CWE-200 · Information Disclosure (page 40)
Page 40 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-28765 | Critical | 9.8 | 2023-04-11 | An attacker with basic privileges in SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, can get access to lcmbiar f… |
CVE-2013-10024 | Low | 3.5 | 2023-04-08 | A vulnerability has been found in Exit Strategy Plugin 1.55 on WordPress and classified as problematic. Affected by this vulnerability is an unknown functional… |
CVE-2023-1710 | Medium | 5.3 | 2023-04-05 | A sensitive information disclosure vulnerability in GitLab affecting all versions from 15.0 prior to 15.8.5, 15.9 prior to 15.9.4 and 15.10 prior to 15.10.1 al… |
CVE-2023-0838 | Medium | 5.5 | 2023-04-05 | An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. A maintainer could mo… |
CVE-2023-1858 | Medium | 4.3 | 2023-04-05 | A vulnerability was found in SourceCodester Earnings and Expense Tracker App 1.0. It has been classified as problematic. This affects an unknown part of the fi… |
CVE-2023-0614 | Medium | 6.5 | 2023-04-03 | The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attacker may be able to… |
CVE-2023-1790 | Medium | 4.3 | 2023-04-01 | A vulnerability, which was classified as problematic, was found in SourceCodester Simple Task Allocation System 1.0. Affected is an unknown function of the fil… |
CVE-2023-29137 | Medium | 4.3 | 2023-03-31 | An issue was discovered in the GrowthExperiments extension for MediaWiki through 1.39.3. The UserImpactHandler for GrowthExperiments inadvertently returns the… |
CVE-2023-1777 | Medium | 6.5 | 2023-03-31 | Mattermost allows an attacker to request a preview of an existing message when creating a new message via the createPost API call, disclosing the contents of t… |
CVE-2023-1775 | Medium | 4.3 | 2023-03-31 | When running in a High Availability configuration, Mattermost fails to sanitize some of the user_updated and post_deleted events broadcast to all users, leadin… |
CVE-2023-1769 | Medium | 4.3 | 2023-03-31 | A vulnerability, which was classified as problematic, was found in SourceCodester Grade Point Average GPA Calculator 1.0. Affected is an unknown function of th… |
CVE-2023-1258 | Medium | 5.3 | 2023-03-31 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ABB Flow-X firmware on Flow-X embedded hardware (web service modules) allows Footpr… |
CVE-2023-28732 | Medium | 6.5 | 2023-03-30 | Missing access control in AnyMailing Joomla Plugin allows to list and access files containing sensitive information from the plugin itself and access to system… |
CVE-2023-0836 | High | 7.5 | 2023-03-29 | An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7… |
CVE-2023-1680 | Medium | 4.3 | 2023-03-29 | A vulnerability, which was classified as problematic, has been found in Xunrui CMS 4.61. This issue affects some unknown processing of the file /dayrui/My/View… |
CVE-2022-48430 | Medium | 5.5 | 2023-03-29 | In JetBrains IntelliJ IDEA before 2023.1 file content could be disclosed via an external stylesheet path in Markdown preview. |
CVE-2023-1683 | Medium | 4.3 | 2023-03-29 | A vulnerability was found in Xunrui CMS 4.61 and classified as problematic. Affected by this issue is some unknown functionality of the file /dayrui/Fcms/View/… |
CVE-2023-1681 | Medium | 4.3 | 2023-03-28 | A vulnerability, which was classified as problematic, was found in Xunrui CMS 4.61. Affected is an unknown function of the file /config/myfield/test.php. The m… |
CVE-2023-25722 | Medium | 5.5 | 2023-03-28 | A credential-leak issue was discovered in related Veracode products before 2023-03-27. Veracode Scan Jenkins Plugin before 23.3.19.0, when configured for remot… |
CVE-2022-48348 | Critical | 9.1 | 2023-03-27 | The MediaProvider module has a vulnerability of unauthorized data read. Successful exploitation of this vulnerability may affect confidentiality and integrity. |
CVE-2022-48347 | High | 7.5 | 2023-03-27 | The MediaProvider module has a vulnerability in permission verification. Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2022-48346 | High | 7.5 | 2023-03-27 | The HwContacts module has a logic bypass vulnerability. Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2023-1075 | Low | 3.3 | 2023-03-27 | A flaw was found in the Linux Kernel. The tls_is_tx_ready() incorrectly checks for list emptiness, potentially accessing a type confused entry to the list_head… |
CVE-2021-3923 | Low | 2.3 | 2023-03-27 | A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel stack information wh… |
