE-2023-40348 | Medium | 5.3 | 2023-08-16 | The webhook endpoint in Jenkins Gogs Plugin 1.0.15 and earlier provides unauthenticated attackers information about the existence of jobs in its output. |
CVE-2023-32495 | High | 7.8 | 2023-08-16 | Dell PowerScale OneFS, 8.2.x-9.5.x, contains a exposure of sensitive information to an unauthorized Actor vulnerability. An authorized local attacker could po… |
CVE-2023-2916 | High | 7.5 | 2023-08-15 | The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the 'admin_notice' func… |
CVE-2023-21267 | Medium | 5.5 | 2023-08-14 | In multiple functions of KeyguardViewMediator.java, there is a possible way to bypass lockdown mode with screen pinning due to a logic error in the code. This… |
CVE-2023-40023 | Medium | 6.5 | 2023-08-14 | yaklang is a programming language designed for cybersecurity. The Yak Engine has been found to contain a local file inclusion (LFI) vulnerability. This vulnera… |
CVE-2023-39393 | High | 7.5 | 2023-08-13 | Vulnerability of insecure signatures in the ServiceWifiResources module. Successful exploitation of this vulnerability may cause ServiceWifiResources to be mal… |
CVE-2023-39383 | High | 7.5 | 2023-08-13 | Vulnerability of input parameters being not strictly verified in the AMS module. Successful exploitation of this vulnerability may compromise apps' data securi… |
CVE-2023-29500 | Medium | 5.3 | 2023-08-11 | Exposure of sensitive information to an unauthorized actor in BIOS firmware for some Intel(R) NUCs may allow a privilege user to potentially enable information… |
CVE-2023-32561 | High | 7.5 | 2023-08-10 | A previously generated artifact by an administrator could be accessed by an attacker. The contents of this artifact could lead to authentication bypass. Fixed… |
CVE-2023-38245 | Medium | 5.5 | 2023-08-10 | Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an Information Disclosure vulnerability. An unauthentic… |
CVE-2023-39951 | Medium | 6.5 | 2023-08-08 | OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. OpenTelemetry Java Instrumentation prior… |
CVE-2023-36908 | Medium | 6.5 | 2023-08-08 | Windows Hyper-V Information Disclosure Vulnerability |
CVE-2023-36894 | Medium | 6.5 | 2023-08-08 | Microsoft SharePoint Server Information Disclosure Vulnerability |
CVE-2023-4177 | Low | 2.6 | 2023-08-06 | A vulnerability was found in EmpowerID up to 7.205.0.0. It has been rated as problematic. This issue affects some unknown processing of the component Multi-Fac… |
CVE-2023-4168 | Medium | 4.3 | 2023-08-05 | A vulnerability was found in Templatecookie Adlisting 2.14.0. It has been classified as problematic. Affected is an unknown function of the file /ad-list of th… |
CVE-2023-39508 | High | 8.8 | 2023-08-05 | Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow… |
CVE-2023-38700 | Low | 3.5 | 2023-08-04 | matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it was possible to craft an event such that it would leak part of a targeted… |
CVE-2023-38494 | Medium | 5.9 | 2023-08-04 | MeterSphere is an open-source continuous testing platform. Prior to version 2.10.4 LTS, some interfaces of the Cloud version of MeterSphere do not have configu… |
CVE-2023-4139 | High | 7.5 | 2023-08-04 | The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Sensitive Information Exposure via Directory Listing due to missing restriction in export f… |
CVE-2023-26441 | Medium | 5.7 | 2023-08-02 | Cacheservice did not correctly check if relative cache object were pointing to the defined absolute location when accessing resources. An attacker with access… |
CVE-2023-31927 | Medium | 5.3 | 2023-08-02 | An information disclosure in the web interface of Brocade Fabric OS versions before Brocade Fabric OS v9.2.0 and v9.1.1c, could allow a remote unauthenticated… |
CVE-2023-38685 | Medium | 4.3 | 2023-07-28 | Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branche… |
CVE-2023-28203 | Medium | 5.5 | 2023-07-28 | The issue was addressed with improved checks. This issue is fixed in Apple Music 4.2.0 for Android. An app may be able to access contacts. |
