CWE-200 · Information Disclosure (page 33)
Page 33 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-25500 | Low | 3.5 | 2023-06-22 | Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0… |
CVE-2023-25499 | Medium | 5.7 | 2023-06-22 | When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 th… |
CVE-2023-35005 | Medium | 6.5 | 2023-06-19 | In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations. This vulnerability is mitigated by the fact configura… |
CVE-2023-2792 | Medium | 6.5 | 2023-06-16 | Mattermost fails to sanitize ephemeral error messages, allowing an attacker to obtain arbitrary message contents by a specially crafted /groupmsg command. |
CVE-2023-34242 | Low | 3.4 | 2023-06-15 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to version 1.13.4, when Gateway API is enabled in Cilium, the… |
CVE-2023-29287 | Medium | 5.3 | 2023-06-15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Information Exposure vulnerability that could… |
CVE-2023-28175 | High | 7.1 | 2023-06-15 | Improper Authorization in SSH server in Bosch VMS 11.0, 11.1.0, and 11.1.1 allows a remote authenticated user to access resources within the trusted internal n… |
CVE-2022-33159 | Medium | 5.3 | 2023-06-15 | IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID… |
CVE-2023-25683 | Medium | 5.9 | 2023-06-15 | IBM PowerVM Hypervisor FW950.00 through FW950.71, FW1010.00 through FW1010.40, FW1020.00 through FW1020.20, and FW1030.00 through FW1030.11 could allow an atta… |
CVE-2023-2820 | Medium | 6.1 | 2023-06-14 | An information disclosure vulnerability in the faye endpoint in Proofpoint Threat Response / Threat Response Auto-Pull (PTR/TRAP) could be used by an attacker… |
CVE-2023-33933 | High | 7.5 | 2023-06-14 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic… |
CVE-2022-47184 | High | 7.5 | 2023-06-14 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic… |
CVE-2023-3231 | Low | 3.1 | 2023-06-14 | A vulnerability has been found in UJCMS up to 6.0.2 and classified as problematic. This vulnerability affects unknown code of the component ZIP Package Handler… |
CVE-2023-34250 | Medium | 4.8 | 2023-06-13 | Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branche… |
CVE-2022-43684 | Critical | 9.9 | 2023-06-13 | ServiceNow has released patches and an upgrade that address an Access Control List (ACL) bypass issue in ServiceNow Core functionality. Additional Details … |
CVE-2023-27465 | Medium | 4.6 | 2023-06-13 | A vulnerability has been identified in SIMOTION C240 (All versions >= V5.4 < V5.5 SP1), SIMOTION C240 PN (All versions >= V5.4 < V5.5 SP1), SIMOTION D410-2 DP… |
CVE-2023-25912 | Medium | 5.3 | 2023-06-11 | The webreport generation feature in the Danfoss AK-EM100 allows an unauthorized actor to generate a web report that discloses sensitive information such as the… |
CVE-2023-22586 | High | 7.7 | 2023-06-11 | The Danfoss AK-EM100 web applications allow for Local File Inclusion in the file parameter. |
CVE-2023-32312 | Low | 3.7 | 2023-06-09 | UmbracoIdentityExtensions is an Umbraco add-on package that enables easy extensibility points for ASP.Net Identity integration. In affected versions client sec… |
CVE-2023-34243 | Medium | 5.8 | 2023-06-08 | TGstation is a toolset to manage production BYOND servers. In affected versions if a Windows user was registered in tgstation-server (TGS), an attacker could d… |
CVE-2023-33848 | Medium | 4.9 | 2023-06-07 | IBM TXSeries for Multiplatforms 8.1, 8.2, 9.1, CICS TX Standard, 11.1, CICS TX Advanced 10.1, and 11.1 could allow a privileged user to obtain highly sensitive… |
CVE-2021-4377 | Medium | 6.5 | 2023-06-07 | The Doneren met Mollie plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.8.5 via the dmm_export_donations() fun… |
CVE-2020-36723 | Medium | 5.3 | 2023-06-07 | The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Sensitive Data Exposure in versions before 2.6.1 via the ~/listingpro-plugi… |
CVE-2022-40525 | High | 7.1 | 2023-06-06 | Information disclosure in Linux Networking Firmware due to unauthorized information leak during side channel analysis. |
CVE-2022-40523 | High | 7.1 | 2023-06-06 | Information disclosure in Kernel due to indirect branch misprediction. |
CVE-2013-10030 | Medium | 4.3 | 2023-06-05 | A vulnerability, which was classified as problematic, has been found in Exit Box Lite Plugin up to 1.06 on WordPress. Affected by this issue is some unknown fu… |
