CWE-200 · Information Disclosure (page 35)
Page 35 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-25165 | Medium | 4.3 | 2023-02-08 | Helm is a tool that streamlines installing and managing Kubernetes applications.`getHostByName` is a Helm template function introduced in Helm v3. The function… |
CVE-2023-25164 | High | 8.6 | 2023-02-08 | Tinacms is a Git-backed headless content management system with support for visual editing. Sites being built with @tinacms/cli >= 1.0.0 && < 1.0.9 which store… |
CVE-2022-40691 | Medium | 5.3 | 2023-02-07 | An information disclosure vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted… |
CVE-2023-24827 | Medium | 6.5 | 2023-02-07 | syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. A password disclosure flaw was fo… |
CVE-2022-44268 | Medium | 6.5 | 2023-02-06 | ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulting image could have embedded the conten… |
CVE-2022-42439 | Medium | 6.8 | 2023-02-06 | IBM App Connect Enterprise 11.0.0.17 through 11.0.0.19 and 12.0.4.0 and 12.0.5.0 contains an unspecified vulnerability in the Discovery Connector nodes which… |
CVE-2020-36660 | Medium | 4.3 | 2023-02-06 | A vulnerability was found in paxswill EVE Ship Replacement Program 0.12.11. It has been rated as problematic. This issue affects some unknown processing of the… |
CVE-2022-23498 | High | 7.1 | 2023-02-03 | Grafana is an open-source platform for monitoring and observability. When datasource query caching is enabled, Grafana caches all headers, including `grafana_s… |
CVE-2022-47070 | High | 7.5 | 2023-02-03 | NVS365 V01 is vulnerable to Incorrect Access Control. After entering a wrong password, the url will be sent to the server twice. In the second package, the ser… |
CVE-2023-0659 | Medium | 5.3 | 2023-02-03 | A vulnerability was found in BDCOM 1704-WGL 2.0.6314. It has been classified as critical. This affects an unknown part of the file /param.file.tgz of the compo… |
CVE-2023-0658 | Medium | 5.3 | 2023-02-03 | A vulnerability, which was classified as critical, was found in Multilaser RE057 and RE170 2.1/2.2. This affects an unknown part of the file /param.file.tgz of… |
CVE-2021-22786 | High | 7.5 | 2023-02-01 | A CWE-200: Information Exposure vulnerability exists that could cause the exposure of sensitive information stored on the memory of the controller when communi… |
CVE-2022-4206 | Medium | 5.0 | 2023-02-01 | A sensitive information leak issue has been discovered in all versions of DAST API scanner from 1.6.50 prior to 2.0.102, exposing the Authorization header in t… |
CVE-2022-32984 | High | 7.5 | 2023-01-31 | BTCPay Server 1.3.0 through 1.5.3 allows a remote attacker to obtain sensitive information when a public Point of Sale app is exposed. The sensitive informatio… |
CVE-2023-22611 | High | 7.5 | 2023-01-31 | A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause information disclosure when specific messages are s… |
CVE-2023-23629 | Medium | 6.3 | 2023-01-28 | Metabase is an open source data analytics platform. Affected versions are subject to Improper Privilege Management. As intended, recipients of dashboards subsc… |
CVE-2023-23628 | Medium | 5.7 | 2023-01-28 | Metabase is an open source data analytics platform. Affected versions are subject to Exposure of Sensitive Information to an Unauthorized Actor. Sandboxed user… |
CVE-2023-23624 | Medium | 4.3 | 2023-01-28 | Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and version 3.1.0.beta2 on the `beta` and `tests-passed` branche… |
CVE-2023-23620 | Medium | 5.3 | 2023-01-28 | Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches, the c… |
CVE-2023-0557 | High | 7.5 | 2023-01-27 | The ContentStudio plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.5. This could allow unauthenticate… |
CVE-2023-23613 | Medium | 5.7 | 2023-01-26 | OpenSearch is an open source distributed and RESTful search engine. In affected versions there is an issue in the implementation of field-level security (FLS)… |
CVE-2023-0321 | Critical | 9.1 | 2023-01-26 | Campbell Scientific dataloggers CR6, CR300, CR800, CR1000 and CR3000 may allow an attacker to download configuration files, which may contain sensitive informa… |
CVE-2022-4054 | Medium | 5.5 | 2023-01-26 | An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions star… |
CVE-2022-31711 | Medium | 5.3 | 2023-01-26 | VMware vRealize Log Insight contains an Information Disclosure Vulnerability. A malicious actor can remotely collect sensitive session and application informat… |
