CWE-200 · Information Disclosure (page 44)
Page 44 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-1777 | Medium | 4.3 | 2020-10-15 | Agent names that participates in a chat conversation are revealed in certain parts of the external interface as well as in chat transcriptions inside the ticke… |
CVE-2020-15794 | Medium | 4.3 | 2020-10-15 | A vulnerability has been identified in Desigo Insight (All versions). Some error messages in the web application show the absolute path to the requested resour… |
CVE-2020-15250 | Medium | 4.4 | 2020-10-12 | In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the sy… |
CVE-2020-26869 | High | 7.5 | 2020-10-12 | ARC Informatique PcVue prior to version 12.0.17 is vulnerable to information exposure, allowing unauthorized users to access session data of legitimate users… |
CVE-2020-14183 | Medium | 4.3 | 2020-10-06 | Affected versions of Jira Server & Data Center allow a remote attacker with limited (non-admin) privileges to view a Jira instance's Support Entitlement Number… |
CVE-2020-1902 | High | 7.5 | 2020-10-06 | A user running a quick search on a highly forwarded message on WhatsApp for Android from v2.20.108 to v2.20.140 or WhatsApp Business for Android from v2.20.35… |
CVE-2020-15235 | Medium | 5.9 | 2020-10-05 | In RACTF before commit f3dc89b, unauthenticated users are able to get the value of sensitive config keys that would normally be hidden to everyone except admin… |
CVE-2020-15671 | Low | 3.1 | 2020-10-01 | When typing in a password under certain conditions, a race may have occured where the InputContext was not being correctly set for the input field, resulting i… |
CVE-2020-5132 | Medium | 5.3 | 2020-09-30 | SonicWall SSL-VPN products and SonicWall firewall SSL-VPN feature misconfiguration leads to possible DNS flaw known as domain name collision vulnerability. Whe… |
CVE-2019-15963 | Medium | 6.5 | 2020-09-23 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view sensitive i… |
CVE-2020-6570 | Medium | 4.3 | 2020-09-21 | Information leakage in WebRTC in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to obtain potentially sensitive information via a crafted WebRTC… |
CVE-2020-5975 | High | 7.5 | 2020-09-18 | NVIDIA GeForce NOW, versions prior to 2.0.23 on Windows and macOS, contains a vulnerability in the desktop application software that includes sensitive informa… |
CVE-2020-14181 | Medium | 5.3 | 2020-09-17 | Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the… |
CVE-2018-19947 | Medium | 4.3 | 2020-09-11 | The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this information exposure vulnerability could disclose sensitive inf… |
CVE-2020-9733 | High | 7.5 | 2020-09-10 | An AEM java servlet in AEM versions 6.5.5.0 (and below) and 6.4.8.1 (and below) executes with the permissions of a high privileged service user. If exploited… |
CVE-2020-15790 | Medium | 5.3 | 2020-09-09 | A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP8). If configured in an insecure manner, the web server might be susceptible to… |
CVE-2020-3644 | Medium | 5.5 | 2020-09-08 | u'Information disclosure issue occurs as in current logic Secure Touch session is released without terminating display session' in Snapdragon Auto, Snapdragon… |
CVE-2020-3643 | Medium | 5.5 | 2020-09-08 | u'Information disclosure issue can occur due to partial secure display-touch session tear-down' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity… |
CVE-2020-3547 | Medium | 4.3 | 2020-09-04 | A vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appliance (ESA), Cisco Content Security Management App… |
CVE-2020-3541 | Medium | 4.4 | 2020-09-04 | A vulnerability in the media engine component of Cisco Webex Meetings Client for Windows, Cisco Webex Meetings Desktop App for Windows, and Cisco Webex Teams f… |
CVE-2020-3537 | Medium | 5.7 | 2020-09-04 | A vulnerability in Cisco Jabber for Windows software could allow an authenticated, remote attacker to gain access to sensitive information. The vulnerability i… |
CVE-2020-3498 | Medium | 6.5 | 2020-09-04 | A vulnerability in Cisco Jabber software could allow an authenticated, remote attacker to gain access to sensitive information. The vulnerability is due to imp… |
CVE-2020-15704 | Medium | 5.5 | 2020-09-01 | The modprobe child process in the ./debian/patches/load_ppp_generic_if_needed patch file incorrectly handled module loading. A local non-root attacker could ex… |
CVE-2020-4172 | Medium | 5.3 | 2020-08-27 | IBM Security Guardium Insights 2.0.1 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have acces… |
CVE-2020-3520 | Medium | 5.5 | 2020-08-26 | A vulnerability in Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, local attacker to obtain confidential information from an af… |
