CWE-200 · Information Disclosure (page 45)
Page 45 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-20734 | Medium | 4.4 | 2022-05-04 | A vulnerability in Cisco SD-WAN vManage Software could allow an authenticated, local attacker to view sensitive information on an affected system. This vulnera… |
CVE-2022-25787 | High | 7.5 | 2022-05-04 | Information Exposure Through Query Strings in GET Request vulnerability in LMM API of Secomea GateManager allows system administrator to hijack connection. Thi… |
CVE-2022-25780 | Medium | 4.3 | 2022-05-04 | Information Exposure vulnerability in web UI of Secomea GateManager allows logged in user to query devices outside own scope. |
CVE-2022-0882 | Medium | 5.3 | 2022-05-03 | A bug exists where an attacker can read the kernel log through exposed Zircon kernel addresses without the required capability ZX_RSRC_KIND_ROOT. It is recomme… |
CVE-2022-1353 | High | 7.1 | 2022-04-29 | A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This flaw allows a local, unprivileged user to gain access to… |
CVE-2021-43938 | High | 8.1 | 2022-04-29 | Elcomplus SmartPTT SCADA Server is vulnerable to an unauthenticated user can request various files from the server without any authentication or authorization. |
CVE-2021-43937 | High | 7.6 | 2022-04-29 | Elcomplus SmartPTT SCADA Server web application does not, or cannot, sufficiently verify whether a well-formed, valid, consistent request was intentionally pro… |
CVE-2022-22277 | Medium | 5.3 | 2022-04-27 | A vulnerability in SonicOS SNMP service resulting exposure of Wireless Access Point sensitive information in cleartext. |
CVE-2022-22276 | Medium | 5.3 | 2022-04-27 | A vulnerability in SonicOS SNMP service resulting exposure of sensitive information to an unauthorized user. |
CVE-2021-34589 | High | 7.5 | 2022-04-27 | In Bender/ebee Charge Controllers in multiple versions are prone to an RFID leak. The RFID of the last charge event can be read without authentication via the… |
CVE-2022-24886 | Low | 2.2 | 2022-04-27 | Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. In versions prior to 3.19.0, any application with notification… |
CVE-2022-24866 | Medium | 4.3 | 2022-04-26 | Discourse Assign is a plugin for assigning users to a topic in Discourse, an open-source messaging platform. Prior to version 1.0.1, the UserBookmarkSerializer… |
CVE-2022-23711 | Medium | 5.3 | 2022-04-21 | A vulnerability in Kibana could expose sensitive information related to Elastic Stack monitoring in the Kibana page source. Elastic Stack monitoring features p… |
CVE-2022-24867 | High | 7.5 | 2022-04-21 | GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. When you pass the c… |
CVE-2022-24865 | Medium | 6.5 | 2022-04-20 | HumHub is an Open Source Enterprise Social Network. In affected versions users who are forced to change their password by an administrator may retrieve other u… |
CVE-2022-27863 | Medium | 5.3 | 2022-04-19 | Sensitive Information Exposure in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 on WordPress allows attackers to get the booking data by gue… |
CVE-2022-1186 | Medium | 5.3 | 2022-04-19 | The WordPress plugin Be POPIA Compliant exposed sensitive information to unauthenticated users consisting of site visitors emails and usernames via an API rout… |
CVE-2021-3503 | Medium | 4.3 | 2022-04-18 | A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data. The highest threat from this vulnerability is to the confiden… |
CVE-2011-4917 | Medium | 5.5 | 2022-04-18 | In the Linux kernel through 3.1 there is an information disclosure issue via /proc/stat. |
CVE-2022-27849 | Medium | 5.3 | 2022-04-15 | Sensitive Information Disclosure (sac-export.csv) in Simple Ajax Chat (WordPress plugin) <= 20220115 |
CVE-2022-24853 | Medium | 5.9 | 2022-04-14 | Metabase is an open source business intelligence and analytics application. Metabase has a proxy to load arbitrary URLs for JSON maps as part of our GeoJSON su… |
CVE-2022-24850 | Medium | 5.3 | 2022-04-14 | Discourse is an open source platform for community discussion. A category's group permissions settings can be viewed by anyone that has access to the category… |
CVE-2022-24849 | Medium | 6.5 | 2022-04-14 | DisCatSharp is a Discord API wrapper for .NET. Users of versions 9.8.5, 9.8.6, 9.9.0 and previously published prereleases of 10.0.0 who have used either one of… |
CVE-2022-25166 | Medium | 5.0 | 2022-04-14 | An issue was discovered in Amazon AWS VPN Client 2.0.0. It is possible to include a UNC path in the OpenVPN configuration file when referencing file paths for… |