CVE-2023-24069 | Low | 3.3 | 2023-01-23 | Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to obtain potentially sensitive attachments sent in messages from the attachments.n… |
CVE-2022-39193 | Medium | 5.3 | 2023-01-20 | An issue was discovered in the CheckUser extension for MediaWiki through 1.39.x. Various components of this extension can expose information on the performer o… |
CVE-2021-39089 | Medium | 4.3 | 2023-01-20 | IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.6.0 could allow an authenticated user to obtain sensitive information from a specially crafted HTTP req… |
CVE-2022-43959 | Medium | 4.9 | 2023-01-20 | Insufficiently Protected Credentials in the AD/LDAP server settings in 1C-Bitrix Bitrix24 through 22.200.200 allow remote administrators to discover an AD/LDAP… |
CVE-2022-39167 | Medium | 5.9 | 2023-01-19 | IBM Spectrum Virtualize 8.5, 8.4, 8.3, 8.2, and 7.8, under certain configurations, could disclose sensitive information to an attacker using man-in-the-middle… |
CVE-2022-45925 | High | 7.5 | 2023-01-18 | An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The action xmlexport accepts the parameter requestContext. If this parameter is… |
CVE-2022-45103 | Medium | 6.5 | 2023-01-18 | Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 9.2.3.x contain an information disclosure vulnerability. A low privile… |
CVE-2022-2907 | Medium | 5.7 | 2023-01-17 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versio… |
CVE-2023-22875 | High | 8.4 | 2023-01-17 | IBM QRadar SIEM 7.4 and 7.5copies certificate key files used for SSL/TLS in the QRadar web user interface to managed hosts in the deployment that do not requi… |
CVE-2022-41859 | High | 7.5 | 2023-01-17 | In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size o… |
CVE-2022-3091 | High | 7.5 | 2023-01-17 | RONDS EPM version 1.19.5 has a vulnerability in which a function could allow unauthenticated users to leak credentials. In some circumstances, an attacker ca… |
CVE-2022-48258 | Medium | 5.3 | 2023-01-13 | In Eternal Terminal 6.2.1, etserver and etclient have world-readable logfiles. |
CVE-2022-46371 | Medium | 5.3 | 2023-01-12 | Alotcer - AR7088H-A firmware version 16.10.3 Information disclosure. Unspecified error message contains the default administrator user name. |
CVE-2022-3870 | Medium | 5.3 | 2023-01-12 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versio… |
CVE-2022-4457 | Medium | 5.5 | 2023-01-11 | Due to a misconfiguration in the manifest file of the WARP client for Android, it was possible to a perform a task hijacking attack. An attacker could create a… |
CVE-2022-4543 | Medium | 5.5 | 2023-01-11 | A flaw named "EntryBleed" was found in the Linux Kernel Page Table Isolation (KPTI). This issue could allow a local attacker to leak KASLR base via prefetch si… |
CVE-2022-4415 | Medium | 5.5 | 2023-01-11 | A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suid_dumpable kernel… |
CVE-2022-0553 | Medium | 6.5 | 2023-01-11 | There is no check to see if slot 0 is being uploaded from the device to the host. When using encrypted images this means the unencrypted firmware can be retrie… |
CVE-2022-46163 | High | 7.5 | 2023-01-10 | Travel support program is a rails app to support the travel support program of openSUSE (TSP). Sensitive user data (bank account details, password Hash) can be… |
CVE-2022-45167 | Medium | 4.3 | 2023-01-10 | An issue was discovered in Archibus Web Central 2022.03.01.107. A service exposed by the application allows a basic user to access the profile information of a… |
CVE-2023-0023 | Medium | 4.5 | 2023-01-10 | In SAP Bank Account Management (Manage Banks) application, when a user clicks a smart link to navigate to another app, personal data is shown directly in the U… |
CVE-2022-23509 | High | 7.3 | 2023-01-09 | Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. GitOps run has a l… |
CVE-2023-0113 | Medium | 5.3 | 2023-01-07 | A vulnerability was found in Netis Netcore Router up to 2.2.6. It has been declared as problematic. Affected by this vulnerability is an unknown functionality… |
CVE-2022-42979 | High | 8.8 | 2023-01-06 | Information disclosure due to an insecure hostname validation in the RYDE application 5.8.43 for Android and iOS allows attackers to take over an account via a… |
CVE-2023-22453 | Medium | 5.3 | 2023-01-05 | Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` bra… |
