CWE-200 · Information Disclosure (page 42)
Page 42 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-34429 | Medium | 5.3 | 2021-07-15 | For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF… |
CVE-2021-32750 | Medium | 6.8 | 2021-07-15 | MuWire is a file publishing and networking tool that protects the identity of its users by using I2P technology. Users of MuWire desktop client prior to versio… |
CVE-2021-21587 | Medium | 5.3 | 2021-07-15 | Dell Wyse Management Suite versions 3.2 and earlier contain a full path disclosure vulnerability. A local unauthenticated attacker could exploit this vulnerabi… |
CVE-2021-35527 | High | 7.5 | 2021-07-14 | Password autocomplete vulnerability in the web application password field of Hitachi ABB Power Grids eSOMS allows attacker to gain access to user credentials t… |
CVE-2021-0602 | High | 7.8 | 2021-07-14 | In onCreateOptionsMenu of WifiNetworkDetailsFragment.java, there is a possible way for guest users to view and modify Wi-Fi settings for all configured APs due… |
CVE-2021-33687 | Medium | 4.9 | 2021-07-14 | SAP NetWeaver AS JAVA (Enterprise Portal), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50 reveals sensitive information in one of their HTTP requests, an attack… |
CVE-2021-33709 | Medium | 4.3 | 2021-07-13 | A vulnerability has been identified in Teamcenter Active Workspace V4 (All versions < V4.3.9), Teamcenter Active Workspace V5.0 (All versions < V5.0.7), Teamce… |
CVE-2021-32747 | Medium | 5.3 | 2021-07-12 | Icinga Web 2 is an open source monitoring web interface, framework, and command-line interface. A vulnerability in which custom variables are exposed to unauth… |
CVE-2021-32707 | Medium | 4.3 | 2021-07-12 | Nextcloud Mail is a mail app for Nextcloud. In versions prior to 1.9.6, the Nextcloud Mail application does not, by default, render images in emails to not lea… |
CVE-2021-32689 | High | 8.1 | 2021-07-12 | Nextcloud Talk is a fully on-premises audio/video and chat communication service. In versions prior to 11.2.2, if a user was able to reuse an earlier used user… |
CVE-2021-21591 | Medium | 6.4 | 2021-07-12 | Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.1.0.0.5.394 contain a plain-text password storage vulnerability. A local malicious user with high pr… |
CVE-2021-21590 | Medium | 6.4 | 2021-07-12 | Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.1.0.0.5.394 contain a plain-text password storage vulnerability. A local malicious user with high pr… |
CVE-2021-22917 | Medium | 6.5 | 2021-07-12 | Brave Browser Desktop between versions 1.17 and 1.20 is vulnerable to information disclosure by way of DNS requests in Tor windows not flowing through Tor if a… |
CVE-2021-22916 | Medium | 5.9 | 2021-07-12 | In Brave Desktop between versions 1.17 and 1.26.60, when adblocking is enabled and a proxy browser extension is installed, the CNAME adblocking feature issues… |
CVE-2021-1562 | Medium | 4.3 | 2021-07-08 | A vulnerability in the XSI-Actions interface of Cisco BroadWorks Application Server could allow an authenticated, remote attacker to access sensitive informati… |
CVE-2021-25432 | Low | 3.3 | 2021-07-08 | Information exposure vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O(8.1) and below, and 3.9.10.11 in Android P(9.0) and above allows… |
CVE-2021-25426 | High | 7.5 | 2021-07-08 | Improper component protection vulnerability in SmsViewerActivity of Samsung Message prior to SMR July-2021 Release 1 allows untrusted applications to access Me… |
CVE-2021-32528 | Medium | 5.3 | 2021-07-07 | Observable behavioral discrepancy vulnerability in QSAN Storage Manager allows remote attackers to obtain the system information without permissions. Suggest c… |
CVE-2021-32731 | Medium | 5.3 | 2021-07-01 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Between (and including) versions 13.1RC1 and 13.1, the… |
CVE-2021-32720 | Medium | 5.3 | 2021-06-28 | Sylius is an Open Source eCommerce platform on top of Symfony. In versions of Sylius prior to 1.9.5 and 1.10.0-RC.1, part of the details (order ID, order numbe… |
CVE-2021-32717 | High | 7.5 | 2021-06-24 | Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 private files publicly accessible with Cloud Storage providers when the hashed URL… |
CVE-2021-32716 | Medium | 4.4 | 2021-06-24 | Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 the admin api has exposed some internal hidden fields when an association has been… |
CVE-2021-32712 | Medium | 5.3 | 2021-06-24 | Shopware is an open source eCommerce platform. Versions prior to 5.6.10 are vulnerable to system information leakage in error handling. Users are recommend to… |
