CWE-200 · Information Disclosure (page 38)
Page 38 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-5166 | High | 8.0 | 2023-09-25 | Docker Desktop before 4.23.0 allows Access Token theft via a crafted extension icon URL. This issue affects Docker Desktop: before 4.23.0. |
CVE-2023-41293 | High | 7.5 | 2023-09-25 | Data security classification vulnerability in the DDMP module. Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2023-1633 | Medium | 6.6 | 2023-09-24 | A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to sens… |
CVE-2023-5134 | Medium | 4.3 | 2023-09-23 | The Easy Registration Forms for WordPress is vulnerable to Information Disclosure via the 'erforms_user_meta' shortcode in versions up to, and including, 2.1.1… |
CVE-2023-38344 | Medium | 6.5 | 2023-09-21 | An issue was discovered in Ivanti Endpoint Manager before 2022 SU4. A file disclosure vulnerability exists in the GetFileContents SOAP action exposed via /land… |
CVE-2023-39677 | High | 7.5 | 2023-09-20 | MyPrestaModules Prestashop Module v6.2.9 and UpdateProducts Prestashop Module v3.6.9 were discovered to contain a PHPInfo information disclosure vulnerability… |
CVE-2023-39052 | Medium | 6.5 | 2023-09-20 | An information leak in Earthgarden_waiting 13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39045 | Medium | 6.5 | 2023-09-20 | An information leak in kokoroe_members card Line 13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-38718 | Low | 3.7 | 2023-09-20 | IBM Robotic Process Automation 21.0.0 through 21.0.7.8 could disclose sensitive information from access to RPA scripts, workflows and related data. IBM X-Forc… |
CVE-2023-40368 | Medium | 4.4 | 2023-09-20 | IBM Storage Protect 8.1.0.0 through 8.1.19.0 could allow a privileged user to obtain sensitive information from the administrative command line client. IBM X-… |
CVE-2023-43617 | Medium | 5.3 | 2023-09-20 | An issue was discovered in Croc through 9.6.5. When a custom shared secret is used, the sender and receiver may divulge parts of this secret to an untrusted Re… |
CVE-2022-47554 | High | 8.2 | 2023-09-19 | Exposure of sensitive information in ekorCCP and ekorRCI, potentially allowing a remote attacker to obtain critical information from various .xml files, includ… |
CVE-2023-42454 | Critical | 10.0 | 2023-09-18 | SQLpage is a SQL-only webapp builder. Someone using SQLpage versions prior to 0.11.1, whose SQLpage instance is exposed publicly, with a database connection st… |
CVE-2023-42387 | High | 7.5 | 2023-09-18 | An issue in TDSQL Chitu management platform v.10.3.19.5.0 allows a remote attacker to obtain sensitive information via get_db_info function in install.php. |
CVE-2023-37263 | Medium | 6.8 | 2023-09-15 | Strapi is the an open-source headless content management system. Prior to version 4.12.1, field level permissions are not respected in the relationship title… |
CVE-2023-36472 | Medium | 5.8 | 2023-09-15 | Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if the… |
CVE-2023-36551 | Medium | 4.3 | 2023-09-13 | A exposure of sensitive information to an unauthorized actor in Fortinet FortiSIEM version 6.7.0 through 6.7.5 allows attacker to information disclosure via a… |
CVE-2021-44172 | Medium | 4.3 | 2023-09-13 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClientEMS versions 7.0.0 through 7.0.4, 7.0.6 through 7.0.7, in a… |
CVE-2023-4917 | Medium | 5.3 | 2023-09-13 | The Leyka plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.30.7 via the 'leyka_ajax_get_env_and_options… |
CVE-2023-36763 | High | 7.5 | 2023-09-12 | Microsoft Outlook Information Disclosure Vulnerability |
CVE-2023-40712 | Medium | 6.5 | 2023-09-12 | Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a… |
CVE-2023-4877 | High | 7.5 | 2023-09-10 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository hamza417/inure prior to build92. |
CVE-2023-4876 | High | 7.5 | 2023-09-10 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository hamza417/inure prior to build92. |
CVE-2022-22409 | Medium | 5.3 | 2023-09-08 | IBM Aspera Faspex 5.0.5 could allow a remote attacker to gather sensitive information about the web application, caused by an insecure configuration. IBM X-Fo… |
