CWE-200 · Information Disclosure (page 37)
Page 37 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-6001 | Medium | 5.3 | 2023-11-08 | Prometheus metrics are available without authentication. These expose detailed and sensitive information about the YugabyteDB Anywhere environment. |
CVE-2023-4272 | Medium | 5.5 | 2023-11-07 | A local non-privileged user can make GPU processing operations that expose sensitive data from previously freed memory. |
CVE-2023-46851 | Medium | 4.9 | 2023-11-07 | Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Project administrators can run these imports, which could c… |
CVE-2023-38547 | Critical | 9.8 | 2023-11-07 | A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its configuration data… |
CVE-2023-46254 | Medium | 4.3 | 2023-11-06 | capsule-proxy is a reverse proxy for Capsule kubernetes multi-tenancy framework. A bug in the RoleBinding reflector used by `capsule-proxy` gives ServiceAccoun… |
CVE-2023-5968 | Medium | 4.9 | 2023-11-06 | Mattermost fails to properly sanitize the user object when updating the username, resulting in the password hash being included in the response body. |
CVE-2021-4430 | Low | 3.5 | 2023-11-06 | A vulnerability classified as problematic has been found in Ortus Solutions ColdBox Elixir 3.1.6. This affects an unknown part of the file src/defaultConfig.js… |
CVE-2023-45189 | Medium | 6.5 | 2023-11-03 | A vulnerability in IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.10, 23.0.0 through 23.0.10 may result… |
CVE-2023-41354 | Medium | 4.0 | 2023-11-03 | Chunghwa Telecom NOKIA G-040W-Q Firewall function does not block ICMP TIMESTAMP requests by default, an unauthenticated remote attacker can exploit this vulner… |
CVE-2023-45024 | High | 7.5 | 2023-11-03 | Best Practical Request Tracker (RT) 5 before 5.0.5 allows Information Disclosure via a transaction search in the transaction query builder. |
CVE-2023-41260 | High | 7.5 | 2023-11-03 | Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Exposure in responses to mail-gateway REST API calls. |
CVE-2023-41259 | High | 7.5 | 2023-11-03 | Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure via fake or spoofed RT email headers in an email message or… |
CVE-2023-34261 | Medium | 5.3 | 2023-11-03 | Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow identification of valid user accounts via username enumeration because they lead to a "nicht ei… |
CVE-2023-39057 | High | 7.5 | 2023-11-02 | An information leak in hirochanKAKIwaiting v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39054 | High | 7.5 | 2023-11-02 | An information leak in Tokudaya.ekimae_mc v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39053 | High | 7.5 | 2023-11-02 | An information leak in Hattoriya v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39051 | High | 7.5 | 2023-11-02 | An information leak in VISION MEAT WORKS Track Diner 10/10mbl v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39050 | High | 7.5 | 2023-11-02 | An information leak in Daiky-value.Fukueten v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39048 | High | 7.5 | 2023-11-02 | An information leak in Tokudaya.honten v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39047 | High | 7.5 | 2023-11-02 | An information leak in shouzu sweets oz v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39042 | High | 7.5 | 2023-11-02 | An information leak in Gyouza-newhushimi v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-5920 | Low | 2.9 | 2023-11-02 | Mattermost Desktop for MacOS fails to utilize the secure keyboard input functionality provided by macOS, allowing for other processes to read the keyboard inpu… |
CVE-2023-5516 | Medium | 5.3 | 2023-11-01 | Poorly constructed webap requests and URI components with special characters trigger unhandled errors and exceptions, disclosing information about the underly… |
CVE-2023-5515 | Medium | 5.3 | 2023-11-01 | The responses for web queries with certain parameters disclose internal path of resources. This information can be used to learn internal structure of the app… |
CVE-2023-43796 | Medium | 5.3 | 2023-10-31 | Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be queried from Synapse. This… |
