CWE-200 · Information Disclosure (page 46)
Page 46 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-1753 | Medium | 5.0 | 2020-03-16 | A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versi… |
CVE-2020-10090 | Medium | 5.3 | 2020-03-13 | GitLab 11.7 through 12.8.1 allows Information Disclosure. Under certain group conditions, group epic information was unintentionally being disclosed. |
CVE-2020-10195 | Medium | 6.3 | 2020-03-13 | The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege escalation via admi… |
CVE-2019-16157 | Medium | 6.5 | 2020-03-13 | An information exposure vulnerability in Fortinet FortiWeb 6.2.0 CLI and earlier may allow an authenticated user to view sensitive information being logged via… |
CVE-2020-1739 | Low | 3.9 | 2020-03-12 | A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of svn module, it is use… |
CVE-2019-9103 | Medium | 5.3 | 2020-03-11 | An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices… |
CVE-2020-6178 | Medium | 5.4 | 2020-03-10 | SAP Enable Now, before version 1911, sends the Session ID cookie value in URL. This might be stolen from the browser history or log files, leading to Informati… |
CVE-2020-0062 | High | 7.5 | 2020-03-10 | In Euicc, there is a possible information disclosure due to an included test Certificate. This could lead to remote information disclosure with no additional e… |
CVE-2020-0031 | Medium | 5.0 | 2020-03-10 | In triggerAugmentedAutofillLocked and related functions of Session.java, it is possible for Augmented Autofill to display sensitive information to the user ina… |
CVE-2020-0029 | Low | 2.3 | 2020-03-10 | In the WifiConfigManager, there is a possible storage of location history which can only be deleted by triggering a factory reset. This could lead to local inf… |
CVE-2019-13457 | Medium | 4.3 | 2020-03-10 | An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8. A customer user can use the search results to disclose information from their… |
CVE-2012-1094 | High | 7.5 | 2020-03-10 | JBoss AS 7 prior to 7.1.1 and mod_cluster do not handle default hostname in the same way, which can cause the excluded-contexts list to be mismatched and the r… |
CVE-2019-12432 | Medium | 4.3 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 8.13 through 11.11. Non-member users who subscribed to issue notifications could access the… |
CVE-2011-4538 | Medium | 5.3 | 2020-03-09 | Lexmark X, W, T, E, and C devices before 2012-02-09 allow attackers to obtain sensitive information by reading passwords within exported settings. |
CVE-2011-3269 | High | 7.5 | 2020-03-09 | Lexmark X, W, T, E, C, 6500e, and 25xxN devices before 2011-11-15 allow attackers to obtain sensitive information via a hidden email address in a Scan To Email… |
CVE-2016-1159 | Medium | 6.5 | 2020-03-09 | In ZOHO Password Manager Pro (PMP) 8.3.0 (Build 8303) and 8.4.0 (Build 8400,8401,8402), underprivileged users can obtain sensitive information (entry password… |
CVE-2020-9386 | Medium | 4.3 | 2020-03-09 | In Mahara 18.10 before 18.10.5, 19.04 before 19.04.4, and 19.10 before 19.10.2, file metadata information is disclosed to group members in the Elasticsearch re… |
CVE-2020-9282 | Medium | 6.5 | 2020-03-09 | In Mahara 18.10 before 18.10.5, 19.04 before 19.04.4, and 19.10 before 19.10.2, certain personal information is discoverable inspecting network responses on th… |
CVE-2020-10104 | Medium | 4.3 | 2020-03-05 | An issue was discovered in Zammad 3.0 through 3.2. After authentication, it transmits sensitive information to the user that may be compromised and used by an… |
CVE-2020-10096 | High | 7.5 | 2020-03-05 | An issue was discovered in Zammad 3.0 through 3.2. It does not prevent caching of confidential data within browser memory. An attacker who either remotely comp… |
CVE-2020-7130 | High | 7.5 | 2020-03-04 | HPE OneView Global Dashboard (OVGD) 1.9 has a remote information disclosure vulnerability. HPE OneView Global Dashboard - After Upgrade or Install of OVGD Vers… |
CVE-2020-3193 | Medium | 5.3 | 2020-03-04 | A vulnerability in the web-based management interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to obtain sensi… |
CVE-2020-3182 | Medium | 4.3 | 2020-03-04 | A vulnerability in the multicast DNS (mDNS) protocol configuration of Cisco Webex Meetings Client for MacOS could allow an unauthenticated adjacent attacker to… |
