CWE-200 · Information Disclosure (page 34)
Page 34 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-40275 | Critical | 9.1 | 2024-03-19 | An issue was discovered in OpenClinic GA 5.247.01. It allows retrieval of patient lists via queries such as findFirstname= to _common/search/searchByAjax/patie… |
CVE-2024-26119 | Medium | 5.3 | 2024-03-18 | Adobe Experience Manager versions 6.5.19 and earlier are affected by an Information Exposure vulnerability that could result in a security feature bypass. An a… |
CVE-2024-26063 | Medium | 5.3 | 2024-03-18 | Adobe Experience Manager versions 6.5.19 and earlier are affected by an Information Exposure vulnerability that could result in a Security feature bypass. An a… |
CVE-2024-27769 | High | 8.8 | 2024-03-18 | Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor may allow Taking Ownership… |
CVE-2024-25903 | Medium | 5.3 | 2024-03-17 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in N-Media Frontend File Manager.This issue affects Frontend File Manager: from n/a th… |
CVE-2024-25591 | Medium | 5.3 | 2024-03-17 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Benjamin Rojas WP Editor.This issue affects WP Editor: from n/a through 1.2.7. |
CVE-2024-25933 | Medium | 5.3 | 2024-03-17 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pepro Dev. Group PeproDev Ultimate Invoice.This issue affects PeproDev Ultimate Inv… |
CVE-2024-24867 | Medium | 5.3 | 2024-03-17 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Osamaesh WP Visitor Statistics (Real Time Traffic).This issue affects WP Visitor St… |
CVE-2024-24845 | Medium | 5.3 | 2024-03-16 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sewpafly Post Thumbnail Editor.This issue affects Post Thumbnail Editor: from n/a t… |
CVE-2024-23523 | Medium | 6.5 | 2024-03-16 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Elementor Pro.This issue affects Elementor Pro: from n/a through 3.19.2. |
CVE-2024-28242 | Medium | 5.3 | 2024-03-15 | Discourse is an open source platform for community discussion. In affected versions an attacker can learn that secret categories exist when they have backgroun… |
CVE-2024-24748 | Medium | 5.3 | 2024-03-15 | Discourse is an open source platform for community discussion. In affected versions an attacker can learn that a secret subcategory exists under a public categ… |
CVE-2024-28849 | Medium | 6.5 | 2024-03-14 | follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow… |
CVE-2024-28193 | Medium | 6.5 | 2024-03-13 | your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify version <1.8.0 allows users to create a public token in the settings, which… |
CVE-2024-2106 | Medium | 5.3 | 2024-03-13 | The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Information Exposure in versions up to, and inclu… |
CVE-2024-1083 | Medium | 5.3 | 2024-03-13 | The Simple Restrict plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.6 via the REST API. This mak… |
CVE-2024-1979 | Low | 3.5 | 2024-03-13 | A vulnerability was found in Quarkus. In certain conditions related to the CI process, git credentials could be inadvertently published, which could put the gi… |
CVE-2024-28238 | Low | 2.3 | 2024-03-12 | Directus is a real-time API and App dashboard for managing SQL database content. When reaching the /files page, a JWT is passed via GET request. Inclusion of s… |
CVE-2024-28236 | High | 7.7 | 2024-03-12 | Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Vela pipelines can use variable substitution combined wi… |
CVE-2024-28340 | High | 7.5 | 2024-03-12 | An information leak in the currentsetting.htm component of Netgear CBR40 2.5.0.28, Netgear CBK40 2.5.0.28, and Netgear CBK43 2.5.0.28 allows attackers to obtai… |
CVE-2024-28339 | Medium | 5.4 | 2024-03-12 | An information leak in the debuginfo.htm component of Netgear CBR40 2.5.0.28, Netgear CBK40 2.5.0.28, and Netgear CBK43 2.5.0.28 allows attackers to obtain sen… |
CVE-2024-26177 | Medium | 5.5 | 2024-03-12 | Windows Kernel Information Disclosure Vulnerability |
CVE-2024-1302 | High | 7.3 | 2024-03-12 | Information exposure vulnerability in Badger Meter Monitool affecting versions up to 4.6.3 and earlier. A local attacker could change the application's file pa… |
CVE-2024-2371 | Medium | 6.2 | 2024-03-12 | Information exposure vulnerability in Korenix JetI/O 6550 affecting firmware version F208 Build:0817. The SNMP protocol uses plaintext to transfer data, allowi… |
