CWE-200 · Information Disclosure (page 41)
Page 41 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-41251 | Medium | 5.9 | 2021-11-05 | @sap-cloud-sdk/core contains the core functionality of the SAP Cloud SDK as well as the SAP Business Technology Platform abstractions. This affects application… |
CVE-2021-39898 | Low | 3.7 | 2021-11-05 | In all versions of GitLab CE/EE since version 10.6, a project export leaks the external webhook token value which may allow access to the project which it was… |
CVE-2021-34774 | Medium | 4.9 | 2021-11-04 | A vulnerability in the web-based management interface of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to acces… |
CVE-2021-36192 | Medium | 5.2 | 2021-11-03 | An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in FortiManager 7.0.1 and below, 6.4.6 and below, 6.2.x, 6.0.x, 5.6.0 may… |
CVE-2021-22047 | Medium | 5.3 | 2021-10-28 | In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured… |
CVE-2021-22044 | High | 7.5 | 2021-10-28 | In Spring Cloud OpenFeign 3.0.0 to 3.0.4, 2.2.0.RELEASE to 2.2.9.RELEASE, and older unsupported versions, applications using type-level `@RequestMapping`annota… |
CVE-2021-41158 | Medium | 5.8 | 2021-10-26 | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on… |
CVE-2021-39224 | Low | 3.5 | 2021-10-25 | Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud OfficeOnline application prior to version 1.1.1 returned verbatim exception messa… |
CVE-2021-39223 | Medium | 4.8 | 2021-10-25 | Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Richdocuments application prior to versions 3.8.6 and 4.2.3 returned verbatim exc… |
CVE-2021-39220 | Low | 3.5 | 2021-10-25 | Nextcloud is an open-source, self-hosted productivity platform The Nextcloud Mail application prior to versions 1.10.4 and 1.11.0 does by default not render im… |
CVE-2017-20007 | Medium | 5.3 | 2021-10-25 | Ingeteam INGEPAC DA AU AUC_1.13.0.28 (and before) web application allows access to a certain path that contains sensitive information that could be used by an… |
CVE-2021-42536 | High | 8.0 | 2021-10-22 | The affected product is vulnerable to a disclosure of peer username and password by allowing all users access to read global variables. |
CVE-2021-31381 | Medium | 6.5 | 2021-10-19 | A configuration weakness in the JBoss Application Server (AppSvr) component of Juniper Networks SRC Series allows a remote attacker to send a specially crafted… |
CVE-2021-31380 | Medium | 5.3 | 2021-10-19 | A configuration weakness in the JBoss Application Server (AppSvr) component of Juniper Networks SRC Series allows a remote attacker to send a specially crafted… |
CVE-2021-31371 | Medium | 5.3 | 2021-10-19 | Juniper Networks Junos OS uses the 128.0.0.0/2 subnet for internal communications between the RE and PFEs. It was discovered that packets utilizing these IP ad… |
CVE-2021-31352 | Medium | 5.3 | 2021-10-19 | An Information Exposure vulnerability in Juniper Networks SRC Series devices configured for NETCONF over SSH permits the negotiation of weak ciphers, which cou… |
CVE-2021-41140 | Medium | 5.3 | 2021-10-19 | Discourse-reactions is a plugin for the Discourse platform that allows user to add their reactions to the post. In affected versions reactions given by user to… |
CVE-2020-4951 | Low | 3.3 | 2021-10-15 | IBM Cognos Analytics 11.1.7 and 11.2.0 contains locally cached browser data, that could allow a local attacker to obtain sensitive information. |
CVE-2021-22036 | Medium | 6.5 | 2021-10-13 | VMware vRealize Orchestrator ((8.x prior to 8.6) contains an open redirect vulnerability due to improper path handling. A malicious actor may be able to redire… |
CVE-2021-20832 | Medium | 5.3 | 2021-10-13 | InBody App for iOS versions prior to 2.3.30 and InBody App for Android versions prior to 2.2.90(510) contain a vulnerability which may lead to information disc… |
CVE-2021-33727 | Medium | 6.5 | 2021-10-12 | A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). An authenticated attacker could download the user profile of any user. Wit… |
CVE-2021-32028 | Medium | 6.5 | 2021-10-11 | A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an authenticated database user could read arb… |
CVE-2021-32029 | Medium | 6.5 | 2021-10-08 | A flaw was found in postgresql. Using an UPDATE ... RETURNING command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of… |
CVE-2021-42089 | High | 7.5 | 2021-10-07 | An issue was discovered in Zammad before 4.1.1. The REST API discloses sensitive information. |
