CWE-200 · Information Disclosure (page 44)
Page 44 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-4135 | Medium | 5.5 | 2022-07-14 | A memory leak vulnerability was found in the Linux kernel's eBPF for the Simulated networking device driver in the way user uses BPF for the device such that f… |
CVE-2022-2408 | Medium | 4.3 | 2022-07-14 | The Guest account feature in Mattermost version 6.7.0 and earlier fails to properly restrict the permissions, which allows a guest user to fetch a list of all… |
CVE-2022-2401 | Medium | 6.5 | 2022-07-14 | Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly a… |
CVE-2021-39019 | Medium | 6.5 | 2022-07-14 | IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could disclose highly sensitive information through an HTTP GET reque… |
CVE-2022-1662 | Medium | 5.5 | 2022-07-14 | In convert2rhel, there's an ansible playbook named ansible/run-convert2rhel.yml which passes the Red Hat Subscription Manager user password via the CLI to conv… |
CVE-2022-35169 | Medium | 6.0 | 2022-07-12 | SAP BusinessObjects Business Intelligence Platform (LCM) - versions 420, 430, allows an attacker with an admin privilege to read and decrypt LCMBIAR file's pas… |
CVE-2022-31134 | Medium | 4.9 | 2022-07-12 | Zulip is an open-source team collaboration tool. Zulip Server versions 2.1.0 above have a user interface tool, accessible only to server owners and server admi… |
CVE-2011-4916 | Medium | 5.5 | 2022-07-12 | Linux kernel through 3.1 allows local users to obtain sensitive keystroke information via access to /dev/pts/ and /dev/tty*. |
CVE-2022-29901 | Medium | 5.6 | 2022-07-12 | Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary… |
CVE-2020-4159 | High | 7.5 | 2022-07-12 | IBM QRadar Network Security 5.4.0 and 5.5.0 discloses sensitive information to unauthorized users which could be used to mount further attacks against the syst… |
CVE-2022-33700 | Low | 2.0 | 2022-07-12 | Exposure of Sensitive Information in putDsaSimImsi in TelephonyUI prior to SMR Jul-2022 Release 1 allows local attacker to access imsi via log. |
CVE-2022-33699 | Low | 2.0 | 2022-07-12 | Exposure of Sensitive Information in getDsaSimImsi in TelephonyUI prior to SMR Jul-2022 Release 1 allows local attacker to access imsi via log. |
CVE-2022-33698 | Low | 3.3 | 2022-07-12 | Exposure of Sensitive Information in Telecom application prior to SMR Jul-2022 Release 1 allows local attackers to access ICCID via log. |
CVE-2022-33693 | Low | 2.0 | 2022-07-12 | Exposure of Sensitive Information in CID Manager prior to SMR Jul-2022 Release 1 allows local attacker to access iccid via log. |
CVE-2022-33687 | Low | 3.3 | 2022-07-12 | Exposure of Sensitive Information in telephony-common.jar prior to SMR Jul-2022 Release 1 allows local attackers to access IMSI via log. |
CVE-2022-33686 | Low | 2.3 | 2022-07-12 | Exposure of Sensitive Information in GsmAlarmManager prior to SMR Jul-2022 Release 1 allows local attacker to access iccid via log. |
CVE-2022-30753 | Low | 3.3 | 2022-07-12 | Improper use of a unique device ID in unprotected SecSoterService prior to SMR Jul-2022 Release 1 allows local attackers to get the device ID without permissio… |
CVE-2020-35167 | Medium | 4.8 | 2022-07-11 | Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vul… |
CVE-2022-31139 | Medium | 5.9 | 2022-07-11 | UnsafeAccessor (UA) is a bridge to access jdk.internal.misc.Unsafe & sun.misc.Unsafe. Normally, if UA is loaded as a named module, the internal data of UA is p… |
CVE-2022-29512 | Medium | 6.5 | 2022-07-11 | Exposure of sensitive information to an unauthorized actor issue in multiple applications of Cybozu Garoon 4.0.0 to 5.9.1 allows a remote authenticated attacke… |
CVE-2022-33742 | High | 7.1 | 2022-07-05 | Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which… |
CVE-2022-33741 | High | 7.1 | 2022-07-05 | Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which… |
CVE-2022-29467 | Medium | 4.3 | 2022-07-04 | Address information disclosure vulnerability in Cybozu Garoon 4.2.0 to 5.5.1 allows a remote authenticated attacker to obtain some data of Address. |
CVE-2022-31112 | High | 8.2 | 2022-06-30 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions parse Server LiveQuery does not re… |
CVE-2022-31032 | Medium | 4.3 | 2022-06-29 | Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.58 authorizations are not p… |