CVE-2019-14893 | Critical | 9.8 | 2020-03-02 | A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious ob… |
CVE-2019-14892 | Critical | 9.8 | 2020-03-02 | A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious obj… |
CVE-2018-8878 | Medium | 5.3 | 2020-02-27 | Information disclosure in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attack… |
CVE-2018-8877 | Medium | 5.3 | 2020-02-27 | Information disclosure in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attack… |
CVE-2020-9337 | Medium | 6.5 | 2020-02-26 | In GolfBuddy Course Manager 1.1, passwords are sent (with base64 encoding) via a GET request. |
CVE-2020-5244 | High | 8.0 | 2020-02-24 | In BuddyPress before 5.1.2, requests to a certain REST API endpoint can result in private user data getting exposed. Authentication is not needed. This has bee… |
CVE-2013-3587 | Medium | 5.9 | 2020-02-21 | The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which… |
CVE-2012-0844 | Medium | 5.5 | 2020-02-21 | Information-disclosure vulnerability in Netsurf through 2.8 due to a world-readable cookie jar. |
CVE-2013-4088 | Medium | 6.5 | 2020-02-21 | Kernel/Modules/AgentTicketWatcher.pm in Open Ticket Request System (OTRS) 3.0.x before 3.0.21, 3.1.x before 3.1.17, and 3.2.x before 3.2.8 does not properly re… |
CVE-2013-3551 | Medium | 6.5 | 2020-02-21 | Kernel/Modules/AgentTicketPhone.pm in Open Ticket Request System (OTRS) 3.0.x before 3.0.20, 3.1.x before 3.1.16, and 3.2.x before 3.2.7, and OTRS ITSM 3.0.x b… |
CVE-2014-4019 | High | 7.5 | 2020-02-20 | ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK stores sensitive information under the web root with insufficient access control, which allows remote at… |
CVE-2011-4915 | Medium | 5.5 | 2020-02-20 | fs/proc/base.c in the Linux kernel through 3.1 allows local users to obtain sensitive keystroke information via access to /proc/interrupts. |
CVE-2014-4658 | Medium | 5.5 | 2020-02-20 | The vault subsystem in Ansible before 1.5.5 does not set the umask before creation or modification of a vault file, which allows local users to obtain sensitiv… |
CVE-2015-9543 | Low | 3.3 | 2020-02-19 | An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0. It can leak consoleauth tokens into log files. An attacker… |
CVE-2020-9043 | High | 8.8 | 2020-02-17 | The wpCentral plugin before 1.5.1 for WordPress allows disclosure of the connection key. |
CVE-2019-15594 | Medium | 4.3 | 2020-02-14 | GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request endpoint. |
CVE-2019-15592 | Medium | 4.3 | 2020-02-14 | GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via… |
CVE-2019-6193 | High | 7.5 | 2020-02-14 | An information disclosure vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow unauthenticated access to… |
CVE-2013-5687 | High | 7.5 | 2020-02-14 | RiskNet Acquirer before hotfix 6.0 b7+ADHOC-443 ApplicationServiceBean contains a service information disclosure. |
CVE-2012-6091 | High | 7.5 | 2020-02-13 | Zend_XmlRpc Class in Magento before 1.7.0.2 contains an information disclosure vulnerability. |
CVE-2018-3987 | Medium | 5.5 | 2020-02-13 | An exploitable information disclosure vulnerability exists in the 'Secret Chats' functionality of Rakuten Viber on Android 9.3.0.6. The 'Secret Chats' function… |
CVE-2020-6190 | Medium | 5.8 | 2020-02-12 | Certain vulnerable endpoints in SAP NetWeaver AS Java (Heap Dump Application), versions 7.30, 7.31, 7.40, 7.50, provide valuable information about the system l… |
CVE-2011-3901 | High | 7.5 | 2020-02-12 | Android SQLite Journal before 4.0.1 has an information disclosure vulnerability. |
CVE-2011-2343 | Low | 2.4 | 2020-02-12 | The Bluetooth stack in Android before 2.3.6 allows a physically proximate attacker to obtain contact information via an AT phonebook transfer. |
CVE-2013-6681 | Medium | 5.9 | 2020-02-12 | Tube Map Live Underground for Android before 3.0.22 has an Information Disclosure Vulnerability |
CVE-2017-18642 | Medium | 6.5 | 2020-02-10 | Syska Smart Bulb devices through 2017-08-06 receive RGB parameters over cleartext Bluetooth Low Energy (BLE), leading to sniffing, reverse engineering, and rep… |
CVE-2012-5828 | Medium | 6.5 | 2020-02-10 | BlackBerry PlayBook before 2.1 has an Information Disclosure Vulnerability via a Web browser component error |
