CWE-200 · Information Disclosure (page 43)
Page 43 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-39859 | Medium | 4.0 | 2022-10-07 | Implicit intent hijacking vulnerability in UPHelper library prior to version 3.0.12 allows attackers to access sensitive information via implicit intent. |
CVE-2022-39856 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in imsservice application prior to SMR Oct-2022 Release 1 allows local attackers to access call information. |
CVE-2022-39848 | Medium | 4.0 | 2022-10-07 | Exposure of sensitive information in AT_Distributor prior to SMR Oct-2022 Release 1 allows local attacker to access SerialNo via log. |
CVE-2022-39222 | Critical | 9.3 | 2022-10-06 | Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex instances with public clients (and by extension, clients accept… |
CVE-2022-32540 | Medium | 5.9 | 2022-09-30 | Information Disclosure in Operator Client application in BVMS 10.1.1, 11.0 and 11.1.0 and VIDEOJET Decoder VJD-7513 versions 10.23 and 10.30 allows man-in-the-… |
CVE-2022-23726 | Medium | 5.4 | 2022-09-30 | PingCentral versions prior to listed versions expose Spring Boot actuator endpoints that with administrative authentication return large amounts of sensitive e… |
CVE-2022-3348 | Medium | 4.9 | 2022-09-28 | Just like in the previous report, an attacker could steal the account of different users. But in this case, it's a little bit more specific, because it is need… |
CVE-2022-39031 | Medium | 5.3 | 2022-09-28 | Smart eVision has insufficient authorization for task acquisition function. An unauthorized remote attacker can exploit this vulnerability to acquire the Sessi… |
CVE-2022-39030 | High | 7.5 | 2022-09-28 | smart eVision has inadequate authorization for system information query function. An unauthenticated remote attacker, who is not explicitly authorized to acces… |
CVE-2022-39029 | Medium | 6.5 | 2022-09-28 | Smart eVision has inadequate authorization for the database query function. A remote attacker with general user privilege, who is not explicitly authorized to… |
CVE-2022-39258 | High | 8.1 | 2022-09-27 | mailcow is a mailserver suite. A vulnerability innversions prior to 2022-09 allows an attacker to craft a custom Swagger API template to spoof Authorize links… |
CVE-2022-35249 | Medium | 4.3 | 2022-09-23 | A information disclosure vulnerability exists in Rocket.Chat <v5 where the getUserMentionsByChannel meteor server method discloses messages from private channe… |
CVE-2022-35247 | Medium | 4.3 | 2022-09-23 | A information disclosure vulnerability exists in Rocket.chat <v5, <v4.8.2 and <v4.7.5 where the lack of ACL checks in the getRoomRoles Meteor method leak chann… |
CVE-2022-35246 | Medium | 4.3 | 2022-09-23 | A NoSQL-Injection information disclosure vulnerability vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 in the getS3FileUrl Meteor server method th… |
CVE-2022-32849 | Medium | 5.5 | 2022-09-23 | An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, tvOS 15.6… |
CVE-2022-32825 | Medium | 5.5 | 2022-09-23 | The issue was addressed with improved memory handling. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, watchOS 8.7, tvOS 15.6, macOS Mon… |
CVE-2022-32818 | Medium | 5.5 | 2022-09-23 | The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.5. An app may be able to leak sensitive kernel state. |
CVE-2022-32805 | Medium | 5.5 | 2022-09-23 | The issue was addressed with improved handling of caches. This issue is fixed in Security Update 2022-005 Catalina, macOS Big Sur 11.6.8, macOS Monterey 12.5… |
CVE-2022-32229 | Medium | 4.3 | 2022-09-23 | A information disclosure vulnerability exists in Rockert.Chat <v5 due to /api/v1/chat.getThreadsList lack of sanitization of user inputs and can therefore leak… |
CVE-2022-32228 | Medium | 4.3 | 2022-09-23 | An information disclosure vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 since the getReadReceipts Meteor server method does not properly filter… |
CVE-2022-32220 | Medium | 6.5 | 2022-09-23 | An information disclosure vulnerability exists in Rocket.Chat <v5 due to the getUserMentionsByChannel meteor server method discloses messages from private chan… |
CVE-2022-32219 | Medium | 4.3 | 2022-09-23 | An information disclosure vulnerability exists in Rocket.Chat <v4.7.5 which allowed the "users.list" REST endpoint gets a query parameter from JSON and runs Us… |
CVE-2022-32218 | Medium | 4.3 | 2022-09-23 | An information disclosure vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 due to the actionLinkHandler method was found to allow Message ID Enumer… |
CVE-2022-40629 | High | 7.5 | 2022-09-23 | This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (inclusive), due to in… |