CVE-2023-38503 | Medium | 5.7 | 2023-07-25 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 10.3.0 and prior to version 10.5.0, the permission filters… |
CVE-2023-38499 | Low | 3.7 | 2023-07-25 | TYPO3 is an open source PHP based web content management system. Starting in version 9.4.0 and prior to versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, and 12.4.4… |
CVE-2023-34235 | High | 8.6 | 2023-07-25 | Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the `t(number)` pre… |
CVE-2023-34093 | Medium | 4.8 | 2023-07-25 | Strapi is an open-source headless content management system. Prior to version 4.10.8, anyone (Strapi developers, users, plugins) can make every attribute of a… |
CVE-2023-37916 | Medium | 6.5 | 2023-07-21 | KubePi is an opensource kubernetes management panel. The endpoint /kubepi/api/v1/users/search?pageNum=1&&pageSize=10 leak password hash of any user (including… |
CVE-2023-3819 | Medium | 6.5 | 2023-07-21 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pimcore/pimcore prior to 10.6.4. |
CVE-2023-32476 | Medium | 6.4 | 2023-07-20 | Dell Hybrid Client version 2.0 contains a Sensitive Data Exposure vulnerability. An unauthenticated malicious user on the device can access hard coded secrets… |
CVE-2023-3779 | Medium | 5.3 | 2023-07-20 | The Essential Addons For Elementor plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 5.8.1 due to the… |
CVE-2023-27877 | Medium | 5.3 | 2023-07-19 | IBM Planning Analytics Cartridge for Cloud Pak for Data 4.0 connects to a CouchDB server. An attacker can exploit an insecure password policy to the CouchDB se… |
CVE-2023-26026 | Medium | 5.3 | 2023-07-19 | Planning Analytics Cartridge for Cloud Pak for Data 4.0 exposes sensitive information in logs which could lead an attacker to exploit this vulnerability to con… |
CVE-2023-35900 | Medium | 4.3 | 2023-07-19 | IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.4 and 23.0.0 through 23.0.5 is vulnerable to disclosing server version information which may… |
CVE-2023-35898 | Medium | 4.3 | 2023-07-19 | IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information due to an insecure security configuration in InfoSpher… |
CVE-2021-4428 | Low | 2.7 | 2023-07-18 | A vulnerability has been found in what3words Autosuggest Plugin up to 4.0.0 on WordPress and classified as problematic. Affected by this vulnerability is the f… |
CVE-2023-3709 | Medium | 5.3 | 2023-07-18 | The Royal Elementor Addons plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 1.3.70 due to the plugin… |
CVE-2023-33857 | Medium | 5.3 | 2023-07-17 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain system information using a specially crafted query that could aid in further att… |
CVE-2023-34236 | High | 8.5 | 2023-07-14 | Weave GitOps Terraform Controller (aka Weave TF-controller) is a controller for Flux to reconcile Terraform resources in a GitOps way. A vulnerability has been… |
CVE-2023-29450 | High | 8.5 | 2023-07-13 | JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of user "zabbix") on the Zabbix Server or Z… |
CVE-2023-34134 | Medium | 6.5 | 2023-07-13 | Exposure of sensitive information to an unauthorized actor vulnerability in SonicWall GMS and Analytics allows authenticated attacker to read administrator pas… |
CVE-2023-34131 | Medium | 5.3 | 2023-07-13 | Exposure of sensitive information to an unauthorized actor vulnerability in SonicWall GMS and Analytics enables an unauthenticated attacker to access restricte… |
CVE-2023-38062 | Medium | 4.3 | 2023-07-12 | In JetBrains TeamCity before 2023.05.1 parameters of the "password" type could be shown in the UI in certain composite build configurations |
CVE-2022-46651 | Medium | 6.5 | 2023-07-12 | Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection e… |
CVE-2023-34090 | High | 7.5 | 2023-07-11 | Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participati… |
CVE-2023-33174 | Medium | 5.5 | 2023-07-11 | Windows Cryptographic Information Disclosure Vulnerability |
CVE-2023-33165 | Medium | 4.3 | 2023-07-11 | Microsoft SharePoint Server Security Feature Bypass Vulnerability |