CVE-2020-24381 | High | 7.5 | 2020-08-19 | GUnet Open eClass Platform (aka openeclass) before 3.11 might allow remote attackers to read students' submitted assessments because it does not ensure that th… |
CVE-2020-1510 | Medium | 5.5 | 2020-08-17 | An information disclosure vulnerability exists when the win32k component improperly provides kernel information. An attacker who successfully exploited the vul… |
CVE-2020-3472 | Medium | 5.0 | 2020-08-17 | A vulnerability in the contacts feature of Cisco Webex Meetings could allow an authenticated, remote attacker with a legitimate user account to access sensitiv… |
CVE-2020-3411 | High | 7.5 | 2020-08-17 | A vulnerability in Cisco DNA Center software could allow an unauthenticated remote attacker access to sensitive information on an affected system. The vulnerab… |
CVE-2020-8232 | Medium | 6.5 | 2020-08-17 | An information disclosure vulnerability exists in EdgeMax EdgeSwitch firmware v1.9.0 that allowed read only users could obtain unauthorized information through… |
CVE-2020-8210 | High | 7.5 | 2020-08-17 | Insufficient protection of secrets in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and… |
CVE-2020-6653 | Low | 3.8 | 2020-08-12 | Eaton's Secure connect mobile app v1.7.3 & prior stores the user login credentials in logcat file when user create or register the account on the Mobile app. A… |
CVE-2020-13179 | Medium | 5.5 | 2020-08-11 | Broker Protocol messages in Teradici PCoIP Standard Agent for Windows and Graphics Agent for Windows prior to 20.04.1 are not cleaned up in server memory, whic… |
CVE-2020-15647 | High | 7.4 | 2020-08-10 | A Content Provider in Firefox for Android allowed local files accessible by the browser to be read by a remote webpage, leading to sensitive data disclosure, i… |
CVE-2020-9525 | High | 8.1 | 2020-08-10 | CS2 Network P2P through 3.x, as used in millions of Internet of Things devices, suffers from an authentication flaw that allows remote attackers to perform a m… |
CVE-2020-12777 | High | 7.5 | 2020-08-10 | A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inject command and disclose system informat… |
CVE-2019-7005 | High | 7.5 | 2020-08-07 | A vulnerability was discovered in the web interface component of IP Office that may potentially allow a remote, unauthenticated user with network access to gai… |
CVE-2017-18112 | Medium | 6.5 | 2020-08-05 | Affected versions of Atlassian Fisheye allow remote attackers to view the HTTP password of a repository via an Information Disclosure vulnerability in the logg… |
CVE-2020-13523 | Low | 3.3 | 2020-08-04 | An exploitable information disclosure vulnerability exists in SoftPerfect’s RAM Disk 4.1 spvve.sys driver. A specially crafted I/O request packet (IRP) can cau… |
CVE-2020-5414 | Medium | 5.7 | 2020-07-31 | VMware Tanzu Application Service for VMs (2.7.x versions prior to 2.7.19, 2.8.x versions prior to 2.8.13, and 2.9.x versions prior to 2.9.7) contains an App Au… |
CVE-2020-8216 | Medium | 4.3 | 2020-07-30 | An information disclosure vulnerability in meeting of Pulse Connect Secure <9.1R8 allowed an authenticated end-users to find meeting details, if they know the… |
CVE-2020-4186 | Medium | 5.3 | 2020-07-30 | IBM Security Guardium 10.5, 10.6, and 11.1 could disclose sensitive information on the login page that could aid in further attacks against the system. IBM X-F… |
CVE-2020-15099 | High | 8.1 | 2020-07-29 | In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, in a case where an attacker manages… |
CVE-2020-15098 | High | 8.8 | 2020-07-29 | In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, it has been discovered that an inte… |
CVE-2020-15086 | Critical | 9.8 | 2020-07-29 | In TYPO3 installations with the "mediace" extension from version 7.6.2 and before version 7.6.5, it has been discovered that an internal verification mechanism… |
CVE-2019-4731 | Medium | 5.5 | 2020-07-28 | IBM MQ Appliance 9.1.4.CD could allow a local attacker to obtain highly sensitive information by inclusion of sensitive data within trace. IBM X-Force ID: 1726… |
CVE-2020-6514 | Medium | 6.5 | 2020-07-22 | Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to potentially exploit heap… |
CVE-2020-12027 | Medium | 4.3 | 2020-07-20 | All versions of FactoryTalk View SE disclose the hostnames and file paths for certain files within the system. A remote, authenticated attacker may be able to… |
CVE-2020-4361 | Medium | 4.3 | 2020-07-20 | IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information by disclosing private IP addresses in HTTP responses. IBM X-Force ID… |