CVE-2022-40194 | Medium | 5.3 | 2022-09-23 | Unauthenticated Sensitive Information Disclosure vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress |
CVE-2022-39230 | Medium | 6.5 | 2022-09-23 | fhir-works-on-aws-authz-smart is an implementation of the authorization interface from the FHIR Works interface. Versions 3.1.1 and 3.1.2 are subject to Exposu… |
CVE-2021-39190 | Medium | 5.3 | 2022-09-22 | The SCCM plugin for GLPI is a plugin to synchronize computers from SCCM (version 1802) to GLPI. In versions prior to 2.3.0, the Configuration page is publicly… |
CVE-2022-23952 | High | 7.5 | 2022-09-21 | In Keylime before 6.3.0, current keylime installer installs the keylime.conf file, which can contain sensitive data, as world-readable. |
CVE-2022-23948 | High | 7.5 | 2022-09-21 | A flaw was found in Keylime before 6.3.0. The logic in the Keylime agent for checking for a secure mount can be fooled by previously created unprivileged mount… |
CVE-2019-5641 | Low | 3.3 | 2022-09-21 | Rapid7 InsightVM suffers from an information exposure issue whereby, when the user's session has ended due to inactivity, an attacker can use the Inspect Eleme… |
CVE-2022-28638 | High | 7.8 | 2022-09-20 | An isolated local disclosure of information and potential isolated local arbitrary code execution vulnerability that could potentially lead to a loss of confid… |
CVE-2022-39212 | Medium | 4.3 | 2022-09-17 | Nextcloud Talk is an open source chat, video & audio calls client for the Nextcloud platform. In affected versions an attacker could see the last video frame o… |
CVE-2022-39210 | Low | 3.2 | 2022-09-17 | Nextcloud android is the official Android client for the Nextcloud home server platform. Internal paths to the Nextcloud Android app files are not properly pro… |
CVE-2022-36075 | Low | 2.6 | 2022-09-15 | Nextcloud files access control is a nextcloud app to manage access control for files. Users with limited access can see file names in certain cases where they… |
CVE-2022-36074 | Medium | 6.4 | 2022-09-15 | Nextcloud server is an open source personal cloud product. Affected versions of this package are vulnerable to Information Exposure which fails to strip the Au… |
CVE-2022-31143 | Medium | 5.3 | 2022-09-14 | GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licen… |
CVE-2022-32244 | Medium | 5.2 | 2022-09-13 | Under certain conditions an attacker authenticated as a CMS administrator access the BOE Commentary database and retrieve (non-personal) system data, modify sy… |
CVE-2022-36101 | Medium | 5.4 | 2022-09-12 | Shopware is an open source e-commerce software. In affected versions the request for the customer detail view in the backend administration contained sensitive… |
CVE-2022-31221 | Low | 2.3 | 2022-09-12 | Dell BIOS versions contain an Information Exposure vulnerability. A local authenticated administrator user could potentially exploit this vulnerability in orde… |
CVE-2022-36878 | Low | 3.3 | 2022-09-09 | Exposure of Sensitive Information in Find My Mobile prior to version 7.2.25.14 allows local attacker to access IMEI via log. |
CVE-2022-36877 | Low | 2.8 | 2022-09-09 | Exposure of Sensitive Information in FaqSymptomCardViewModel in Samsung Members prior to versions 4.3.00.11 in Global and 14.0.02.4 in China allows local attac… |
CVE-2022-38400 | Medium | 5.9 | 2022-09-08 | Mailform Pro CGI 4.3.1 and earlier allow a remote unauthenticated attacker to obtain the user input data by having a use of the product to access a specially c… |
CVE-2022-36079 | High | 8.6 | 2022-09-07 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Internal fields (keys used internally by Parse Server… |
CVE-2022-34867 | High | 7.3 | 2022-09-06 | Unauthenticated Sensitive Information Disclosure vulnerability in WP Libre Form 2 plugin <= 2.0.8 at WordPress allows attackers to list and delete submissions… |
CVE-2022-2939 | Medium | 5.3 | 2022-09-06 | The WP Cerber Security plugin for WordPress is vulnerable to security protection bypass in versions up to, and including 9.0, that makes user enumeration possi… |
CVE-2022-2462 | Medium | 5.3 | 2022-09-06 | The Transposh WordPress Translation plugin for WordPress is vulnerable to sensitive information disclosure to unauthenticated users in versions up to, and incl… |
CVE-2022-31176 | High | 8.3 | 2022-09-02 | Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser (Chromium/Chrome). An interna… |
CVE-2022-2806 | Medium | 5.5 | 2022-09-01 | It was found that the ovirt-log-collector/sosreport collects the RHV admin password unfiltered. Fixed in: sos-4.2-20.el8_6, ovirt-log-collector-4.4.7-2.el8ev |
