CWE-200 · Information Disclosure (page 34)
Page 34 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-48347 | High | 7.5 | 2023-03-27 | The MediaProvider module has a vulnerability in permission verification. Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2022-48346 | High | 7.5 | 2023-03-27 | The HwContacts module has a logic bypass vulnerability. Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2023-1075 | Low | 3.3 | 2023-03-27 | A flaw was found in the Linux Kernel. The tls_is_tx_ready() incorrectly checks for list emptiness, potentially accessing a type confused entry to the list_head… |
CVE-2021-3923 | Low | 2.3 | 2023-03-27 | A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel stack information wh… |
CVE-2023-24838 | Critical | 9.8 | 2023-03-27 | HGiga PowerStation has a vulnerability of Information Leakage. An unauthenticated remote attacker can exploit this vulnerability to obtain the administrator's… |
CVE-2022-39043 | Low | 2.4 | 2023-03-27 | Juiker app stores debug logs which contains sensitive information to mobile external storage. An unauthenticated physical attacker can access these files to ac… |
CVE-2023-28444 | Critical | 9.9 | 2023-03-24 | angular-server-side-configuration helps configure an angular application at runtime on the server or in a docker container via environment variables. angular-s… |
CVE-2023-21067 | High | 7.5 | 2023-03-24 | Product: AndroidVersions: Android kernelAndroid ID: A-254114726References: N/A |
CVE-2023-28442 | High | 7.5 | 2023-03-24 | GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. Prior to versions 2.20.6, 2.19.6, and 2.18… |
CVE-2023-28336 | Medium | 4.3 | 2023-03-23 | Insufficient filtering of grade report history made it possible for teachers to access the names of users they could not otherwise access. |
CVE-2023-28334 | Medium | 4.3 | 2023-03-23 | Authenticated users were able to enumerate other users' names via the learning plans page. |
CVE-2023-1402 | Medium | 4.3 | 2023-03-23 | The course participation report required additional checks to prevent roles being displayed which the user did not have access to view. |
CVE-2023-20055 | High | 8.0 | 2023-03-23 | A vulnerability in the management API of Cisco DNA Center could allow an authenticated, remote attacker to elevate privileges in the context of the web-based m… |
CVE-2023-28432 | High | 7.5 | 2023-03-22 | Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z… |
CVE-2023-1562 | Low | 3.5 | 2023-03-22 | Mattermost fails to check the "Show Full Name" setting when rendering the result for the /plugins/focalboard/api/v2/users API call, allowing an attacker to lea… |
CVE-2022-45634 | Medium | 4.3 | 2023-03-22 | An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows authenticated attacker to gain access to sensitive account information |
CVE-2022-45124 | High | 7.5 | 2023-03-20 | An information disclosure vulnerability exists in the User authentication functionality of WellinTech KingHistorian 35.01.00.05. A specially crafted network pa… |
CVE-2023-27591 | High | 7.5 | 2023-03-17 | Miniflux is a feed reader. Prior to version 2.0.43, an unauthenticated user can retrieve Prometheus metrics from a publicly reachable Miniflux instance where t… |
CVE-2023-0027 | Medium | 5.3 | 2023-03-17 | Rockwell Automation Modbus TCP Server AOI prior to 2.04.00 is vulnerable to an unauthorized user sending a malformed message that could cause the controller to… |
CVE-2023-23622 | Medium | 4.3 | 2023-03-17 | Discourse is an open-source discussion platform. Prior to version 3.0.1 of the `stable` branch and version 3.1.0.beta2 of the `beta` and `tests-passed` branche… |
CVE-2023-23935 | Low | 3.5 | 2023-03-16 | Discourse is an open-source messaging platform. In versions 3.0.1 and prior on the `stable` branch and versions 3.1.0.beta2 and prior on the `beta` and `tests-… |
CVE-2023-22880 | Medium | 6.8 | 2023-03-16 | Zoom for Windows clients before version 5.13.3, Zoom Rooms for Windows clients before version 5.13.5 and Zoom VDI for Windows clients before 5.13.1 contain an… |
CVE-2023-21449 | Medium | 4.0 | 2023-03-16 | Improper access control vulnerability in Call application prior to SMR Mar-2023 Release 1 allows local attackers to access sensitive information without proper… |
CVE-2023-25680 | Medium | 4.2 | 2023-03-15 | IBM Robotic Process Automation 21.0.1 through 21.0.5 is vulnerable to insufficiently protecting credentials. Queue Provider credentials are not obfuscated wh… |
