CWE-200 · Information Disclosure (page 48)
Page 48 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-22925 | Medium | 5.3 | 2021-08-05 | curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET… |
CVE-2021-34707 | Medium | 6.5 | 2021-08-04 | A vulnerability in the REST API of Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker to access sensitive data on… |
CVE-2021-32787 | Low | 3.1 | 2021-08-02 | Sourcegraph is a code search and navigation engine. Sourcegraph before version 3.30.0 has two potential information leaks. The site-admin area can be accessed… |
CVE-2021-20332 | Medium | 4.2 | 2021-08-02 | Specific MongoDB Rust Driver versions can include credentials used by the connection pool to authenticate connections in the monitoring event that is emitted w… |
CVE-2021-36091 | Low | 3.5 | 2021-07-26 | Agents are able to list appointments in the calendars without required permissions. This issue affects: OTRS AG ((OTRS)) Community Edition: 6.0.x version 6.0.1… |
CVE-2021-21443 | Low | 3.5 | 2021-07-26 | Agents are able to list customer user emails without required permissions in the bulk action screen. This issue affects: OTRS AG ((OTRS)) Community Edition: 6… |
CVE-2021-21440 | Medium | 5.2 | 2021-07-26 | Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x… |
CVE-2020-7387 | Medium | 5.3 | 2021-07-22 | Sage X3 Installation Pathname Disclosure. A specially crafted packet can elicit a response from the AdxDSrv.exe component that reveals the installation directo… |
CVE-2021-22001 | High | 7.5 | 2021-07-22 | In UAA versions prior to 75.3.0, sensitive information like relaying secret of the provider was revealed in response when deletion request of an identity provi… |
CVE-2021-22770 | Medium | 6.5 | 2021-07-21 | A CWE-200: Information Exposure vulnerability exists in Easergy T300 with firmware V2.7.1 and older that exposes sensitive information to an actor not explicit… |
CVE-2021-22728 | Medium | 6.5 | 2021-07-21 | A CWE-200: Information Exposure vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV… |
CVE-2021-22721 | Medium | 5.3 | 2021-07-21 | A CWE-200: Information Exposure vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV… |
CVE-2021-22145 | Medium | 6.5 | 2021-07-21 | A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elas… |
CVE-2021-21817 | High | 7.5 | 2021-07-16 | An information disclosure vulnerability exists in the Zebra IP Routing Manager functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request ca… |
CVE-2021-21816 | Medium | 4.3 | 2021-07-16 | An information disclosure vulnerability exists in the Syslog functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lead to the disc… |
CVE-2021-0291 | Medium | 6.5 | 2021-07-15 | An Exposure of System Data vulnerability in Juniper Networks Junos OS and Junos OS Evolved, where a sensitive system-level resource is not being sufficiently p… |
CVE-2021-32770 | High | 7.5 | 2021-07-15 | Gatsby is a framework for building websites. The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP Basic Authentication var… |
CVE-2021-20498 | Medium | 5.3 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 reveals version information in HTTP requests that could be used in further attacks against the system. IBM X-Force ID… |
CVE-2021-34429 | Medium | 5.3 | 2021-07-15 | For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF… |
CVE-2021-32750 | Medium | 6.8 | 2021-07-15 | MuWire is a file publishing and networking tool that protects the identity of its users by using I2P technology. Users of MuWire desktop client prior to versio… |
CVE-2021-21587 | Medium | 5.3 | 2021-07-15 | Dell Wyse Management Suite versions 3.2 and earlier contain a full path disclosure vulnerability. A local unauthenticated attacker could exploit this vulnerabi… |
CVE-2021-35527 | High | 7.5 | 2021-07-14 | Password autocomplete vulnerability in the web application password field of Hitachi ABB Power Grids eSOMS allows attacker to gain access to user credentials t… |
CVE-2021-0602 | High | 7.8 | 2021-07-14 | In onCreateOptionsMenu of WifiNetworkDetailsFragment.java, there is a possible way for guest users to view and modify Wi-Fi settings for all configured APs due… |
CVE-2021-33687 | Medium | 4.9 | 2021-07-14 | SAP NetWeaver AS JAVA (Enterprise Portal), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50 reveals sensitive information in one of their HTTP requests, an attack… |
CVE-2021-33709 | Medium | 4.3 | 2021-07-13 | A vulnerability has been identified in Teamcenter Active Workspace V4 (All versions < V4.3.9), Teamcenter Active Workspace V5.0 (All versions < V5.0.7), Teamce… |
