CWE-200 · Information Disclosure (page 40)
Page 40 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-22545 | Medium | 4.9 | 2022-02-09 | A high privileged user who has access to transaction SM59 can read connection details stored with the destination for http calls in SAP NetWeaver Application S… |
CVE-2022-22542 | Medium | 6.5 | 2022-02-09 | S/4HANA Supplier Factsheet exposes the private address and bank details of an Employee Business Partner with Supplier Role, AND Enterprise Search for Customer… |
CVE-2021-0170 | Medium | 5.5 | 2022-02-09 | Exposure of Sensitive Information to an Unauthorized Actor in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM… |
CVE-2021-0166 | Medium | 6.7 | 2022-02-09 | Exposure of Sensitive Information to an Unauthorized Actor in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM… |
CVE-2022-23619 | Medium | 5.3 | 2022-02-09 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to guess if a user… |
CVE-2021-40360 | High | 8.8 | 2022-02-09 | A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMA… |
CVE-2022-21712 | High | 7.5 | 2022-02-07 | twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-ori… |
CVE-2022-0474 | Low | 2.4 | 2022-02-07 | Full list of recipients from customer users in a contact field could be disclosed in notification emails event when the notification is set to be sent to each… |
CVE-2022-22680 | Medium | 5.3 | 2022-02-07 | Exposure of sensitive information to an unauthorized actor vulnerability in Web Server in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote… |
CVE-2021-38960 | High | 7.5 | 2022-02-04 | IBM OPENBMC OP920, OP930, and OP940 could allow an unauthenticated user to obtain sensitive information. IBM X-Force ID: 212047. |
CVE-2021-36151 | Medium | 5.5 | 2022-02-04 | In Apache Gobblin, the Hadoop token is written to a temp file that is visible to all local users on Unix-like systems. This affects versions <= 0.15.0. Users s… |
CVE-2020-12966 | Medium | 5.5 | 2022-02-04 | AMD EPYC™ Processors contain an information disclosure vulnerability in the Secure Encrypted Virtualization with Encrypted State (SEV-ES) and Secure Encrypted… |
CVE-2022-23607 | Medium | 6.5 | 2022-02-01 | treq is an HTTP library inspired by requests but written on top of Twisted's Agents. Treq's request methods (`treq.get`, `treq.post`, etc.) and `treq.client.HT… |
CVE-2021-40340 | Low | 3.7 | 2022-01-28 | Information Exposure vulnerability in Hitachi Energy LinkOne application, due to a misconfiguration in the ASP server exposes server and ASP.net information, a… |
CVE-2021-31567 | Medium | 6.8 | 2022-01-28 | Authenticated (admin+) Arbitrary File Download vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6). The plugin allows arbitrary f… |
CVE-2021-22825 | High | 8.0 | 2022-01-28 | A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could allow an attacker to access the system with elevated priv… |
CVE-2021-22815 | Medium | 5.3 | 2022-01-28 | A CWE-200: Information Exposure vulnerability exists which could cause the troubleshooting archive to be accessed. Affected Products: 1-Phase Uninterruptible P… |
CVE-2021-29838 | Medium | 5.9 | 2022-01-26 | IBM Security Guardium Insights 3.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transpor… |
CVE-2021-44692 | Medium | 5.3 | 2022-01-26 | BuddyBoss Platform through 1.8.0 allows remote attackers to obtain the email address of each user. When creating a new user, it generates a Unique ID for their… |
CVE-2021-40159 | High | 7.8 | 2022-01-25 | An Information Disclosure vulnerability for JT files in Autodesk Inventor 2022, 2021, 2020, 2019 in conjunction with other vulnerabilities may lead to code exe… |
CVE-2021-23195 | Medium | 5.3 | 2022-01-21 | Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 has the option for automated indexing (directory listing) activated. When accessin… |
CVE-2022-22733 | Medium | 6.5 | 2022-01-20 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache ShardingSphere ElasticJob-UI allows an attacker who has guest account to do… |
CVE-2022-0281 | High | 7.5 | 2022-01-20 | Exposure of Sensitive Information to an Unauthorized Actor in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-21296 | Medium | 5.3 | 2022-01-19 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Or… |
CVE-2022-21673 | Medium | 4.3 | 2022-01-18 | Grafana is an open-source platform for monitoring and observability. In affected versions when a data source has the Forward OAuth Identity feature enabled, se… |
CVE-2022-21683 | Low | 3.5 | 2022-01-18 | Wagtail is a Django based content management system focused on flexibility and user experience. When notifications for new replies in comment threads are sent… |
