CWE-200 · Information Disclosure (page 39)
Page 39 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-24853 | Medium | 5.9 | 2022-04-14 | Metabase is an open source business intelligence and analytics application. Metabase has a proxy to load arbitrary URLs for JSON maps as part of our GeoJSON su… |
CVE-2022-24850 | Medium | 5.3 | 2022-04-14 | Discourse is an open source platform for community discussion. A category's group permissions settings can be viewed by anyone that has access to the category… |
CVE-2022-24849 | Medium | 6.5 | 2022-04-14 | DisCatSharp is a Discord API wrapper for .NET. Users of versions 9.8.5, 9.8.6, 9.9.0 and previously published prereleases of 10.0.0 who have used either one of… |
CVE-2022-25166 | Medium | 5.0 | 2022-04-14 | An issue was discovered in Amazon AWS VPN Client 2.0.0. It is possible to include a UNC path in the OpenVPN configuration file when referencing file paths for… |
CVE-2022-22183 | High | 7.5 | 2022-04-14 | An Improper Access Control vulnerability in Juniper Networks Junos OS Evolved allows a network-based unauthenticated attacker who is able to connect to a speci… |
CVE-2021-43287 | High | 7.5 | 2022-04-14 | An issue was discovered in ThoughtWorks GoCD before 21.3.0. The business continuity add-on, which is enabled by default, leaks all secrets known to the GoCD se… |
CVE-2022-22961 | Medium | 5.3 | 2022-04-13 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an information disclosure vulnerability due to returning excess information. A ma… |
CVE-2022-1332 | Medium | 4.3 | 2022-04-13 | One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom… |
CVE-2021-28544 | Medium | 4.3 | 2022-04-12 | Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-b… |
CVE-2022-27667 | High | 7.5 | 2022-04-12 | Under certain conditions, SAP BusinessObjects Business Intelligence platform, Client Management Console (CMC) - version 430, allows an attacker to access infor… |
CVE-2022-27241 | High | 7.5 | 2022-04-12 | A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.31), Mendix Applications using Mendix 8 (All versions < V8.18.1… |
CVE-2022-24837 | Medium | 5.3 | 2022-04-11 | HedgeDoc is an open-source, web-based, self-hosted, collaborative markdown editor. Images uploaded with HedgeDoc version 1.9.1 and later have an enumerable fil… |
CVE-2022-27844 | Low | 2.7 | 2022-04-11 | Arbitrary File Read vulnerability in WPvivid Team Migration, Backup, Staging – WPvivid (WordPress plugin) versions <= 0.9.70 |
CVE-2022-27576 | Low | 3.3 | 2022-04-11 | Information exposure vulnerability in Samsung DeX Home prior to SMR April-2022 Release 1 allows to access currently launched foreground app information without… |
CVE-2022-27575 | Low | 3.3 | 2022-04-11 | Information exposure vulnerability in One UI Home prior to SMR April-2022 Release 1 allows to access currently launched foreground app information without perm… |
CVE-2022-24804 | Medium | 5.3 | 2022-04-11 | Discourse is an open source platform for community discussion. In stable versions prior to 2.8.3 and beta versions prior 2.9.0.beta4 erroneously expose groups… |
CVE-2022-25594 | Medium | 5.3 | 2022-04-07 | Microprogram’s parking lot management system is vulnerable to sensitive information exposure. An unauthorized remote attacker can input specific URLs to acquir… |
CVE-2021-43205 | Medium | 4.3 | 2022-04-06 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClient for Linux version 7.0.2 and below, 6.4.7 and below and 6.2… |
CVE-2021-40375 | Medium | 6.5 | 2022-04-06 | Apperta Foundation OpenEyes 3.5.1 allows remote attackers to view the sensitive information of patients without having the intended level of privilege. Despite… |
CVE-2022-0709 | High | 7.5 | 2022-04-04 | The Booking Package WordPress plugin before 1.5.29 requires a token for exporting the ical representation of it's booking calendar, but this token is returned… |
CVE-2019-14839 | High | 7.5 | 2022-04-01 | It was observed that while login into Business-central console, HTTP request discloses sensitive information like username and password when intercepted using… |
CVE-2022-23158 | Medium | 6.0 | 2022-04-01 | Wyse Device Agent version 14.6.1.4 and below contain a sensitive data exposure vulnerability. A local authenticated user with standard privilege could potentia… |
CVE-2022-23157 | Medium | 4.4 | 2022-04-01 | Wyse Device Agent version 14.6.1.4 and below contain a sensitive data exposure vulnerability. A authenticated malicious user could potentially exploit this vul… |
CVE-2022-24797 | Medium | 6.5 | 2022-03-31 | Pomerium is an identity-aware access proxy. In distributed service mode, Pomerium's Authenticate service exposes pprof debug and prometheus metrics handlers to… |