CVE-2024-0906 | Medium | 5.3 | 2024-03-12 | The f(x) Private Site plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.1 via the API. This makes… |
CVE-2024-28120 | Medium | 6.5 | 2024-03-11 | codeium-chrome is an open source code completion plugin for the chrome web browser. The service worker of the codeium-chrome extension doesn't check the sender… |
CVE-2024-25114 | Low | 2.6 | 2024-03-11 | Collabora Online is a collaborative online office suite based on LibreOffice technology. Each document in Collabora Online is opened by a separate "Kit" instan… |
CVE-2024-26309 | Medium | 5.3 | 2024-03-08 | Archer Platform 6.x before 6.14 P2 HF2 (6.14.0.2.2) contains a sensitive information disclosure vulnerability. An unauthenticated attacker could potentially ob… |
CVE-2024-23292 | Low | 3.3 | 2024-03-08 | This issue was addressed with improved data protection. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4. An app may be able to access inform… |
CVE-2024-23235 | Medium | 4.7 | 2024-03-08 | A race condition was addressed with additional validation. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tv… |
CVE-2023-28826 | Medium | 5.5 | 2024-03-08 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, macOS Monterey 12.7.4, macOS So… |
CVE-2024-1460 | Medium | 5.6 | 2024-03-07 | MSI Afterburner v4.6.5.16370 is vulnerable to a Kernel Memory Leak vulnerability by triggering the 0x80002040 IOCTL code of the RTCore64.sys driver. The handle… |
CVE-2024-24765 | High | 7.5 | 2024-03-06 | CasaOS-UserService provides user management functionalities to CasaOS. Prior to version 0.4.7, path filtering of the URL for user avatar image files was not st… |
CVE-2024-20292 | Medium | 4.4 | 2024-03-06 | A vulnerability in the logging component of Cisco Duo Authentication for Windows Logon and RDP could allow an authenticated, local attacker to view sensitive i… |
CVE-2023-48644 | Medium | 6.1 | 2024-03-05 | An issue was discovered in the Archibus app 4.0.3 for iOS. There is an XSS vulnerability in the create work request feature of the maintenance module, via the… |
CVE-2024-1769 | Medium | 5.3 | 2024-03-05 | The JM Twitter Cards plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 14 via the meta description data. This ma… |
CVE-2022-43890 | Medium | 5.3 | 2024-03-04 | IBM Security Verify Privilege On-Premises 11.5 could disclose sensitive information through an HTTP request that could aid an attacker in further attacks again… |
CVE-2024-20019 | Medium | 5.9 | 2024-03-04 | In wlan driver, there is a possible memory leak due to improper input handling. This could lead to remote denial of service with no additional execution privil… |
CVE-2019-25210 | Medium | 6.5 | 2024-03-03 | An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. It displays values of secrets when the --dry-run flag is used. This is… |
CVE-2024-0765 | Medium | 6.5 | 2024-03-03 | As a default user on a multi-user instance of AnythingLLM, you could execute a call to the `/export-data` endpoint of the system and then unzip and read that e… |
CVE-2024-25839 | High | 7.5 | 2024-03-03 | An issue was discovered in Webbax "Super Newsletter" (supernewsletter) module for PrestaShop versions 1.4.21 and before, allows local attackers to escalate pri… |
CVE-2024-27296 | Medium | 5.3 | 2024-03-01 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 10.8.3, the exact Directus version number was being shipped i… |
CVE-2023-50324 | Medium | 5.3 | 2024-03-01 | IBM Cognos Command Center 10.2.4.1 and 10.2.5 exposes details the X-AspNet-Version Response Header that could allow an attacker to obtain information of the ap… |
CVE-2024-1952 | Low | 3.1 | 2024-02-29 | Mattermost version 8.1.x before 8.1.9 fails to sanitize data associated with permalinks when a plugin updates an ephemeral post, allowing an authenticated atta… |
CVE-2024-1949 | Low | 2.6 | 2024-02-29 | A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized access to individual p… |
CVE-2024-23493 | Medium | 4.3 | 2024-02-29 | Mattermost fails to properly authorize the requests fetching team associated AD/LDAP groups, allowing a user to fetch details of AD/LDAP groups of a team that… |
CVE-2024-26470 | High | 8.1 | 2024-02-29 | A host header injection vulnerability in the forgot password function of FullStackHero's WebAPI Boilerplate v1.0.0 and v1.0.1 allows attackers to leak the pass… |
CVE-2024-26132 | Medium | 4.0 | 2024-02-29 | Element Android is an Android Matrix Client. A third-party malicious application installed on the same phone can force Element Android, version 0.91.0 through… |