CVE-2023-28010 | Medium | 4.0 | 2023-09-08 | In some configuration scenarios, the Domino server host name can be exposed. This information could be used to target future attacks. |
CVE-2023-39620 | High | 7.5 | 2023-09-08 | An Issue in Buffalo America, Inc. TeraStation NAS TS5410R v.5.00 thru v.0.07 allows a remote attacker to obtain sensitive information via the guest account fun… |
CVE-2023-40029 | Critical | 9.9 | 2023-09-07 | Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a resul… |
CVE-2023-41050 | Medium | 6.8 | 2023-09-06 | AccessControl provides a general security framework for use in Zope. Python's "format" functionality allows someone controlling the format string to "read" obj… |
CVE-2023-32271 | Medium | 6.5 | 2023-09-05 | An information disclosure vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OAS Platform v18.00.0072. A… |
CVE-2023-4714 | Medium | 4.3 | 2023-09-01 | A vulnerability was found in PlayTube 3.0.1 and classified as problematic. This issue affects some unknown processing of the component Redirect Handler. The ma… |
CVE-2023-23763 | Medium | 5.3 | 2023-09-01 | An authorization/sensitive information disclosure vulnerability was identified in GitHub Enterprise Server that allowed a fork to retain read access to an upst… |
CVE-2022-4343 | Medium | 5.0 | 2023-09-01 | An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions… |
CVE-2023-41749 | High | 7.5 | 2023-08-31 | Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Agent (Windows) before build 3… |
CVE-2023-41745 | Medium | 5.5 | 2023-08-31 | Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Agent (Linux, macOS, Windows)… |
CVE-2021-32050 | Medium | 4.2 | 2023-08-29 | Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published ev… |
CVE-2023-0238 | Low | 3.9 | 2023-08-29 | Due to lack of a security policy, the WARP Mobile Client (<=6.29) for Android was susceptible to this vulnerability which allowed a malicious app installed on… |
CVE-2023-24959 | Medium | 5.3 | 2023-08-28 | IBM InfoSphere Information Systems 11.7 could expose information about the host system and environment configuration. IBM X-Force ID: 246332. |
CVE-2023-39289 | High | 7.5 | 2023-08-25 | A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2208.101 could allow an unauthenticated attacker to conduct an ac… |
CVE-2023-40580 | High | 8.1 | 2023-08-25 | Freighter is a Stellar chrome extension. It may be possible for a malicious website to access the recovery mnemonic phrase when the Freighter wallet is unlocke… |
CVE-2023-39519 | High | 7.5 | 2023-08-24 | Cloud Explorer Lite is an open source cloud management platform. Prior to version 1.4.0, there is a risk of sensitive information leakage in the user informati… |
CVE-2023-3705 | High | 7.5 | 2023-08-24 | The vulnerability exists in CP-Plus NVR due to an improper input handling at the web-based management interface of the affected product. An unauthenticated rem… |
CVE-2023-4230 | Medium | 5.3 | 2023-08-24 | A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, which has the potential to facilitate the collecti… |
CVE-2022-3745 | Medium | 4.4 | 2023-08-23 | A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to vi… |
CVE-2022-3743 | Medium | 4.4 | 2023-08-23 | A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges under… |
CVE-2023-37379 | High | 8.1 | 2023-08-23 | Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privile… |
CVE-2023-25913 | High | 7.5 | 2023-08-21 | Because of an authentication flaw an attacker would be capable of generating a web report that discloses sensitive information such as internal IP addresses, u… |
CVE-2023-38158 | Low | 3.1 | 2023-08-21 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability |
CVE-2023-40735 | High | 7.5 | 2023-08-21 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Cavo – Connecting for a Safer World BUTTERFLY BUTTON (Architecture flaw) allows los… |
CVE-2023-39974 | Medium | 5.3 | 2023-08-17 | Exposure of Sensitive Information vulnerability in AcyMailing Enterprise component for Joomla. It allows unauthorized actors to get the number of subscribers i… |
CVE-2023-40348 | Medium | 5.3 | 2023-08-16 | The webhook endpoint in Jenkins Gogs Plugin 1.0.15 and earlier provides unauthenticated attackers information about the existence of jobs in its output. |