CVE-2022-1077 | Medium | 5.3 | 2022-03-29 | A vulnerability was found in TEM FLEX-1080 and FLEX-1085 1.6.0. It has been declared as problematic. This vulnerability log.cgi of the component Log Handler. A… |
CVE-2022-24784 | Low | 3.7 | 2022-03-25 | Statamic is a Laravel and Git powered CMS. Before versions 3.2.39 and 3.3.2, it is possible to confirm a single character of a user's password hash using a spe… |
CVE-2022-0494 | Medium | 4.4 | 2022-03-25 | A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in the Linux kernel. This flaw allows a local attacker wi… |
CVE-2022-24782 | Medium | 4.3 | 2022-03-24 | Discourse is an open source discussion platform. Versions 2.8.2 and prior in the `stable` branch, 2.9.0.beta3 and prior in the `beta` branch, and 2.9.0.beta3 a… |
CVE-2022-24768 | Critical | 9.9 | 2022-03-23 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All unpatched versions of Argo CD starting with 1.0.0 are vulnerable to an improper a… |
CVE-2022-0854 | Medium | 5.5 | 2022-03-23 | A memory leak flaw was found in the Linux kernel’s DMA subsystem, in the way a user calls DMA_FROM_DEVICE. This flaw allows a local user to read random memory… |
CVE-2021-4180 | Medium | 4.3 | 2022-03-23 | An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname. An attacker could exploit thi… |
CVE-2021-27424 | Medium | 5.3 | 2022-03-23 | GE UR firmware versions prior to version 8.1x shares MODBUS memory map as part of the communications guide. GE was made aware a “Last-key pressed” MODBUS regis… |
CVE-2021-27422 | High | 7.5 | 2022-03-23 | GE UR firmware versions prior to version 8.1x web server interface is supported on UR over HTTP protocol. It allows sensitive information exposure without auth… |
CVE-2022-1004 | Medium | 4.3 | 2022-03-21 | Accounted time is shown in the Ticket Detail View (External Interface), even if ExternalFrontend::TicketDetailView###AccountedTimeDisplay is disabled. |
CVE-2022-25602 | High | 8.3 | 2022-03-18 | Nonce token leak vulnerability leading to arbitrary file upload, theme deletion, plugin settings change discovered in Responsive Menu WordPress plugin (version… |
CVE-2022-25248 | Medium | 5.3 | 2022-03-16 | When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) supplies the event log of the specific service. |
CVE-2022-0430 | Medium | 5.3 | 2022-03-15 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository httpie/httpie prior to 3.1.0. |
CVE-2022-24762 | Medium | 6.5 | 2022-03-14 | sysend.js is a library that allows a user to send messages between pages that are open in the same browser. Users that use cross-origin communication may have… |
CVE-2022-24742 | Medium | 5.0 | 2022-03-14 | Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab remains unclosed af… |
CVE-2021-41850 | High | 7.8 | 2022-03-11 | An issue was discovered in Luna Simo PPR1.180610.011/202001031830. A pre-installed app with a package name of com.skyroam.silverhelper writes three IMEI values… |
CVE-2021-41849 | Medium | 5.5 | 2022-03-11 | An issue was discovered in Luna Simo PPR1.180610.011/202001031830. It sends the following Personally Identifiable Information (PII) in plaintext using HTTP to… |
CVE-2021-32477 | Medium | 4.3 | 2022-03-11 | The last time a user accessed the mobile app is displayed on their profile page, but should be restricted to users with the relevant capability (site administr… |
CVE-2021-32473 | Medium | 5.3 | 2022-03-11 | It was possible for a student to view their quiz grade before it had been released, using a quiz web service. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8… |
CVE-2022-25512 | High | 7.5 | 2022-03-11 | FreeTAKServer-UI v1.9.8 was discovered to leak sensitive API and Websocket keys. |
CVE-2022-26847 | Medium | 5.3 | 2022-03-10 | SPIP before 3.2.14 and 4.x before 4.0.5 allows unauthenticated access to information about editorial objects. |
CVE-2022-25830 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Galaxy Watch3 Plugin prior to version 2.2.09.22012751 allows attacker to access password information of connected WiFiAp… |
CVE-2022-25829 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Watch Active2 Plugin prior to version 2.2.08.22012751 allows attacker to access password information of connected WiFiAp… |
CVE-2022-25828 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Watch Active Plugin prior to version 2.2.07.22012751 allows attacker to access password information of connected WiFiAp i… |