CVE-2023-22876 | Medium | 4.3 | 2023-03-15 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.7 and 6.1.0.0 through 6.1.2.1 could allow a privileged user to obtain sensitive information… |
CVE-2020-4927 | Medium | 5.7 | 2023-03-15 | A vulnerability in the Spectrum Scale 5.0.5.0 through 5.1.6.1 core component could allow unauthorized access to user data or injection of arbitrary data in the… |
CVE-2022-38456 | Medium | 4.3 | 2023-03-15 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ernest Marcinko Ajax Search Lite plugin <= 4.10.3 versions. |
CVE-2023-24923 | Medium | 5.5 | 2023-03-14 | Microsoft OneDrive for Android Information Disclosure Vulnerability |
CVE-2023-24882 | Medium | 5.5 | 2023-03-14 | Microsoft OneDrive for Android Information Disclosure Vulnerability |
CVE-2023-27894 | Medium | 5.0 | 2023-03-14 | SAP BusinessObjects Business Intelligence Platform (Web Services) - versions 420, 430, allows an attacker to inject arbitrary values as CMS parameters to perfo… |
CVE-2023-23327 | Medium | 4.9 | 2023-03-10 | An Information Disclosure vulnerability exists in AvantFAX 3.3.7. Backups of the AvantFAX sent/received faxes, and database backups are stored using the curren… |
CVE-2023-1203 | Medium | 6.5 | 2023-03-10 | Improper removal of sensitive data in the entry edit feature of Hub Business submodule in Devolutions Remote Desktop Manager PowerShell Module 2022.3.1.5 and e… |
CVE-2022-22075 | Medium | 6.2 | 2023-03-10 | Information Disclosure in Graphics during GPU context switch. |
CVE-2014-125093 | Medium | 4.3 | 2023-03-10 | A vulnerability has been found in Ad Blocking Detector Plugin up to 1.2.1 on WordPress and classified as problematic. This vulnerability affects unknown code o… |
CVE-2021-34125 | High | 7.5 | 2023-03-09 | An issue discovered in Yuneec Mantis Q and PX4-Autopilot v 1.11.3 and below allow attacker to gain access to sensitive information via various nuttx commands. |
CVE-2018-25081 | High | 7.5 | 2023-03-09 | Bitwarden through 2023.2.1 offers password auto-fill within a cross-domain IFRAME element. NOTE: the vendor's position is that there have been important legiti… |
CVE-2023-1263 | Medium | 5.3 | 2023-03-07 | The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 4.1.6 via the cmp_get_post_de… |
CVE-2023-27481 | Medium | 4.3 | 2023-03-07 | Directus is a real-time API and App dashboard for managing SQL database content. In versions prior to 9.16.0 users with read access to the `password` field in… |
CVE-2023-27478 | Medium | 6.5 | 2023-03-07 | libmemcached-awesome is an open source C/C++ client library and tools for the memcached server. `libmemcached` could return data for a previously requested key… |
CVE-2023-23776 | Medium | 4.6 | 2023-03-07 | An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in FortiAnalyzer versions 7.2.0 through 7.2.1, 7.0.0 through 7.0.4 and 6… |
CVE-2022-46257 | Medium | 4.3 | 2023-03-07 | An information disclosure vulnerability was identified in GitHub Enterprise Server that allowed private repositories to be added to a GitHub Actions runner gro… |
CVE-2022-41329 | Medium | 5.3 | 2023-03-07 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0… |
CVE-2022-27490 | Medium | 5.4 | 2023-03-07 | A exposure of sensitive information to an unauthorized actor in Fortinet FortiManager version 6.0.0 through 6.0.4, FortiAnalyzer version 6.0.0 through 6.0.4, F… |
CVE-2020-36668 | Medium | 4.3 | 2023-03-07 | The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to sensitive information disclosure in versions up to, and including, 1.4.0 due… |
CVE-2023-22847 | Medium | 4.3 | 2023-03-07 | Information disclosure vulnerability exists in pg_ivm versions prior to 1.5.1. An Incrementally Maintainable Materialized View (IMMV) created by pg_ivm may ref… |
CVE-2023-26054 | Medium | 6.5 | 2023-03-06 | BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In affected versions when the user sends… |
CVE-2023-25169 | Low | 3.1 | 2023-03-06 | discourse-yearly-review is a discourse plugin which publishes an automated Year in Review topic. In affected versions a user present in a yearly review topic t… |
CVE-2022-4862 | Medium | 5.0 | 2023-03-06 | Rendering of HTML provided by another authenticated user is possible in browser on M-Files Web before 22.12.12140.3. This allows the content to steal user sens… |
CVE-2022-3284 | Medium | 6.5 | 2023-03-06 | Download key for a file in a vault was passed in an insecure way that could easily be logged in M-Files New Web in M-Files before 22.11.12011.0. This issue aff… |
