CWE-200 · Information Disclosure (page 38)
Page 38 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-33742 | High | 7.1 | 2022-07-05 | Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which… |
CVE-2022-33741 | High | 7.1 | 2022-07-05 | Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which… |
CVE-2022-29467 | Medium | 4.3 | 2022-07-04 | Address information disclosure vulnerability in Cybozu Garoon 4.2.0 to 5.5.1 allows a remote authenticated attacker to obtain some data of Address. |
CVE-2022-31112 | High | 8.2 | 2022-06-30 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions parse Server LiveQuery does not re… |
CVE-2022-31032 | Medium | 4.3 | 2022-06-29 | Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.58 authorizations are not p… |
CVE-2017-20110 | Medium | 4.3 | 2022-06-29 | A vulnerability, which was classified as problematic, has been found in Teleopti WFM up to 7.1.0. Affected by this issue is some unknown functionality of the c… |
CVE-2017-20109 | Medium | 4.3 | 2022-06-29 | A vulnerability classified as problematic was found in Teleopti WFM up to 7.1.0. Affected by this vulnerability is an unknown functionality of the file /Teleop… |
CVE-2022-31068 | Medium | 5.3 | 2022-06-28 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versio… |
CVE-2022-0987 | Low | 3.3 | 2022-06-28 | A flaw was found in PackageKit in the way some of the methods exposed by the Transaction interface examines files. This issue allows a local user to measure th… |
CVE-2022-31091 | High | 7.7 | 2022-06-27 | Guzzle, an extensible PHP HTTP client. `Authorization` and `Cookie` headers on requests are sensitive information. In affected versions on making a request whi… |
CVE-2022-31090 | High | 7.7 | 2022-06-27 | Guzzle, an extensible PHP HTTP client. `Authorization` headers on requests are sensitive information. In affected versions when using our Curl handler, it is p… |
CVE-2022-2221 | Medium | 6.5 | 2022-06-27 | Information Exposure vulnerability in My Account Settings of Devolutions Remote Desktop Manager before 2022.1.8 allows authenticated users to access credential… |
CVE-2017-20101 | Low | 3.5 | 2022-06-27 | A vulnerability, which was classified as problematic, was found in ProjectSend r754. This affects an unknown part of the file process.php?do=zip_download. The… |
CVE-2022-0722 | High | 7.5 | 2022-06-27 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository ionicabizau/parse-url prior to 7.0.0. |
CVE-2022-31095 | Medium | 4.3 | 2022-06-21 | discourse-chat is a chat plugin for the Discourse application. Versions prior to 0.4 are vulnerable to an exposure of sensitive information, where an attacker… |
CVE-2022-30607 | Medium | 6.5 | 2022-06-17 | IBM Robotic Process Automation 20.10.0, 20.12.5, 21.0.0, 21.0.1, and 21.0.2 contains a vulnerability that could allow a user to obtain sensitive information du… |
CVE-2022-30184 | Medium | 5.5 | 2022-06-15 | .NET and Visual Studio Information Disclosure Vulnerability |
CVE-2022-31070 | Medium | 5.8 | 2022-06-15 | NestJS Proxy is a NestJS module to decorate and proxy calls. Prior to version 0.7.0, the nestjs-proxy library did not have a way to block sensitive cookies (e… |
CVE-2022-31069 | Medium | 5.8 | 2022-06-15 | NestJS Proxy is a NestJS module to decorate and proxy calls. Prior to version 0.7.0, the nestjs-proxy library did not have a way to control when Authorization… |
CVE-2022-20664 | High | 7.7 | 2022-06-15 | A vulnerability in the web management interface of Cisco Secure Email and Web Manager, formerly Cisco Security Management Appliance (SMA), and Cisco Email Secu… |
CVE-2022-31066 | Medium | 5.9 | 2022-06-14 | EdgeX Foundry is an open source project for building a common open framework for Internet of Things edge computing. Prior to version 2.1.1, the /api/v2/config… |
CVE-2022-31060 | Medium | 5.3 | 2022-06-14 | Discourse is an open-source discussion platform. Prior to version 2.8.4 in the `stable` branch and version `2.9.0.beta5` in the `beta` and `tests-passed` branc… |
CVE-2022-31046 | Medium | 4.3 | 2022-06-14 | TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the export functionality… |
CVE-2022-29241 | High | 7.1 | 2022-06-14 | Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter Notebook. Prior to version 1.1… |
CVE-2022-31309 | High | 7.5 | 2022-06-14 | A vulnerability in live_check.shtml of WAVLINK AERIAL X 1200M M79X3.V5030.180719 allows attackers to obtain sensitive router information via execution of the e… |
