CWE-200 · Information Disclosure (page 42)
Page 42 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-47411 | Critical | 9.1 | 2022-12-14 | An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3… |
CVE-2022-47410 | Critical | 9.1 | 2022-12-14 | An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3… |
CVE-2022-23504 | Medium | 5.7 | 2022-12-14 | TYPO3 is an open source PHP based web content management system. Versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are subject to Sensitive Information Di… |
CVE-2022-46355 | High | 7.5 | 2022-12-13 | A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (HS… |
CVE-2022-20497 | Medium | 4.6 | 2022-12-13 | In updatePublicMode of NotificationLockscreenUserManagerImpl.java, there is a possible way to reveal sensitive notifications on the lockscreen due to an incorr… |
CVE-2022-37930 | Medium | 6.7 | 2022-12-12 | A security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays and HPE Nimble Storage Secondary Flash Arrays which could potentially al… |
CVE-2022-37909 | Medium | 5.3 | 2022-12-12 | Aruba has identified certain configurations of ArubaOS that can lead to sensitive information disclosure from the configured ESSIDs. The scenarios in which dis… |
CVE-2022-23497 | Medium | 6.5 | 2022-12-09 | FreshRSS is a free, self-hostable RSS aggregator. User configuration files can be accessed by a remote user. In addition to user preferences, such configuratio… |
CVE-2022-46158 | Medium | 5.3 | 2022-12-08 | PrestaShop is an open-source e-commerce solution. Versions prior to 1.7.8.8 did not properly restrict host filesystem access for users. Users may have been abl… |
CVE-2022-23469 | Low | 3.5 | 2022-12-08 | Traefik is an open source HTTP reverse proxy and load balancer. Versions prior to 2.9.6 are subject to a potential vulnerability in Traefik displaying the Auth… |
CVE-2022-46825 | Medium | 4.0 | 2022-12-08 | In JetBrains IntelliJ IDEA before 2022.3 the built-in web server leaked information about open projects. |
CVE-2022-39914 | Medium | 4.0 | 2022-12-08 | Exposure of Sensitive Information from an Unauthorized Actor vulnerability in Samsung DisplayManagerService prior to Android T(13) allows local attacker to acc… |
CVE-2022-39913 | Medium | 6.8 | 2022-12-08 | Exposure of Sensitive Information to an Unauthorized Actor in Persona Manager prior to Android T(13) allows local attacker to access user profiles information. |
CVE-2022-39904 | Low | 3.3 | 2022-12-08 | Exposure of Sensitive Information vulnerability in Samsung Settings prior to SMR Dec-2022 Release 1 allows local attackers to access the Network Access Identif… |
CVE-2022-39903 | Medium | 4.0 | 2022-12-08 | Improper access control vulnerability in RCS call prior to SMR Dec-2022 Release 1 allows local attackers to access RCS incoming call number. |
CVE-2022-39897 | Medium | 4.4 | 2022-12-08 | Exposure of Sensitive Information vulnerability in kernel prior to SMR Dec-2022 Release 1 allows attackers to access the kernel address information via log. |
CVE-2022-42782 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing permission check, This could lead to local information disclosure. |
CVE-2022-42766 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing permission check, This could lead to local information disclosure. |
CVE-2022-32221 | Critical | 9.8 | 2022-12-05 | When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIEL… |
CVE-2022-2827 | High | 7.5 | 2022-12-05 | AMI MegaRAC User Enumeration Vulnerability |
CVE-2022-41971 | Medium | 4.8 | 2022-12-01 | Nextcould Talk android is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.8, 13.0.10, 14.0.6, and 15.0.0, guests can continue to recei… |
CVE-2022-43901 | Medium | 5.7 | 2022-12-01 | IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps 1.4.3 could disclose sensitive information. An authenticated local attacker could exploit this vul… |
CVE-2022-28607 | High | 7.5 | 2022-12-01 | An issue was discovered in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to gain sensitive information via the ac… |
CVE-2022-1911 | Medium | 5.3 | 2022-11-30 | Error in parser function in M-Files Server versions before 22.6.11534.1 and before 22.6.11505.0 allowed unauthenticated access to some information of the under… |
