CWE-200 · Information Disclosure (page 47)
Page 47 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2014-5011 | Medium | 6.5 | 2020-01-10 | DOMPDF before 0.6.2 allows Information Disclosure. |
CVE-2012-2724 | Medium | 5.3 | 2020-01-09 | The Simplenews module 6.x-1.x before 6.x-1.4, 6.x-2.x before 6.x-2.0-alpha4, and 7.x-1.x before 7.x-1.0-rc1 for Drupal reveals the email addresses of new maili… |
CVE-2019-6331 | Low | 3.3 | 2020-01-09 | An issue was found in Samsung Mobile Print (Android) versions prior to 4.08.007. A potential security vulnerability caused by incomplete obfuscation of applica… |
CVE-2014-3753 | Medium | 5.5 | 2020-01-09 | AgileBits 1Password through 1.0.9.340 allows security feature bypass |
CVE-2019-17018 | Medium | 5.3 | 2020-01-08 | When in Private Browsing Mode on Windows 10, the Windows keyboard may retain word suggestions to improve the accuracy of the keyboard. This vulnerability affec… |
CVE-2016-5346 | Medium | 5.5 | 2020-01-08 | An Information Disclosure vulnerability exists in the Google Pixel/Pixel SL Qualcomm Avtimer Driver due to a NULL pointer dereference when processing an accept… |
CVE-2016-6587 | Medium | 5.5 | 2020-01-08 | An Information Disclosure vulnerability exists in the mid.dat file stored on the SD card in Symantec Norton Mobile Security for Android before 3.16, which coul… |
CVE-2019-14820 | Medium | 4.3 | 2020-01-08 | It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a speci… |
CVE-2020-6170 | Critical | 9.8 | 2020-01-08 | An authentication bypass vulnerability on Genexis Platinum-4410 v2.1 P4410-V2 1.28 devices allows attackers to obtain cleartext credentials from the HTML sourc… |
CVE-2014-5209 | Medium | 5.3 | 2020-01-08 | An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET_RESTRICT control message, which could let a malicious user… |
CVE-2019-6700 | Medium | 6.5 | 2020-01-07 | An information exposure vulnerability in the external authentication profile form of FortiSIEM 5.2.2 and earlier may allow an authenticated attacker to retriev… |
CVE-2019-9541 | Medium | 6.1 | 2020-01-03 | : Information Exposure vulnerability in itemlookup.asp of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an A… |
CVE-2019-19256 | Medium | 5.3 | 2020-01-03 | GitLab Enterprise Edition (EE) 12.2 and later through 12.5 has Incorrect Access Control. |
CVE-2019-19254 | Medium | 5.3 | 2020-01-03 | GitLab Community Edition (CE) and Enterprise Edition (EE). 9.6 and later through 12.5 has Incorrect Access Control. |
CVE-2014-6275 | Medium | 5.9 | 2020-01-02 | FusionForge before 5.3.2 use scripts that run under the shared Apache user, which is also used by project homepages by default. If project webpages are hosted… |
CVE-2018-20495 | Medium | 5.3 | 2019-12-30 | An issue was discovered in GitLab Community and Enterprise Edition 11.3.x and 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows… |
CVE-2018-20488 | Medium | 4.3 | 2019-12-30 | An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows Information Exposu… |
CVE-2012-5476 | Medium | 5.5 | 2019-12-30 | Within the RHOS Essex Preview (2012.2) of the OpenStack dashboard package, the file /etc/quantum/quantum.conf is world readable which exposes the admin passwor… |
CVE-2018-1682 | Medium | 5.3 | 2019-12-30 | IBM Watson Studio Local 1.2.3 could disclose sensitive information over the network that an attacked could use in further attacks against the system. IBM X-For… |
CVE-2013-4868 | Medium | 5.3 | 2019-12-27 | Karotz API 12.07.19.00: Session Token Information Disclosure |
CVE-2012-4420 | High | 7.5 | 2019-12-26 | An information disclosure flaw was found in the way the Java Virtual Machine (JVM) implementation of Java SE 7 as provided by OpenJDK 7 incorrectly initialized… |
CVE-2019-19983 | Medium | 4.3 | 2019-12-26 | In the WordPress plugin, Fast Velocity Minify before 2.7.7, the full web root path to the running WordPress application can be discovered. In order to exploit… |
CVE-2019-11294 | Medium | 4.3 | 2019-12-19 | Cloud Foundry Cloud Controller API (CAPI), version 1.88.0, allows space developers to list all global service brokers, including service broker URLs and GUIDs… |