CVE-2020-7696 | Medium | 5.3 | 2020-07-17 | This affects all versions of package react-native-fast-image. When an image with source={{uri: "...", headers: { host: "somehost.com", authorization: "..." }}… |
CVE-2020-7284 | High | 8.6 | 2020-07-03 | Exposure of Sensitive Information in McAfee Network Security Management (NSM) prior to 10.1.7.7 allows local users to gain unauthorised access to the root acco… |
CVE-2020-15081 | Medium | 5.3 | 2020-07-02 | In PrestaShop from version 1.5.0.0 and before 1.7.6.6, there is information exposure in the upload directory. The problem is fixed in version 1.7.6.6. A possib… |
CVE-2020-15080 | Medium | 5.3 | 2020-07-02 | In PrestaShop from version 1.7.4.0 and before version 1.7.6.6, some files should not be in the release archive, and others should not be accessible. The proble… |
CVE-2020-15502 | High | 7.5 | 2020-07-02 | The DuckDuckGo application through 5.58.0 for Android, and through 7.47.1.0 for iOS, sends hostnames of visited web sites within HTTPS .ico requests to servers… |
CVE-2020-3391 | Medium | 6.5 | 2020-07-02 | A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an authenticated, remote attacker to view sensitive information in clear text. T… |
CVE-2020-4565 | Medium | 5.9 | 2020-06-26 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow an attacker to obtain sensitive information due to insecure communications being used between the a… |
CVE-2020-10274 | High | 7.1 | 2020-06-24 | The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default credentials from the Control Dashboard… |
CVE-2020-7262 | Medium | 5.3 | 2020-06-22 | Improper Access Control vulnerability in McAfee Advanced Threat Defense (ATD) prior to 4.10.0 allows local users to view sensitive files via a carefully crafte… |
CVE-2020-13264 | Medium | 5.3 | 2020-06-19 | Kubernetes cluster token disclosure in GitLab CE/EE 10.3 and later through 13.0.1 allows other group maintainers to view Kubernetes cluster token |
CVE-2020-13261 | Medium | 5.3 | 2020-06-19 | Amazon EKS credentials disclosure in GitLab CE/EE 12.6 and later through 13.0.1 allows other administrators to view Amazon EKS credentials via HTML source code |
CVE-2020-10750 | High | 7.1 | 2020-06-19 | Sensitive information written to a log file vulnerability was found in jaegertracing/jaeger before version 1.18.1 when the Kafka data store is used. This flaw… |
CVE-2016-11081 | Medium | 4.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 2.2.0. It allows unintended access to information stored by a web browser. |
CVE-2016-11078 | Medium | 6.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.0.0. It potentially allows attackers to obtain sensitive information (credential fields within config.jso… |
CVE-2016-11075 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.0.0. It allows attackers to obtain sensitive information about team URLs via an API. |
CVE-2016-11066 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.2.0. The initial_load API disclosed unnecessary personal information. |
CVE-2017-18902 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows attackers to discover team invite IDs via team API endpoints. |
CVE-2017-18901 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows attackers to discover a team invite ID by requesting a JSON document. |
CVE-2017-18895 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows attackers to obtain sensitive information (user statuses) via a REST API… |
CVE-2017-18887 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It discloses the team creator's e-mail address to members. |
CVE-2018-21260 | Low | 2.7 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3. WebSocket events were accidentally sent during certain user-management operations… |
CVE-2019-13033 | Low | 3.3 | 2020-06-18 | In CISOfy Lynis 2.x through 2.7.5, the license key can be obtained by looking at the process list when a data upload is being performed. This license can be us… |
CVE-2020-10782 | Medium | 6.5 | 2020-06-18 | An exposure of sensitive information flaw was found in Ansible version 3.7.0. Sensitive information, such tokens and other secrets could be readable and expose… |
CVE-2020-3362 | Medium | 4.7 | 2020-06-18 | A vulnerability in the CLI of Cisco Network Services Orchestrator (NSO) could allow an authenticated, local attacker to access confidential information on an a… |
CVE-2020-3360 | Medium | 5.3 | 2020-06-18 | A vulnerability in the Web Access feature of Cisco IP Phones Series 7800 and Series 8800 could allow an unauthenticated, remote attacker to view sensitive info… |
CVE-2020-3347 | Medium | 5.5 | 2020-06-18 | A vulnerability in Cisco Webex Meetings Desktop App for Windows could allow an authenticated, local attacker to gain access to sensitive information on an affe… |