CVE-2023-26108 | Low | 3.7 | 2023-03-06 | Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerability is possible… |
CVE-2023-25819 | Medium | 5.3 | 2023-03-04 | Discourse is an open source platform for community discussion. Tags that are normally private are showing in metadata. This affects any site running the `tests… |
CVE-2023-20062 | Medium | 6.5 | 2023-03-03 | Multiple vulnerabilities in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to collect sensitive information or perform a serve… |
CVE-2023-20061 | Medium | 6.5 | 2023-03-03 | Multiple vulnerabilities in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to collect sensitive information or perform a serve… |
CVE-2022-41862 | Low | 3.7 | 2023-03-03 | In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditi… |
CVE-2023-26476 | High | 7.5 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in version 3.2-m3, users can deduce the content of the password fields by repeated call to `LiveTableResult… |
CVE-2023-25536 | Medium | 6.7 | 2023-03-02 | Dell PowerScale OneFS 9.4.0.x contains exposure of sensitive information to an unauthorized actor. A malicious authenticated local user could potentially expl… |
CVE-2023-25544 | High | 7.5 | 2023-03-01 | Dell NetWorker versions 19.5 and earlier contain 'Apache Tomcat' version disclosure vulnerability. A NetWorker server user with remote access to NetWorker cli… |
CVE-2023-24567 | High | 7.5 | 2023-03-01 | Dell NetWorker versions 19.5 and earlier contain 'RabbitMQ' version disclosure vulnerability. A NetWorker server user with remote access to NetWorker clients… |
CVE-2023-1055 | Medium | 5.5 | 2023-02-27 | A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which… |
CVE-2023-23511 | Medium | 5.5 | 2023-02-27 | The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3, tvOS 16.3, w… |
CVE-2023-23500 | Medium | 5.5 | 2023-02-27 | The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3, iOS 15.7.3 and iPadOS 15.7.3, tvOS… |
CVE-2023-23499 | Medium | 5.5 | 2023-02-27 | This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, watchOS 9.3, macOS Big Sur 11.7.3, tvO… |
CVE-2022-32896 | Medium | 5.5 | 2023-02-27 | This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.6, macOS Big Sur 11.7. A user may be able to view sensitive use… |
CVE-2022-32855 | Medium | 5.5 | 2023-02-27 | A logic issue was addressed with improved state management. This issue is fixed in iOS 15.6 and iPadOS 15.6. A user may be able to view restricted content from… |
CVE-2022-32836 | High | 7.5 | 2023-02-27 | This issue was addressed with improved state management. This issue is fixed in Apple Music 3.9.10 for Android. An app may be able to access user-sensitive dat… |
CVE-2022-32824 | Medium | 5.5 | 2023-02-27 | The issue was addressed with improved memory handling. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6. An app may be able to disclose… |
CVE-2022-32784 | Medium | 6.5 | 2023-02-27 | The issue was addressed with improved UI handling. This issue is fixed in Safari 15.6, iOS 15.6 and iPadOS 15.6. Visiting a maliciously crafted website may lea… |
CVE-2022-22668 | Medium | 5.5 | 2023-02-27 | A logic issue was addressed with improved restrictions. This issue is fixed in iOS 15.4 and iPadOS 15.4, macOS Monterey 12.3. A malicious application may be ab… |
CVE-2021-46841 | Medium | 5.9 | 2023-02-27 | This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in Apple Music 3.5.0 for Android. An attacker in a privi… |
CVE-2020-9846 | Medium | 5.3 | 2023-02-27 | A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.0.1. A malicious application may be able to access local u… |
CVE-2023-27266 | Low | 2.7 | 2023-02-27 | Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the /api/v4/users/me/teams API endpoint, allowing an attacker with team… |
CVE-2023-27265 | Low | 2.7 | 2023-02-27 | Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the "Regenerate Invite Id" API endpoint, allowing an attacker with team… |
CVE-2023-0994 | High | 7.5 | 2023-02-24 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository francoisjacquet/rosariosis prior to 10.8.2. |
CVE-2023-0597 | Medium | 5.5 | 2023-02-23 | A flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping of X86 CPU data to memory was found in the way user can guess location of exceptio… |