CVE-2022-22183 | High | 7.5 | 2022-04-14 | An Improper Access Control vulnerability in Juniper Networks Junos OS Evolved allows a network-based unauthenticated attacker who is able to connect to a speci… |
CVE-2021-43287 | High | 7.5 | 2022-04-14 | An issue was discovered in ThoughtWorks GoCD before 21.3.0. The business continuity add-on, which is enabled by default, leaks all secrets known to the GoCD se… |
CVE-2022-22961 | Medium | 5.3 | 2022-04-13 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an information disclosure vulnerability due to returning excess information. A ma… |
CVE-2022-1332 | Medium | 4.3 | 2022-04-13 | One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom… |
CVE-2021-28544 | Medium | 4.3 | 2022-04-12 | Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-b… |
CVE-2022-27667 | High | 7.5 | 2022-04-12 | Under certain conditions, SAP BusinessObjects Business Intelligence platform, Client Management Console (CMC) - version 430, allows an attacker to access infor… |
CVE-2022-27241 | High | 7.5 | 2022-04-12 | A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.31), Mendix Applications using Mendix 8 (All versions < V8.18.1… |
CVE-2022-24837 | Medium | 5.3 | 2022-04-11 | HedgeDoc is an open-source, web-based, self-hosted, collaborative markdown editor. Images uploaded with HedgeDoc version 1.9.1 and later have an enumerable fil… |
CVE-2022-27844 | Low | 2.7 | 2022-04-11 | Arbitrary File Read vulnerability in WPvivid Team Migration, Backup, Staging – WPvivid (WordPress plugin) versions <= 0.9.70 |
CVE-2022-27576 | Low | 3.3 | 2022-04-11 | Information exposure vulnerability in Samsung DeX Home prior to SMR April-2022 Release 1 allows to access currently launched foreground app information without… |
CVE-2022-27575 | Low | 3.3 | 2022-04-11 | Information exposure vulnerability in One UI Home prior to SMR April-2022 Release 1 allows to access currently launched foreground app information without perm… |
CVE-2022-24804 | Medium | 5.3 | 2022-04-11 | Discourse is an open source platform for community discussion. In stable versions prior to 2.8.3 and beta versions prior 2.9.0.beta4 erroneously expose groups… |
CVE-2022-25594 | Medium | 5.3 | 2022-04-07 | Microprogram’s parking lot management system is vulnerable to sensitive information exposure. An unauthorized remote attacker can input specific URLs to acquir… |
CVE-2021-43205 | Medium | 4.3 | 2022-04-06 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClient for Linux version 7.0.2 and below, 6.4.7 and below and 6.2… |
CVE-2021-40375 | Medium | 6.5 | 2022-04-06 | Apperta Foundation OpenEyes 3.5.1 allows remote attackers to view the sensitive information of patients without having the intended level of privilege. Despite… |
CVE-2022-0709 | High | 7.5 | 2022-04-04 | The Booking Package WordPress plugin before 1.5.29 requires a token for exporting the ical representation of it's booking calendar, but this token is returned… |
CVE-2019-14839 | High | 7.5 | 2022-04-01 | It was observed that while login into Business-central console, HTTP request discloses sensitive information like username and password when intercepted using… |
CVE-2022-23158 | Medium | 6.0 | 2022-04-01 | Wyse Device Agent version 14.6.1.4 and below contain a sensitive data exposure vulnerability. A local authenticated user with standard privilege could potentia… |
CVE-2022-23157 | Medium | 4.4 | 2022-04-01 | Wyse Device Agent version 14.6.1.4 and below contain a sensitive data exposure vulnerability. A authenticated malicious user could potentially exploit this vul… |
CVE-2022-24797 | Medium | 6.5 | 2022-03-31 | Pomerium is an identity-aware access proxy. In distributed service mode, Pomerium's Authenticate service exposes pprof debug and prometheus metrics handlers to… |
CVE-2022-1077 | Medium | 5.3 | 2022-03-29 | A vulnerability was found in TEM FLEX-1080 and FLEX-1085 1.6.0. It has been declared as problematic. This vulnerability log.cgi of the component Log Handler. A… |
CVE-2022-24784 | Low | 3.7 | 2022-03-25 | Statamic is a Laravel and Git powered CMS. Before versions 3.2.39 and 3.3.2, it is possible to confirm a single character of a user's password hash using a spe… |
CVE-2022-0494 | Medium | 4.4 | 2022-03-25 | A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in the Linux kernel. This flaw allows a local attacker wi… |
CVE-2022-24782 | Medium | 4.3 | 2022-03-24 | Discourse is an open source discussion platform. Versions 2.8.2 and prior in the `stable` branch, 2.9.0.beta3 and prior in the `beta` branch, and 2.9.0.beta3 a… |