CVE-2021-37867 | Medium | 4.3 | 2022-01-18 | Mattermost Boards plugin v0.10.0 and earlier fails to protect email addresses of all users via one of the Boards APIs, which allows authenticated and unauthori… |
CVE-2022-0235 | Medium | 6.1 | 2022-01-16 | node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2021-44739 | Medium | 4.3 | 2022-01-14 | Acrobat Reader DC ActiveX Control versions 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an Information… |
CVE-2021-44702 | Medium | 4.3 | 2022-01-14 | Acrobat Reader DC ActiveX Control versions 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an Information… |
CVE-2022-21677 | Medium | 4.3 | 2022-01-14 | Discourse is an open source discussion platform. Discourse groups can be configured with varying visibility levels for the group as well as the group members… |
CVE-2022-21678 | Medium | 4.3 | 2022-01-13 | Discourse is an open source discussion platform. Prior to version 2.8.0.beta11 in the `tests-passed` branch, version 2.8.0.beta11 in the `beta` branch, and ver… |
CVE-2021-30314 | Medium | 6.2 | 2022-01-13 | Lack of validation for third party application accessing the service can lead to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Conn… |
CVE-2022-0013 | Medium | 5.0 | 2022-01-12 | A file information exposure vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables a local attacker to read the contents of arbitrary fil… |
CVE-2021-41767 | Medium | 6.5 | 2022-01-11 | Apache Guacamole 1.3.0 and older may incorrectly include a private tunnel identifier in the non-private details of some REST responses. This may allow an authe… |
CVE-2022-21671 | High | 8.1 | 2022-01-11 | @replit/crosis is a JavaScript client that speaks Replit's container protocol. A vulnerability that involves exposure of sensitive information exists in versio… |
CVE-2021-43951 | Medium | 4.3 | 2022-01-10 | Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view object import configuration details… |
CVE-2021-43949 | Medium | 4.3 | 2022-01-10 | Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view private objects via a Broken Access… |
CVE-2021-24948 | High | 7.5 | 2022-01-10 | The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not validate the qvquery parameter of the tp_get_dl_post_info_ajax AJAX action, which co… |
CVE-2022-22701 | Medium | 6.5 | 2022-01-10 | PartKeepr versions up to v1.4.0, loads attachments using a URL while creating a part and allows the use of the 'file://' URI scheme, allowing an authenticated… |
CVE-2022-22287 | Low | 3.9 | 2022-01-10 | Abitrary file access vulnerability in Samsung Email prior to 6.1.60.16 allows attacker to read isolated data in sandbox. |
CVE-2021-46166 | Medium | 6.5 | 2022-01-10 | Zoho ManageEngine Desktop Central before 10.0.662 allows authenticated users to obtain sensitive information from the database by visiting the Reports page. |
CVE-2021-46148 | Medium | 6.5 | 2022-01-10 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. Some unprivileged users can view confidential information (… |
CVE-2021-38956 | Medium | 5.3 | 2022-01-10 | IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 could disclose sensitive version information in HTTP response headers that could aid in further attacks agai… |
CVE-2022-21642 | Medium | 4.3 | 2022-01-05 | Discourse is an open source platform for community discussion. In affected versions when composing a message from topic the composer user suggestions reveals w… |
CVE-2020-15933 | Medium | 5.3 | 2022-01-05 | A exposure of sensitive information to an unauthorized actor in Fortinet FortiMail versions 6.0.9 and below, FortiMail versions 6.2.4 and below FortiMail versi… |
CVE-2021-20871 | Medium | 6.5 | 2022-01-04 | Exposure of sensitive information to an unauthorized actor vulnerability in KONICA MINOLTA bizhub series (bizhub C750i G00-35 and earlier, bizhub C650i/C550i/C… |
CVE-2021-20869 | Medium | 6.5 | 2022-01-04 | Exposure of sensitive information to an unauthorized actor vulnerability in KONICA MINOLTA bizhub series (bizhub C750i G00-35 and earlier, bizhub C650i/C550i/C… |
CVE-2021-39980 | Medium | 5.3 | 2022-01-03 | Telephony application has a Exposure of Sensitive Information to an Unauthorized Actor vulnerability.Successful exploitation of this vulnerability could lead t… |
CVE-2021-39972 | High | 7.5 | 2022-01-03 | MyHuawei-App has a Exposure of Sensitive Information to an Unauthorized Actor vulnerability.Successful exploitation of this vulnerability could compromise conf… |