CVE-2022-23546 | Medium | 5.5 | 2023-01-05 | In version 2.9.0.beta14 of Discourse, an open-source discussion platform, maliciously embedded urls can leak an admin's digest of recent topics, possibly expos… |
CVE-2022-43573 | Low | 3.1 | 2023-01-05 | IBM Robotic Process Automation 20.12 through 21.0.6 is vulnerable to exposure of the name and email for the creator/modifier of platform level objects. IBM X-… |
CVE-2022-4869 | Low | 3.5 | 2023-01-05 | A vulnerability was found in Evolution Events Artaxerxes. It has been declared as problematic. This vulnerability affects unknown code of the file arta/common/… |
CVE-2022-43540 | Medium | 5.5 | 2023-01-05 | A vulnerability exists in the ClearPass OnGuard macOS agent that allows for an attacker with local macOS instance access to potentially obtain sensitive inform… |
CVE-2022-43539 | Medium | 5.7 | 2023-01-05 | A vulnerability exists in the ClearPass Policy Manager cluster communications that allow for an attacker in a privileged network position to potentially obtai… |
CVE-2022-22337 | Medium | 4.3 | 2023-01-04 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 could disclose sensitive information to an authenticated user. IBM X-Force ID: 219507. |
CVE-2022-46081 | High | 7.5 | 2023-01-04 | In Garmin Connect 4.61, terminating a LiveTrack session wouldn't prevent the LiveTrack API from continued exposure of private personal information. NOTE: this… |
CVE-2013-10007 | Medium | 5.3 | 2023-01-03 | A vulnerability classified as problematic has been found in ethitter WP-Print-Friendly up to 0.5.2. This affects an unknown part of the file wp-print-friendly… |
CVE-2022-3460 | High | 7.5 | 2023-01-03 | In affected versions of Octopus Deploy it is possible for certain types of sensitive variables to inadvertently become unmasked when viewed in variable preview. |
CVE-2022-42266 | Medium | 5.5 | 2022-12-30 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where an unprivileged regular… |
CVE-2022-34674 | Medium | 6.8 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where a helper function maps more physical pages than were reque… |
CVE-2019-18177 | Medium | 6.5 | 2022-12-26 | In certain Citrix products, information disclosure can be achieved by an authenticated VPN user when there is a configured SSL VPN endpoint. This affects Citri… |
CVE-2019-14802 | Medium | 5.3 | 2022-12-26 | HashiCorp Nomad 0.5.0 through 0.9.4 (fixed in 0.9.5) reveals unintended environment variables to the rendering task during template rendering, aka GHSA-6hv3-7c… |
CVE-2022-41767 | Medium | 5.3 | 2022-12-26 | An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. When changes made by an IP address are reassigne… |
CVE-2022-45414 | High | 8.1 | 2022-12-22 | If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a VIDEO tag with the POSTER attribute or… |
CVE-2022-31746 | Medium | 6.5 | 2022-12-22 | Internal URLs are protected by a secret UUID key, which could have been leaked to web page through the Referrer header. This vulnerability affects Firefox for… |
CVE-2022-29916 | Medium | 6.5 | 2022-12-22 | Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables. This could have been used to probe the bro… |
CVE-2022-22745 | Medium | 6.5 | 2022-12-22 | Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations. This vulnerability affects Firefox ESR < 91.5, Firefo… |
CVE-2022-25948 | Medium | 5.3 | 2022-12-22 | The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties o… |
CVE-2022-3185 | Medium | 5.3 | 2022-12-21 | Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the affected product exposes sensitive data concerning the device. |
CVE-2022-46310 | High | 7.5 | 2022-12-20 | The TelephonyProvider module has a vulnerability in obtaining values.Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2022-39166 | Medium | 4.4 | 2022-12-20 | IBM Security Guardium 11.4 could allow a privileged user to obtain sensitive information inside of an HTTP response. IBM X-Force ID: 235405. |
CVE-2022-23488 | Medium | 6.5 | 2022-12-17 | BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are vulnerable to Insertion of Sensitive Information Into Sent Data. The mo… |
CVE-2022-23490 | Medium | 4.3 | 2022-12-16 | BigBlueButton is an open source web conferencing system. Versions prior to 2.4.0 expose sensitive information to Unauthorized Actors. This issue affects meetin… |
CVE-2022-41964 | Medium | 5.7 | 2022-12-16 | BigBlueButton is an open source web conferencing system. This vulnerability only affects release candidates of BigBlueButton 2.4. The attacker can start a subs… |