CVE-2012-1994 | Medium | 5.7 | 2020-02-10 | HP Systems Insight Manager before 7.0 allows a remote user on adjacent network to access information |
CVE-2012-5570 | Medium | 4.3 | 2020-02-08 | The Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with the "access basic_webmail" permission to read arbitrary users… |
CVE-2014-9127 | Medium | 6.5 | 2020-02-08 | Open-School Community Edition 2.2 does not properly restrict access to the export functionality, which allows remote authenticated users to obtain sensitive in… |
CVE-2014-7863 | High | 7.5 | 2020-02-08 | The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, an… |
CVE-2013-0192 | Medium | 4.9 | 2020-02-07 | File Disclosure in SMF (SimpleMachines Forum) <= 2.0.3: Forum admin can read files such as the database config. |
CVE-2013-3564 | Medium | 5.3 | 2020-02-06 | The web interface in VideoLAN VLC media player before 2.0.7 has no access control which allows remote attackers to view directory listings via the 'dir' comman… |
CVE-2013-2683 | Medium | 5.3 | 2020-02-06 | Cisco Linksys E4200 1.0.05 Build 7 devices contain an Information Disclosure Vulnerability which allows remote attackers to obtain private IP addresses and oth… |
CVE-2012-6341 | Medium | 6.5 | 2020-02-06 | An Information Disclosure vulnerability exists in the my config file in NEtGEAR WGR614 v7 and v9, which could let a malicious user recover all previously used… |
CVE-2013-4166 | High | 7.5 | 2020-02-06 | The gpg_ctx_add_recipient function in camel/camel-gpg-context.c in GNOME Evolution 3.8.4 and earlier and Evolution Data Server 3.9.5 and earlier does not prope… |
CVE-2010-3917 | Medium | 6.5 | 2020-02-06 | Google Chrome before 3.0 does not properly handle XML documents, which allows remote attackers to obtain sensitive information via a crafted web site. |
CVE-2015-2802 | High | 7.5 | 2020-02-04 | An Information Disclosure vulnerability exists in HP SiteScope 11.2 and 11.3 on Windows, Linux and Solaris, HP Asset Manager 9.30 through 9.32, 9.40 through 9… |
CVE-2019-4562 | Medium | 5.3 | 2020-02-04 | IBM Security Directory Server 6.4.0 stores sensitive information in URLs. This may lead to information disclosure if unauthorized parties have access to the UR… |
CVE-2013-2676 | High | 7.5 | 2020-02-04 | Brother MFC-9970CDW 1.10 firmware L devices contain an information disclosure vulnerability which allows remote attackers to view private IP addresses and othe… |
CVE-2011-4937 | High | 7.5 | 2020-02-04 | Joomla! 1.7.1 has core information disclosure due to inadequate error checking. |
CVE-2016-4676 | High | 7.5 | 2020-02-03 | A Cross-origin vulnerability exists in WebKit in Apple Safari before 10.0.1 when processing location attributes, which could let a remote malicious user obtain… |
CVE-2013-2674 | High | 7.5 | 2020-02-03 | Brother MFC-9970CDW 1.10 firmware L devices contain an information disclosure vulnerability which allows remote attackers to view sensitive information from re… |
CVE-2013-2631 | Medium | 5.3 | 2020-02-03 | TinyWebGallery (TWG) 1.8.9 and earlier contains a full path disclosure vulnerability which allows remote attackers to obtain sensitive information through the… |
CVE-2013-2624 | Medium | 5.3 | 2020-02-03 | Telean before 1.3.1 contains a full path disclosure vulnerability which could allow remote attackers to obtain sensitive information through a specially crafte… |
CVE-2014-8328 | Medium | 5.3 | 2020-02-03 | The default configuration in the Dynamic Content Elements (dce) extension before 0.11.5 for TYPO3 allows remote attackers to obtain sensitive installation envi… |
CVE-2019-3016 | Medium | 6.2 | 2020-01-31 | In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in the same guest. This p… |
CVE-2011-4088 | High | 7.5 | 2020-01-31 | ABRT might allow attackers to obtain sensitive information from crash reports. |
CVE-2019-19550 | High | 7.5 | 2020-01-31 | Remote Authentication Bypass in Senior Rubiweb 6.2.34.28 and 6.2.34.37 allows admin access to sensitive information of affected users using vulnerable versions… |
CVE-2013-4187 | Medium | 6.5 | 2020-01-30 | The Flippy module 7.x-1.x before 7.x-1.2 for Drupal does not properly restrict access to nodes, which allows remote authenticated users with the permission to… |
CVE-2013-1631 | Medium | 5.3 | 2020-01-30 | Verax NMS prior to 2.1.0 leaks connection details when any user executes a Repair Table action |