CVE-2022-2739 | Medium | 5.3 | 2022-09-01 | The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included an incorrect version of podman missing the fix for… |
CVE-2022-1663 | Medium | 6.5 | 2022-08-29 | The Stop Spam Comments WordPress plugin through 0.2.1.2 does not properly generate the Javascript access token for preventing abuse of comment section, allowin… |
CVE-2022-0851 | Medium | 5.5 | 2022-08-29 | There is a flaw in convert2rhel. When the --activationkey option is used with convert2rhel, the activation key is subsequently passed to subscription-manager v… |
CVE-2022-0850 | High | 7.1 | 2022-08-29 | A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to userspace. |
CVE-2022-0812 | Medium | 4.3 | 2022-08-29 | An information leak flaw was found in NFS over RDMA in the net/sunrpc/xprtrdma/rpc_rdma.c in the Linux Kernel. This flaw allows an attacker with normal user pr… |
CVE-2021-3688 | Medium | 4.8 | 2022-08-26 | A flaw was found in Red Hat JBoss Core Services HTTP Server in all versions, where it does not properly normalize the path component of a request URL contains… |
CVE-2021-3644 | Low | 3.3 | 2022-08-26 | A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressions, a user who was… |
CVE-2021-3585 | Medium | 5.5 | 2022-08-26 | A flaw was found in openstack-tripleo-heat-templates. Plain passwords from RHSM exist in the logs during OSP13 deployment with subscription-manager. |
CVE-2021-20260 | High | 7.8 | 2022-08-26 | A flaw was found in the Foreman project. The Datacenter plugin exposes the password through the API to an authenticated local attacker with view_hosts permissi… |
CVE-2022-32742 | Medium | 4.3 | 2022-08-25 | A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to fulfill the write, allowing s… |
CVE-2021-42523 | High | 7.5 | 2022-08-25 | There are two Information Disclosure vulnerabilities in colord, and they lie in colord/src/cd-device-db.c and colord/src/cd-profile-db.c separately. They exist… |
CVE-2021-42522 | High | 7.5 | 2022-08-25 | There is a Information Disclosure vulnerability in anjuta/plugins/document-manager/anjuta-bookmarks.c. This issue was caused by the incorrect use of libxml2 AP… |
CVE-2021-3800 | Medium | 5.5 | 2022-08-23 | A flaw was found in glib before version 2.63.6. Due to random charset alias, pkexec can leak content from files owned by privileged users to unprivileged ones… |
CVE-2021-3798 | Medium | 5.5 | 2022-08-23 | A flaw was found in openCryptoki. The openCryptoki Soft token does not check if an EC key is valid when an EC key is created via C_CreateObject, nor when C_Der… |
CVE-2021-3736 | Medium | 5.5 | 2022-08-23 | A flaw was found in the Linux kernel. A memory leak problem was found in mbochs_ioctl in samples/vfio-mdev/mbochs.c in Virtual Function I/O (VFIO) Mediated dev… |
CVE-2021-3714 | Medium | 5.9 | 2022-08-23 | A flaw was found in the Linux kernels memory deduplication mechanism. Previous work has shown that memory deduplication can be attacked via a local exploitatio… |
CVE-2022-31238 | Medium | 4.7 | 2022-08-22 | Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.19, 9.2.1.12, 9.3.0.6, and 9.4.0.2, contain a process invoked with sensitive information vulner… |
CVE-2022-34776 | Medium | 5.5 | 2022-08-22 | Tabit - giftcard stealth. Several APIs on the web system display, without authorization, sensitive information such as health statements, previous bills in a s… |
CVE-2022-2558 | Medium | 5.3 | 2022-08-22 | The Simple Job Board WordPress plugin before 2.10.0 is susceptible to Directory Listing which allows the public listing of uploaded resumes in certain configur… |
CVE-2021-3590 | High | 8.8 | 2022-08-22 | A flaw was found in Foreman project. A credential leak was identified which will expose Azure Compute Profile password through JSON of the API output. The high… |
CVE-2022-30693 | Medium | 5.3 | 2022-08-18 | Information disclosure vulnerability in the system configuration of Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to obtain the data of the product v… |
CVE-2022-35147 | Critical | 9.8 | 2022-08-17 | DoraCMS v2.18 and earlier allows attackers to bypass login authentication via a crafted HTTP request. |
CVE-2022-37438 | Low | 2.6 | 2022-08-16 | In Splunk Enterprise versions in the following table, an authenticated user can craft a dashboard that could potentially leak information (for example, usernam… |
CVE-2022-35290 | High | 7.5 | 2022-08-10 | Under certain conditions SAP Authenticator for Android allows an attacker to access information which would otherwise be restricted. |
CVE-2022-31674 | Medium | 4.3 | 2022-08-10 | VMware vRealize Operations contains an information disclosure vulnerability. A low-privileged malicious actor with network access can access log files that lea… |