CVE-2023-33956 | Medium | 4.3 | 2023-06-05 | Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to an Insecure direct object r… |
CVE-2023-3064 | High | 7.5 | 2023-06-05 | Anonymous user may get the list of existing users managed by the application, that could ease further attacks (see CVE-2023-3065 and 3066)This issue affects Mo… |
CVE-2023-34094 | High | 7.5 | 2023-06-02 | ChuanhuChatGPT is a graphical user interface for ChatGPT and many large language models. A vulnerability in versions 20230526 and prior allows unauthorized acc… |
CVE-2023-34092 | High | 7.5 | 2023-06-01 | Vite provides frontend tooling. Prior to versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9, Vite Server Options (`server.fs.deny`) can be bypassed using d… |
CVE-2023-33960 | High | 7.5 | 2023-06-01 | OpenProject is web-based project management software. For any OpenProject installation, a `robots.txt` file is generated through the server to denote which rou… |
CVE-2023-32710 | Medium | 4.8 | 2023-06-01 | In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and in Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user can perform an u… |
CVE-2023-33979 | Medium | 6.5 | 2023-05-31 | gpt_academic provides a graphical interface for ChatGPT/GLM. A vulnerability was found in gpt_academic 3.37 and prior. This issue affects some unknown processi… |
CVE-2023-2749 | High | 8.6 | 2023-05-31 | Download Center fails to properly validate the file path submitted by a user, An attacker can exploit this vulnerability to gain unauthorized access to sensiti… |
CVE-2023-31185 | High | 7.5 | 2023-05-30 | ROZCOM server framework - Misconfiguration may allow information disclosure via an unspecified request. |
CVE-2023-33955 | Medium | 4.3 | 2023-05-30 | Minio Console is the UI for MinIO Object Storage. Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename. This issue has been patc… |
CVE-2014-125102 | Medium | 4.3 | 2023-05-29 | A vulnerability classified as problematic was found in Bestwebsoft Relevant Plugin up to 1.0.7 on WordPress. Affected by this vulnerability is an unknown funct… |
CVE-2023-28322 | Low | 3.7 | 2023-05-26 | An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNC… |
CVE-2023-32681 | Medium | 6.1 | 2023-05-26 | Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endp… |
CVE-2022-39335 | Medium | 5.0 | 2023-05-26 | Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix Federation API allows remote homeservers to request… |
CVE-2023-2025 | Medium | 5.0 | 2023-05-18 | OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 may expose sensitive information to an unauthorized user under certain circumstances. |
CVE-2022-45459 | High | 7.5 | 2023-05-18 | Sensitive information disclosure due to insecure registry permissions. The following products are affected: Acronis Agent (Windows) before build 30025, Acronis… |
CVE-2023-29857 | Medium | 5.3 | 2023-05-18 | An issue in Teslamate v1.27.1 allows attackers to obtain sensitive information via directly accessing the teslamate link. |
CVE-2023-27863 | Medium | 4.4 | 2023-05-12 | IBM Spectrum Protect Plus Server 10.1.13, under specific configurations, could allow an elevated user to obtain SMB credentials that may be used to access vSna… |
CVE-2023-2514 | Medium | 6.7 | 2023-05-12 | Mattermost Sever fails to redact the DB username and password before emitting an application log during server initialization. |
CVE-2023-28357 | Medium | 4.3 | 2023-05-11 | A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command /mute occur after checking whether a user is a member of a given… |
CVE-2023-32082 | Low | 3.1 | 2023-05-11 | etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key na… |
CVE-2023-27870 | Medium | 5.9 | 2023-05-11 | IBM Spectrum Virtualize 8.5, under certain circumstances, could disclose sensitive credential information while a download from Fix Central is in progress. IB… |
CVE-2023-29106 | Medium | 5.3 | 2023-05-09 | A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1)… |
CVE-2023-32113 | High | 7.5 | 2023-05-09 | SAP GUI for Windows - version 7.70, 8.0, allows an unauthorized attacker to gain NTLM authentication information of a victim by tricking it into clicking a pre… |
CVE-2023-31404 | Medium | 5.0 | 2023-05-09 | Under certain conditions, SAP BusinessObjects Business Intelligence Platform (Central Management Service) - versions 420, 430, allows an attacker to access inf… |