CVE-2021-34702 | Medium | 4.3 | 2021-10-06 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive… |
CVE-2021-41125 | Medium | 5.7 | 2021-10-06 | Scrapy is a high-level web crawling and scraping framework for Python. If you use `HttpAuthMiddleware` (i.e. the `http_user` and `http_pass` spider attributes)… |
CVE-2021-25486 | Low | 2.5 | 2021-10-06 | Exposure of information vulnerability in ipcdump prior to SMR Oct-2021 Release 1 allows an attacker detect device information via analyzing packet in log. |
CVE-2021-0644 | Medium | 5.5 | 2021-10-06 | In conditionallyRemoveIdentifiers of SubscriptionController.java, there is a possible way to retrieve a trackable identifier due to a missing permission check… |
CVE-2021-41124 | High | 7.4 | 2021-10-05 | Scrapy-splash is a library which provides Scrapy and JavaScript integration. In affected versions users who use [`HttpAuthMiddleware`](http://doc.scrapy.org/en… |
CVE-2021-41120 | High | 7.5 | 2021-10-05 | sylius/paypal-plugin is a paypal plugin for the Sylius development platform. In affected versions the URL to the payment page done after checkout was created w… |
CVE-2021-41123 | Medium | 5.3 | 2021-10-04 | Survey Solutions is a survey management and data collection system. In affected versions the Headquarters application publishes /metrics endpoint available to… |
CVE-2021-41092 | Medium | 5.4 | 2021-10-04 | Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running `docker login my-private-registry.ex… |
CVE-2021-23858 | High | 8.6 | 2021-10-04 | Information disclosure: The main configuration, including users and their hashed passwords, is exposed by an unprotected web server resource and can be accesse… |
CVE-2021-23855 | High | 8.6 | 2021-10-04 | The user and password data base is exposed by an unprotected web server resource. Passwords are hashed with a weak hashing algorithm and therefore allow an att… |
CVE-2021-41109 | High | 7.5 | 2021-09-30 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.4, for regular (non-LiveQuery) qu… |
CVE-2021-41301 | Critical | 9.8 | 2021-09-30 | ECOA BAS controller is vulnerable to configuration disclosure when direct object reference is made to the specific files using an HTTP GET request. This will e… |
CVE-2021-39857 | Medium | 4.3 | 2021-09-29 | Adobe Acrobat Reader DC add-on for Internet Explorer versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are a… |
CVE-2021-39856 | Medium | 6.5 | 2021-09-29 | Acrobat Reader DC ActiveX Control versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by an Infor… |
CVE-2021-39855 | Medium | 6.5 | 2021-09-29 | Acrobat Reader DC ActiveX Control versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by an Infor… |
CVE-2021-24661 | Medium | 4.3 | 2021-09-27 | The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows users with Contributor roles or higher to… |
CVE-2021-22272 | Medium | 6.5 | 2021-09-27 | The vulnerability origins in the commissioning process where an attacker of the ControlTouch can enter a serial number in a specific way to transfer the device… |
CVE-2021-22276 | Medium | 6.1 | 2021-09-23 | The vulnerability allows a successful attacker to bypass the integrity check of FW uploaded to the free@home System Access Point. |
CVE-2021-26333 | Medium | 5.5 | 2021-09-21 | An information disclosure vulnerability exists in AMD Platform Security Processor (PSP) chipset driver. The discretionary access control list (DACL) may allow… |
CVE-2021-41082 | High | 7.5 | 2021-09-20 | Discourse is a platform for community discussion. In affected versions any private message that includes a group had its title and participating user exposed t… |
CVE-2021-24585 | Medium | 6.5 | 2021-09-20 | The Timetable and Event Schedule WordPress plugin before 2.4.0 outputs the Hashed Password, Username and Email Address (along other less sensitive data) of the… |
CVE-2021-40690 | High | 7.5 | 2021-09-19 | All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passe… |
CVE-2021-39327 | Medium | 5.3 | 2021-09-17 | The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backu… |
CVE-2021-40862 | High | 8.8 | 2021-09-15 | HashiCorp Terraform Enterprise up to v202108-1 contained an API endpoint that erroneously disclosed a sensitive URL to authenticated parties, which could be us… |
CVE-2021-39211 | Medium | 5.3 | 2021-09-15 | GLPI is a free Asset and IT management software package. Starting in version 9.2 and prior to version 9.5.6, the telemetry endpoint discloses GLPI and server i… |