CVE-2017-20110 | Medium | 4.3 | 2022-06-29 | A vulnerability, which was classified as problematic, has been found in Teleopti WFM up to 7.1.0. Affected by this issue is some unknown functionality of the c… |
CVE-2017-20109 | Medium | 4.3 | 2022-06-29 | A vulnerability classified as problematic was found in Teleopti WFM up to 7.1.0. Affected by this vulnerability is an unknown functionality of the file /Teleop… |
CVE-2022-31068 | Medium | 5.3 | 2022-06-28 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versio… |
CVE-2022-0987 | Low | 3.3 | 2022-06-28 | A flaw was found in PackageKit in the way some of the methods exposed by the Transaction interface examines files. This issue allows a local user to measure th… |
CVE-2022-31091 | High | 7.7 | 2022-06-27 | Guzzle, an extensible PHP HTTP client. `Authorization` and `Cookie` headers on requests are sensitive information. In affected versions on making a request whi… |
CVE-2022-31090 | High | 7.7 | 2022-06-27 | Guzzle, an extensible PHP HTTP client. `Authorization` headers on requests are sensitive information. In affected versions when using our Curl handler, it is p… |
CVE-2022-2221 | Medium | 6.5 | 2022-06-27 | Information Exposure vulnerability in My Account Settings of Devolutions Remote Desktop Manager before 2022.1.8 allows authenticated users to access credential… |
CVE-2017-20101 | Low | 3.5 | 2022-06-27 | A vulnerability, which was classified as problematic, was found in ProjectSend r754. This affects an unknown part of the file process.php?do=zip_download. The… |
CVE-2022-0722 | High | 7.5 | 2022-06-27 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository ionicabizau/parse-url prior to 7.0.0. |
CVE-2022-31095 | Medium | 4.3 | 2022-06-21 | discourse-chat is a chat plugin for the Discourse application. Versions prior to 0.4 are vulnerable to an exposure of sensitive information, where an attacker… |
CVE-2022-30607 | Medium | 6.5 | 2022-06-17 | IBM Robotic Process Automation 20.10.0, 20.12.5, 21.0.0, 21.0.1, and 21.0.2 contains a vulnerability that could allow a user to obtain sensitive information du… |
CVE-2022-30184 | Medium | 5.5 | 2022-06-15 | .NET and Visual Studio Information Disclosure Vulnerability |
CVE-2022-31070 | Medium | 5.8 | 2022-06-15 | NestJS Proxy is a NestJS module to decorate and proxy calls. Prior to version 0.7.0, the nestjs-proxy library did not have a way to block sensitive cookies (e… |
CVE-2022-31069 | Medium | 5.8 | 2022-06-15 | NestJS Proxy is a NestJS module to decorate and proxy calls. Prior to version 0.7.0, the nestjs-proxy library did not have a way to control when Authorization… |
CVE-2022-20664 | High | 7.7 | 2022-06-15 | A vulnerability in the web management interface of Cisco Secure Email and Web Manager, formerly Cisco Security Management Appliance (SMA), and Cisco Email Secu… |
CVE-2022-31066 | Medium | 5.9 | 2022-06-14 | EdgeX Foundry is an open source project for building a common open framework for Internet of Things edge computing. Prior to version 2.1.1, the /api/v2/config… |
CVE-2022-31060 | Medium | 5.3 | 2022-06-14 | Discourse is an open-source discussion platform. Prior to version 2.8.4 in the `stable` branch and version `2.9.0.beta5` in the `beta` and `tests-passed` branc… |
CVE-2022-31046 | Medium | 4.3 | 2022-06-14 | TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the export functionality… |
CVE-2022-29241 | High | 7.1 | 2022-06-14 | Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter Notebook. Prior to version 1.1… |
CVE-2022-31309 | High | 7.5 | 2022-06-14 | A vulnerability in live_check.shtml of WAVLINK AERIAL X 1200M M79X3.V5030.180719 allows attackers to obtain sensitive router information via execution of the e… |
CVE-2022-31308 | High | 7.5 | 2022-06-14 | A vulnerability in live_mfg.shtml of WAVLINK AERIAL X 1200M M79X3.V5030.191012 allows attackers to obtain sensitive router information via execution of the exe… |
CVE-2021-35080 | Medium | 6.5 | 2022-06-14 | Disabled SMMU from secure side while RPM is assigned a secure stream can lead to information disclosure in Snapdragon Industrial IOT, Snapdragon Mobile, Snapdr… |
CVE-2021-35070 | Medium | 6.5 | 2022-06-14 | RPM secure Stream can access any secure resource due to improper SMMU configuration and can lead to information disclosure in Snapdragon Industrial IOT, Snapdr… |
CVE-2022-32192 | High | 7.5 | 2022-06-13 | Couchbase Server 5.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor. |