CVE-2021-37125 | High | 7.5 | 2022-01-03 | Arbitrary file has a Exposure of Sensitive Information to an Unauthorized Actor vulnerability .Successful exploitation of this vulnerability may cause confiden… |
CVE-2021-36723 | Medium | 6.1 | 2021-12-29 | Emuse - eServices / eNvoice Exposure Of Private Personal Information due to lack of identification mechanisms and predictable IDs an attacker can scrape all th… |
CVE-2021-45884 | High | 7.5 | 2021-12-27 | In Brave Desktop 1.17 through 1.33 before 1.33.106, when CNAME-based adblocking and a proxying extension with a SOCKS fallback are enabled, additional DNS requ… |
CVE-2021-45654 | Critical | 9.6 | 2021-12-26 | NETGEAR XR1000 devices before 1.0.0.58 are affected by disclosure of sensitive information. |
CVE-2021-45653 | Low | 3.9 | 2021-12-26 | Certain NETGEAR devices are affected by disclosure of sensitive information. This affects RBK352 before 4.4.0.10, RBR350 before 4.4.0.10, and RBS350 before 4.4… |
CVE-2021-45652 | Critical | 9.6 | 2021-12-26 | Certain NETGEAR devices are affected by disclosure of sensitive information. This affects RBK352 before 4.4.0.10, RBR350 before 4.4.0.10, and RBS350 before 4.4… |
CVE-2021-45651 | High | 7.4 | 2021-12-26 | Certain NETGEAR devices are affected by disclosure of sensitive information. This affects RBK50 before 2.7.3.22, RBR50 before 2.7.3.22, and RBS50 before 2.7.3… |
CVE-2021-45650 | Critical | 9.1 | 2021-12-26 | Certain NETGEAR devices are affected by disclosure of sensitive information. This affects R7000 before 1.0.11.110, R7900 before 1.0.4.30, R8000 before 1.0.4.62… |
CVE-2021-45649 | High | 7.9 | 2021-12-26 | Certain NETGEAR devices are affected by disclosure of sensitive information. This affects R6400v2 before 1.0.4.84, R6700v3 before 1.0.4.84, R7000 before 1.0.11… |
CVE-2021-45648 | Low | 3.1 | 2021-12-26 | Certain NETGEAR devices are affected by disclosure of sensitive information. This affects EX6100v2 before 1.0.1.106, EX6150v2 before 1.0.1.106, EX6250 before 1… |
CVE-2021-45647 | Medium | 6.5 | 2021-12-26 | Certain NETGEAR devices are affected by disclosure of sensitive information. This affects EAX80 before 1.0.1.62, EX7000 before 1.0.1.104, R6120 before 1.0.0.76… |
CVE-2021-45646 | Medium | 5.3 | 2021-12-26 | NETGEAR R7000 devices before 1.0.11.116 are affected by disclosure of sensitive information. |
CVE-2021-45603 | Medium | 6.1 | 2021-12-26 | Certain NETGEAR devices are affected by disclosure of sensitive information. A UPnP request reveals a device's serial number, which can be used for a password… |
CVE-2021-45493 | High | 7.6 | 2021-12-26 | Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects RAX35 before 1.0.4.102, RAX38 before 1.0.4.102, and RAX40 before… |
CVE-2021-4024 | Medium | 6.5 | 2021-12-23 | A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` pro… |
CVE-2021-39013 | Medium | 6.5 | 2021-12-22 | IBM Cloud Pak for Security (CP4S) 1.7.2.0, 1.7.1.0, and 1.7.0.0 could allow an authenticated user to obtain sensitive information in HTTP responses that could… |
CVE-2021-36341 | Medium | 5.5 | 2021-12-21 | Dell Wyse Device Agent version 14.5.4.1 and below contain a sensitive data exposure vulnerability. A local authenticated user with low privileges could potenti… |
CVE-2021-44145 | Medium | 6.5 | 2021-12-17 | In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity c… |
CVE-2021-45038 | Medium | 5.3 | 2021-12-17 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. By using an action=rollback query, attackers can view priva… |
CVE-2021-45095 | Medium | 5.5 | 2021-12-16 | pep_sock_accept in net/phonet/pep.c in the Linux kernel through 5.15.8 has a refcount leak. |
CVE-2021-1023 | Medium | 5.0 | 2021-12-15 | In onCreate of RequestIgnoreBatteryOptimizations.java, there is a possible way to determine whether an app is installed, without query permissions, due to side… |
CVE-2021-0983 | Low | 3.3 | 2021-12-15 | In createAdminSupportIntent of DevicePolicyManagerService.java, there is a possible disclosure of information about installed device/profile owner package name… |
CVE-2021-43823 | Medium | 6.5 | 2021-12-13 | Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.33.2 is vulnerable to a side-channel attack where strings in private source… |
CVE-2021-38901 | Medium | 5.5 | 2021-12-13 | IBM Spectrum Protect Operations Center 7.1, under special configurations, could allow a local user to obtain highly sensitive information. IBM X-Force ID: 2096… |
CVE-2021-39941 | Low | 3.7 | 2021-12-13 | An information disclosure vulnerability in GitLab CE/EE versions 12.0 to 14.3.6, 14.4 to 14.4.4, and 14.5 to 14.5.2 allowed non-project members to see the defa… |