CVE-2023-24881 | Medium | 6.5 | 2023-07-11 | Microsoft Teams Information Disclosure Vulnerability |
CVE-2023-34442 | Low | 3.3 | 2023-07-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Camel.This issue affects Apache Camel: from 3.X t… |
CVE-2023-3553 | High | 7.5 | 2023-07-08 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository nilsteampassnet/teampass prior to 3.0.10. |
CVE-2023-35934 | Medium | 6.1 | 2023-07-06 | yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak co… |
CVE-2023-37239 | High | 7.5 | 2023-07-06 | Format string vulnerability in the distributed file system. Attackers who bypass the selinux permission can exploit this vulnerability to crash the program. |
CVE-2022-48520 | High | 7.5 | 2023-07-06 | Unauthorized access vulnerability in the SystemUI module. Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2022-48519 | High | 7.5 | 2023-07-06 | Unauthorized access vulnerability in the SystemUI module. Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2022-48516 | High | 7.5 | 2023-07-06 | Vulnerability that a unique value can be obtained by a third-party app in the DSoftBus module. Successful exploitation of this vulnerability will affect confid… |
CVE-2022-48514 | High | 7.5 | 2023-07-06 | The Sepolicy module has inappropriate permission control on the use of Netlink.Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2022-48510 | Critical | 9.8 | 2023-07-06 | Input verification vulnerability in the AMS module. Successful exploitation of this vulnerability will cause unauthorized operations. |
CVE-2023-3455 | Critical | 9.1 | 2023-07-05 | Key management vulnerability on system. Successful exploitation of this vulnerability may affect service availability and integrity. |
CVE-2021-46891 | Critical | 9.8 | 2023-07-05 | Vulnerability of incomplete read and write permission verification in the GPU module. Successful exploitation of this vulnerability may affect service confiden… |
CVE-2023-21624 | Medium | 6.2 | 2023-07-04 | Information disclosure in DSP Services while loading dynamic module. |
CVE-2023-36817 | High | 7.5 | 2023-07-03 | `tktchurch/website` contains the codebase for The King's Temple Church website. In version 0.1.0, a Stripe API key was found in the public code repository of t… |
CVE-2023-36539 | Medium | 5.3 | 2023-06-30 | Exposure of information intended to be encrypted by some Zoom clients may lead to disclosure of sensitive information. |
CVE-2023-36476 | High | 7.9 | 2023-06-29 | calamares-nixos-extensions provides Calamares branding and modules for NixOS, a distribution of GNU/Linux. Users of calamares-nixos-extensions version 0.3.12 a… |
CVE-2023-21237 | Medium | 5.5 | 2023-06-28 | In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI. T… |
CVE-2023-30993 | Medium | 6.8 | 2023-06-27 | IBM Cloud Pak for Security (CP4S) 1.9.0.0 through 1.9.2.0 could allow an attacker with a valid API key for one tenant to access data from another tenant's acco… |
CVE-2023-28857 | Medium | 4.0 | 2023-06-27 | Apereo CAS is an open source multilingual single sign-on solution for the web. Apereo CAS can be configured to use authentication based on client X509 certific… |
CVE-2022-34352 | Medium | 6.5 | 2023-06-27 | IBM QRadar SIEM 7.5.0 is vulnerable to information exposure allowing a delegated Admin tenant user with a specific domain security profile assigned to see dat… |
CVE-2023-34098 | Medium | 5.3 | 2023-06-27 | Shopware is an open source e-commerce software. Due to an incorrect configuration in the `.htaccess` file, the configuration file of the Javascript could be re… |
CVE-2023-3132 | Medium | 5.9 | 2023-06-27 | The MainWP Child plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.4.1.1 due to insufficient controls on… |
CVE-2023-34466 | Medium | 4.3 | 2023-06-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.0-milestone-1 and prior to versi… |
CVE-2023-2991 | Medium | 5.3 | 2023-06-22 | Fortra Globalscape EFT's administration server suffers from an information disclosure vulnerability where the serial number of the harddrive that Globalscape i… |