CVE-2022-24768 | Critical | 9.9 | 2022-03-23 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All unpatched versions of Argo CD starting with 1.0.0 are vulnerable to an improper a… |
CVE-2022-0854 | Medium | 5.5 | 2022-03-23 | A memory leak flaw was found in the Linux kernel’s DMA subsystem, in the way a user calls DMA_FROM_DEVICE. This flaw allows a local user to read random memory… |
CVE-2021-4180 | Medium | 4.3 | 2022-03-23 | An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname. An attacker could exploit thi… |
CVE-2021-27424 | Medium | 5.3 | 2022-03-23 | GE UR firmware versions prior to version 8.1x shares MODBUS memory map as part of the communications guide. GE was made aware a “Last-key pressed” MODBUS regis… |
CVE-2021-27422 | High | 7.5 | 2022-03-23 | GE UR firmware versions prior to version 8.1x web server interface is supported on UR over HTTP protocol. It allows sensitive information exposure without auth… |
CVE-2022-1004 | Medium | 4.3 | 2022-03-21 | Accounted time is shown in the Ticket Detail View (External Interface), even if ExternalFrontend::TicketDetailView###AccountedTimeDisplay is disabled. |
CVE-2022-25602 | High | 8.3 | 2022-03-18 | Nonce token leak vulnerability leading to arbitrary file upload, theme deletion, plugin settings change discovered in Responsive Menu WordPress plugin (version… |
CVE-2022-25248 | Medium | 5.3 | 2022-03-16 | When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) supplies the event log of the specific service. |
CVE-2022-0430 | Medium | 5.3 | 2022-03-15 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository httpie/httpie prior to 3.1.0. |
CVE-2022-24762 | Medium | 6.5 | 2022-03-14 | sysend.js is a library that allows a user to send messages between pages that are open in the same browser. Users that use cross-origin communication may have… |
CVE-2022-24742 | Medium | 5.0 | 2022-03-14 | Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab remains unclosed af… |
CVE-2021-41850 | High | 7.8 | 2022-03-11 | An issue was discovered in Luna Simo PPR1.180610.011/202001031830. A pre-installed app with a package name of com.skyroam.silverhelper writes three IMEI values… |
CVE-2021-41849 | Medium | 5.5 | 2022-03-11 | An issue was discovered in Luna Simo PPR1.180610.011/202001031830. It sends the following Personally Identifiable Information (PII) in plaintext using HTTP to… |
CVE-2021-32477 | Medium | 4.3 | 2022-03-11 | The last time a user accessed the mobile app is displayed on their profile page, but should be restricted to users with the relevant capability (site administr… |
CVE-2021-32473 | Medium | 5.3 | 2022-03-11 | It was possible for a student to view their quiz grade before it had been released, using a quiz web service. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8… |
CVE-2022-25512 | High | 7.5 | 2022-03-11 | FreeTAKServer-UI v1.9.8 was discovered to leak sensitive API and Websocket keys. |
CVE-2022-26847 | Medium | 5.3 | 2022-03-10 | SPIP before 3.2.14 and 4.x before 4.0.5 allows unauthenticated access to information about editorial objects. |
CVE-2022-25830 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Galaxy Watch3 Plugin prior to version 2.2.09.22012751 allows attacker to access password information of connected WiFiAp… |
CVE-2022-25829 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Watch Active2 Plugin prior to version 2.2.08.22012751 allows attacker to access password information of connected WiFiAp… |
CVE-2022-25828 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Watch Active Plugin prior to version 2.2.07.22012751 allows attacker to access password information of connected WiFiAp i… |
CVE-2022-25827 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Galaxy Watch Plugin prior to version 2.2.05.22012751 allows attacker to access password information of connected WiFiAp i… |
CVE-2022-25826 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Galaxy S3 Plugin prior to version 2.2.03.22012751 allows attacker to access password information of connected WiFiAp in t… |
CVE-2022-25823 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Galaxy Watch Plugin prior to version 2.2.05.220126741 allows attackers to access user information in log. |
CVE-2022-24398 | Medium | 6.5 | 2022-03-10 | Under certain conditions SAP Business Objects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker to access information which… |
CVE-2022-22547 | High | 7.5 | 2022-03-10 | Simple Diagnostics Agent - versions 1.0 (up to version 1.57.), allows an attacker to access information which would otherwise be restricted via a random port 9… |