CVE-2022-4228 | Medium | 5.3 | 2022-11-30 | A vulnerability classified as problematic has been found in SourceCodester Book Store Management System 1.0. This affects an unknown part of the file /bsms_ci/… |
CVE-2022-46150 | Medium | 4.3 | 2022-11-29 | Discourse is an open-source discussion platform. Prior to version 2.8.13 of the `stable` branch and version 2.9.0.beta14 of the `beta` and `tests-passed` branc… |
CVE-2022-41944 | Low | 3.5 | 2022-11-28 | Discourse is an open-source discussion platform. In stable versions prior to 2.8.12 and beta or tests-passed versions prior to 2.9.0.beta.13, under certain con… |
CVE-2022-41954 | Low | 3.3 | 2022-11-25 | MPXJ is an open source library to read and write project plans from a variety of file formats and databases. On Unix-like operating systems (not Windows or mac… |
CVE-2022-41926 | Low | 3.3 | 2022-11-25 | Nextcould talk android is the android OS implementation of the nextcloud talk chat system. In affected versions the receiver is not protected by broadcastPermi… |
CVE-2022-26885 | High | 7.5 | 2022-11-24 | When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher. |
CVE-2022-41946 | Medium | 4.7 | 2022-11-23 | pgjdbc is an open source postgresql JDBC Driver. In affected versions a prepared statement using either `PreparedStatement.setText(int, InputStream)` or `Prepa… |
CVE-2022-41935 | Medium | 5.3 | 2022-11-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users without the right to view documents can deduce t… |
CVE-2022-38113 | Medium | 5.3 | 2022-11-23 | This vulnerability discloses build and services versions in the server response header. |
CVE-2022-39397 | Medium | 5.6 | 2022-11-22 | aliyun-oss-client is a rust client for Alibaba Cloud OSS. Users of this library will be affected, the incoming secret will be disclosed unintentionally. This i… |
CVE-2022-41939 | Medium | 6.1 | 2022-11-19 | knative.dev/func is is a client library and CLI enabling the development and deployment of Kubernetes functions. Developers using a malicious or compromised th… |
CVE-2022-42883 | Medium | 5.3 | 2022-11-18 | Sensitive Information Disclosure vulnerability discovered by Quiz And Survey Master plugin <= 7.3.10 on WordPress. |
CVE-2022-41655 | Medium | 4.3 | 2022-11-18 | Auth. (subscriber+) Sensitive Data Exposure vulnerability in Phone Orders for WooCommerce plugin <= 3.7.1 on WordPress. |
CVE-2022-41618 | Low | 3.7 | 2022-11-18 | Unauthenticated Error Log Disclosure vulnerability in Media Library Assistant plugin <= 3.00 on WordPress. |
CVE-2022-41914 | Low | 3.7 | 2022-11-16 | Zulip is an open-source team collaboration tool. For organizations with System for Cross-domain Identity Management(SCIM) account management enabled, Zulip Ser… |
CVE-2022-41917 | Medium | 4.3 | 2022-11-16 | OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. OpenSearch allows users to specify a local file when defining text analyzers to… |
CVE-2022-42132 | Medium | 5.9 | 2022-11-15 | The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix… |
CVE-2022-41913 | Medium | 4.3 | 2022-11-14 | Discourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic. Members o… |
CVE-2022-39385 | Medium | 6.5 | 2022-11-14 | Discourse is the an open source discussion platform. In some rare cases users redeeming an invitation can be added as a participant to several private message… |
CVE-2022-28764 | Low | 3.3 | 2022-11-14 | The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.12.6 is susceptible to a local information exposure vulnerability… |
CVE-2022-34314 | Medium | 4.0 | 2022-11-14 | IBM CICS TX 11.1 could disclose sensitive information to a local user due to insecure permission settings. IBM X-Force ID: 229450. |
CVE-2022-34329 | Medium | 5.3 | 2022-11-14 | IBM CICS TX 11.7 could allow an attacker to obtain sensitive information from HTTP response headers. IBM X-Force ID: 229467. |
CVE-2022-34313 | Medium | 4.3 | 2022-11-14 | IBM CICS TX 11.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a htt… |
CVE-2022-34312 | Medium | 4.0 | 2022-11-14 | IBM CICS TX 11.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 229447. |