CVE-2023-43041 | Medium | 6.5 | 2023-10-29 | IBM QRadar SIEM 7.5 is vulnerable to information exposure allowing a delegated Admin tenant user with a specific domain security profile assigned to see data f… |
CVE-2022-3611 | High | 7.6 | 2023-10-27 | An information disclosure vulnerability has been identified in the Lenovo App Store which may allow some applications to gain unauthorized access to sensitive… |
CVE-2023-33558 | High | 7.5 | 2023-10-26 | An information disclosure vulnerability in the component users-grid-data.php of Ocomon before v4.0.1 allows attackers to obtain sensitive information such as e… |
CVE-2023-31416 | Medium | 5.3 | 2023-10-26 | Secret token configuration is never applied when using ECK <2.8 with APM Server >=8.0. This could lead to anonymous requests to an APM Server being accepted an… |
CVE-2023-38849 | High | 7.5 | 2023-10-25 | An issue in tire-sales Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. |
CVE-2023-38847 | High | 7.5 | 2023-10-25 | An issue in CHRISTINA JAPAN Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. |
CVE-2023-38846 | High | 7.5 | 2023-10-25 | An issue in Marbre Lapin Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. |
CVE-2023-38845 | High | 7.5 | 2023-10-25 | An issue in Anglaise Company Anglaise.Company v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. |
CVE-2023-42846 | Medium | 5.3 | 2023-10-25 | This issue was addressed by removing the vulnerable code. This issue is fixed in watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, tvOS 17.1, iOS 17.1 and iPadOS 17… |
CVE-2023-41988 | Medium | 6.8 | 2023-10-25 | This issue was addressed by restricting options offered on a locked device. This issue is fixed in macOS Sonoma 14.1, watchOS 10.1, iOS 17.1 and iPadOS 17.1. A… |
CVE-2023-46128 | Medium | 6.5 | 2023-10-25 | Nautobot is a Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 2.0.x, c… |
CVE-2023-46125 | Medium | 6.5 | 2023-10-25 | Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of pri… |
CVE-2023-42490 | High | 7.5 | 2023-10-25 | EisBaer Scada - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2023-39739 | High | 8.2 | 2023-10-25 | The leakage of the client secret in REGINA SWEETS&BAKERY Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages. |
CVE-2023-39737 | High | 8.2 | 2023-10-25 | The leakage of the client secret in Matsuya Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages. |
CVE-2023-39736 | High | 8.2 | 2023-10-25 | The leakage of the client secret in Fukunaga_memberscard Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages. |
CVE-2023-39735 | High | 8.2 | 2023-10-25 | The leakage of the client secret in Uomasa_Saiji_news Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages. |
CVE-2023-46288 | Medium | 4.3 | 2023-10-23 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.4.0 to 2.7.0. Sensitive co… |
CVE-2023-5718 | Medium | 4.3 | 2023-10-23 | The Vue.js Devtools extension was found to leak screenshot data back to a malicious web page via the standard `postMessage()` API. By creating a malicious web… |
CVE-2023-46315 | High | 7.5 | 2023-10-22 | The zanllp sd-webui-infinite-image-browsing (aka Infinite Image Browsing) extension before 977815a for stable-diffusion-webui (aka Stable Diffusion web UI), if… |
CVE-2023-5070 | Medium | 6.5 | 2023-10-20 | The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2… |
CVE-2023-4796 | Medium | 4.3 | 2023-10-20 | The Booster for WooCommerce for WordPress is vulnerable to Information Disclosure via the 'wcj_wp_option' shortcode in versions up to, and including, 7.1.0 due… |
CVE-2023-5576 | High | 8.0 | 2023-10-20 | The Migration, Backup, Staging - WPvivid plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 0.9.91 via Goog… |
CVE-2023-46115 | High | 8.4 | 2023-10-20 | Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a… |
CVE-2023-41893 | Medium | 4.3 | 2023-10-20 | Home assistant is an open source home automation. The audit team’s analyses confirmed that the `redirect_uri` and `client_id` are alterable when logging in. Co… |
CVE-2023-45809 | Low | 2.7 | 2023-10-19 | Wagtail is an open source content management system built on Django. A user with a limited-permission editor account for the Wagtail admin can make a direct UR… |