CVE-2022-0813 | Medium | 5.3 | 2022-03-10 | PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the… |
CVE-2022-0725 | High | 7.5 | 2022-03-10 | A flaw was found in keepass. The vulnerability occurs due to logging the plain text passwords in system log and leads to an Information Exposure vulnerability… |
CVE-2022-0516 | High | 7.8 | 2022-03-10 | A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for s390 in the Linux kernel. This flaw allows a local atta… |
CVE-2021-4023 | Medium | 5.5 | 2022-03-10 | A flaw was found in the io-workqueue implementation in the Linux kernel versions prior to 5.15-rc1. The kernel can panic when an improper cancellation operatio… |
CVE-2021-3732 | Medium | 5.5 | 2022-03-10 | A flaw was found in the Linux kernel's OverlayFS subsystem in the way the user mounts the TmpFS filesystem with OverlayFS. This flaw allows a local user to gai… |
CVE-2020-14112 | Medium | 5.3 | 2022-03-10 | Information Leak Vulnerability exists in the Xiaomi Router AX6000. The vulnerability is caused by incorrect routing configuration. Attackers can exploit this v… |
CVE-2022-24747 | Medium | 6.3 | 2022-03-09 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. Affected versions of shopware do no properly set sen… |
CVE-2021-22783 | High | 8.8 | 2022-03-09 | A CWE-200: Information Exposure vulnerability exists which could allow a session hijack when the door panel is communicating with the door. Affected Product: R… |
CVE-2021-41239 | Medium | 5.3 | 2022-03-08 | Nextcloud server is a self hosted system designed to provide cloud style services. In affected versions the User Status API did not consider the user enumerati… |
CVE-2021-41181 | Low | 2.4 | 2022-03-08 | Nextcloud talk is a self hosting messaging service. In versions prior to 12.3.0 the Nextcloud Android Talk application did not properly detect the lockscreen s… |
CVE-2022-24737 | Medium | 6.5 | 2022-03-07 | HTTPie is a command-line HTTP client. HTTPie has the practical concept of sessions, which help users to persistently store some of the state that belongs to th… |
CVE-2022-0384 | Medium | 4.3 | 2022-03-07 | The Video Conferencing with Zoom WordPress plugin before 3.8.17 does not have authorisation in its vczapi_get_wp_users AJAX action, allowing any authenticated… |
CVE-2022-24725 | Medium | 6.2 | 2022-03-03 | Shescape is a shell escape package for JavaScript. An issue in versions 1.4.0 to 1.5.1 allows for exposure of the home directory on Unix systems when using Bas… |
CVE-2021-3602 | Medium | 5.5 | 2022-03-03 | An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RU… |
CVE-2022-23648 | High | 7.5 | 2022-03-03 | containerd is a container runtime available as a daemon for Linux and Windows. A bug was found in containerd prior to versions 1.6.1, 1.5.10, and 1.14.12 where… |
CVE-2021-4076 | High | 7.5 | 2022-03-02 | A flaw exists in tang, a network-based cryptographic binding server, which could result in leak of private keys. |
CVE-2021-3677 | Medium | 6.5 | 2022-03-02 | A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database use… |
CVE-2022-23779 | Medium | 5.3 | 2022-03-02 | Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by reading HTTP redir… |
CVE-2022-22303 | Low | 2.8 | 2022-03-02 | An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiManager versions prior to 7.0.2, 6.4.7 and 6.2.9… |
CVE-2022-0577 | Medium | 6.5 | 2022-03-02 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1. |
CVE-2021-25118 | Medium | 5.3 | 2022-02-28 | The Yoast SEO WordPress plugin (from versions 16.7 until 17.2) discloses the full internal path of featured images in posts via the wp/v2/posts REST endpoints… |
CVE-2022-24633 | Medium | 5.3 | 2022-02-24 | All versions of FileCloud prior to 21.3 are vulnerable to user enumeration. The vulnerability exists in the parameter "path" passing "/SHARED/<username>". A ma… |
CVE-2022-0654 | High | 7.5 | 2022-02-23 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository fgribreau/node-request-retry prior to 7.0.0. |
CVE-2022-23984 | Low | 3.7 | 2022-02-21 | Sensitive information disclosure discovered in wpDiscuz WordPress plugin (versions <= 7.3.11). |
CVE-2022-0708 | Medium | 4.3 | 2022-02-21 | Mattermost 6.3.0 and earlier fails to protect email addresses of the creator of the team via one of the APIs, which allows authenticated team members to access… |
CVE-2021-44141 | Medium | 4.3 | 2022-02-21 | All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the… |
CVE-2022-23982 | Medium | 4.3 | 2022-02-18 | The vulnerability discovered in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4) allows server information exposure. |