CVE-2021-32747 | Medium | 5.3 | 2021-07-12 | Icinga Web 2 is an open source monitoring web interface, framework, and command-line interface. A vulnerability in which custom variables are exposed to unauth… |
CVE-2021-32707 | Medium | 4.3 | 2021-07-12 | Nextcloud Mail is a mail app for Nextcloud. In versions prior to 1.9.6, the Nextcloud Mail application does not, by default, render images in emails to not lea… |
CVE-2021-32689 | High | 8.1 | 2021-07-12 | Nextcloud Talk is a fully on-premises audio/video and chat communication service. In versions prior to 11.2.2, if a user was able to reuse an earlier used user… |
CVE-2021-21591 | Medium | 6.4 | 2021-07-12 | Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.1.0.0.5.394 contain a plain-text password storage vulnerability. A local malicious user with high pr… |
CVE-2021-21590 | Medium | 6.4 | 2021-07-12 | Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.1.0.0.5.394 contain a plain-text password storage vulnerability. A local malicious user with high pr… |
CVE-2021-22917 | Medium | 6.5 | 2021-07-12 | Brave Browser Desktop between versions 1.17 and 1.20 is vulnerable to information disclosure by way of DNS requests in Tor windows not flowing through Tor if a… |
CVE-2021-22916 | Medium | 5.9 | 2021-07-12 | In Brave Desktop between versions 1.17 and 1.26.60, when adblocking is enabled and a proxy browser extension is installed, the CNAME adblocking feature issues… |
CVE-2021-1562 | Medium | 4.3 | 2021-07-08 | A vulnerability in the XSI-Actions interface of Cisco BroadWorks Application Server could allow an authenticated, remote attacker to access sensitive informati… |
CVE-2021-25432 | Low | 3.3 | 2021-07-08 | Information exposure vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O(8.1) and below, and 3.9.10.11 in Android P(9.0) and above allows… |
CVE-2021-25426 | High | 7.5 | 2021-07-08 | Improper component protection vulnerability in SmsViewerActivity of Samsung Message prior to SMR July-2021 Release 1 allows untrusted applications to access Me… |
CVE-2021-32528 | Medium | 5.3 | 2021-07-07 | Observable behavioral discrepancy vulnerability in QSAN Storage Manager allows remote attackers to obtain the system information without permissions. Suggest c… |
CVE-2021-32731 | Medium | 5.3 | 2021-07-01 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Between (and including) versions 13.1RC1 and 13.1, the… |
CVE-2021-32720 | Medium | 5.3 | 2021-06-28 | Sylius is an Open Source eCommerce platform on top of Symfony. In versions of Sylius prior to 1.9.5 and 1.10.0-RC.1, part of the details (order ID, order numbe… |
CVE-2021-32717 | High | 7.5 | 2021-06-24 | Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 private files publicly accessible with Cloud Storage providers when the hashed URL… |
CVE-2021-32716 | Medium | 4.4 | 2021-06-24 | Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 the admin api has exposed some internal hidden fields when an association has been… |
CVE-2021-32712 | Medium | 5.3 | 2021-06-24 | Shopware is an open source eCommerce platform. Versions prior to 5.6.10 are vulnerable to system information leakage in error handling. Users are recommend to… |
CVE-2021-32711 | Critical | 9.1 | 2021-06-24 | Shopware is an open source eCommerce platform. Versions prior to 6.3.5.1 may leak of information via Store-API. The vulnerability could only be fixed by changi… |
CVE-2021-25652 | Medium | 4.9 | 2021-06-24 | An information disclosure vulnerability was discovered in the directory and file management of Avaya Aura Appliance Virtualization Platform Utilities (AVPU). T… |
CVE-2021-25649 | Medium | 4.9 | 2021-06-24 | An information disclosure vulnerability was discovered in the directory and file management of Avaya Aura Utility Services. This vulnerability may potentially… |
CVE-2021-20019 | High | 7.5 | 2021-06-23 | A vulnerability in SonicOS where the HTTP server response leaks partial memory by sending a crafted HTTP request, this can potentially lead to an internal sens… |
CVE-2021-29086 | Medium | 5.3 | 2021-06-23 | Exposure of sensitive information to an unauthorized actor vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows… |
CVE-2010-1432 | High | 7.5 | 2021-06-21 | Joomla! Core is prone to an information disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may help in launching f… |
CVE-2021-32695 | Low | 3.9 | 2021-06-17 | Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.16.1, a malicious app on the same device could have gotten access to the shar… |
CVE-2021-32690 | Medium | 6.8 | 2021-06-16 | Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources). In versions of helm prior to 3.6.1, a vulnerability exists where the user… |