CVE-2023-30740 | Medium | 6.3 | 2023-05-09 | SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker to access sensitive information which is otherwise res… |
CVE-2023-28762 | Critical | 9.1 | 2023-05-09 | SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker with administrator privileges to get the login token o… |
CVE-2023-22813 | Low | 3.3 | 2023-05-08 | A device API endpoint was missing access controls on Western Digital My Cloud OS 5 iOS and Anroid Mobile Apps, My Cloud Home iOS and Android Mobile A… |
CVE-2023-31133 | High | 7.5 | 2023-05-08 | Ghost is an app for new-media creators with tools to build a website, publish content, send newsletters, and offer paid subscriptions to members. Prior to vers… |
CVE-2023-24505 | Medium | 5.3 | 2023-05-08 | Milesight NCR/camera version 71.8.0.6-r5 discloses sensitive information through an unspecified request. |
CVE-2023-31413 | Low | 3.3 | 2023-05-04 | Filebeat versions through 7.17.9 and 8.6.2 have a flaw in httpjson input that allows the http request Authorization or Proxy-Authorization header contents to b… |
CVE-2023-26268 | Medium | 4.4 | 2023-05-02 | Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document fu… |
CVE-2023-22503 | Medium | 5.3 | 2023-05-01 | Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of attachments and labels in a private Conf… |
CVE-2023-30853 | High | 7.6 | 2023-04-28 | Gradle Build Action allows users to execute a Gradle Build in their GitHub Actions workflow. A vulnerability impacts GitHub workflows using the Gradle Build Ac… |
CVE-2023-28770 | High | 7.5 | 2023-04-27 | The sensitive information exposure vulnerability in the CGI “Export_Log” and the binary “zcmd” in Zyxel DX5401-B0 firmware versions prior to V5.17(ABYO.1)C0 co… |
CVE-2023-30843 | High | 7.4 | 2023-04-26 | Payload is a free and open source headless content management system. In versions prior to 1.7.0, if a user has access to documents that contain hidden fields… |
CVE-2023-30841 | Medium | 6.0 | 2023-04-26 | Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Bare… |
CVE-2023-1387 | Medium | 4.2 | 2023-04-26 | Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the… |
CVE-2023-23839 | Medium | 6.5 | 2023-04-25 | The SolarWinds Platform was susceptible to the Exposure of Sensitive Information Vulnerability. This vulnerability allows users to access Orion.WebCommunityStr… |
CVE-2023-2281 | Low | 3.1 | 2023-04-25 | When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients. This allows the clients to see the name, d… |
CVE-2023-22577 | Critical | 9.8 | 2023-04-24 | Within White Rabbit Switch it's possible as an unauthenticated user to retrieve sensitive information such as password hashes and the SNMP community strings. |
CVE-2023-30611 | Medium | 4.3 | 2023-04-19 | Discourse-reactions is a plugin that allows user to add their reactions to the post in the Discourse messaging platform. In affected versions data about what r… |
CVE-2023-29517 | High | 7.5 | 2023-04-19 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The office document viewer macro was allowing anyone t… |
CVE-2023-26049 | Low | 2.4 | 2023-04-18 | Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or othe… |
CVE-2023-22307 | Medium | 5.5 | 2023-04-18 | Sensitive data exposure in Webconf in Tribe29 Checkmk Appliance before 1.6.4 allows local attacker to retrieve passwords via reading log files. |
CVE-2023-30540 | Low | 3.5 | 2023-04-17 | Nextcloud Talk is a chat, video & audio call extension for Nextcloud. In affected versions a user that was added later to a conversation can use this informati… |
CVE-2023-1831 | High | 7.2 | 2023-04-17 | Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logg… |
CVE-2022-34125 | Medium | 6.5 | 2023-04-16 | front/icon.send.php in the CMDB plugin before 3.0.3 for GLPI allows attackers to gain read access to sensitive information via a _log/ pathname in the file par… |
CVE-2023-20866 | Medium | 6.5 | 2023-04-13 | In Spring Session version 3.0.0, the session id can be logged to the standard output stream. This vulnerability exposes sensitive information to those who have… |
CVE-2023-28271 | Medium | 5.5 | 2023-04-11 | Windows Kernel Memory Information Disclosure Vulnerability |