CVE-2019-5073 | Medium | 5.3 | 2019-12-18 | An exploitable information exposure vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC200 Firmware versions 03.01.07(13) and 03… |
CVE-2019-15580 | Medium | 6.5 | 2019-12-18 | An information exposure vulnerability exists in gitlab.com <v12.3.2, <v12.2.6, and <v12.1.10 when using the blocking merge request feature, it was possible for… |
CVE-2019-15577 | Medium | 4.3 | 2019-12-18 | An information disclosure vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed project milestones to be disclosed via groups bro… |
CVE-2019-15576 | High | 7.5 | 2019-12-18 | An information disclosure vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed an attacker to view private system notes from a G… |
CVE-2019-8730 | Low | 3.3 | 2019-12-18 | The contents of locked notes sometimes appeared in search results. This issue was addressed with improved data cleanup. This issue is fixed in macOS Catalina 1… |
CVE-2019-8620 | High | 7.5 | 2019-12-18 | A user privacy issue was addressed by removing the broadcast MAC address. This issue is fixed in iOS 12.3, tvOS 12.3, watchOS 5.2.1. A device may be passively… |
CVE-2019-8567 | High | 7.5 | 2019-12-18 | A user privacy issue was addressed by removing the broadcast MAC address. This issue is fixed in iOS 12.2. A device may be passively tracked by its WiFi MAC ad… |
CVE-2019-3993 | High | 7.5 | 2019-12-17 | ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote unauthenticated attacker can recover a user's password hash by se… |
CVE-2019-3992 | High | 7.5 | 2019-12-17 | ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote unauthenticated attacker can access the server's configuration fi… |
CVE-2019-12414 | Medium | 5.3 | 2019-12-16 | In Apache Incubator Superset before 0.32, a user can view database names that he has no access to on a dropdown list in SQLLab |
CVE-2019-4444 | Medium | 5.5 | 2019-12-16 | IBM API Connect 2018.1 through 2018.4.1.7 Developer Portal's user registration page does not disable password autocomplete. An attacker with access to the brow… |
CVE-2019-18335 | Medium | 5.3 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application… |
CVE-2019-18334 | Medium | 5.3 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application… |
CVE-2019-18333 | Medium | 5.3 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application… |
CVE-2019-18332 | Medium | 5.3 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application… |
CVE-2019-18331 | Medium | 5.3 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application… |
CVE-2019-18287 | Medium | 5.3 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). The Application Server exposes directory listings… |
CVE-2019-18286 | Medium | 5.3 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). The Application Server exposes directory listings… |
CVE-2019-0405 | High | 7.5 | 2019-12-11 | SAP Enable Now, before version 1911, leaks information about the existence of a particular user which can be used to construct a list of users, leading to a us… |
CVE-2019-1489 | High | 7.5 | 2019-12-10 | An information disclosure vulnerability exists when the Windows Remote Desktop Protocol (RDP) fails to properly handle objects in memory, aka 'Remote Desktop P… |
CVE-2019-1487 | Medium | 6.5 | 2019-12-10 | An information disclosure vulnerability in Android Apps using Microsoft Authentication Library (MSAL) 0.3.1-Alpha or later exists under specific conditions, ak… |
CVE-2019-1474 | Medium | 5.5 | 2019-12-10 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnera… |
CVE-2019-1472 | Medium | 5.5 | 2019-12-10 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnera… |
CVE-2019-1470 | Medium | 6.0 | 2019-12-10 | An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a… |
CVE-2019-1469 | Medium | 5.5 | 2019-12-10 | An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerabili… |
CVE-2019-1467 | Medium | 6.5 | 2019-12-10 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis… |
CVE-2019-1464 | Medium | 5.5 | 2019-12-10 | An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel Information Disclosur… |
