CWE-200 · Information Disclosure (page 49)
Page 49 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-1216 | Medium | 5.5 | 2019-09-11 | An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Information Disclosure Vulnerability'. |
CVE-2019-1209 | Medium | 6.5 | 2019-09-11 | An information disclosure vulnerability exists in Lync 2013, aka 'Lync 2013 Information Disclosure Vulnerability'. |
CVE-2019-0352 | High | 7.5 | 2019-09-10 | In SAP Business Objects Business Intelligence Platform, before versions 4.1, 4.2 and 4.3, some dynamic pages (like jsp) are cached, which leads to an attacker… |
CVE-2019-16177 | High | 7.5 | 2019-09-09 | In Limesurvey before 3.17.14, the entire database is exposed through browser caching. |
CVE-2019-11605 | High | 7.5 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition 11.8.x before 11.8.10, 11.9.x before 11.9.11, and 11.10.x before 11.10.3. It allows Informat… |
CVE-2019-11545 | Medium | 4.3 | 2019-09-09 | An issue was discovered in GitLab Community Edition 11.9.x before 11.9.10 and 11.10.x before 11.10.2. It allows Information Disclosure. When an issue is moved… |
CVE-2019-5463 | Medium | 5.3 | 2019-09-09 | An authorization issue was discovered in the GitLab CE/EE CI badge images endpoint which could result in disclosure of the build status. This vulnerability was… |
CVE-2019-10667 | Medium | 5.3 | 2019-09-09 | An issue was discovered in LibreNMS through 1.47. Information disclosure can occur: an attacker can fingerprint the exact code version installed and disclose l… |
CVE-2018-21011 | High | 7.5 | 2019-09-09 | The charitable plugin before 1.5.14 for WordPress has unauthorized access to user and donation details. |
CVE-2019-9444 | Medium | 4.4 | 2019-09-06 | In the Android kernel in sync debug fs driver there is a kernel pointer leak due to the usage of printf with %p. This could lead to local information disclosur… |
CVE-2019-2103 | Medium | 5.5 | 2019-09-05 | In Google Assistant in Android 9, there is a possible permissions bypass that allows the Assistant to take a screenshot of apps with FLAG_SECURE. This could le… |
CVE-2019-1976 | Critical | 9.8 | 2019-09-05 | A vulnerability in the “plug-and-play” services component of Cisco Industrial Network Director (IND) could allow an unauthenticated, remote attacke… |
CVE-2019-15902 | Medium | 5.6 | 2019-09-04 | A backporting error was discovered in the Linux stable/longterm kernel 4.4.x through 4.4.190, 4.9.x through 4.9.190, 4.14.x through 4.14.141, 4.19.x through 4… |
CVE-2019-11658 | Medium | 4.3 | 2019-08-30 | Information exposure in Micro Focus Content Manager, versions 9.1, 9.2 and 9.3. This vulnerability when configured to use an Oracle database, allows valid syst… |
CVE-2019-11064 | Critical | 9.8 | 2019-08-29 | A vulnerability of remote credential disclosure was discovered in Advan VD-1 firmware versions up to 230. An attacker can export system configuration which is… |
CVE-2018-13367 | Medium | 5.3 | 2019-08-23 | An information exposure vulnerability in FortiOS 6.2.3, 6.2.0 and below may allow an unauthenticated attacker to gain platform information such as version, mod… |
CVE-2019-13421 | Medium | 4.9 | 2019-08-23 | Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes of other users configured in the internal… |
CVE-2014-10388 | Medium | 5.3 | 2019-08-22 | The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has full path disclosure. |
CVE-2019-6177 | Critical | 9.8 | 2019-08-21 | A vulnerability reported in Lenovo Solution Center version 03.12.003, which is no longer supported, could allow log files to be written to non-standard locatio… |
CVE-2019-1908 | High | 7.5 | 2019-08-21 | A vulnerability in the Intelligent Platform Management Interface (IPMI) implementation of Cisco Integrated Management Controller (IMC) could allow an unauthent… |
CVE-2019-15045 | Medium | 5.3 | 2019-08-21 | AjaxDomainServlet in Zoho ManageEngine ServiceDesk Plus 10 allows User Enumeration. NOTE: the vendor's position is that this is intended functionality |
CVE-2019-12746 | Medium | 6.5 | 2019-08-21 | An issue was discovered in Open Ticket Request System (OTRS) Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. A user logged into OTRS as an age… |
CVE-2019-4437 | Medium | 5.3 | 2019-08-20 | IBM API Connect 2018.1 through 2018.4.1.6 may inadvertently leak sensitive details about internal servers and network via API swagger. IBM X-force ID: 162947. |
CVE-2018-18056 | Medium | 4.6 | 2019-08-20 | An issue was discovered in the Texas Instruments (TI) TM4C, MSP432E and MSP432P microcontroller series. The eXecute-Only-Memory (XOM) implementation prevents c… |
CVE-2017-18550 | Medium | 5.5 | 2019-08-19 | An issue was discovered in drivers/scsi/aacraid/commctrl.c in the Linux kernel before 4.13. There is potential exposure of kernel stack memory because aac_get_… |
CVE-2017-18549 | Medium | 5.5 | 2019-08-19 | An issue was discovered in drivers/scsi/aacraid/commctrl.c in the Linux kernel before 4.13. There is potential exposure of kernel stack memory because aac_send… |