CVE-2021-32711 | Critical | 9.1 | 2021-06-24 | Shopware is an open source eCommerce platform. Versions prior to 6.3.5.1 may leak of information via Store-API. The vulnerability could only be fixed by changi… |
CVE-2021-25652 | Medium | 4.9 | 2021-06-24 | An information disclosure vulnerability was discovered in the directory and file management of Avaya Aura Appliance Virtualization Platform Utilities (AVPU). T… |
CVE-2021-25649 | Medium | 4.9 | 2021-06-24 | An information disclosure vulnerability was discovered in the directory and file management of Avaya Aura Utility Services. This vulnerability may potentially… |
CVE-2021-20019 | High | 7.5 | 2021-06-23 | A vulnerability in SonicOS where the HTTP server response leaks partial memory by sending a crafted HTTP request, this can potentially lead to an internal sens… |
CVE-2021-29086 | Medium | 5.3 | 2021-06-23 | Exposure of sensitive information to an unauthorized actor vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows… |
CVE-2010-1432 | High | 7.5 | 2021-06-21 | Joomla! Core is prone to an information disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may help in launching f… |
CVE-2021-32695 | Low | 3.9 | 2021-06-17 | Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.16.1, a malicious app on the same device could have gotten access to the shar… |
CVE-2021-32690 | Medium | 6.8 | 2021-06-16 | Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources). In versions of helm prior to 3.6.1, a vulnerability exists where the user… |
CVE-2020-12987 | Medium | 5.5 | 2021-06-11 | A heap information leak/kernel pool address disclosure vulnerability in the AMD Graphics Driver for Windows 10 may lead to KASLR bypass. |
CVE-2021-23204 | High | 8.1 | 2021-06-11 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gallagher Command Centre Server allows OSDP key material to be exposed to Command C… |
CVE-2021-22913 | Medium | 6.5 | 2021-06-11 | Nextcloud Deck before 1.2.7, 1.4.1 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by default instead… |
CVE-2021-22912 | Medium | 6.5 | 2021-06-11 | Nextcloud iOS before 3.4.2 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by default instead of only… |
CVE-2021-22905 | Medium | 6.5 | 2021-06-11 | Nextcloud Android App (com.nextcloud.client) before v3.16.0 is vulnerable to information disclosure due to searches for sharees being performed by default on t… |
CVE-2021-22898 | Low | 3.1 | 2021-06-11 | curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send… |
CVE-2021-22749 | Medium | 5.3 | 2021-06-11 | A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Modicon X80 BMXNOR0200H RTU SV1.70 IR22 and prior that could caus… |
CVE-2021-25403 | Low | 3.3 | 2021-06-11 | Intent redirection vulnerability in Samsung Account prior to version 10.8.0.4 in Android P(9.0) and below, and 12.2.0.9 in Android Q(10.0) and above allows att… |
CVE-2021-25392 | Medium | 4.0 | 2021-06-11 | Improper protection of backup path configuration in Samsung Dex prior to SMR MAY-2021 Release 1 allows local attackers to get sensitive information via changin… |
CVE-2021-28805 | High | 7.8 | 2021-06-11 | Inclusion of sensitive information in the source code has been reported to affect certain QNAP switches running QSS. If exploited, this vulnerability allows at… |
CVE-2021-28169 | Medium | 5.3 | 2021-06-09 | For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected res… |
CVE-2021-32658 | Medium | 4.7 | 2021-06-08 | Nextcloud Android is the Android client for the Nextcloud open source home cloud system. Due to a timeout issue the Android client may not properly clean all s… |
CVE-2021-20259 | High | 7.8 | 2021-06-07 | A flaw was found in the Foreman project. The Proxmox compute resource exposes the password through the API to an authenticated local attacker with view_hosts p… |
CVE-2021-33839 | High | 7.5 | 2021-06-04 | Luca through 1.7.4 on Android allows remote attackers to obtain sensitive information about COVID-19 tracking because the QR code of a Public Location can be i… |
CVE-2017-8761 | Medium | 4.3 | 2021-06-02 | In OpenStack Swift through 2.10.1, 2.11.0 through 2.13.0, and 2.14.0, the proxy-server logs full tempurl paths, potentially leaking reusable tempurl signatures… |
CVE-2020-14371 | Medium | 6.5 | 2021-06-02 | A credential leak vulnerability was found in Red Hat Satellite. This flaw exposes the compute resources credentials through VMs that are running on these resou… |
CVE-2020-14335 | Medium | 5.5 | 2021-06-02 | A flaw was found in Red Hat Satellite, which allows a privileged attacker to read OMAPI secrets through the ISC DHCP of Smart-Proxy. This flaw allows an attack… |