CVE-2023-24838 | Critical | 9.8 | 2023-03-27 | HGiga PowerStation has a vulnerability of Information Leakage. An unauthenticated remote attacker can exploit this vulnerability to obtain the administrator's… |
CVE-2022-39043 | Low | 2.4 | 2023-03-27 | Juiker app stores debug logs which contains sensitive information to mobile external storage. An unauthenticated physical attacker can access these files to ac… |
CVE-2023-28444 | Critical | 9.9 | 2023-03-24 | angular-server-side-configuration helps configure an angular application at runtime on the server or in a docker container via environment variables. angular-s… |
CVE-2023-21067 | High | 7.5 | 2023-03-24 | Product: AndroidVersions: Android kernelAndroid ID: A-254114726References: N/A |
CVE-2023-28442 | High | 7.5 | 2023-03-24 | GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. Prior to versions 2.20.6, 2.19.6, and 2.18… |
CVE-2023-28336 | Medium | 4.3 | 2023-03-23 | Insufficient filtering of grade report history made it possible for teachers to access the names of users they could not otherwise access. |
CVE-2023-28334 | Medium | 4.3 | 2023-03-23 | Authenticated users were able to enumerate other users' names via the learning plans page. |
CVE-2023-1402 | Medium | 4.3 | 2023-03-23 | The course participation report required additional checks to prevent roles being displayed which the user did not have access to view. |
CVE-2023-20055 | High | 8.0 | 2023-03-23 | A vulnerability in the management API of Cisco DNA Center could allow an authenticated, remote attacker to elevate privileges in the context of the web-based m… |
CVE-2023-28432 | High | 7.5 | 2023-03-22 | Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z… |
CVE-2023-1562 | Low | 3.5 | 2023-03-22 | Mattermost fails to check the "Show Full Name" setting when rendering the result for the /plugins/focalboard/api/v2/users API call, allowing an attacker to lea… |
CVE-2022-45634 | Medium | 4.3 | 2023-03-22 | An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows authenticated attacker to gain access to sensitive account information |
CVE-2022-45124 | High | 7.5 | 2023-03-20 | An information disclosure vulnerability exists in the User authentication functionality of WellinTech KingHistorian 35.01.00.05. A specially crafted network pa… |
CVE-2023-27591 | High | 7.5 | 2023-03-17 | Miniflux is a feed reader. Prior to version 2.0.43, an unauthenticated user can retrieve Prometheus metrics from a publicly reachable Miniflux instance where t… |
CVE-2023-0027 | Medium | 5.3 | 2023-03-17 | Rockwell Automation Modbus TCP Server AOI prior to 2.04.00 is vulnerable to an unauthorized user sending a malformed message that could cause the controller to… |
CVE-2023-23622 | Medium | 4.3 | 2023-03-17 | Discourse is an open-source discussion platform. Prior to version 3.0.1 of the `stable` branch and version 3.1.0.beta2 of the `beta` and `tests-passed` branche… |
CVE-2023-23935 | Low | 3.5 | 2023-03-16 | Discourse is an open-source messaging platform. In versions 3.0.1 and prior on the `stable` branch and versions 3.1.0.beta2 and prior on the `beta` and `tests-… |
CVE-2023-22880 | Medium | 6.8 | 2023-03-16 | Zoom for Windows clients before version 5.13.3, Zoom Rooms for Windows clients before version 5.13.5 and Zoom VDI for Windows clients before 5.13.1 contain an… |
CVE-2023-21449 | Medium | 4.0 | 2023-03-16 | Improper access control vulnerability in Call application prior to SMR Mar-2023 Release 1 allows local attackers to access sensitive information without proper… |
CVE-2023-25680 | Medium | 4.2 | 2023-03-15 | IBM Robotic Process Automation 21.0.1 through 21.0.5 is vulnerable to insufficiently protecting credentials. Queue Provider credentials are not obfuscated wh… |
CVE-2023-22876 | Medium | 4.3 | 2023-03-15 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.7 and 6.1.0.0 through 6.1.2.1 could allow a privileged user to obtain sensitive information… |
CVE-2020-4927 | Medium | 5.7 | 2023-03-15 | A vulnerability in the Spectrum Scale 5.0.5.0 through 5.1.6.1 core component could allow unauthorized access to user data or injection of arbitrary data in the… |
CVE-2022-38456 | Medium | 4.3 | 2023-03-15 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ernest Marcinko Ajax Search Lite plugin <= 4.10.3 versions. |
CVE-2023-24923 | Medium | 5.5 | 2023-03-14 | Microsoft OneDrive for Android Information Disclosure Vulnerability |
CVE-2023-24882 | Medium | 5.5 | 2023-03-14 | Microsoft OneDrive for Android Information Disclosure Vulnerability |