CVE-2022-31308 | High | 7.5 | 2022-06-14 | A vulnerability in live_mfg.shtml of WAVLINK AERIAL X 1200M M79X3.V5030.191012 allows attackers to obtain sensitive router information via execution of the exe… |
CVE-2021-35080 | Medium | 6.5 | 2022-06-14 | Disabled SMMU from secure side while RPM is assigned a secure stream can lead to information disclosure in Snapdragon Industrial IOT, Snapdragon Mobile, Snapdr… |
CVE-2021-35070 | Medium | 6.5 | 2022-06-14 | RPM secure Stream can access any secure resource due to improper SMMU configuration and can lead to information disclosure in Snapdragon Industrial IOT, Snapdr… |
CVE-2022-32192 | High | 7.5 | 2022-06-13 | Couchbase Server 5.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor. |
CVE-2022-29244 | High | 7.5 | 2022-06-13 | npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--worksp… |
CVE-2022-1595 | Medium | 5.3 | 2022-06-13 | The HC Custom WP-Admin URL WordPress plugin through 1.4 leaks the secret login URL when sending a specific crafted request |
CVE-2022-32741 | Medium | 5.3 | 2022-06-13 | Attacker is able to determine if the provided username exists (and it's valid) using Request New Password feature, based on the response time. |
CVE-2022-32740 | Low | 3.5 | 2022-06-13 | A reply to a forwarded email article by a 3rd party could unintensionally expose the email content to the ticket customer under certain circumstances. |
CVE-2022-32739 | Low | 3.5 | 2022-06-13 | When Secure::DisableBanner system configuration has been disabled and agent shares his calendar via public URL, received ICS file contains OTRS release number. |
CVE-2017-20031 | Low | 2.7 | 2022-06-10 | A vulnerability was found in PHPList 3.2.6. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation o… |
CVE-2022-31043 | High | 7.5 | 2022-06-10 | Guzzle is an open source PHP HTTP client. In affected versions `Authorization` headers on requests are sensitive information. On making a request using the `ht… |
CVE-2022-31042 | High | 7.5 | 2022-06-10 | Guzzle is an open source PHP HTTP client. In affected versions the `Cookie` headers on requests are sensitive information. On making a request using the `https… |
CVE-2017-20022 | High | 7.5 | 2022-06-09 | A vulnerability has been found in Solare Solar-Log 2.8.4-56/3.5.2-85 and classified as problematic. This vulnerability affects unknown code. The manipulation l… |
CVE-2017-20019 | Medium | 4.3 | 2022-06-09 | A vulnerability classified as problematic was found in Solare Solar-Log 2.8.4-56/3.5.2-85. Affected by this vulnerability is an unknown functionality of the co… |
CVE-2022-31051 | Medium | 4.4 | 2022-06-09 | semantic-release is an open source npm package for automated version management and package publishing. In affected versions secrets that would normally be mas… |
CVE-2022-31033 | Medium | 5.9 | 2022-06-09 | The Mechanize library is used for automating interaction with websites. Mechanize automatically stores and sends cookies, follows redirects, and can follow lin… |
CVE-2022-30556 | High | 7.5 | 2022-06-09 | Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer. |
CVE-2022-28614 | Medium | 5.3 | 2022-06-09 | The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input us… |
CVE-2019-25069 | Medium | 5.3 | 2022-06-09 | A vulnerability, which was classified as problematic, has been found in Axios Italia Axios RE 1.7.0/7.0.0. This issue affects some unknown processing of the co… |
CVE-2022-30743 | Medium | 5.3 | 2022-06-07 | Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the data of contact and gallery without permission. |
CVE-2022-30742 | Low | 3.3 | 2022-06-07 | Sensitive information exposure vulnerability in FmmExtraOperation of Find My Mobile prior to 7.2.24.12 allows local attackers with log access permissio to get… |
CVE-2022-30741 | Low | 3.3 | 2022-06-07 | Sensitive information exposure vulnerability in SimChangeAlertManger of Find My Mobile prior to 7.2.24.12 allows local attackers with log access permission to… |
CVE-2022-30740 | Medium | 4.1 | 2022-06-07 | Improper auto-fill algorithm in Samsung Internet prior to version 17.0.1.69 allows physical attackers to guess stored credit card numbers. |
CVE-2022-30737 | Medium | 4.0 | 2022-06-07 | Implicit Intent hijacking vulnerability in Samsung Account prior to version 13.2.00.6 allows attackers to get email ID. |
CVE-2022-30736 | Medium | 5.3 | 2022-06-07 | Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the data of contact and gallery without permission. |