CVE-2021-20582 | Medium | 5.3 | 2021-09-14 | IBM Security Secret Server up to 11.0 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have acce… |
CVE-2021-37192 | Medium | 4.3 | 2021-09-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). The affected software has an information disclosure vulnerabilit… |
CVE-2021-37190 | Medium | 4.3 | 2021-09-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). The affected software has an information disclosure vulnerabilit… |
CVE-2021-22527 | Medium | 6.0 | 2021-09-13 | Information leakage vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4 |
CVE-2021-39203 | Medium | 6.8 | 2021-09-09 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions authenticated us… |
CVE-2021-39200 | Medium | 5.3 | 2021-09-09 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions output data of t… |
CVE-2021-25464 | Low | 3.3 | 2021-09-09 | An improper file management vulnerability in SamsungCapture prior to version 4.8.02 allows sensitive information leak. |
CVE-2021-34771 | Medium | 5.5 | 2021-09-09 | A vulnerability in the Cisco IOS XR Software CLI could allow an authenticated, local attacker to view more information than their privileges allow. This vulner… |
CVE-2021-28566 | Low | 3.7 | 2021-09-08 | Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Information Disclosure vulnerability when uploadin… |
CVE-2021-37629 | Medium | 5.3 | 2021-09-07 | Nextcloud Richdocuments is an open source collaborative office suite. In affected versions there is a lack of rate limiting on the Richdocuments OCS endpoint… |
CVE-2020-7819 | Critical | 9.3 | 2021-09-07 | A SQL-Injection vulnerability in the nTracker USB Enterprise(secure USB management solution) allows a remote unauthenticated attacker to perform SQL query to a… |
CVE-2021-36096 | Medium | 5.2 | 2021-09-06 | Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x… |
CVE-2021-36095 | Medium | 5.3 | 2021-09-06 | Malicious attacker is able to find out valid user logins by using the "lost password" feature. This issue affects: OTRS AG ((OTRS)) Community Edition version 6… |
CVE-2021-39192 | Medium | 6.5 | 2021-09-03 | Ghost is a Node.js content management system. An error in the implementation of the limits service between versions 4.0.0 and 4.9.4 allows all authenticated us… |
CVE-2021-38314 | Medium | 5.3 | 2021-09-02 | The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the `incl… |
CVE-2021-22793 | High | 7.2 | 2021-09-02 | A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exist in AccuSine PCS+ / PFV+ (Versions prior to V1.6.7) and AccuSine PCSn… |
CVE-2021-39164 | Low | 3.1 | 2021-08-31 | Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the membership (list… |
CVE-2021-39163 | Low | 3.1 | 2021-08-31 | Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the name, avatar, to… |
CVE-2021-40086 | Low | 2.2 | 2021-08-25 | An issue was discovered in PrimeKey EJBCA before 7.6.0. As part of the configuration of the aliases for SCEP, CMP, EST, and Auto-enrollment, the enrollment sec… |
CVE-2021-21823 | High | 7.5 | 2021-08-20 | An information disclosure vulnerability exists in the Friend finder functionality of GmbH Komoot version 10.26.9 up to 11.1.11. A specially crafted series of n… |
CVE-2021-34749 | Medium | 5.8 | 2021-08-18 | A vulnerability in Server Name Identification (SNI) request filtering of Cisco Web Security Appliance (WSA), Cisco Firepower Threat Defense (FTD), and the Snor… |
CVE-2021-35936 | Medium | 5.3 | 2021-08-16 | If remote logging is not used, the worker (in the case of CeleryExecutor) or the scheduler (in the case of LocalExecutor) runs a Flask logging server and is li… |
CVE-2021-37326 | Medium | 5.3 | 2021-08-15 | NetSarang Xshell 7 before Build 0077 includes unintended code strings in paste operations. |
CVE-2021-36793 | High | 7.5 | 2021-08-13 | The routes (aka Extbase Yaml Routes) extension before 2.1.1 for TYPO3, when CsrfTokenViewHelper is used, allows Sensitive Information Disclosure because a sess… |
CVE-2021-37703 | Medium | 4.3 | 2021-08-13 | Discourse is an open-source platform for community discussion. In Discourse before versions 2.7.8 and 2.8.0.beta5, a user's read state for a topic such as the… |
CVE-2021-37704 | Medium | 5.4 | 2021-08-12 | PhpFastCache is a high-performance backend cache system (packagist package phpfastcache/phpfastcache). In versions before 6.1.5, 7.1.2, and 8.0.7 the `phpinfo(… |