CVE-2023-42666 | Medium | 5.3 | 2023-10-19 | The affected product is vulnerable to an exposure of sensitive information to an unauthorized actor vulnerability, which may allow an attacker to… |
CVE-2023-5254 | Medium | 5.3 | 2023-10-19 | The ChatBot plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.8.9 via the qcld_wb_chatbot_check_user fun… |
CVE-2023-34437 | High | 7.5 | 2023-10-19 | Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a vulnerability in their password retrieval functionality which could allow an at… |
CVE-2023-45912 | High | 7.5 | 2023-10-18 | WIPOTEC GmbH ComScale v4.3.29.21344 and v4.4.12.723 fails to validate user sessions, allowing unauthenticated attackers to read files from the underlying opera… |
CVE-2023-5642 | Critical | 9.8 | 2023-10-18 | Advantech R-SeeNet v2.4.23 allows an unauthenticated remote attacker to read from and write to the snmpmon.ini file, which contains sensitive information. |
CVE-2023-5552 | High | 7.1 | 2023-10-18 | A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to decrypt PDFs in Sophos Firewall version… |
CVE-2023-22086 | High | 7.5 | 2023-10-17 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2023-22019 | High | 7.5 | 2023-10-17 | Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affected is 12.2.1.4.0… |
CVE-2023-45803 | Medium | 4.2 | 2023-10-17 | urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status… |
CVE-2023-5339 | Medium | 4.7 | 2023-10-17 | Mattermost Desktop fails to set an appropriate log level during initial run after fresh installation resulting in logging all keystrokes including password ent… |
CVE-2023-41752 | High | 7.5 | 2023-10-17 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through… |
CVE-2022-43889 | Medium | 5.3 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could disclose sensitive information through an HTTP request that could aid an attacker in further attacks agai… |
CVE-2021-38859 | Medium | 4.3 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow a user to obtain version number information using a specially crafted HTTP request that could be us… |
CVE-2012-10016 | Medium | 4.3 | 2023-10-17 | A vulnerability classified as problematic has been found in Halulu simple-download-button-shortcode Plugin 1.0 on WordPress. Affected is an unknown function of… |
CVE-2023-45131 | High | 7.5 | 2023-10-16 | Discourse is an open source platform for community discussion. New chat messages can be read by making an unauthenticated POST request to MessageBus. This issu… |
CVE-2023-44394 | Medium | 4.3 | 2023-10-16 | MantisBT is an open source bug tracker. Due to insufficient access-level checks on the Wiki redirection page, any user can reveal private Projects' names, by a… |
CVE-2023-44391 | Medium | 5.3 | 2023-10-16 | Discourse is an open source platform for community discussion. User summaries are accessible for anonymous users even when `hide_user_profiles_from_public` is… |
CVE-2023-43814 | Low | 3.7 | 2023-10-16 | Discourse is an open source platform for community discussion. Attackers with details specific to a poll in a topic can use the `/polls/grouped_poll_results` e… |
CVE-2023-45147 | Medium | 4.9 | 2023-10-16 | Discourse is an open source community platform. In affected versions any user can create a topic and add arbitrary custom fields to a topic. The severity of th… |
CVE-2023-38059 | Medium | 5.3 | 2023-10-16 | The loading of external images is not blocked, even if configured, if the attacker uses protocol-relative URL in the payload. This can be used to retreive the… |
CVE-2022-43868 | Medium | 5.3 | 2023-10-14 | IBM Security Verify Access OIDC Provider could disclose directory information that could aid attackers in further attacks against the system. IBM X-Force ID… |
CVE-2023-5579 | Low | 3.5 | 2023-10-14 | A vulnerability was found in yhz66 Sandbox 6.1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /im/user/… |
CVE-2023-45348 | Medium | 4.3 | 2023-10-14 | Apache Airflow, versions 2.7.0 and 2.7.1, is affected by a vulnerability that allows an authenticated user to retrieve sensitive configuration information when… |
CVE-2023-42780 | Medium | 6.5 | 2023-10-14 | Apache Airflow, versions prior to 2.7.2, contains a security vulnerability that allows authenticated users of Airflow to list warnings for all DAGs, even if th… |