CVE-2020-3242 | Medium | 4.9 | 2020-06-18 | A vulnerability in the REST API of Cisco UCS Director could allow an authenticated, remote attacker with administrative privileges to obtain confidential infor… |
CVE-2020-7932 | Medium | 5.7 | 2020-06-17 | OMERO.web before 5.6.3 optionally allows sensitive data elements (e.g., a session key) to be passed as URL query parameters. If an attacker tricks a user into… |
CVE-2020-7510 | High | 7.5 | 2020-06-16 | A CWE-200: Information Exposure vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow attacker to obtain private keys. |
CVE-2020-7506 | High | 7.5 | 2020-06-16 | A CWE-200: Information Exposure vulnerability exists in Easergy T300, Firmware V1.5.2 and prior, which could allow an attacker to pack or unpack the archive wi… |
CVE-2020-4045 | High | 7.5 | 2020-06-11 | SSB-DB version 20.0.0 has an information disclosure vulnerability. The get() method is supposed to only decrypt messages when you explicitly ask it to, but the… |
CVE-2020-13702 | Medium | 4.3 | 2020-06-11 | The Rolling Proximity Identifier used in the Apple/Google Exposure Notification API beta through 2020-05-29 enables attackers to circumvent Bluetooth Smart Pri… |
CVE-2020-13268 | Medium | 5.3 | 2020-06-10 | A specially crafted request could be used to confirm the existence of files hosted on object storage services, without disclosing their contents. This vulnerab… |
CVE-2020-1775 | Low | 3.5 | 2020-06-08 | BCC recipients in mails sent from OTRS are visible in article detail on external interface. This issue affects OTRS: 8.0.3 and prior versions, 7.0.17 and prior… |
CVE-2020-12802 | Medium | 5.3 | 2020-06-08 | LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default… |
CVE-2019-20836 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.5. It has mishandling of cloud credentials, as demonstrated by Google Drive. |
CVE-2018-21242 | Critical | 9.8 | 2020-06-04 | An issue was discovered in Foxit PhantomPDF before 8.3.6. It allows Remote Code Execution via a GoToE or GoToR action. |
CVE-2020-7030 | Medium | 5.5 | 2020-06-04 | A sensitive information disclosure vulnerability was discovered in the web interface component of IP Office that may potentially allow a local user to gain una… |
CVE-2011-2863 | Medium | 6.5 | 2020-06-03 | Insufficient policy enforcement in V8 in Google Chrome prior to 14.0.0.0 allowed a remote attacker to obtain potentially sensitive information from process mem… |
CVE-2020-13597 | Medium | 6.0 | 2020-06-03 | Clusters using Calico (version 3.14.0 and below), Calico Enterprise (version 2.8.2 and below), may be vulnerable to information disclosure if IPv6 is enabled b… |
CVE-2020-13764 | High | 7.5 | 2020-06-02 | common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special case for a $current_u… |
CVE-2014-8940 | Medium | 5.3 | 2020-06-01 | Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information (names and details of projects) by visiting the /update.log URI. |
CVE-2020-5573 | Medium | 4.6 | 2020-05-29 | Android App 'kintone mobile for Android' 1.0.0 to 2.5 allows an attacker to obtain credential information registered in the product via unspecified vectors. |
CVE-2020-5572 | Medium | 4.6 | 2020-05-29 | Android App 'Mailwise for Android' 1.0.0 to 1.0.1 allows an attacker to obtain credential information registered in the product via unspecified vectors. |
CVE-2020-11059 | Critical | 9.6 | 2020-05-27 | In AEgir greater than or equal to 21.7.0 and less than 21.10.1, aegir publish and aegir build may leak secrets from environment variables in the browser bundle… |
CVE-2020-10945 | Medium | 4.3 | 2020-05-27 | Centreon before 19.10.7 exposes Session IDs in server responses. |
CVE-2020-4226 | High | 7.5 | 2020-05-27 | IBM MobileFirst Platform Foundation 8.0.0.0 stores highly sensitive information in URL parameters. This may lead to information disclosure if unauthorized part… |
CVE-2020-6830 | High | 7.5 | 2020-05-26 | For native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token was being used… |
CVE-2020-6489 | Medium | 4.3 | 2020-05-21 | Inappropriate implementation in developer tools in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had convinced the user to take certain act… |
CVE-2020-5364 | Medium | 5.3 | 2020-05-20 | Dell EMC Isilon OneFS versions 8.2.2 and earlier contain an SNMPv2 vulnerability. The SNMPv2 services is enabled, by default, with a pre-configured community s… |
CVE-2020-13129 | High | 7.2 | 2020-05-18 | An issue was discovered in the stashcat app through 3.9.1 for macOS, Windows, Android, iOS, and possibly other platforms. The GET method is used with client_ke… |