CVE-2022-30735 | Medium | 5.9 | 2022-06-07 | Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the access_token without permission. |
CVE-2022-30734 | Medium | 4.0 | 2022-06-07 | Sensitive information exposure in Sign-out log in Samsung Account prior to version 13.2.00.6 allows attackers to get an user email or phone number without perm… |
CVE-2022-30733 | Medium | 4.0 | 2022-06-07 | Sensitive information exposure in Sign-in log in Samsung Account prior to version 13.2.00.6 allows attackers to get an user email or phone number without permi… |
CVE-2022-30732 | Medium | 5.5 | 2022-06-07 | Exposure of Sensitive Information vulnerability in Samsung Account prior to version 13.2.00.6 allows attacker to access sensitive information via onActivityRes… |
CVE-2020-36532 | Medium | 4.3 | 2022-06-07 | A vulnerability has been found in Klapp App and classified as problematic. This vulnerability affects unknown code of the component Authorization. The manipula… |
CVE-2022-30586 | High | 7.2 | 2022-06-06 | Gradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to code execution. |
CVE-2022-28224 | Medium | 5.5 | 2022-06-06 | Clusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with the floating IP featu… |
CVE-2021-42886 | High | 7.5 | 2022-06-03 | TOTOLINK EX1200T V4.1.2cu.5215 contains an information disclosure vulnerability where an attacker can get the apmib configuration file without authorization, a… |
CVE-2022-26869 | Critical | 9.8 | 2022-06-02 | Dell PowerStore versions 2.0.0.x, 2.0.1.x and 2.1.0.x contains an open port vulnerability. A remote unauthenticated attacker could potentially exploit this vul… |
CVE-2022-27775 | High | 7.5 | 2022-06-02 | An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a… |
CVE-2022-29235 | Medium | 5.3 | 2022-06-02 | BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4-rc-6, an attacker who is able to obtain t… |
CVE-2022-29232 | Medium | 6.5 | 2022-06-01 | BigBlueButton is an open source web conferencing system. Starting with version 2.2 and prior to versions 2.3.9 and 2.4-beta-1, an attacker can circumvent acces… |
CVE-2022-24414 | High | 7.6 | 2022-05-26 | Dell EMC CloudLink 7.1.3 and all earlier versions, Auth Token is exposed in GET requests. These request parameters can get logged in reverse proxies and server… |
CVE-2022-20821 | Medium | 6.5 | 2022-05-26 | A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running w… |
CVE-2022-29248 | High | 8.0 | 2022-05-25 | Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 and 7.4.3 contains a vulnerability with the cookie middleware. The vulnerability is that it is not… |
CVE-2022-1815 | High | 7.5 | 2022-05-25 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.1.2. |
CVE-2022-29567 | Medium | 5.7 | 2022-05-24 | The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 2… |
CVE-2022-24906 | Low | 3.5 | 2022-05-20 | Nextcloud Deck is a Kanban-style project & personal management tool for Nextcloud, similar to Trello. The full path of the application is exposed to unauthoriz… |
CVE-2022-29165 | Critical | 10.0 | 2022-05-20 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A critical vulnerability has been discovered in Argo CD starting with version 1.4.0 a… |
CVE-2022-1774 | Medium | 6.1 | 2022-05-18 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.0.7. |
CVE-2022-30990 | High | 7.5 | 2022-05-18 | Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 15 (Linux) before build 29240… |
CVE-2022-30598 | Medium | 4.3 | 2022-05-18 | A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it. |
CVE-2022-23067 | High | 8.8 | 2022-05-18 | ToolJet versions v0.5.0 to v1.2.2 are vulnerable to token leakage via Referer header that leads to account takeover . If the user opens the invite link/signup… |
CVE-2022-24890 | Low | 2.4 | 2022-05-17 | Nextcloud Talk is a video and audio conferencing app for Nextcloud. In versions prior to 13.0.5 and 14.0.0, a call moderator can indirectly enable user webcams… |
CVE-2020-4957 | Medium | 5.3 | 2022-05-17 | IBM Security Identity Governance and Intelligence 5.2.6 could disclose sensitive information in URL parameters that could aid in future attacks against the sys… |
CVE-2022-30334 | Medium | 5.3 | 2022-05-07 | Brave before 1.34, when a Private Window with Tor Connectivity is used, leaks .onion URLs in Referer and Origin headers. NOTE: although this was fixed by Brave… |