CVE-2023-22476 | Medium | 4.3 | 2023-02-23 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions prior to 2.25.6, due to insufficient access-level checks, any logged-in user allowed… |
CVE-2017-20178 | Low | 3.1 | 2023-02-21 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Codiad 2.8.0. It has been rated as problematic. Affected by this issue is the function saveJSON of… |
CVE-2022-48319 | Medium | 6.5 | 2023-02-20 | Sensitive host secret disclosed in cmk-update-agent.log file in Tribe29's Checkmk <= 2.1.0p13, Checkmk <= 2.0.0p29, and all versions of Checkmk 1.6.0 (EOL) all… |
CVE-2023-0901 | Medium | 5.3 | 2023-02-18 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pixelfed/pixelfed prior to 0.11.4. |
CVE-2022-34351 | Medium | 5.9 | 2023-02-17 | IBM QRadar SIEM 7.4 and 7.5 is vulnerable to information exposure allowing a non-tenant user with a specific domain security profile assigned to see some data… |
CVE-2022-43930 | Medium | 6.2 | 2023-02-17 | IBM Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 is vulnerable to an Information Disclosure as sensitive information may be included in a log file. IB… |
CVE-2022-41734 | Medium | 5.3 | 2023-02-17 | IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is return… |
CVE-2022-43927 | Medium | 5.9 | 2023-02-17 | IBM Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 is vulnerable to information Disclosure due to improper privilege management when a specially crafted… |
CVE-2022-27891 | Medium | 5.3 | 2023-02-16 | Palantir Gotham included an unauthenticated endpoint that listed all active usernames on the stack with an active session. The affected services have been patc… |
CVE-2023-22580 | Medium | 5.3 | 2023-02-16 | Due to improper input filtering in the sequalize js library, can malicious queries lead to sensitive information disclosure. |
CVE-2023-23458 | Medium | 6.5 | 2023-02-15 | Sunell DVR, latest version, CWE-200: Exposure of Sensitive Information to an Unauthorized Actor through an unspecified request. |
CVE-2023-0020 | High | 8.5 | 2023-02-14 | SAP BusinessObjects Business Intelligence platform - versions 420, 430, allows an authenticated attacker to access sensitive information which is otherwise res… |
CVE-2023-0814 | Medium | 6.5 | 2023-02-14 | The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to sensitive information disclosure via the [user_meta] shortco… |
CVE-2022-45454 | High | 7.5 | 2023-02-13 | Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Agent (Windows) before build 30161, Acronis C… |
CVE-2022-47367 | Medium | 5.5 | 2023-02-12 | In bluetooth driver, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2022-47329 | Medium | 5.5 | 2023-02-12 | In wlan driver, there is a possible missing permission check. This could lead to local information disclosure. |
CVE-2022-47328 | Medium | 5.5 | 2023-02-12 | In wlan driver, there is a possible missing permission check. This could lead to local information disclosure. |
CVE-2022-47326 | Medium | 5.5 | 2023-02-12 | In wlan driver, there is a possible missing permission check. This could lead to local information disclosure. |
CVE-2022-47325 | Medium | 5.5 | 2023-02-12 | In wlan driver, there is a possible missing permission check. This could lead to local information disclosure. |
CVE-2022-47324 | Medium | 5.5 | 2023-02-12 | In wlan driver, there is a possible missing permission check. This could lead to local information disclosure. |
CVE-2022-38686 | Medium | 5.5 | 2023-02-12 | In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services. |
CVE-2022-46650 | Medium | 4.9 | 2023-02-10 | Acemanager in ALEOS before version 4.16 allows a user with valid credentials to reconfigure the device to expose the ACEManager credentials on the pre-login st… |
CVE-2022-24410 | Medium | 6.8 | 2023-02-10 | Dell BIOS contains an information exposure vulnerability. An unauthenticated local attacker with physical access to the system and knowledge of the system con… |
CVE-2023-23592 | High | 7.5 | 2023-02-09 | WALLIX Access Manager 3.x through 4.0.x allows a remote attacker to access sensitive information. |
CVE-2023-21435 | Medium | 4.4 | 2023-02-09 | Exposure of Sensitive Information vulnerability in Fingerprint TA prior to SMR Feb-2023 Release 1 allows attackers to access the memory address information via… |
CVE-2023-25165 | Medium | 4.3 | 2023-02-08 | Helm is a tool that streamlines installing and managing Kubernetes applications.`getHostByName` is a Helm template function introduced in Helm v3. The function… |