CVE-2021-21596 | Critical | 9.6 | 2021-08-09 | Dell OpenManage Enterprise versions 3.4 through 3.6.1 and Dell OpenManage Enterprise Modular versions 1.20.00 through 1.30.00, contain a remote code execution… |
CVE-2021-21584 | High | 7.7 | 2021-08-09 | Dell OpenManage Enterprise version 3.5 and OpenManage Enterprise-Modular version 1.30.00 contain an information disclosure vulnerability. An authenticated low… |
CVE-2021-21564 | Critical | 9.8 | 2021-08-09 | Dell OpenManage Enterprise versions prior to 3.6.1 contain an improper authentication vulnerability. A remote unauthenticated attacker may potentially exploit… |
CVE-2015-7731 | Medium | 5.5 | 2021-08-09 | SAP Mobile Platform 3.0 SP05 ClientHub allows attackers to obtain the keystream and other sensitive information via the DataVault, aka SAP Security Note 209483… |
CVE-2021-20594 | High | 7.5 | 2021-08-06 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16/32/120SFCPU firmwa… |
CVE-2021-3566 | Medium | 5.5 | 2021-08-05 | Prior to ffmpeg version 4.3, the tty demuxer did not have a 'read_probe' function assigned to it. By crafting a legitimate "ffconcat" file that references an i… |
CVE-2021-32002 | Medium | 4.3 | 2021-08-05 | Improper Access Control vulnerability in web service of Secomea SiteManager allows local attacker without credentials to gather network information and configu… |
CVE-2021-22925 | Medium | 5.3 | 2021-08-05 | curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET… |
CVE-2021-34707 | Medium | 6.5 | 2021-08-04 | A vulnerability in the REST API of Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker to access sensitive data on… |
CVE-2021-32787 | Low | 3.1 | 2021-08-02 | Sourcegraph is a code search and navigation engine. Sourcegraph before version 3.30.0 has two potential information leaks. The site-admin area can be accessed… |
CVE-2021-20332 | Medium | 4.2 | 2021-08-02 | Specific MongoDB Rust Driver versions can include credentials used by the connection pool to authenticate connections in the monitoring event that is emitted w… |
CVE-2021-36091 | Low | 3.5 | 2021-07-26 | Agents are able to list appointments in the calendars without required permissions. This issue affects: OTRS AG ((OTRS)) Community Edition: 6.0.x version 6.0.1… |
CVE-2021-21443 | Low | 3.5 | 2021-07-26 | Agents are able to list customer user emails without required permissions in the bulk action screen. This issue affects: OTRS AG ((OTRS)) Community Edition: 6… |
CVE-2021-21440 | Medium | 5.2 | 2021-07-26 | Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x… |
CVE-2020-7387 | Medium | 5.3 | 2021-07-22 | Sage X3 Installation Pathname Disclosure. A specially crafted packet can elicit a response from the AdxDSrv.exe component that reveals the installation directo… |
CVE-2021-22001 | High | 7.5 | 2021-07-22 | In UAA versions prior to 75.3.0, sensitive information like relaying secret of the provider was revealed in response when deletion request of an identity provi… |
CVE-2021-22770 | Medium | 6.5 | 2021-07-21 | A CWE-200: Information Exposure vulnerability exists in Easergy T300 with firmware V2.7.1 and older that exposes sensitive information to an actor not explicit… |
CVE-2021-22728 | Medium | 6.5 | 2021-07-21 | A CWE-200: Information Exposure vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV… |
CVE-2021-22721 | Medium | 5.3 | 2021-07-21 | A CWE-200: Information Exposure vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV… |
CVE-2021-22145 | Medium | 6.5 | 2021-07-21 | A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elas… |
CVE-2021-21817 | High | 7.5 | 2021-07-16 | An information disclosure vulnerability exists in the Zebra IP Routing Manager functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request ca… |
CVE-2021-21816 | Medium | 4.3 | 2021-07-16 | An information disclosure vulnerability exists in the Syslog functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lead to the disc… |
CVE-2021-0291 | Medium | 6.5 | 2021-07-15 | An Exposure of System Data vulnerability in Juniper Networks Junos OS and Junos OS Evolved, where a sensitive system-level resource is not being sufficiently p… |
CVE-2021-32770 | High | 7.5 | 2021-07-15 | Gatsby is a framework for building websites. The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP Basic Authentication var… |
CVE-2021-20498 | Medium | 5.3 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 reveals version information in HTTP requests that could be used in further attacks against the system. IBM X-Force ID… |