CVE-2023-28221 | High | 7.0 | 2023-04-11 | Windows Error Reporting Service Elevation of Privilege Vulnerability |
CVE-2022-43951 | Medium | 5.3 | 2023-04-11 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.11 and… |
CVE-2023-23588 | Medium | 6.2 | 2023-04-11 | A vulnerability has been identified in SIMATIC IPC1047 (All versions), SIMATIC IPC1047E (All versions with maxView Storage Manager < 4.09.00.25611 on Windows)… |
CVE-2023-29111 | Low | 3.1 | 2023-04-11 | The SAP AIF (ODATA service) - versions 755, 756, discloses more detailed information than is required. An authorized attacker can use the collected information… |
CVE-2023-28765 | Critical | 9.8 | 2023-04-11 | An attacker with basic privileges in SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, can get access to lcmbiar f… |
CVE-2013-10024 | Low | 3.5 | 2023-04-08 | A vulnerability has been found in Exit Strategy Plugin 1.55 on WordPress and classified as problematic. Affected by this vulnerability is an unknown functional… |
CVE-2023-1710 | Medium | 5.3 | 2023-04-05 | A sensitive information disclosure vulnerability in GitLab affecting all versions from 15.0 prior to 15.8.5, 15.9 prior to 15.9.4 and 15.10 prior to 15.10.1 al… |
CVE-2023-0838 | Medium | 5.5 | 2023-04-05 | An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. A maintainer could mo… |
CVE-2023-1858 | Medium | 4.3 | 2023-04-05 | A vulnerability was found in SourceCodester Earnings and Expense Tracker App 1.0. It has been classified as problematic. This affects an unknown part of the fi… |
CVE-2023-0614 | Medium | 6.5 | 2023-04-03 | The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attacker may be able to… |
CVE-2023-1790 | Medium | 4.3 | 2023-04-01 | A vulnerability, which was classified as problematic, was found in SourceCodester Simple Task Allocation System 1.0. Affected is an unknown function of the fil… |
CVE-2023-29137 | Medium | 4.3 | 2023-03-31 | An issue was discovered in the GrowthExperiments extension for MediaWiki through 1.39.3. The UserImpactHandler for GrowthExperiments inadvertently returns the… |
CVE-2023-1777 | Medium | 6.5 | 2023-03-31 | Mattermost allows an attacker to request a preview of an existing message when creating a new message via the createPost API call, disclosing the contents of t… |
CVE-2023-1775 | Medium | 4.3 | 2023-03-31 | When running in a High Availability configuration, Mattermost fails to sanitize some of the user_updated and post_deleted events broadcast to all users, leadin… |
CVE-2023-1769 | Medium | 4.3 | 2023-03-31 | A vulnerability, which was classified as problematic, was found in SourceCodester Grade Point Average GPA Calculator 1.0. Affected is an unknown function of th… |
CVE-2023-1258 | Medium | 5.3 | 2023-03-31 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ABB Flow-X firmware on Flow-X embedded hardware (web service modules) allows Footpr… |
CVE-2023-28732 | Medium | 6.5 | 2023-03-30 | Missing access control in AnyMailing Joomla Plugin allows to list and access files containing sensitive information from the plugin itself and access to system… |
CVE-2023-0836 | High | 7.5 | 2023-03-29 | An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7… |
CVE-2023-1680 | Medium | 4.3 | 2023-03-29 | A vulnerability, which was classified as problematic, has been found in Xunrui CMS 4.61. This issue affects some unknown processing of the file /dayrui/My/View… |
CVE-2022-48430 | Medium | 5.5 | 2023-03-29 | In JetBrains IntelliJ IDEA before 2023.1 file content could be disclosed via an external stylesheet path in Markdown preview. |
CVE-2023-1683 | Medium | 4.3 | 2023-03-29 | A vulnerability was found in Xunrui CMS 4.61 and classified as problematic. Affected by this issue is some unknown functionality of the file /dayrui/Fcms/View/… |
CVE-2023-1681 | Medium | 4.3 | 2023-03-28 | A vulnerability, which was classified as problematic, was found in Xunrui CMS 4.61. Affected is an unknown function of the file /config/myfield/test.php. The m… |
CVE-2023-25722 | Medium | 5.5 | 2023-03-28 | A credential-leak issue was discovered in related Veracode products before 2023-03-27. Veracode Scan Jenkins Plugin before 23.3.19.0, when configured for remot… |
CVE-2022-48348 | Critical | 9.1 | 2023-03-27 | The MediaProvider module has a vulnerability of unauthorized data read. Successful exploitation of this vulnerability may affect confidentiality and integrity. |