CVE-2013-0291 | High | 7.5 | 2020-01-30 | NextGEN Gallery Plugin for WordPress 1.9.10 and 1.9.11 has a Path Disclosure Vulnerability |
CVE-2020-2103 | Medium | 5.4 | 2020-01-29 | Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI diagnostic page. |
CVE-2013-1602 | High | 7.5 | 2020-01-28 | An Information Disclosure vulnerability exists due to insufficient validation of authentication cookies for the RTSP session in D-Link DCS-5635 1.01, DCS-1100L… |
CVE-2013-1601 | Medium | 5.3 | 2020-01-28 | An Information Disclosure vulnerability exists due to a failure to restrict access on the lums.cgi script when processing a live video stream in D-LINK An Info… |
CVE-2013-6455 | Medium | 5.3 | 2020-01-28 | The CentralAuth extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to obtain usernames via vectors re… |
CVE-2019-5470 | High | 7.5 | 2020-01-28 | An information disclosure issue was discovered GitLab versions < 12.1.2, < 12.0.4, and < 11.11.6 in the security dashboard which could result in disclosure of… |
CVE-2019-5465 | Medium | 4.3 | 2020-01-28 | An information disclosure issue was discovered in GitLab CE/EE 8.14 and later, by using the move issue feature which could result in disclosure of the newly cr… |
CVE-2019-15583 | High | 7.5 | 2020-01-28 | An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). When an issue was moved to… |
CVE-2019-15579 | Medium | 5.3 | 2020-01-28 | An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) where the assignee(s) of a… |
CVE-2019-15578 | Medium | 5.3 | 2020-01-28 | An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). The path of a private proj… |
CVE-2013-2499 | High | 7.5 | 2020-01-27 | SimpleHRM 2.3 and earlier could allow remote attackers to bypass the authentication process in 'user_manager.php' via spoofing a cookie. |
CVE-2020-5220 | Medium | 4.4 | 2020-01-27 | Sylius ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended seriali… |
CVE-2014-9481 | Medium | 5.9 | 2020-01-27 | The Scribunto extension for MediaWiki allows remote attackers to obtain the rollback token and possibly other sensitive information via a crafted module, relat… |
CVE-2013-1594 | High | 7.5 | 2020-01-24 | An Information Disclosure vulnerability exists via a GET request in Vivotek PT7135 IP Camera 0300a and 0400a due to wireless keys and 3rd party credentials sto… |
CVE-2019-19631 | High | 8.8 | 2020-01-24 | An issue was discovered in Big Switch Big Monitoring Fabric 6.2 through 6.2.4, 6.3 through 6.3.9, 7.0 through 7.0.3, and 7.1 through 7.1.3; Big Cloud Fabric 4… |
CVE-2013-4176 | Medium | 5.5 | 2020-01-23 | mysecureshell 1.31: Local Information Disclosure Vulnerability |
CVE-2011-3613 | High | 7.5 | 2020-01-22 | An issue exists in Vanilla Forums before 2.0.17.9 due to the way cookies are handled. |
CVE-2018-16269 | High | 7.5 | 2020-01-22 | The wnoti system service in Samsung Galaxy Gear series allows an unprivileged process to take over the internal notification message data, due to improper D-Bu… |
CVE-2018-16264 | Medium | 6.5 | 2020-01-22 | The BlueZ system service in Tizen allows an unprivileged process to partially control Bluetooth or acquire sensitive information, due to improper D-Bus securit… |
CVE-2011-5282 | Medium | 5.3 | 2020-01-21 | mIRC prior to 7.22 has a message leak because chopping of outbound messages is mishandled. |
CVE-2017-3211 | Medium | 5.3 | 2020-01-15 | Yopify, an e-commerce notification plugin, up to April 06, 2017, leaks the first name, last initial, city, and recent purchase data of customers, all without u… |
CVE-2020-6954 | Medium | 6.5 | 2020-01-13 | An issue was discovered on Cayin SMP-PRO4 devices. A user can discover a saved password by viewing the URL after a Connection String Test. This password is sho… |
CVE-2020-5197 | Medium | 4.3 | 2020-01-13 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 5.1 through 12.6.1. It has Incorrect Access Control. |
CVE-2014-6038 | High | 7.5 | 2020-01-13 | Zoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 have a database Information Disclosure Vulnerability. Fixed in EventLog Analyzer 10.0 Bui… |
CVE-2019-14301 | High | 7.5 | 2020-01-10 | Ricoh SP C250DN 1.06 devices have Incorrect Access Control (issue 1 of 2). |
CVE-2019-4559 | Medium | 5.3 | 2020-01-10 | IBM QRadar SIEM 7.3.0 through 7.3.3 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system… |