CVE-2024-23302 | High | 7.5 | 2024-02-29 | Couchbase Server before 7.2.4 has a private key leak in goxdcr.log. |
CVE-2024-0620 | Medium | 5.3 | 2024-02-29 | The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.9 via API. Thi… |
CVE-2024-0616 | Medium | 5.3 | 2024-02-29 | The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4… |
CVE-2023-6922 | Medium | 4.3 | 2024-02-28 | The Under Construction / Maintenance Mode from Acurax plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2… |
CVE-2024-26144 | Medium | 5.3 | 2024-02-27 | Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active… |
CVE-2024-27905 | Critical | 9.1 | 2024-02-27 | ** UNSUPPORTED WHEN ASSIGNED ** Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Aurora. An endpoint exposing internals to u… |
CVE-2024-27356 | High | 7.5 | 2024-02-27 | An issue was discovered on certain GL-iNet devices. Attackers can download files such as logs via commands, potentially obtaining critical user information. Th… |
CVE-2024-24720 | Medium | 5.3 | 2024-02-27 | An issue was discovered in the Forgot password function in Innovaphone PBX before 14r1 devices. It provides information about whether a user exists on a system. |
CVE-2024-27456 | Critical | 9.1 | 2024-02-26 | rack-cors (aka Rack CORS Middleware) 2.0.1 has 0666 permissions for the .rb files. |
CVE-2024-1436 | Medium | 5.3 | 2024-02-26 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wiloke WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit.This issue affects… |
CVE-2024-21501 | Medium | 5.3 | 2024-02-24 | Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allow… |
CVE-2024-24309 | High | 7.5 | 2024-02-23 | In the module "Survey TMA" (ecomiz_survey_tma) up to version 2.0.0 from Ecomiz for PrestaShop, a guest can download personal information without restriction. |
CVE-2021-33146 | Medium | 5.3 | 2024-02-23 | Improper input validation in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow an unauthenticated user to… |
CVE-2024-25130 | Medium | 5.4 | 2024-02-22 | Tuleap is an open source suite to improve management of software developments and collaboration. Prior to version 15.5.99.76 of Tuleap Community Edition and pr… |
CVE-2024-24817 | Medium | 4.3 | 2024-02-22 | Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on the open-source discussion platform Discourse. Prior to versio… |
CVE-2024-26136 | High | 7.5 | 2024-02-20 | kedi ElectronCord is a bot management tool for Discord. Commit aaaeaf4e6c99893827b2eea4dd02f755e1e24041 exposes an account access token in the `config.json` fi… |
CVE-2023-52097 | High | 7.5 | 2024-02-18 | Vulnerability of foreground service restrictions being bypassed in the NMS module.Successful exploitation of this vulnerability may affect service confidential… |
CVE-2024-20937 | Medium | 4.3 | 2024-02-17 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affe… |
CVE-2023-21833 | Medium | 4.3 | 2024-02-17 | Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Object Store). The supported version that is affected is 8.8. Eas… |
CVE-2024-24758 | Low | 3.9 | 2024-02-16 | Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Prox… |
CVE-2024-0020 | Medium | 5.5 | 2024-02-16 | In onActivityResult of NotificationSoundPreference.java, there is a possible way to hear audio files belonging to a different user due to a confused deputy. Th… |
CVE-2024-1591 | Low | 3.3 | 2024-02-16 | Prior to version 24.1, a local authenticated attacker can view Sysvol when Privilege Management for Windows is configured to use a GPO policy. This allows them… |
CVE-2023-44253 | Medium | 5.0 | 2024-02-15 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiManager version 7.4.0 through 7.4.1 and before 7.2.5, Fo… |
CVE-2024-0708 | Medium | 5.3 | 2024-02-15 | The Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions… |
CVE-2023-51787 | High | 7.5 | 2024-02-15 | An issue was discovered in Wind River VxWorks 7 22.09 and 23.03. If a VxWorks task or POSIX thread that uses OpenSSL exits, limited per-task memory is not free… |
CVE-2024-25121 | High | 7.1 | 2024-02-13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions of TYPO3 entities of the File Abstraction Laye… |
CVE-2024-25120 | Medium | 4.3 | 2024-02-13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. The TYPO3-specific `t3://` URI scheme could be used to access resou… |
CVE-2024-25119 | Medium | 4.9 | 2024-02-13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. The plaintext value of `$GLOBALS['SYS']['encryptionKey']` was displ… |