CVE-2022-27949 | High | 7.5 | 2022-11-14 | A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed (for example… |
CVE-2022-41876 | High | 7.5 | 2022-11-10 | ezplatform-graphql is a GraphQL server implementation for Ibexa DXP and Ibexa Open Source. Versions prior to 2.3.12 and 1.0.13 are subject to Insecure Storage… |
CVE-2022-39307 | Medium | 6.7 | 2022-11-09 | Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the `/api/user… |
CVE-2022-36077 | High | 7.2 | 2022-11-08 | The Electron framework enables writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions prior to 21.0.0-beta.1, 20.0.1, 19.0.11… |
CVE-2022-44746 | Medium | 5.5 | 2022-11-07 | Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before bu… |
CVE-2022-38654 | Medium | 5.5 | 2022-11-04 | HCL Domino is susceptible to an information disclosure vulnerability. In some scenarios, local calls made on the server to search the Domino directory will ig… |
CVE-2022-42442 | Low | 3.3 | 2022-11-03 | IBM Robotic Process Automation for Cloud Pak 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to exposure of the first tenant owner e-mail address to… |
CVE-2022-39378 | Medium | 5.3 | 2022-11-02 | Discourse is a platform for community discussion. Under certain conditions, a user badge may have been awarded based on a user's activity in a topic with restr… |
CVE-2022-35842 | Low | 3.7 | 2022-11-02 | An exposure of sensitive information to an unauthorized actor vulnerabiltiy [CWE-200] in FortiOS SSL-VPN versions 7.2.0, versions 7.0.0 through 7.0.6 and versi… |
CVE-2022-33878 | Low | 2.2 | 2022-11-02 | An exposure of sensitive information to an unauthorized actor vulnerabiltiy [CWE-200] in FortiClient for Mac versions 7.0.0 through 7.0.5 may allow a local aut… |
CVE-2022-42819 | Medium | 5.5 | 2022-11-01 | An access issue was addressed with improved access restrictions. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, macOS Monterey 12.6. An app may b… |
CVE-2022-42818 | Medium | 5.9 | 2022-11-01 | This issue was addressed with improved data protection. This issue is fixed in macOS Ventura 13. A user in a privileged network position may be able to track u… |
CVE-2022-42817 | Medium | 6.5 | 2022-11-01 | A logic issue was addressed with improved state management. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, iOS 16.1 and iPadOS 16, watchOS 9.1. Visiting… |
CVE-2022-42815 | Medium | 5.5 | 2022-11-01 | This issue was addressed with improved data protection. This issue is fixed in macOS Ventura 13. An app may be able to access user-sensitive data. |
CVE-2022-42810 | Medium | 5.5 | 2022-11-01 | The issue was addressed with improved memory handling. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, tvOS 16.1, iOS 16.1 and iPadOS 16, macOS Ventura 13… |
CVE-2022-32913 | Low | 3.3 | 2022-11-01 | The issue was addressed with additional restrictions on the observability of app states. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, iOS 16, w… |
CVE-2022-32877 | Medium | 5.5 | 2022-11-01 | A configuration issue was addressed with additional restrictions. This issue is fixed in macOS Big Sur 11.7, macOS Monterey 12.6. An app may be able to access… |
CVE-2022-32875 | Medium | 5.0 | 2022-11-01 | A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, iOS 16, watchOS 9, macOS Monterey 12.6… |
CVE-2022-32870 | Low | 2.4 | 2022-11-01 | A logic issue was addressed with improved state management. This issue is fixed in iOS 16, macOS Ventura 13, watchOS 9. A user with physical access to a device… |
CVE-2022-32862 | Medium | 5.5 | 2022-11-01 | This issue was addressed with improved data protection. This issue is fixed in macOS Big Sur 11.7.1, macOS Ventura 13, macOS Monterey 12.6.1. An app with root… |
CVE-2022-32858 | Medium | 5.5 | 2022-11-01 | The issue was addressed with improved memory handling. This issue is fixed in iOS 16, macOS Ventura 13, watchOS 9. An app may be able to leak sensitive kernel… |
CVE-2022-32835 | Low | 3.3 | 2022-11-01 | This issue was addressed with improved entitlements. This issue is fixed in iOS 16, watchOS 9. An app may be able to read a persistent device identifier. |
CVE-2022-23738 | Medium | 5.7 | 2022-11-01 | An improper cache key vulnerability was identified in GitHub Enterprise Server that allowed an unauthorized actor to access private repository files through a… |