CVE-2022-29244 | High | 7.5 | 2022-06-13 | npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--worksp… |
CVE-2022-1595 | Medium | 5.3 | 2022-06-13 | The HC Custom WP-Admin URL WordPress plugin through 1.4 leaks the secret login URL when sending a specific crafted request |
CVE-2022-32741 | Medium | 5.3 | 2022-06-13 | Attacker is able to determine if the provided username exists (and it's valid) using Request New Password feature, based on the response time. |
CVE-2022-32740 | Low | 3.5 | 2022-06-13 | A reply to a forwarded email article by a 3rd party could unintensionally expose the email content to the ticket customer under certain circumstances. |
CVE-2022-32739 | Low | 3.5 | 2022-06-13 | When Secure::DisableBanner system configuration has been disabled and agent shares his calendar via public URL, received ICS file contains OTRS release number. |
CVE-2017-20031 | Low | 2.7 | 2022-06-10 | A vulnerability was found in PHPList 3.2.6. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation o… |
CVE-2022-31043 | High | 7.5 | 2022-06-10 | Guzzle is an open source PHP HTTP client. In affected versions `Authorization` headers on requests are sensitive information. On making a request using the `ht… |
CVE-2022-31042 | High | 7.5 | 2022-06-10 | Guzzle is an open source PHP HTTP client. In affected versions the `Cookie` headers on requests are sensitive information. On making a request using the `https… |
CVE-2017-20022 | High | 7.5 | 2022-06-09 | A vulnerability has been found in Solare Solar-Log 2.8.4-56/3.5.2-85 and classified as problematic. This vulnerability affects unknown code. The manipulation l… |
CVE-2017-20019 | Medium | 4.3 | 2022-06-09 | A vulnerability classified as problematic was found in Solare Solar-Log 2.8.4-56/3.5.2-85. Affected by this vulnerability is an unknown functionality of the co… |
CVE-2022-31051 | Medium | 4.4 | 2022-06-09 | semantic-release is an open source npm package for automated version management and package publishing. In affected versions secrets that would normally be mas… |
CVE-2022-31033 | Medium | 5.9 | 2022-06-09 | The Mechanize library is used for automating interaction with websites. Mechanize automatically stores and sends cookies, follows redirects, and can follow lin… |
CVE-2022-30556 | High | 7.5 | 2022-06-09 | Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer. |
CVE-2022-28614 | Medium | 5.3 | 2022-06-09 | The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input us… |
CVE-2019-25069 | Medium | 5.3 | 2022-06-09 | A vulnerability, which was classified as problematic, has been found in Axios Italia Axios RE 1.7.0/7.0.0. This issue affects some unknown processing of the co… |
CVE-2022-30743 | Medium | 5.3 | 2022-06-07 | Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the data of contact and gallery without permission. |
CVE-2022-30742 | Low | 3.3 | 2022-06-07 | Sensitive information exposure vulnerability in FmmExtraOperation of Find My Mobile prior to 7.2.24.12 allows local attackers with log access permissio to get… |
CVE-2022-30741 | Low | 3.3 | 2022-06-07 | Sensitive information exposure vulnerability in SimChangeAlertManger of Find My Mobile prior to 7.2.24.12 allows local attackers with log access permission to… |
CVE-2022-30740 | Medium | 4.1 | 2022-06-07 | Improper auto-fill algorithm in Samsung Internet prior to version 17.0.1.69 allows physical attackers to guess stored credit card numbers. |
CVE-2022-30737 | Medium | 4.0 | 2022-06-07 | Implicit Intent hijacking vulnerability in Samsung Account prior to version 13.2.00.6 allows attackers to get email ID. |
CVE-2022-30736 | Medium | 5.3 | 2022-06-07 | Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the data of contact and gallery without permission. |
CVE-2022-30735 | Medium | 5.9 | 2022-06-07 | Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the access_token without permission. |
CVE-2022-30734 | Medium | 4.0 | 2022-06-07 | Sensitive information exposure in Sign-out log in Samsung Account prior to version 13.2.00.6 allows attackers to get an user email or phone number without perm… |
CVE-2022-30733 | Medium | 4.0 | 2022-06-07 | Sensitive information exposure in Sign-in log in Samsung Account prior to version 13.2.00.6 allows attackers to get an user email or phone number without permi… |
CVE-2022-30732 | Medium | 5.5 | 2022-06-07 | Exposure of Sensitive Information vulnerability in Samsung Account prior to version 13.2.00.6 allows attacker to access sensitive information via onActivityRes… |