CVE-2022-35715 | High | 7.5 | 2022-08-10 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in a s… |
CVE-2022-34659 | Medium | 5.3 | 2022-08-10 | A vulnerability has been identified in Simcenter STAR-CCM+ (All versions only if the Power-on-Demand public license server is used). Affected applications expo… |
CVE-2022-34712 | Medium | 5.5 | 2022-08-09 | Windows Defender Credential Guard Information Disclosure Vulnerability |
CVE-2022-34710 | Medium | 5.5 | 2022-08-09 | Windows Defender Credential Guard Information Disclosure Vulnerability |
CVE-2022-34708 | Medium | 5.5 | 2022-08-09 | Windows Kernel Information Disclosure Vulnerability |
CVE-2022-34704 | Medium | 4.7 | 2022-08-09 | Windows Defender Credential Guard Information Disclosure Vulnerability |
CVE-2022-34692 | Medium | 5.3 | 2022-08-09 | Microsoft Exchange Server Information Disclosure Vulnerability |
CVE-2022-30197 | Medium | 5.5 | 2022-08-09 | Windows Kernel Information Disclosure Vulnerability |
CVE-2022-2704 | Medium | 4.3 | 2022-08-08 | A vulnerability was found in SourceCodester Simple E-Learning System. It has been declared as problematic. This vulnerability affects unknown code of the file… |
CVE-2022-27633 | High | 7.5 | 2022-08-05 | An information disclosure vulnerability exists in the confctl_get_guest_wlan functionality of TCL LinkHub Mesh Wifi MS1G_00_01.00_14. A specially-crafted netwo… |
CVE-2022-27630 | High | 7.5 | 2022-08-05 | An information disclosure vulnerability exists in the confctl_get_master_wlan functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted net… |
CVE-2022-29071 | Medium | 4.0 | 2022-08-05 | This advisory documents an internally found vulnerability in the on premises deployment model of Arista CloudVision Portal (CVP) where under a certain set of c… |
CVE-2022-36835 | Low | 3.3 | 2022-08-05 | Implicit Intent hijacking vulnerability in Samsung Internet Browser prior to version 17.0.7.34 allows attackers to access arbitrary files. |
CVE-2022-36834 | Low | 3.3 | 2022-08-05 | Exposure of Sensitive Information vulnerability in Game Launcher prior to version 6.0.07 allows local attacker to access app data with user interaction. |
CVE-2022-33728 | Medium | 4.0 | 2022-08-05 | Exposure of sensitive information in Bluetooth prior to SMR Aug-2022 Release 1 allows local attackers to access connected BT macAddress via Settings.Gloabal. |
CVE-2022-33724 | Low | 3.3 | 2022-08-05 | Exposure of Sensitive Information in Samsung Dialer application?prior to SMR Aug-2022 Release 1 allows local attackers to access ICCID via log. |
CVE-2022-31190 | Medium | 5.3 | 2022-08-01 | DSpace open source software is a repository application which provides durable access to digital resources. dspace-xmlui is a UI component for DSpace. In affec… |
CVE-2022-31185 | Medium | 5.3 | 2022-08-01 | mprweb is a hosting platform for the makedeb Package Repository. Email addresses were found to not have been hidden, even if a user had clicked the `Hide Email… |
CVE-2022-31177 | Low | 2.7 | 2022-08-01 | Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could q… |
CVE-2022-27614 | Medium | 5.3 | 2022-07-28 | Exposure of sensitive information to an unauthorized actor vulnerability in web server in Synology Media Server before 1.8.1-2876 allows remote attackers to ob… |
CVE-2021-40180 | High | 7.5 | 2022-07-26 | In the WeChat application 8.0.10 for Android and iOS, a mini program can obtain sensitive information from a user's address book via wx.searchContacts. |
CVE-2022-31162 | High | 7.5 | 2022-07-22 | Slack Morphism is an async client library for Rust. Prior to 0.41.0, it was possible for Slack OAuth client information to leak in application debug logs. Stri… |
CVE-2022-22216 | Medium | 4.3 | 2022-07-20 | An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the PFE of Juniper Networks Junos OS on PTX Series and QFX10k Series allows an a… |
CVE-2022-2394 | Medium | 4.1 | 2022-07-19 | Puppet Bolt prior to version 3.24.0 will print sensitive parameters when planning a run resulting in them potentially being logged when run programmatically, s… |
CVE-2022-2117 | Medium | 5.3 | 2022-07-18 | The GiveWP plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.20.2 via the /donor-wall REST-API endpoin… |
CVE-2022-30625 | Medium | 5.7 | 2022-07-18 | Directory listing is a web server function that displays the directory contents when there is no index file in a specific website directory. A directory listin… |
CVE-2021-4135 | Medium | 5.5 | 2022-07-14 | A memory leak vulnerability was found in the Linux kernel's eBPF for the Simulated networking device driver in the way user uses BPF for the device such that f… |