CVE-2023-27894 | Medium | 5.0 | 2023-03-14 | SAP BusinessObjects Business Intelligence Platform (Web Services) - versions 420, 430, allows an attacker to inject arbitrary values as CMS parameters to perfo… |
CVE-2023-23327 | Medium | 4.9 | 2023-03-10 | An Information Disclosure vulnerability exists in AvantFAX 3.3.7. Backups of the AvantFAX sent/received faxes, and database backups are stored using the curren… |
CVE-2023-1203 | Medium | 6.5 | 2023-03-10 | Improper removal of sensitive data in the entry edit feature of Hub Business submodule in Devolutions Remote Desktop Manager PowerShell Module 2022.3.1.5 and e… |
CVE-2022-22075 | Medium | 6.2 | 2023-03-10 | Information Disclosure in Graphics during GPU context switch. |
CVE-2014-125093 | Medium | 4.3 | 2023-03-10 | A vulnerability has been found in Ad Blocking Detector Plugin up to 1.2.1 on WordPress and classified as problematic. This vulnerability affects unknown code o… |
CVE-2021-34125 | High | 7.5 | 2023-03-09 | An issue discovered in Yuneec Mantis Q and PX4-Autopilot v 1.11.3 and below allow attacker to gain access to sensitive information via various nuttx commands. |
CVE-2018-25081 | High | 7.5 | 2023-03-09 | Bitwarden through 2023.2.1 offers password auto-fill within a cross-domain IFRAME element. NOTE: the vendor's position is that there have been important legiti… |
CVE-2023-1263 | Medium | 5.3 | 2023-03-07 | The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 4.1.6 via the cmp_get_post_de… |
CVE-2023-27481 | Medium | 4.3 | 2023-03-07 | Directus is a real-time API and App dashboard for managing SQL database content. In versions prior to 9.16.0 users with read access to the `password` field in… |
CVE-2023-27478 | Medium | 6.5 | 2023-03-07 | libmemcached-awesome is an open source C/C++ client library and tools for the memcached server. `libmemcached` could return data for a previously requested key… |
CVE-2023-23776 | Medium | 4.6 | 2023-03-07 | An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in FortiAnalyzer versions 7.2.0 through 7.2.1, 7.0.0 through 7.0.4 and 6… |
CVE-2022-46257 | Medium | 4.3 | 2023-03-07 | An information disclosure vulnerability was identified in GitHub Enterprise Server that allowed private repositories to be added to a GitHub Actions runner gro… |
CVE-2022-41329 | Medium | 5.3 | 2023-03-07 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0… |
CVE-2022-27490 | Medium | 5.4 | 2023-03-07 | A exposure of sensitive information to an unauthorized actor in Fortinet FortiManager version 6.0.0 through 6.0.4, FortiAnalyzer version 6.0.0 through 6.0.4, F… |
CVE-2020-36668 | Medium | 4.3 | 2023-03-07 | The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to sensitive information disclosure in versions up to, and including, 1.4.0 due… |
CVE-2023-22847 | Medium | 4.3 | 2023-03-07 | Information disclosure vulnerability exists in pg_ivm versions prior to 1.5.1. An Incrementally Maintainable Materialized View (IMMV) created by pg_ivm may ref… |
CVE-2023-26054 | Medium | 6.5 | 2023-03-06 | BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In affected versions when the user sends… |
CVE-2023-25169 | Low | 3.1 | 2023-03-06 | discourse-yearly-review is a discourse plugin which publishes an automated Year in Review topic. In affected versions a user present in a yearly review topic t… |
CVE-2022-4862 | Medium | 5.0 | 2023-03-06 | Rendering of HTML provided by another authenticated user is possible in browser on M-Files Web before 22.12.12140.3. This allows the content to steal user sens… |
CVE-2022-3284 | Medium | 6.5 | 2023-03-06 | Download key for a file in a vault was passed in an insecure way that could easily be logged in M-Files New Web in M-Files before 22.11.12011.0. This issue aff… |
CVE-2023-26108 | Low | 3.7 | 2023-03-06 | Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerability is possible… |
CVE-2023-25819 | Medium | 5.3 | 2023-03-04 | Discourse is an open source platform for community discussion. Tags that are normally private are showing in metadata. This affects any site running the `tests… |
CVE-2023-20062 | Medium | 6.5 | 2023-03-03 | Multiple vulnerabilities in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to collect sensitive information or perform a serve… |
CVE-2023-20061 | Medium | 6.5 | 2023-03-03 | Multiple vulnerabilities in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to collect sensitive information or perform a serve… |
CVE-2022-41862 | Low | 3.7 | 2023-03-03 | In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditi… |