CVE-2022-25827 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Galaxy Watch Plugin prior to version 2.2.05.22012751 allows attacker to access password information of connected WiFiAp i… |
CVE-2022-25826 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Galaxy S3 Plugin prior to version 2.2.03.22012751 allows attacker to access password information of connected WiFiAp in t… |
CVE-2022-25823 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Galaxy Watch Plugin prior to version 2.2.05.220126741 allows attackers to access user information in log. |
CVE-2022-24398 | Medium | 6.5 | 2022-03-10 | Under certain conditions SAP Business Objects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker to access information which… |
CVE-2022-22547 | High | 7.5 | 2022-03-10 | Simple Diagnostics Agent - versions 1.0 (up to version 1.57.), allows an attacker to access information which would otherwise be restricted via a random port 9… |
CVE-2022-0813 | Medium | 5.3 | 2022-03-10 | PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the… |
CVE-2022-0725 | High | 7.5 | 2022-03-10 | A flaw was found in keepass. The vulnerability occurs due to logging the plain text passwords in system log and leads to an Information Exposure vulnerability… |
CVE-2022-0516 | High | 7.8 | 2022-03-10 | A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for s390 in the Linux kernel. This flaw allows a local atta… |
CVE-2021-4023 | Medium | 5.5 | 2022-03-10 | A flaw was found in the io-workqueue implementation in the Linux kernel versions prior to 5.15-rc1. The kernel can panic when an improper cancellation operatio… |
CVE-2021-3732 | Medium | 5.5 | 2022-03-10 | A flaw was found in the Linux kernel's OverlayFS subsystem in the way the user mounts the TmpFS filesystem with OverlayFS. This flaw allows a local user to gai… |
CVE-2020-14112 | Medium | 5.3 | 2022-03-10 | Information Leak Vulnerability exists in the Xiaomi Router AX6000. The vulnerability is caused by incorrect routing configuration. Attackers can exploit this v… |
CVE-2022-24747 | Medium | 6.3 | 2022-03-09 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. Affected versions of shopware do no properly set sen… |
CVE-2021-22783 | High | 8.8 | 2022-03-09 | A CWE-200: Information Exposure vulnerability exists which could allow a session hijack when the door panel is communicating with the door. Affected Product: R… |
CVE-2021-41239 | Medium | 5.3 | 2022-03-08 | Nextcloud server is a self hosted system designed to provide cloud style services. In affected versions the User Status API did not consider the user enumerati… |
CVE-2021-41181 | Low | 2.4 | 2022-03-08 | Nextcloud talk is a self hosting messaging service. In versions prior to 12.3.0 the Nextcloud Android Talk application did not properly detect the lockscreen s… |
CVE-2022-24737 | Medium | 6.5 | 2022-03-07 | HTTPie is a command-line HTTP client. HTTPie has the practical concept of sessions, which help users to persistently store some of the state that belongs to th… |
CVE-2022-0384 | Medium | 4.3 | 2022-03-07 | The Video Conferencing with Zoom WordPress plugin before 3.8.17 does not have authorisation in its vczapi_get_wp_users AJAX action, allowing any authenticated… |
CVE-2022-24725 | Medium | 6.2 | 2022-03-03 | Shescape is a shell escape package for JavaScript. An issue in versions 1.4.0 to 1.5.1 allows for exposure of the home directory on Unix systems when using Bas… |
CVE-2021-3602 | Medium | 5.5 | 2022-03-03 | An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RU… |
CVE-2022-23648 | High | 7.5 | 2022-03-03 | containerd is a container runtime available as a daemon for Linux and Windows. A bug was found in containerd prior to versions 1.6.1, 1.5.10, and 1.14.12 where… |
CVE-2021-4076 | High | 7.5 | 2022-03-02 | A flaw exists in tang, a network-based cryptographic binding server, which could result in leak of private keys. |
CVE-2021-3677 | Medium | 6.5 | 2022-03-02 | A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database use… |
CVE-2022-23779 | Medium | 5.3 | 2022-03-02 | Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by reading HTTP redir… |
CVE-2022-22303 | Low | 2.8 | 2022-03-02 | An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiManager versions prior to 7.0.2, 6.4.7 and 6.2.9… |
CVE-2022-0577 | Medium | 6.5 | 2022-03-02 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1. |
CVE-2021-25118 | Medium | 5.3 | 2022-02-28 | The Yoast SEO WordPress plugin (from versions 16.7 until 17.2) discloses the full internal path of featured images in posts via the wp/v2/posts REST endpoints… |