CVE-2023-32495 | High | 7.8 | 2023-08-16 | Dell PowerScale OneFS, 8.2.x-9.5.x, contains a exposure of sensitive information to an unauthorized Actor vulnerability. An authorized local attacker could po… |
CVE-2023-2916 | High | 7.5 | 2023-08-15 | The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the 'admin_notice' func… |
CVE-2023-21267 | Medium | 5.5 | 2023-08-14 | In multiple functions of KeyguardViewMediator.java, there is a possible way to bypass lockdown mode with screen pinning due to a logic error in the code. This… |
CVE-2023-40023 | Medium | 6.5 | 2023-08-14 | yaklang is a programming language designed for cybersecurity. The Yak Engine has been found to contain a local file inclusion (LFI) vulnerability. This vulnera… |
CVE-2023-39393 | High | 7.5 | 2023-08-13 | Vulnerability of insecure signatures in the ServiceWifiResources module. Successful exploitation of this vulnerability may cause ServiceWifiResources to be mal… |
CVE-2023-39383 | High | 7.5 | 2023-08-13 | Vulnerability of input parameters being not strictly verified in the AMS module. Successful exploitation of this vulnerability may compromise apps' data securi… |
CVE-2023-29500 | Medium | 5.3 | 2023-08-11 | Exposure of sensitive information to an unauthorized actor in BIOS firmware for some Intel(R) NUCs may allow a privilege user to potentially enable information… |
CVE-2023-32561 | High | 7.5 | 2023-08-10 | A previously generated artifact by an administrator could be accessed by an attacker. The contents of this artifact could lead to authentication bypass. Fixed… |
CVE-2023-38245 | Medium | 5.5 | 2023-08-10 | Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an Information Disclosure vulnerability. An unauthentic… |
CVE-2023-39951 | Medium | 6.5 | 2023-08-08 | OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. OpenTelemetry Java Instrumentation prior… |
CVE-2023-36908 | Medium | 6.5 | 2023-08-08 | Windows Hyper-V Information Disclosure Vulnerability |
CVE-2023-36894 | Medium | 6.5 | 2023-08-08 | Microsoft SharePoint Server Information Disclosure Vulnerability |
CVE-2023-4177 | Low | 2.6 | 2023-08-06 | A vulnerability was found in EmpowerID up to 7.205.0.0. It has been rated as problematic. This issue affects some unknown processing of the component Multi-Fac… |
CVE-2023-4168 | Medium | 4.3 | 2023-08-05 | A vulnerability was found in Templatecookie Adlisting 2.14.0. It has been classified as problematic. Affected is an unknown function of the file /ad-list of th… |
CVE-2023-39508 | High | 8.8 | 2023-08-05 | Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow… |
CVE-2023-38700 | Low | 3.5 | 2023-08-04 | matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it was possible to craft an event such that it would leak part of a targeted… |
CVE-2023-38494 | Medium | 5.9 | 2023-08-04 | MeterSphere is an open-source continuous testing platform. Prior to version 2.10.4 LTS, some interfaces of the Cloud version of MeterSphere do not have configu… |
CVE-2023-4139 | High | 7.5 | 2023-08-04 | The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Sensitive Information Exposure via Directory Listing due to missing restriction in export f… |
CVE-2023-26441 | Medium | 5.7 | 2023-08-02 | Cacheservice did not correctly check if relative cache object were pointing to the defined absolute location when accessing resources. An attacker with access… |
CVE-2023-31927 | Medium | 5.3 | 2023-08-02 | An information disclosure in the web interface of Brocade Fabric OS versions before Brocade Fabric OS v9.2.0 and v9.1.1c, could allow a remote unauthenticated… |
CVE-2023-38685 | Medium | 4.3 | 2023-07-28 | Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branche… |
CVE-2023-28203 | Medium | 5.5 | 2023-07-28 | The issue was addressed with improved checks. This issue is fixed in Apple Music 4.2.0 for Android. An app may be able to access contacts. |
CVE-2023-38503 | Medium | 5.7 | 2023-07-25 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 10.3.0 and prior to version 10.5.0, the permission filters… |
CVE-2023-38499 | Low | 3.7 | 2023-07-25 | TYPO3 is an open source PHP based web content management system. Starting in version 9.4.0 and prior to versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, and 12.4.4… |