CVE-2022-26070 | Medium | 4.3 | 2022-05-06 | When handling a mismatched pre-authentication cookie, the application leaks the internal error message in the response, which contains the Splunk Enterprise lo… |
CVE-2022-27875 | Medium | 5.5 | 2022-05-05 | On F5 Access for Android 3.x versions prior to 3.0.8, a Task Hijacking vulnerability exists in the F5 Access for Android application, which may allow an attack… |
CVE-2022-25990 | Medium | 5.3 | 2022-05-05 | On 1.0.x versions prior to 1.0.1, systems running F5OS-A software may expose certain registry ports externally. Note: Software versions which have reached End… |
CVE-2021-39020 | Medium | 5.3 | 2022-05-05 | IBM Guardium Data Encryption (GDE) 4.0.0.7 and lower stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized pa… |
CVE-2022-20734 | Medium | 4.4 | 2022-05-04 | A vulnerability in Cisco SD-WAN vManage Software could allow an authenticated, local attacker to view sensitive information on an affected system. This vulnera… |
CVE-2022-25787 | High | 7.5 | 2022-05-04 | Information Exposure Through Query Strings in GET Request vulnerability in LMM API of Secomea GateManager allows system administrator to hijack connection. Thi… |
CVE-2022-25780 | Medium | 4.3 | 2022-05-04 | Information Exposure vulnerability in web UI of Secomea GateManager allows logged in user to query devices outside own scope. |
CVE-2022-0882 | Medium | 5.3 | 2022-05-03 | A bug exists where an attacker can read the kernel log through exposed Zircon kernel addresses without the required capability ZX_RSRC_KIND_ROOT. It is recomme… |
CVE-2022-1353 | High | 7.1 | 2022-04-29 | A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This flaw allows a local, unprivileged user to gain access to… |
CVE-2021-43938 | High | 8.1 | 2022-04-29 | Elcomplus SmartPTT SCADA Server is vulnerable to an unauthenticated user can request various files from the server without any authentication or authorization. |
CVE-2021-43937 | High | 7.6 | 2022-04-29 | Elcomplus SmartPTT SCADA Server web application does not, or cannot, sufficiently verify whether a well-formed, valid, consistent request was intentionally pro… |
CVE-2022-22277 | Medium | 5.3 | 2022-04-27 | A vulnerability in SonicOS SNMP service resulting exposure of Wireless Access Point sensitive information in cleartext. |
CVE-2022-22276 | Medium | 5.3 | 2022-04-27 | A vulnerability in SonicOS SNMP service resulting exposure of sensitive information to an unauthorized user. |
CVE-2021-34589 | High | 7.5 | 2022-04-27 | In Bender/ebee Charge Controllers in multiple versions are prone to an RFID leak. The RFID of the last charge event can be read without authentication via the… |
CVE-2022-24886 | Low | 2.2 | 2022-04-27 | Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. In versions prior to 3.19.0, any application with notification… |
CVE-2022-24866 | Medium | 4.3 | 2022-04-26 | Discourse Assign is a plugin for assigning users to a topic in Discourse, an open-source messaging platform. Prior to version 1.0.1, the UserBookmarkSerializer… |
CVE-2022-23711 | Medium | 5.3 | 2022-04-21 | A vulnerability in Kibana could expose sensitive information related to Elastic Stack monitoring in the Kibana page source. Elastic Stack monitoring features p… |
CVE-2022-24867 | High | 7.5 | 2022-04-21 | GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. When you pass the c… |
CVE-2022-24865 | Medium | 6.5 | 2022-04-20 | HumHub is an Open Source Enterprise Social Network. In affected versions users who are forced to change their password by an administrator may retrieve other u… |
CVE-2022-27863 | Medium | 5.3 | 2022-04-19 | Sensitive Information Exposure in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 on WordPress allows attackers to get the booking data by gue… |
CVE-2022-1186 | Medium | 5.3 | 2022-04-19 | The WordPress plugin Be POPIA Compliant exposed sensitive information to unauthenticated users consisting of site visitors emails and usernames via an API rout… |
CVE-2021-3503 | Medium | 4.3 | 2022-04-18 | A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data. The highest threat from this vulnerability is to the confiden… |
CVE-2011-4917 | Medium | 5.5 | 2022-04-18 | In the Linux kernel through 3.1 there is an information disclosure issue via /proc/stat. |
CVE-2022-27849 | Medium | 5.3 | 2022-04-15 | Sensitive Information Disclosure (sac-export.csv) in Simple Ajax Chat (WordPress plugin) <= 20220115 |