CVE-2022-39018 | High | 8.2 | 2022-10-31 | Broken access controls on PDFtron data in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to access restricted PDF files via a known URL. |
CVE-2022-24670 | High | 7.1 | 2022-10-27 | An attacker can use the unrestricted LDAP queries to determine configuration entries |
CVE-2021-45475 | Medium | 5.3 | 2022-10-27 | Yordam Library Information Document Automation product before version 19.02 has an unauthenticated Information disclosure vulnerability. |
CVE-2022-39359 | Medium | 6.5 | 2022-10-26 | Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, custom GeoJSON map URL address w… |
CVE-2022-39358 | Medium | 6.5 | 2022-10-26 | Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6, it was possible to circumvent locked parameters… |
CVE-2022-20955 | Medium | 5.5 | 2022-10-26 | Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal… |
CVE-2022-20954 | Medium | 5.5 | 2022-10-26 | Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal… |
CVE-2022-20953 | Medium | 5.5 | 2022-10-26 | Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal… |
CVE-2022-20811 | Medium | 5.5 | 2022-10-26 | Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal… |
CVE-2022-20776 | Medium | 5.5 | 2022-10-26 | Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal… |
CVE-2022-33181 | Medium | 5.5 | 2022-10-25 | An information disclosure vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5, 7.4.2.j could allow a local authen… |
CVE-2022-27912 | Medium | 5.3 | 2022-10-25 | An issue was discovered in Joomla! 4.0.0 through 4.2.3. Sites with publicly enabled debug mode exposed data of previous requests. |
CVE-2022-26423 | High | 8.2 | 2022-10-21 | Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials. |
CVE-2022-1070 | High | 8.2 | 2022-10-21 | Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials. |
CVE-2022-41707 | Medium | 6.5 | 2022-10-19 | Relatedcode's Messenger version 7bcd20b allows an authenticated external attacker to access sensitive data of any user of the application. This is possible bec… |
CVE-2022-43410 | Medium | 5.3 | 2022-10-19 | Jenkins Mercurial Plugin 1251.va_b_121f184902 and earlier provides information about which jobs were triggered or scheduled for polling through its webhook end… |
CVE-2022-39253 | Medium | 5.5 | 2022-10-19 | Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are… |
CVE-2020-8975 | High | 7.5 | 2022-10-17 | ZGR TPS200 NG in its 2.00 firmware version and 1.01 hardware version, allows a remote attacker with access to the web application and knowledge of the routes (… |
CVE-2022-3501 | Low | 3.5 | 2022-10-17 | Article template contents with sensitive data could be accessed from agents without permissions. |
CVE-2022-39309 | Medium | 4.9 | 2022-10-14 | GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD version… |
CVE-2022-38689 | Medium | 5.5 | 2022-10-14 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2022-38688 | Medium | 5.5 | 2022-10-14 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2022-39201 | Medium | 6.8 | 2022-10-13 | Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and 9.1.8, Grafana coul… |
CVE-2022-31130 | Medium | 4.9 | 2022-10-13 | Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication… |
CVE-2022-33919 | High | 7.8 | 2022-10-12 | Dell GeoDrive, versions 2.1 - 2.2, contains an information disclosure vulnerability in GUI. An authenticated non-admin user could potentially exploit this vuln… |
CVE-2022-39013 | High | 7.6 | 2022-10-11 | Under certain conditions an authenticated attacker can get access to OS credentials. Getting access to OS credentials enables the attacker to modify system dat… |
CVE-2022-35296 | Medium | 4.9 | 2022-10-11 | Under certain conditions, the application SAP BusinessObjects Business Intelligence Platform (Version Management System) exposes sensitive information to an ac… |
CVE-2022-40177 | Medium | 5.7 | 2022-10-11 | A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All… |
CVE-2022-39289 | Critical | 9.1 | 2022-10-07 | ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the ZoneMinder API Exposes Database Log contents to user… |