CVE-2023-26476 | High | 7.5 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in version 3.2-m3, users can deduce the content of the password fields by repeated call to `LiveTableResult… |
CVE-2023-25536 | Medium | 6.7 | 2023-03-02 | Dell PowerScale OneFS 9.4.0.x contains exposure of sensitive information to an unauthorized actor. A malicious authenticated local user could potentially expl… |
CVE-2023-25544 | High | 7.5 | 2023-03-01 | Dell NetWorker versions 19.5 and earlier contain 'Apache Tomcat' version disclosure vulnerability. A NetWorker server user with remote access to NetWorker cli… |
CVE-2023-24567 | High | 7.5 | 2023-03-01 | Dell NetWorker versions 19.5 and earlier contain 'RabbitMQ' version disclosure vulnerability. A NetWorker server user with remote access to NetWorker clients… |
CVE-2023-1055 | Medium | 5.5 | 2023-02-27 | A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which… |
CVE-2023-23511 | Medium | 5.5 | 2023-02-27 | The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3, tvOS 16.3, w… |
CVE-2023-23500 | Medium | 5.5 | 2023-02-27 | The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3, iOS 15.7.3 and iPadOS 15.7.3, tvOS… |
CVE-2023-23499 | Medium | 5.5 | 2023-02-27 | This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, watchOS 9.3, macOS Big Sur 11.7.3, tvO… |
CVE-2022-32896 | Medium | 5.5 | 2023-02-27 | This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.6, macOS Big Sur 11.7. A user may be able to view sensitive use… |
CVE-2022-32855 | Medium | 5.5 | 2023-02-27 | A logic issue was addressed with improved state management. This issue is fixed in iOS 15.6 and iPadOS 15.6. A user may be able to view restricted content from… |
CVE-2022-32836 | High | 7.5 | 2023-02-27 | This issue was addressed with improved state management. This issue is fixed in Apple Music 3.9.10 for Android. An app may be able to access user-sensitive dat… |
CVE-2022-32824 | Medium | 5.5 | 2023-02-27 | The issue was addressed with improved memory handling. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6. An app may be able to disclose… |
CVE-2022-32784 | Medium | 6.5 | 2023-02-27 | The issue was addressed with improved UI handling. This issue is fixed in Safari 15.6, iOS 15.6 and iPadOS 15.6. Visiting a maliciously crafted website may lea… |
CVE-2022-22668 | Medium | 5.5 | 2023-02-27 | A logic issue was addressed with improved restrictions. This issue is fixed in iOS 15.4 and iPadOS 15.4, macOS Monterey 12.3. A malicious application may be ab… |
CVE-2021-46841 | Medium | 5.9 | 2023-02-27 | This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in Apple Music 3.5.0 for Android. An attacker in a privi… |
CVE-2020-9846 | Medium | 5.3 | 2023-02-27 | A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.0.1. A malicious application may be able to access local u… |
CVE-2023-27266 | Low | 2.7 | 2023-02-27 | Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the /api/v4/users/me/teams API endpoint, allowing an attacker with team… |
CVE-2023-27265 | Low | 2.7 | 2023-02-27 | Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the "Regenerate Invite Id" API endpoint, allowing an attacker with team… |
CVE-2023-0994 | High | 7.5 | 2023-02-24 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository francoisjacquet/rosariosis prior to 10.8.2. |
CVE-2023-0597 | Medium | 5.5 | 2023-02-23 | A flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping of X86 CPU data to memory was found in the way user can guess location of exceptio… |
CVE-2023-22476 | Medium | 4.3 | 2023-02-23 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions prior to 2.25.6, due to insufficient access-level checks, any logged-in user allowed… |
CVE-2017-20178 | Low | 3.1 | 2023-02-21 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Codiad 2.8.0. It has been rated as problematic. Affected by this issue is the function saveJSON of… |
CVE-2022-48319 | Medium | 6.5 | 2023-02-20 | Sensitive host secret disclosed in cmk-update-agent.log file in Tribe29's Checkmk <= 2.1.0p13, Checkmk <= 2.0.0p29, and all versions of Checkmk 1.6.0 (EOL) all… |
CVE-2023-0901 | Medium | 5.3 | 2023-02-18 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pixelfed/pixelfed prior to 0.11.4. |
CVE-2022-34351 | Medium | 5.9 | 2023-02-17 | IBM QRadar SIEM 7.4 and 7.5 is vulnerable to information exposure allowing a non-tenant user with a specific domain security profile assigned to see some data… |
CVE-2022-43930 | Medium | 6.2 | 2023-02-17 | IBM Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 is vulnerable to an Information Disclosure as sensitive information may be included in a log file. IB… |