CVE-2021-20585 | Medium | 5.3 | 2021-06-01 | IBM Security Verify Access 20.07 could disclose sensitive information in HTTP server headers that could be used in further attacks against the system. IBM X-Fo… |
CVE-2020-14329 | Low | 3.3 | 2021-05-27 | A data exposure flaw was found in Ansible Tower in versions before 3.7.2, where sensitive data can be exposed from the /api/v2/labels/ endpoint. This flaw allo… |
CVE-2020-10698 | Low | 3.3 | 2021-05-27 | A flaw was found in Ansible Tower when running jobs. This flaw allows an attacker to access the stdout of the executed jobs which are run from other organizati… |
CVE-2021-22892 | High | 7.5 | 2021-05-27 | An information disclosure vulnerability exists in the Rocket.Chat server fixed v3.13, v3.12.2 & v3.11.3 that allowed email addresses to be disclosed by enumera… |
CVE-2021-22740 | Medium | 6.5 | 2021-05-26 | Information Exposure vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause information to be exposed when an unautho… |
CVE-2021-22739 | Medium | 5.9 | 2021-05-26 | Information Exposure vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause a device to be compromised when it is fir… |
CVE-2021-32638 | Medium | 4.4 | 2021-05-25 | Github's CodeQL action is provided to run CodeQL-based code scanning on non-GitHub CI/CD systems and requires a GitHub access token to connect to a GitHub repo… |
CVE-2021-23937 | High | 7.5 | 2021-05-25 | A DNS proxy and possible amplification attack vulnerability in WebClientInfo of Apache Wicket allows an attacker to trigger arbitrary DNS lookups from the serv… |
CVE-2021-32624 | High | 7.5 | 2021-05-24 | Keystone 5 is an open source CMS platform to build Node.js applications. This security advisory relates to a newly discovered capability in our query infrastru… |
CVE-2021-27434 | High | 7.5 | 2021-05-20 | Products with Unified Automation .NET based OPC UA Client/Server SDK Bundle: Versions V3.0.7 and prior (.NET 4.5, 4.0, and 3.5 Framework versions only) are vul… |
CVE-2021-3426 | Medium | 5.7 | 2021-05-20 | There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server co… |
CVE-2021-21733 | Medium | 4.9 | 2021-05-19 | The management system of ZXCDN is impacted by the information leak vulnerability. Attackers can make further analysis according to the information returned by… |
CVE-2021-32820 | High | 8.6 | 2021-05-14 | Express-handlebars is a Handlebars view engine for Express. Express-handlebars mixes pure template data with engine configuration options through the Express r… |
CVE-2021-32819 | High | 8.0 | 2021-05-14 | Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configurati… |
CVE-2021-32817 | Medium | 5.4 | 2021-05-14 | express-hbs is an Express handlebars template engine. express-hbs mixes pure template data with engine configuration options through the Express render API. Mo… |
CVE-2021-22137 | Medium | 5.3 | 2021-05-13 | In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Security is used. Search queries do not pr… |
CVE-2021-22135 | Medium | 5.3 | 2021-05-13 | Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile API when Document and F… |
CVE-2021-21424 | Medium | 5.3 | 2021-05-13 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant… |
CVE-2021-20993 | Medium | 5.3 | 2021-05-13 | In multiple managed switches by WAGO in different versions the activated directory listing provides an attacker with the index of the resources located inside… |
CVE-2021-20250 | Medium | 4.3 | 2021-05-13 | A flaw was found in wildfly. The JBoss EJB client has publicly accessible privileged actions which may lead to information disclosure on the server it is deplo… |
CVE-2021-20331 | Medium | 4.2 | 2021-05-13 | Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an applica… |
CVE-2021-20313 | High | 7.5 | 2021-05-11 | A flaw was found in ImageMagick in versions before 7.0.11. A potential cipher leak when the calculate signatures in TransformSignature is possible. The highest… |
CVE-2021-31173 | Medium | 5.3 | 2021-05-11 | Microsoft SharePoint Server Information Disclosure Vulnerability |
CVE-2021-31918 | High | 7.5 | 2021-05-06 | A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log file is readable to all users during stack update and creatio… |
CVE-2021-21537 | Medium | 6.2 | 2021-04-30 | Dell Hybrid Client versions prior to 1.5 contain an information exposure vulnerability. A local unauthenticated attacker may exploit this vulnerability in orde… |
CVE-2021-21536 | Medium | 6.2 | 2021-04-30 | Dell Hybrid Client versions prior to 1.5 contain an information exposure vulnerability. A local unauthenticated attacker may exploit this vulnerability in orde… |