CVE-2019-1463 | Medium | 5.5 | 2019-12-10 | An information disclosure vulnerability exists in Microsoft Access software when the software fails to properly handle objects in memory, aka 'Microsoft Access… |
CVE-2019-1400 | Medium | 5.5 | 2019-12-10 | An information disclosure vulnerability exists in Microsoft Access software when the software fails to properly handle objects in memory, aka 'Microsoft Access… |
CVE-2019-13744 | Medium | 6.5 | 2019-12-10 | Insufficient policy enforcement in cookies in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2019-13737 | Medium | 6.5 | 2019-12-10 | Insufficient policy enforcement in autocomplete in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information fr… |
CVE-2014-0242 | High | 7.5 | 2019-12-09 | mod_wsgi module before 3.4 for Apache, when used in embedded mode, might allow remote attackers to obtain sensitive information via the Content-Type header whi… |
CVE-2019-19627 | Medium | 5.3 | 2019-12-06 | SROS 2 0.8.1 (after CVE-2019-19625 is mitigated) leaks ROS 2 node-related information regardless of the rtps_protection_kind configuration. (SROS2 provides the… |
CVE-2019-19625 | Medium | 5.3 | 2019-12-06 | SROS 2 0.8.1 (which provides the tools that generate and distribute keys for Robot Operating System 2 and uses the underlying security plugins of DDS from ROS… |
CVE-2012-1105 | Medium | 5.5 | 2019-12-05 | An Information Disclosure vulnerability exists in the Jasig Project php-pear-CAS 1.2.2 package in the /tmp directory. The Central Authentication Service client… |
CVE-2019-19007 | High | 7.2 | 2019-12-05 | Intelbras IWR 3000N 1.8.7 devices allow disclosure of the administrator login name and password because v1/system/user is mishandled, a related issue to CVE-20… |
CVE-2014-3591 | Medium | 4.2 | 2019-11-29 | Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to ob… |
CVE-2019-18660 | Medium | 4.7 | 2019-11-27 | The Linux kernel before 5.4.1 on powerpc allows Information Exposure because the Spectre-RSB mitigation is not in place for all applicable CPUs, aka CID-39e72b… |
CVE-2011-2480 | High | 7.5 | 2019-11-27 | Information Disclosure vulnerability in the 802.11 stack, as used in FreeBSD before 8.2 and NetBSD when using certain non-x86 architectures. A signedness error… |
CVE-2019-10195 | Medium | 6.5 | 2019-11-27 | A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way that FreeIPA's batch… |
CVE-2011-1934 | Medium | 4.3 | 2019-11-26 | lilo-uuid-diskid causes lilo.conf to be world-readable in lilo 23.1. |
CVE-2019-18679 | High | 7.5 | 2019-11-26 | An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect data management, it is vulnerable to information disclosure when processing HT… |
CVE-2019-18461 | Medium | 4.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.3 when a sub group epic is added to a public group. It has Incorrect Access… |
CVE-2019-18460 | High | 7.5 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4 in the Comments Search feature provided by the Elasticsearch integration… |
CVE-2016-5724 | High | 7.5 | 2019-11-26 | Cloudera CDH before 5.9 has Potentially Sensitive Information in Diagnostic Support Bundles. |
CVE-2015-6495 | High | 7.5 | 2019-11-26 | There is Sensitive Information in Cloudera Manager before 5.4.6 Diagnostic Support Bundles. |
CVE-2011-4076 | Medium | 5.9 | 2019-11-26 | OpenStack Nova before 2012.1 allows someone with access to an EC2_ACCESS_KEY (equivalent to a username) to obtain the EC2_SECRET_KEY (equivalent to a password)… |
CVE-2019-10224 | Medium | 4.6 | 2019-11-25 | A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and dsconf commands may display sensitive inf… |
CVE-2019-10217 | Medium | 6.5 | 2019-11-25 | A flaw was found in ansible 2.8.0 before 2.8.4. Fields managing sensitive data should be set as such by no_log feature. Some of these fields in GCP modules are… |
CVE-2019-5880 | High | 7.4 | 2019-11-25 | Insufficient policy enforcement in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2012-5644 | Medium | 5.5 | 2019-11-25 | libuser has information disclosure when moving user's home directory |
CVE-2012-5535 | High | 7.5 | 2019-11-25 | gnome-system-log polkit policy allows arbitrary files on the system to be read |