CVE-2022-24633 | Medium | 5.3 | 2022-02-24 | All versions of FileCloud prior to 21.3 are vulnerable to user enumeration. The vulnerability exists in the parameter "path" passing "/SHARED/<username>". A ma… |
CVE-2022-0654 | High | 7.5 | 2022-02-23 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository fgribreau/node-request-retry prior to 7.0.0. |
CVE-2022-23984 | Low | 3.7 | 2022-02-21 | Sensitive information disclosure discovered in wpDiscuz WordPress plugin (versions <= 7.3.11). |
CVE-2022-0708 | Medium | 4.3 | 2022-02-21 | Mattermost 6.3.0 and earlier fails to protect email addresses of the creator of the team via one of the APIs, which allows authenticated team members to access… |
CVE-2021-44141 | Medium | 4.3 | 2022-02-21 | All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the… |
CVE-2022-23982 | Medium | 4.3 | 2022-02-18 | The vulnerability discovered in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4) allows server information exposure. |
CVE-2022-0672 | Medium | 5.5 | 2022-02-18 | A flaw was found in LemMinX in versions prior to 0.19.0. Insecure redirect could allow unauthorized access to sensitive information locally if LemMinX is run u… |
CVE-2021-20320 | Medium | 5.5 | 2022-02-18 | A flaw was found in s390 eBPF JIT in bpf_jit_insn in arch/s390/net/bpf_jit_comp.c in the Linux kernel. In this flaw, a local attacker with special user privile… |
CVE-2021-3773 | Critical | 9.8 | 2022-02-16 | A flaw in netfilter could allow a network-connected attacker to infer openvpn connection endpoint information for further use in traditional network attacks. |
CVE-2022-23643 | Medium | 6.5 | 2022-02-15 | Sourcegraph is a code search and navigation engine. Sourcegraph versions 3.35 and 3.36 reintroduced a previously fixed side-channel vulnerabilitity in the Code… |
CVE-2021-45310 | Medium | 5.3 | 2022-02-14 | Sangoma Technologies Corporation Switchvox Version 102409 is affected by an information disclosure vulnerability due to an improper access restriction. Users i… |
CVE-2021-45421 | High | 7.5 | 2022-02-14 | Emerson Dixell XWEB-500 products are affected by information disclosure via directory listing. A potential attacker can use this misconfiguration to access all… |
CVE-2021-45420 | Critical | 9.8 | 2022-02-14 | Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi, and /cgi-bin/lo_u… |
CVE-2021-25110 | Medium | 4.3 | 2022-02-14 | The Futurio Extra WordPress plugin before 1.6.3 allows any logged in user, such as subscriber, to extract any other user's email address. |
CVE-2022-23634 | High | 8.0 | 2022-02-11 | Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to… |
CVE-2022-23633 | High | 7.4 | 2022-02-11 | Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response… |
CVE-2022-24003 | Medium | 4.0 | 2022-02-11 | Exposure of Sensitive Information vulnerability in Bixby Vision prior to version 3.7.50.6 allows attackers to access internal data of Bixby Vision via unprotec… |
CVE-2022-24001 | Low | 3.8 | 2022-02-11 | Information disclosure vulnerability in Edge Panel prior to Android S(12) allows physical attackers to access screenshot in clipboard via Edge Panel. |
CVE-2021-22785 | High | 7.5 | 2022-02-11 | A CWE-200: Information Exposure vulnerability exists that could cause sensitive information of files located in the web root directory to leak when an attacker… |
CVE-2022-20680 | Medium | 4.3 | 2022-02-10 | A vulnerability in the web-based management interface of Cisco Prime Service Catalog could allow an authenticated, remote attacker to access sensitive informat… |
CVE-2022-20630 | Medium | 4.4 | 2022-02-10 | A vulnerability in the audit log of Cisco DNA Center could allow an authenticated, local attacker to view sensitive information in clear text. This vulnerabili… |
CVE-2022-0018 | Medium | 6.1 | 2022-02-10 | An information exposure vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows and MacOS where the credentials of the local user account a… |
CVE-2022-22545 | Medium | 4.9 | 2022-02-09 | A high privileged user who has access to transaction SM59 can read connection details stored with the destination for http calls in SAP NetWeaver Application S… |
CVE-2022-22542 | Medium | 6.5 | 2022-02-09 | S/4HANA Supplier Factsheet exposes the private address and bank details of an Employee Business Partner with Supplier Role, AND Enterprise Search for Customer… |
CVE-2021-0170 | Medium | 5.5 | 2022-02-09 | Exposure of Sensitive Information to an Unauthorized Actor in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM… |
CVE-2021-0166 | Medium | 6.7 | 2022-02-09 | Exposure of Sensitive Information to an Unauthorized Actor in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM… |