CVE-2020-36532 | Medium | 4.3 | 2022-06-07 | A vulnerability has been found in Klapp App and classified as problematic. This vulnerability affects unknown code of the component Authorization. The manipula… |
CVE-2022-30586 | High | 7.2 | 2022-06-06 | Gradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to code execution. |
CVE-2022-28224 | Medium | 5.5 | 2022-06-06 | Clusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with the floating IP featu… |
CVE-2021-42886 | High | 7.5 | 2022-06-03 | TOTOLINK EX1200T V4.1.2cu.5215 contains an information disclosure vulnerability where an attacker can get the apmib configuration file without authorization, a… |
CVE-2022-26869 | Critical | 9.8 | 2022-06-02 | Dell PowerStore versions 2.0.0.x, 2.0.1.x and 2.1.0.x contains an open port vulnerability. A remote unauthenticated attacker could potentially exploit this vul… |
CVE-2022-27775 | High | 7.5 | 2022-06-02 | An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a… |
CVE-2022-29235 | Medium | 5.3 | 2022-06-02 | BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4-rc-6, an attacker who is able to obtain t… |
CVE-2022-29232 | Medium | 6.5 | 2022-06-01 | BigBlueButton is an open source web conferencing system. Starting with version 2.2 and prior to versions 2.3.9 and 2.4-beta-1, an attacker can circumvent acces… |
CVE-2022-24414 | High | 7.6 | 2022-05-26 | Dell EMC CloudLink 7.1.3 and all earlier versions, Auth Token is exposed in GET requests. These request parameters can get logged in reverse proxies and server… |
CVE-2022-20821 | Medium | 6.5 | 2022-05-26 | A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running w… |
CVE-2022-29248 | High | 8.0 | 2022-05-25 | Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 and 7.4.3 contains a vulnerability with the cookie middleware. The vulnerability is that it is not… |
CVE-2022-1815 | High | 7.5 | 2022-05-25 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.1.2. |
CVE-2022-29567 | Medium | 5.7 | 2022-05-24 | The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 2… |
CVE-2022-24906 | Low | 3.5 | 2022-05-20 | Nextcloud Deck is a Kanban-style project & personal management tool for Nextcloud, similar to Trello. The full path of the application is exposed to unauthoriz… |
CVE-2022-29165 | Critical | 10.0 | 2022-05-20 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A critical vulnerability has been discovered in Argo CD starting with version 1.4.0 a… |
CVE-2022-1774 | Medium | 6.1 | 2022-05-18 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.0.7. |
CVE-2022-30990 | High | 7.5 | 2022-05-18 | Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 15 (Linux) before build 29240… |
CVE-2022-30598 | Medium | 4.3 | 2022-05-18 | A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it. |
CVE-2022-23067 | High | 8.8 | 2022-05-18 | ToolJet versions v0.5.0 to v1.2.2 are vulnerable to token leakage via Referer header that leads to account takeover . If the user opens the invite link/signup… |
CVE-2022-24890 | Low | 2.4 | 2022-05-17 | Nextcloud Talk is a video and audio conferencing app for Nextcloud. In versions prior to 13.0.5 and 14.0.0, a call moderator can indirectly enable user webcams… |
CVE-2020-4957 | Medium | 5.3 | 2022-05-17 | IBM Security Identity Governance and Intelligence 5.2.6 could disclose sensitive information in URL parameters that could aid in future attacks against the sys… |
CVE-2022-30334 | Medium | 5.3 | 2022-05-07 | Brave before 1.34, when a Private Window with Tor Connectivity is used, leaks .onion URLs in Referer and Origin headers. NOTE: although this was fixed by Brave… |
CVE-2022-26070 | Medium | 4.3 | 2022-05-06 | When handling a mismatched pre-authentication cookie, the application leaks the internal error message in the response, which contains the Splunk Enterprise lo… |
CVE-2022-27875 | Medium | 5.5 | 2022-05-05 | On F5 Access for Android 3.x versions prior to 3.0.8, a Task Hijacking vulnerability exists in the F5 Access for Android application, which may allow an attack… |
CVE-2022-25990 | Medium | 5.3 | 2022-05-05 | On 1.0.x versions prior to 1.0.1, systems running F5OS-A software may expose certain registry ports externally. Note: Software versions which have reached End… |
CVE-2021-39020 | Medium | 5.3 | 2022-05-05 | IBM Guardium Data Encryption (GDE) 4.0.0.7 and lower stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized pa… |