CVE-2020-12987 | Medium | 5.5 | 2021-06-11 | A heap information leak/kernel pool address disclosure vulnerability in the AMD Graphics Driver for Windows 10 may lead to KASLR bypass. |
CVE-2021-23204 | High | 8.1 | 2021-06-11 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gallagher Command Centre Server allows OSDP key material to be exposed to Command C… |
CVE-2021-22913 | Medium | 6.5 | 2021-06-11 | Nextcloud Deck before 1.2.7, 1.4.1 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by default instead… |
CVE-2021-22912 | Medium | 6.5 | 2021-06-11 | Nextcloud iOS before 3.4.2 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by default instead of only… |
CVE-2021-22905 | Medium | 6.5 | 2021-06-11 | Nextcloud Android App (com.nextcloud.client) before v3.16.0 is vulnerable to information disclosure due to searches for sharees being performed by default on t… |
CVE-2021-22898 | Low | 3.1 | 2021-06-11 | curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send… |
CVE-2021-22749 | Medium | 5.3 | 2021-06-11 | A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Modicon X80 BMXNOR0200H RTU SV1.70 IR22 and prior that could caus… |
CVE-2021-25403 | Low | 3.3 | 2021-06-11 | Intent redirection vulnerability in Samsung Account prior to version 10.8.0.4 in Android P(9.0) and below, and 12.2.0.9 in Android Q(10.0) and above allows att… |
CVE-2021-25392 | Medium | 4.0 | 2021-06-11 | Improper protection of backup path configuration in Samsung Dex prior to SMR MAY-2021 Release 1 allows local attackers to get sensitive information via changin… |
CVE-2021-28805 | High | 7.8 | 2021-06-11 | Inclusion of sensitive information in the source code has been reported to affect certain QNAP switches running QSS. If exploited, this vulnerability allows at… |
CVE-2021-28169 | Medium | 5.3 | 2021-06-09 | For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected res… |
CVE-2021-32658 | Medium | 4.7 | 2021-06-08 | Nextcloud Android is the Android client for the Nextcloud open source home cloud system. Due to a timeout issue the Android client may not properly clean all s… |
CVE-2021-20259 | High | 7.8 | 2021-06-07 | A flaw was found in the Foreman project. The Proxmox compute resource exposes the password through the API to an authenticated local attacker with view_hosts p… |
CVE-2021-33839 | High | 7.5 | 2021-06-04 | Luca through 1.7.4 on Android allows remote attackers to obtain sensitive information about COVID-19 tracking because the QR code of a Public Location can be i… |
CVE-2017-8761 | Medium | 4.3 | 2021-06-02 | In OpenStack Swift through 2.10.1, 2.11.0 through 2.13.0, and 2.14.0, the proxy-server logs full tempurl paths, potentially leaking reusable tempurl signatures… |
CVE-2020-14371 | Medium | 6.5 | 2021-06-02 | A credential leak vulnerability was found in Red Hat Satellite. This flaw exposes the compute resources credentials through VMs that are running on these resou… |
CVE-2020-14335 | Medium | 5.5 | 2021-06-02 | A flaw was found in Red Hat Satellite, which allows a privileged attacker to read OMAPI secrets through the ISC DHCP of Smart-Proxy. This flaw allows an attack… |
CVE-2021-20585 | Medium | 5.3 | 2021-06-01 | IBM Security Verify Access 20.07 could disclose sensitive information in HTTP server headers that could be used in further attacks against the system. IBM X-Fo… |
CVE-2020-14329 | Low | 3.3 | 2021-05-27 | A data exposure flaw was found in Ansible Tower in versions before 3.7.2, where sensitive data can be exposed from the /api/v2/labels/ endpoint. This flaw allo… |
CVE-2020-10698 | Low | 3.3 | 2021-05-27 | A flaw was found in Ansible Tower when running jobs. This flaw allows an attacker to access the stdout of the executed jobs which are run from other organizati… |
CVE-2021-22892 | High | 7.5 | 2021-05-27 | An information disclosure vulnerability exists in the Rocket.Chat server fixed v3.13, v3.12.2 & v3.11.3 that allowed email addresses to be disclosed by enumera… |
CVE-2021-22740 | Medium | 6.5 | 2021-05-26 | Information Exposure vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause information to be exposed when an unautho… |
CVE-2021-22739 | Medium | 5.9 | 2021-05-26 | Information Exposure vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause a device to be compromised when it is fir… |
CVE-2021-32638 | Medium | 4.4 | 2021-05-25 | Github's CodeQL action is provided to run CodeQL-based code scanning on non-GitHub CI/CD systems and requires a GitHub access token to connect to a GitHub repo… |