CVE-2019-16285 | Medium | 4.6 | 2019-11-22 | If a local user has been configured and logged in, an unauthenticated attacker with physical access may be able to extract sensitive information onto a local d… |
CVE-2012-6079 | High | 7.5 | 2019-11-22 | W3 Total Cache before 0.9.2.5 exposes sensitive cached database information which allows remote attackers to download this information via their hash keys. |
CVE-2012-6078 | High | 7.5 | 2019-11-22 | W3 Total Cache before 0.9.2.5 generates hash keys insecurely which allows remote attackers to predict the values of the hashes. |
CVE-2012-6077 | High | 7.5 | 2019-11-22 | W3 Total Cache before 0.9.2.5 allows remote attackers to retrieve password hash information due to insecure storage of database cache files. |
CVE-2013-3314 | High | 7.5 | 2019-11-21 | The Loftek Nexus 543 IP Camera allows remote attackers to obtain (1) IP addresses via a request to get_realip.cgi or (2) firmware versions (ui and system), tim… |
CVE-2019-6852 | High | 7.5 | 2019-11-20 | A CWE-200: Information Exposure vulnerability exists in Modicon Controllers (M340 CPUs, M340 communication modules, Premium CPUs, Premium communication modules… |
CVE-2015-3167 | High | 7.5 | 2019-11-20 | contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error respons… |
CVE-2013-1817 | High | 7.5 | 2019-11-20 | MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive information. |
CVE-2019-10083 | Medium | 5.3 | 2019-11-19 | When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of its contents (at the top most level, not… |
CVE-2012-0843 | Medium | 5.5 | 2019-11-19 | uzbl: Information disclosure via world-readable cookies storage file |
CVE-2011-4919 | High | 7.5 | 2019-11-19 | mpack 1.6 has information disclosure via eavesdropping on mails sent by other users |
CVE-2012-0842 | Medium | 5.5 | 2019-11-19 | surf: cookie jar has read access from other local user |
CVE-2019-19022 | High | 7.5 | 2019-11-17 | iTerm2 through 3.3.6 has potentially insufficient documentation about the presence of search history in com.googlecode.iterm2.plist, which might allow remote a… |
CVE-2013-7089 | High | 7.5 | 2019-11-15 | ClamAV before 0.97.7: dbg_printhex possible information leak |
CVE-2019-18987 | Medium | 5.3 | 2019-11-15 | An issue was discovered in the AbuseFilter extension through 1.34 for MediaWiki. Once a specific abuse filter has (accidentally or otherwise) been made public… |
CVE-2013-3070 | High | 7.5 | 2019-11-14 | An Information Disclosure vulnerability exists in Netgear WNDR4700 running firmware 1.0.0.34 in the management web interface, which discloses the PSK of the wi… |
CVE-2012-1169 | Medium | 5.3 | 2019-11-14 | Moodle before 2.2.2 has Personal information disclosure, when administrative setting users name display is set to first name only full names are shown in page… |
CVE-2012-1161 | Medium | 4.3 | 2019-11-14 | Moodle before 2.2.2: Course information leak via hidden courses being displayed in tag search results |
CVE-2012-1159 | Medium | 4.3 | 2019-11-14 | Moodle before 2.2.2: Overview report allows users to see hidden courses |
CVE-2012-1158 | Medium | 4.3 | 2019-11-14 | Moodle before 2.2.2 has a course information leak in gradebook where users are able to see hidden grade items in export |
CVE-2012-1155 | High | 7.5 | 2019-11-14 | Moodle has a database activity export permission issue where the export function of the database activity module exports all entries even those from groups the… |
CVE-2019-0390 | Medium | 4.3 | 2019-11-13 | Under certain conditions SAP Data Hub (corrected in DH_Foundation version 2) allows an attacker to access information which would otherwise be restricted. Conn… |
CVE-2011-4972 | High | 7.5 | 2019-11-13 | hook_file_download in the CKEditor module 7.x-1.4 for Drupal does not properly restrict access to private files, which allows remote attackers to read private… |
CVE-2019-14367 | High | 7.5 | 2019-11-12 | Slack-Chat through 1.5.5 leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack (channels, members, et… |
CVE-2019-14366 | High | 7.5 | 2019-11-12 | WP SlackSync plugin through 1.8.5 for WordPress leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack… |