CVE-2022-20591 | Medium | 5.5 | 2022-12-16 | In ppmpu_set of ppmpu.c, there is a possible information disclosure due to a logic error in the code. This could lead to local information disclosure with no a… |
CVE-2022-46702 | Medium | 5.5 | 2022-12-15 | The issue was addressed with improved memory handling. This issue is fixed in iOS 16.2 and iPadOS 16.2. An app may be able to disclose kernel memory. |
CVE-2022-42866 | Medium | 5.5 | 2022-12-15 | The issue was addressed with improved handling of caches. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2, watchOS 9.2. An app m… |
CVE-2022-42854 | Medium | 5.5 | 2022-12-15 | The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.2, macOS Ventura 13.1. An app may be able to disclose kernel… |
CVE-2022-42852 | Medium | 6.5 | 2022-12-15 | The issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16… |
CVE-2022-42843 | Medium | 5.5 | 2022-12-15 | This issue was addressed with improved data protection. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2, watchOS 9.2. A user may… |
CVE-2022-3917 | Medium | 4.6 | 2022-12-14 | Improper access control of bootloader function was discovered in Motorola Mobility Motorola e20 prior to version RONS31.267-38-8 allows attacker with local acc… |
CVE-2022-47411 | Critical | 9.1 | 2022-12-14 | An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3… |
CVE-2022-47410 | Critical | 9.1 | 2022-12-14 | An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3… |
CVE-2022-23504 | Medium | 5.7 | 2022-12-14 | TYPO3 is an open source PHP based web content management system. Versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are subject to Sensitive Information Di… |
CVE-2022-46355 | High | 7.5 | 2022-12-13 | A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (HS… |
CVE-2022-20497 | Medium | 4.6 | 2022-12-13 | In updatePublicMode of NotificationLockscreenUserManagerImpl.java, there is a possible way to reveal sensitive notifications on the lockscreen due to an incorr… |
CVE-2022-37930 | Medium | 6.7 | 2022-12-12 | A security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays and HPE Nimble Storage Secondary Flash Arrays which could potentially al… |
CVE-2022-37909 | Medium | 5.3 | 2022-12-12 | Aruba has identified certain configurations of ArubaOS that can lead to sensitive information disclosure from the configured ESSIDs. The scenarios in which dis… |
CVE-2022-23497 | Medium | 6.5 | 2022-12-09 | FreshRSS is a free, self-hostable RSS aggregator. User configuration files can be accessed by a remote user. In addition to user preferences, such configuratio… |
CVE-2022-46158 | Medium | 5.3 | 2022-12-08 | PrestaShop is an open-source e-commerce solution. Versions prior to 1.7.8.8 did not properly restrict host filesystem access for users. Users may have been abl… |
CVE-2022-23469 | Low | 3.5 | 2022-12-08 | Traefik is an open source HTTP reverse proxy and load balancer. Versions prior to 2.9.6 are subject to a potential vulnerability in Traefik displaying the Auth… |
CVE-2022-46825 | Medium | 4.0 | 2022-12-08 | In JetBrains IntelliJ IDEA before 2022.3 the built-in web server leaked information about open projects. |
CVE-2022-39914 | Medium | 4.0 | 2022-12-08 | Exposure of Sensitive Information from an Unauthorized Actor vulnerability in Samsung DisplayManagerService prior to Android T(13) allows local attacker to acc… |
CVE-2022-39913 | Medium | 6.8 | 2022-12-08 | Exposure of Sensitive Information to an Unauthorized Actor in Persona Manager prior to Android T(13) allows local attacker to access user profiles information. |
CVE-2022-39904 | Low | 3.3 | 2022-12-08 | Exposure of Sensitive Information vulnerability in Samsung Settings prior to SMR Dec-2022 Release 1 allows local attackers to access the Network Access Identif… |
CVE-2022-39903 | Medium | 4.0 | 2022-12-08 | Improper access control vulnerability in RCS call prior to SMR Dec-2022 Release 1 allows local attackers to access RCS incoming call number. |
CVE-2022-39897 | Medium | 4.4 | 2022-12-08 | Exposure of Sensitive Information vulnerability in kernel prior to SMR Dec-2022 Release 1 allows attackers to access the kernel address information via log. |
CVE-2022-42782 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing permission check, This could lead to local information disclosure. |
CVE-2022-42766 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing permission check, This could lead to local information disclosure. |
CVE-2022-32221 | Critical | 9.8 | 2022-12-05 | When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIEL… |