CVE-2023-34235 | High | 8.6 | 2023-07-25 | Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the `t(number)` pre… |
CVE-2023-34093 | Medium | 4.8 | 2023-07-25 | Strapi is an open-source headless content management system. Prior to version 4.10.8, anyone (Strapi developers, users, plugins) can make every attribute of a… |
CVE-2023-37916 | Medium | 6.5 | 2023-07-21 | KubePi is an opensource kubernetes management panel. The endpoint /kubepi/api/v1/users/search?pageNum=1&&pageSize=10 leak password hash of any user (including… |
CVE-2023-3819 | Medium | 6.5 | 2023-07-21 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pimcore/pimcore prior to 10.6.4. |
CVE-2023-32476 | Medium | 6.4 | 2023-07-20 | Dell Hybrid Client version 2.0 contains a Sensitive Data Exposure vulnerability. An unauthenticated malicious user on the device can access hard coded secrets… |
CVE-2023-3779 | Medium | 5.3 | 2023-07-20 | The Essential Addons For Elementor plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 5.8.1 due to the… |
CVE-2023-27877 | Medium | 5.3 | 2023-07-19 | IBM Planning Analytics Cartridge for Cloud Pak for Data 4.0 connects to a CouchDB server. An attacker can exploit an insecure password policy to the CouchDB se… |
CVE-2023-26026 | Medium | 5.3 | 2023-07-19 | Planning Analytics Cartridge for Cloud Pak for Data 4.0 exposes sensitive information in logs which could lead an attacker to exploit this vulnerability to con… |
CVE-2023-35900 | Medium | 4.3 | 2023-07-19 | IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.4 and 23.0.0 through 23.0.5 is vulnerable to disclosing server version information which may… |
CVE-2023-35898 | Medium | 4.3 | 2023-07-19 | IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information due to an insecure security configuration in InfoSpher… |
CVE-2021-4428 | Low | 2.7 | 2023-07-18 | A vulnerability has been found in what3words Autosuggest Plugin up to 4.0.0 on WordPress and classified as problematic. Affected by this vulnerability is the f… |
CVE-2023-3709 | Medium | 5.3 | 2023-07-18 | The Royal Elementor Addons plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 1.3.70 due to the plugin… |
CVE-2023-33857 | Medium | 5.3 | 2023-07-17 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain system information using a specially crafted query that could aid in further att… |
CVE-2023-34236 | High | 8.5 | 2023-07-14 | Weave GitOps Terraform Controller (aka Weave TF-controller) is a controller for Flux to reconcile Terraform resources in a GitOps way. A vulnerability has been… |
CVE-2023-29450 | High | 8.5 | 2023-07-13 | JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of user "zabbix") on the Zabbix Server or Z… |
CVE-2023-34134 | Medium | 6.5 | 2023-07-13 | Exposure of sensitive information to an unauthorized actor vulnerability in SonicWall GMS and Analytics allows authenticated attacker to read administrator pas… |
CVE-2023-34131 | Medium | 5.3 | 2023-07-13 | Exposure of sensitive information to an unauthorized actor vulnerability in SonicWall GMS and Analytics enables an unauthenticated attacker to access restricte… |
CVE-2023-38062 | Medium | 4.3 | 2023-07-12 | In JetBrains TeamCity before 2023.05.1 parameters of the "password" type could be shown in the UI in certain composite build configurations |
CVE-2022-46651 | Medium | 6.5 | 2023-07-12 | Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection e… |
CVE-2023-34090 | High | 7.5 | 2023-07-11 | Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participati… |
CVE-2023-33174 | Medium | 5.5 | 2023-07-11 | Windows Cryptographic Information Disclosure Vulnerability |
CVE-2023-33165 | Medium | 4.3 | 2023-07-11 | Microsoft SharePoint Server Security Feature Bypass Vulnerability |
CVE-2023-24881 | Medium | 6.5 | 2023-07-11 | Microsoft Teams Information Disclosure Vulnerability |
CVE-2023-34442 | Low | 3.3 | 2023-07-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Camel.This issue affects Apache Camel: from 3.X t… |
CVE-2023-3553 | High | 7.5 | 2023-07-08 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository nilsteampassnet/teampass prior to 3.0.10. |
CVE-2023-35934 | Medium | 6.1 | 2023-07-06 | yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak co… |