CVE-2021-24945 | High | 8.0 | 2021-12-13 | The Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.38 does not have any authorisation and CSRF checks in the likebtn_export_votes AJAX action, which… |
CVE-2018-25022 | Low | 3.1 | 2021-12-13 | The Onion module in toxcore before 0.2.2 doesn't restrict which packets can be onion-routed, which allows a remote attacker to discover a target user's IP addr… |
CVE-2021-37935 | High | 7.5 | 2021-12-10 | An information disclosure vulnerability in the login page of Huntflow Enterprise before 3.10.4 could allow an unauthenticated, remote user to get information a… |
CVE-2021-43536 | Medium | 6.5 | 2021-12-08 | Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL. This vulnerability affects Thunderbird <… |
CVE-2021-41090 | Medium | 6.5 | 2021-12-08 | Grafana Agent is a telemetry collector for sending metrics, logs, and trace data to the opinionated Grafana observability stack. Prior to versions 0.20.1 and 0… |
CVE-2021-25519 | Medium | 4.0 | 2021-12-08 | An improper access control vulnerability in CPLC prior to SMR Dec-2021 Release 1 allows local attackers to access CPLC information without permission. |
CVE-2021-43067 | High | 8.3 | 2021-12-08 | A exposure of sensitive information to an unauthorized actor in Fortinet FortiAuthenticator version 6.4.0, version 6.3.2 and below, version 6.2.1 and below, ve… |
CVE-2021-43963 | High | 8.1 | 2021-12-07 | An issue was discovered in Couchbase Sync Gateway 2.7.0 through 2.8.2. The bucket credentials used to read and write data in Couchbase Server were insecurely b… |
CVE-2021-37067 | High | 7.5 | 2021-12-07 | There is a Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead… |
CVE-2021-29115 | Medium | 5.3 | 2021-12-07 | An information disclosure vulnerability in the ArcGIS Service Directory in Esri ArcGIS Enterprise versions 10.9.0 and below may allows a remote attacker to vie… |
CVE-2021-36198 | High | 8.3 | 2021-12-06 | Successful exploitation of this vulnerability could allow an unauthorized user to access sensitive data. |
CVE-2020-27414 | Medium | 5.9 | 2021-12-02 | Mahavitaran android application 7.50 and prior transmit sensitive information in URL parameters. This may lead to information disclosure if unauthorized partie… |
CVE-2021-43792 | Medium | 4.3 | 2021-12-01 | Discourse is an open source discussion platform. In affected versions a vulnerability affects users of tag groups who use the "Tags are visible only to the fol… |
CVE-2021-39000 | Medium | 5.5 | 2021-11-30 | IBM MQ Appliance 9.2 CD and 9.2 LTS could allow a local attacker to obtain sensitive information by inclusion of sensitive data within diagnostics. IBM X-Force… |
CVE-2021-38999 | Medium | 5.5 | 2021-11-30 | IBM MQ Appliance could allow a local attacker to obtain sensitive information by inclusion of sensitive data within trace. |
CVE-2021-37010 | High | 7.5 | 2021-11-23 | There is a Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cau… |
CVE-2019-5640 | Low | 3.3 | 2021-11-22 | Rapid7 Nexpose versions prior to 6.6.114 suffer from an information exposure issue whereby, when the user's session has ended due to inactivity, an attacker ca… |
CVE-2021-41532 | Medium | 5.3 | 2021-11-19 | In Apache Ozone before 1.2.0, Recon HTTP endpoints provide access to OM, SCM and Datanode metadata. Due to a bug, any unauthenticated user can access the data… |
CVE-2021-23193 | High | 8.1 | 2021-11-18 | Improper privilege validation vulnerability in COM Interface of Gallagher Command Centre Server allows authenticated unprivileged operators to retrieve sensiti… |
CVE-2021-37939 | Low | 2.7 | 2021-11-18 | It was discovered that Kibana’s JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, which may be intentional… |
CVE-2021-41277 | Critical | 10.0 | 2021-11-17 | Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->ma… |
CVE-2021-32600 | Medium | 5.0 | 2021-11-17 | An exposure of sensitive information to an unauthorized actor vulnerability in FortiOS CLI 7.0.0, 6.4.0 through 6.4.6, 6.2.0 through 6.2.9, 6.0.x and 5.6.x may… |
CVE-2021-41271 | Medium | 4.8 | 2021-11-15 | Discourse is a platform for community discussion. In affected versions a maliciously crafted request could cause an error response to be cached by intermediate… |
CVE-2021-41263 | High | 8.3 | 2021-11-15 | rails_multisite provides multi-db support for Rails applications. In affected versions this vulnerability impacts any Rails applications using `rails_multisite… |
CVE-2021-30284 | High | 7.5 | 2021-11-12 | Possible information exposure and denial of service due to NAS not dropping messages when integrity check fails in Snapdragon Auto, Snapdragon Compute, Snapdra… |