CVE-2021-23937 | High | 7.5 | 2021-05-25 | A DNS proxy and possible amplification attack vulnerability in WebClientInfo of Apache Wicket allows an attacker to trigger arbitrary DNS lookups from the serv… |
CVE-2021-32624 | High | 7.5 | 2021-05-24 | Keystone 5 is an open source CMS platform to build Node.js applications. This security advisory relates to a newly discovered capability in our query infrastru… |
CVE-2021-27434 | High | 7.5 | 2021-05-20 | Products with Unified Automation .NET based OPC UA Client/Server SDK Bundle: Versions V3.0.7 and prior (.NET 4.5, 4.0, and 3.5 Framework versions only) are vul… |
CVE-2021-3426 | Medium | 5.7 | 2021-05-20 | There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server co… |
CVE-2021-21733 | Medium | 4.9 | 2021-05-19 | The management system of ZXCDN is impacted by the information leak vulnerability. Attackers can make further analysis according to the information returned by… |
CVE-2021-32820 | High | 8.6 | 2021-05-14 | Express-handlebars is a Handlebars view engine for Express. Express-handlebars mixes pure template data with engine configuration options through the Express r… |
CVE-2021-32819 | High | 8.0 | 2021-05-14 | Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configurati… |
CVE-2021-32817 | Medium | 5.4 | 2021-05-14 | express-hbs is an Express handlebars template engine. express-hbs mixes pure template data with engine configuration options through the Express render API. Mo… |
CVE-2021-22137 | Medium | 5.3 | 2021-05-13 | In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Security is used. Search queries do not pr… |
CVE-2021-22135 | Medium | 5.3 | 2021-05-13 | Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile API when Document and F… |
CVE-2021-21424 | Medium | 5.3 | 2021-05-13 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant… |
CVE-2021-20993 | Medium | 5.3 | 2021-05-13 | In multiple managed switches by WAGO in different versions the activated directory listing provides an attacker with the index of the resources located inside… |
CVE-2021-20250 | Medium | 4.3 | 2021-05-13 | A flaw was found in wildfly. The JBoss EJB client has publicly accessible privileged actions which may lead to information disclosure on the server it is deplo… |
CVE-2021-20331 | Medium | 4.2 | 2021-05-13 | Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an applica… |
CVE-2021-20313 | High | 7.5 | 2021-05-11 | A flaw was found in ImageMagick in versions before 7.0.11. A potential cipher leak when the calculate signatures in TransformSignature is possible. The highest… |
CVE-2021-31173 | Medium | 5.3 | 2021-05-11 | Microsoft SharePoint Server Information Disclosure Vulnerability |
CVE-2021-31918 | High | 7.5 | 2021-05-06 | A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log file is readable to all users during stack update and creatio… |
CVE-2021-21537 | Medium | 6.2 | 2021-04-30 | Dell Hybrid Client versions prior to 1.5 contain an information exposure vulnerability. A local unauthenticated attacker may exploit this vulnerability in orde… |
CVE-2021-21536 | Medium | 6.2 | 2021-04-30 | Dell Hybrid Client versions prior to 1.5 contain an information exposure vulnerability. A local unauthenticated attacker may exploit this vulnerability in orde… |
CVE-2021-21534 | Medium | 4.0 | 2021-04-30 | Dell Hybrid Client versions prior to 1.5 contain an information exposure vulnerability. A local unauthenticated attacker may exploit this vulnerability in orde… |
CVE-2021-20228 | High | 7.5 | 2021-04-29 | A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature when using the sub-opti… |
CVE-2021-29483 | Critical | 9.4 | 2021-04-28 | ManageWiki is an extension to the MediaWiki project. The 'wikiconfig' API leaked the value of private configuration variables set through the ManageWiki variab… |
CVE-2021-30169 | Medium | 5.3 | 2021-04-28 | The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant user’s credential. |
CVE-2021-30168 | Critical | 9.8 | 2021-04-28 | The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant administrator’s credential and further control… |
CVE-2021-30638 | High | 7.5 | 2021-04-27 | Information Exposure vulnerability in context asset handling of Apache Tapestry allows an attacker to download files inside WEB-INF if using a specially-constr… |
CVE-2020-36319 | Low | 3.1 | 2021-04-23 | Insecure configuration of default ObjectMapper in com.vaadin:flow-server versions 3.0.0 through 3.0.5 (Vaadin 15.0.0 through 15.0.4) may expose sensitive data… |
CVE-2021-31549 | Medium | 4.3 | 2021-04-22 | An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. The Special:AbuseFilter/examine form allowed for the disclosure of suppresse… |