CVE-2024-25118 | Medium | 4.3 | 2024-02-13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. Password hashes were being reflected in the editing forms of the TY… |
CVE-2024-21380 | High | 8.0 | 2024-02-13 | Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability |
CVE-2022-22506 | Medium | 4.6 | 2024-02-12 | IBM Robotic Process Automation 21.0.2 contains a vulnerability that could allow user ids may be exposed across tenants. IBM X-Force ID: 227293. |
CVE-2024-1431 | Medium | 4.3 | 2024-02-11 | A vulnerability was found in Netgear R7000 1.0.11.136_10.2.120 and classified as problematic. Affected by this issue is some unknown functionality of the file… |
CVE-2024-1430 | Medium | 4.3 | 2024-02-11 | A vulnerability has been found in Netgear R7000 1.0.11.136_10.2.120 and classified as problematic. Affected by this vulnerability is an unknown functionality o… |
CVE-2024-1406 | Medium | 4.3 | 2024-02-10 | A vulnerability was found in Linksys WRT54GL 4.30.18. It has been declared as problematic. This vulnerability affects unknown code of the file /SysInfo1.htm of… |
CVE-2024-1405 | Medium | 4.3 | 2024-02-10 | A vulnerability was found in Linksys WRT54GL 4.30.18. It has been classified as problematic. This affects an unknown part of the file /wlaninfo.htm of the comp… |
CVE-2023-28077 | Medium | 4.4 | 2024-02-10 | Dell BSAFE SSL-J, versions prior to 6.5, and versions 7.0 and 7.1 contain a debug message revealing unnecessary information vulnerability. This may lead to di… |
CVE-2024-21624 | Medium | 5.7 | 2024-02-09 | nonebot2 is a cross-platform Python asynchronous chatbot framework written in Python. This security advisory pertains to a potential information leak (e.g., en… |
CVE-2024-1404 | Medium | 4.3 | 2024-02-09 | A vulnerability was found in Linksys WRT54GL 4.30.18 and classified as problematic. Affected by this issue is some unknown functionality of the file /SysInfo.h… |
CVE-2023-50298 | High | 7.5 | 2024-02-09 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 b… |
CVE-2024-24825 | Critical | 9.1 | 2024-02-09 | DIRAC is a distributed resource framework. In affected versions any user could get a token that has been requested by another user/agent. This may expose resou… |
CVE-2024-0242 | High | 7.3 | 2024-02-08 | Under certain circumstances IQ Panel4 and IQ4 Hub panel software prior to version 4.4.2 could allow unauthorized access to settings. |
CVE-2024-24215 | Medium | 5.3 | 2024-02-08 | An issue in the component /cgi-bin/GetJsonValue.cgi of Cellinx NVT Web Server 5.0.0.014 allows attackers to leak configuration information via a crafted POST r… |
CVE-2024-24304 | High | 7.5 | 2024-02-07 | In the module "Mailjet" (mailjet) from Mailjet for PrestaShop before versions 3.5.1, a guest can download technical information without restriction. |
CVE-2024-22022 | High | 8.8 | 2024-02-07 | Vulnerability CVE-2024-22022 allows a Veeam Recovery Orchestrator user that has been assigned a low-privileged role to access the NTLM hash of the service acco… |
CVE-2024-1255 | Medium | 5.3 | 2024-02-06 | A vulnerability has been found in sepidz SepidzDigitalMenu up to 7.1.0728.1 and classified as problematic. This vulnerability affects unknown code of the file… |
CVE-2024-22331 | Medium | 6.2 | 2024-02-06 | IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.19, 7.1 through 7.1.2.15, 7.2 through 7.2.3.8, 7.3 through 7.3.2.3, and IBM UrbanCode Deploy (UCD) - IBM DevOps De… |
CVE-2024-23344 | Medium | 5.3 | 2024-02-06 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. Some users might get access to restricted information when a p… |
CVE-2023-46183 | Medium | 5.3 | 2024-02-06 | IBM PowerVM Hypervisor FW950.00 through FW950.90, FW1020.00 through FW1020.40, and FW1030.00 through FW1030.30 could allow a system administrator to obtain sen… |
CVE-2024-1210 | Medium | 5.3 | 2024-02-05 | The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via API. This makes it poss… |
CVE-2024-1209 | Medium | 5.3 | 2024-02-05 | The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via direct file access due… |
CVE-2024-1208 | Medium | 5.3 | 2024-02-05 | The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.2 via API. This makes it poss… |
CVE-2023-33851 | Medium | 5.3 | 2024-02-04 | IBM PowerVM Hypervisor FW950.00 through FW950.90, FW1020.00 through FW1020.40, and FW1030.00 through FW1030.30 could reveal sensitive partition data to a syste… |