CVE-2023-42663 | Medium | 6.5 | 2023-10-14 | Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about… |
CVE-2023-39999 | Medium | 4.3 | 2023-10-13 | Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through… |
CVE-2023-45143 | Low | 3.9 | 2023-10-12 | Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects… |
CVE-2023-44187 | Medium | 5.9 | 2023-10-11 | An Exposure of Sensitive Information vulnerability in the 'file copy' command of Junos OS Evolved allows a local, authenticated attacker with shell access to v… |
CVE-2023-41881 | Low | 3.7 | 2023-10-11 | vantage6 is privacy preserving federated learning infrastructure. When a collaboration is deleted, the linked resources (such as tasks from that collaboration)… |
CVE-2023-44097 | High | 7.5 | 2023-10-11 | Vulnerability of the permission to access device SNs being improperly managed.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-44093 | High | 7.5 | 2023-10-11 | Vulnerability of package names' public keys not being verified in the security module.Successful exploitation of this vulnerability may affect service confiden… |
CVE-2023-29348 | High | 7.5 | 2023-10-10 | Windows Remote Desktop Gateway (RD Gateway) Information Disclosure Vulnerability |
CVE-2023-37939 | Low | 3.3 | 2023-10-10 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClient for Windows 7.2.0, 7.0 all versions, 6.4 all versions, 6.2… |
CVE-2023-45219 | Medium | 4.4 | 2023-10-10 | Exposure of Sensitive Information vulnerability exist in an undisclosed BIG-IP TMOS shell (tmsh) command which may allow an authenticated attacker with resour… |
CVE-2022-34355 | Medium | 4.0 | 2023-10-06 | IBM Jazz Foundation (IBM Engineering Lifecycle Management 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2) could disclose sensitive version information to a user that co… |
CVE-2023-43804 | Medium | 5.9 | 2023-10-04 | urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies o… |
CVE-2023-3361 | High | 7.7 | 2023-10-04 | A flaw was found in Red Hat OpenShift Data Science. When exporting a pipeline from the Elyra notebook pipeline editor as Python DSL or YAML, it reads S3 creden… |
CVE-2023-1584 | High | 7.5 | 2023-10-04 | A flaw was found in Quarkus. Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, which can a… |
CVE-2022-22447 | Medium | 4.0 | 2023-10-04 | IBM Disconnected Log Collector 1.0 through 1.8.2 is vulnerable to potential security misconfigurations that could disclose unintended information. IBM X-Force… |
CVE-2023-4886 | Medium | 6.7 | 2023-10-03 | A sensitive information exposure vulnerability was found in foreman. Contents of tomcat's server.xml file, which contain passwords to candlepin's keystore and… |
CVE-2023-3349 | High | 8.2 | 2023-10-03 | Information exposure vulnerability in IBERMATICA RPS 2019, which exploitation could allow an unauthenticated user to retrieve sensitive information, such as us… |
CVE-2022-47892 | Medium | 5.3 | 2023-10-03 | All versions of NetMan 204 could allow an unauthenticated remote attacker to read a file (config.cgi) containing sensitive information, like credentials. |
CVE-2023-5160 | Medium | 4.3 | 2023-10-02 | Mattermost fails to check the Show Full Name option at the /api/v4/teams/TEAM_ID/top/team_members endpoint allowing a member to get the full name of another us… |
CVE-2023-5256 | High | 7.5 | 2023-09-28 | In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and ma… |
CVE-2023-42820 | High | 7.0 | 2023-09-27 | JumpServer is an open source bastion host. This vulnerability is due to exposing the random number seed to the API, potentially allowing the randomly generated… |
CVE-2023-41323 | Medium | 5.3 | 2023-09-27 | GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses… |
CVE-2023-41321 | Medium | 4.9 | 2023-09-27 | GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses… |
CVE-2023-40049 | Medium | 5.3 | 2023-09-27 | In WS_FTP Server version prior to 8.8.2, an unauthenticated user could enumerate files under the 'WebServiceHost' directory listing. |
CVE-2023-23958 | Medium | 6.8 | 2023-09-27 | Symantec Protection Engine, prior to 9.1.0, may be susceptible to a Hash Leak vulnerability. |