CVE-2021-21534 | Medium | 4.0 | 2021-04-30 | Dell Hybrid Client versions prior to 1.5 contain an information exposure vulnerability. A local unauthenticated attacker may exploit this vulnerability in orde… |
CVE-2021-20228 | High | 7.5 | 2021-04-29 | A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature when using the sub-opti… |
CVE-2021-29483 | Critical | 9.4 | 2021-04-28 | ManageWiki is an extension to the MediaWiki project. The 'wikiconfig' API leaked the value of private configuration variables set through the ManageWiki variab… |
CVE-2021-30169 | Medium | 5.3 | 2021-04-28 | The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant user’s credential. |
CVE-2021-30168 | Critical | 9.8 | 2021-04-28 | The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant administrator’s credential and further control… |
CVE-2021-30638 | High | 7.5 | 2021-04-27 | Information Exposure vulnerability in context asset handling of Apache Tapestry allows an attacker to download files inside WEB-INF if using a specially-constr… |
CVE-2020-36319 | Low | 3.1 | 2021-04-23 | Insecure configuration of default ObjectMapper in com.vaadin:flow-server versions 3.0.0 through 3.0.5 (Vaadin 15.0.0 through 15.0.4) may expose sensitive data… |
CVE-2021-31549 | Medium | 4.3 | 2021-04-22 | An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. The Special:AbuseFilter/examine form allowed for the disclosure of suppresse… |
CVE-2021-31547 | Medium | 4.3 | 2021-04-22 | An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. Its AbuseFilterCheckMatch API reveals suppressed edits and usernames to unpr… |
CVE-2021-31545 | Medium | 5.3 | 2021-04-22 | An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. The page_recent_contributors leaked the existence of certain deleted MediaWi… |
CVE-2021-29450 | Medium | 6.5 | 2021-04-15 | Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. This requ… |
CVE-2021-27850 | Critical | 9.8 | 2021-04-15 | A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5… |
CVE-2020-7270 | Medium | 4.9 | 2021-04-15 | Exposure of Sensitive Information in the web interface in McAfee Advanced Threat Defense (ATD) prior to 4.12.2 allows remote authenticated users to view sensit… |
CVE-2020-7269 | Medium | 4.9 | 2021-04-15 | Exposure of Sensitive Information in the web interface in McAfee Advanced Threat Defense (ATD) prior to 4.12.2 allows remote authenticated users to view sensit… |
CVE-2021-24227 | High | 7.5 | 2021-04-12 | The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the… |
CVE-2021-24226 | High | 7.5 | 2021-04-12 | In the AccessAlly WordPress plugin before 3.5.7, the file "resource/frontend/product/product-shortcode.php" responsible for the [accessally_order_form] shortco… |
CVE-2021-25376 | Low | 3.1 | 2021-04-09 | An improper synchronization logic in Samsung Email prior to version 6.1.41.0 can leak messages in certain mailbox in plain text when STARTTLS negotiation is fa… |
CVE-2021-25375 | Medium | 6.5 | 2021-04-09 | Using predictable index for attachments in Samsung Email prior to version 6.1.41.0 allows remote attackers to get attachments of another emails when users open… |
CVE-2021-25364 | Medium | 4.0 | 2021-04-09 | A pendingIntent hijacking vulnerability in Secure Folder prior to SMR APR-2021 Release 1 allows unprivileged applications to access contact information. |
CVE-2021-25357 | Medium | 5.6 | 2021-04-09 | A pendingIntent hijacking vulnerability in Create Movie prior to SMR APR-2021 Release 1 in Android O(8.x) and P(9.0), 3.4.81.1 in Android Q(10,0), and 3.6.80.7… |
CVE-2021-30156 | Medium | 4.3 | 2021-04-09 | An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Special:Contributions can leak that a "hidden" user exists. |
CVE-2021-3413 | Medium | 6.3 | 2021-04-08 | A flaw was found in Red Hat Satellite in tfm-rubygem-foreman_azure_rm in versions before 2.2.0. A credential leak was identified which will expose Azure Resour… |
CVE-2021-1406 | Medium | 4.9 | 2021-04-08 | A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could… |
CVE-2021-24170 | High | 7.5 | 2021-04-05 | The REST API endpoint get_users in the User Profile Picture WordPress plugin before 2.5.0 returned more information than was required for its functionality to… |
CVE-2021-24167 | High | 7.5 | 2021-04-05 | When visiting a site running Web-Stat < 1.4.0, the "wts_web_stat_load_init" function used the visitor’s browser to send an XMLHttpRequest request to https://wt… |
CVE-2021-24164 | Medium | 4.3 | 2021-04-05 | In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and… |