CVE-2019-13511 | Low | 3.3 | 2019-08-15 | Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain an INFORMATION EXPOSURE CWE-200. A maliciously crafted Arena file opened by… |
CVE-2018-14669 | High | 7.5 | 2019-08-15 | ClickHouse MySQL client before versions 1.1.54390 had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a malicious MySQL database read arbitrary fil… |
CVE-2019-14800 | Medium | 5.3 | 2019-08-15 | The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via the wp-admin/admin-… |
CVE-2019-1228 | Medium | 5.5 | 2019-08-14 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulner… |
CVE-2019-1227 | Medium | 5.5 | 2019-08-14 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulner… |
CVE-2019-1225 | High | 7.5 | 2019-08-14 | An information disclosure vulnerability exists when the Windows RDP server improperly discloses the contents of its memory. An attacker who successfully exploi… |
CVE-2019-1224 | High | 7.5 | 2019-08-14 | An information disclosure vulnerability exists when the Windows RDP server improperly discloses the contents of its memory. An attacker who successfully exploi… |
CVE-2019-1202 | Medium | 4.4 | 2019-08-14 | An information disclosure vulnerability exists in the way Microsoft SharePoint handles session objects. An authenticated attacker who successfully exploited th… |
CVE-2019-1172 | Medium | 4.3 | 2019-08-14 | An information disclosure vulnerability exists in Azure Active Directory (AAD) Microsoft Account (MSA) during the login request session. An attacker who succes… |
CVE-2019-1171 | Medium | 5.6 | 2019-08-14 | An information disclosure vulnerability exists in SymCrypt during the OAEP decryption stage. An attacker who successfully exploited this vulnerability could ob… |
CVE-2019-1158 | Medium | 5.5 | 2019-08-14 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exp… |
CVE-2019-1154 | Medium | 5.5 | 2019-08-14 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exp… |
CVE-2019-1143 | Medium | 5.5 | 2019-08-14 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exp… |
CVE-2019-1078 | Medium | 5.5 | 2019-08-14 | An information disclosure vulnerability exists when the Windows Graphics component improperly handles objects in memory. An attacker who successfully exploited… |
CVE-2019-1030 | Medium | 4.3 | 2019-08-14 | An information disclosure vulnerability exists when Microsoft Edge based on Edge HTML improperly handles objects in memory. An attacker who successfully exploi… |
CVE-2019-0338 | Medium | 5.3 | 2019-08-14 | During an OData V2/V4 request in SAP Gateway, versions 750, 751, 752, 753, the HTTP Header attributes cache-control and pragma were not properly set, allowing… |
CVE-2019-13419 | High | 7.5 | 2019-08-13 | Search Guard versions before 23.1 had an issue that for aggregations clear text values of anonymised fields were leaked. |
CVE-2019-13417 | Medium | 5.3 | 2019-08-12 | Search Guard versions before 24.0 had an issue that field caps and mapping API leak field names (but not values) for fields which are not allowed for the user… |
CVE-2018-20958 | Medium | 6.5 | 2019-08-07 | The Bluetooth Low Energy (BLE) subsystem on Tapplock devices before 2018-06-12 relies on Key1 and SerialNo for unlock operations; however, these are derived fr… |
CVE-2016-10811 | High | 8.8 | 2019-08-07 | In cPanel before 57.9999.54, /scripts/unsuspendacct exposed TTYs (SEC-116). |
CVE-2016-10810 | High | 8.8 | 2019-08-07 | In cPanel before 57.9999.54, /scripts/maildir_converter exposed a TTY to an unprivileged process (SEC-115). |
CVE-2016-10809 | High | 8.8 | 2019-08-07 | In cPanel before 57.9999.54, /scripts/checkinfopages exposed a TTY to an unprivileged process (SEC-114). |
CVE-2016-10797 | Medium | 4.3 | 2019-08-06 | cPanel before 58.0.4 allows WHM "Purchase and Install an SSL Certificate" page visitors to list all server domains (SEC-133). |
CVE-2016-10794 | Medium | 6.5 | 2019-08-06 | cPanel before 59.9999.145 allows arbitrary file-read operations because of a multipart form processing error (SEC-154). |
CVE-2016-10790 | High | 7.5 | 2019-08-06 | cPanel before 60.0.25 does not use TLS for HTTP POSTs to listinput.cpanel.net (SEC-192). |
CVE-2016-10786 | Medium | 6.5 | 2019-08-06 | cPanel before 60.0.25 allows members of the nobody group to read Apache HTTP Server SSL keys (SEC-186). |
CVE-2016-10785 | Medium | 6.5 | 2019-08-06 | cPanel before 60.0.25 allows attackers to discover file contents during file copy operations (SEC-185). |
CVE-2019-3800 | Medium | 6.3 | 2019-08-05 | CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-cred… |
CVE-2017-18478 | Medium | 6.5 | 2019-08-05 | In cPanel before 62.0.4 incorrect ACL checks could occur in xml-api for Rearrange Account actions (SEC-207). |
CVE-2017-18474 | Medium | 6.5 | 2019-08-05 | cPanel before 62.0.4 allows arbitrary file-read operations via Exim valiases (SEC-201). |
CVE-2019-7852 | Medium | 5.3 | 2019-08-02 | A path disclosure vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. Requests for a specific file pat… |
CVE-2017-18436 | Low | 3.5 | 2019-08-02 | cPanel before 64.0.21 allows demo accounts to read files via a Fileman::getfileactions API2 call (SEC-239). |
CVE-2017-18432 | High | 7.8 | 2019-08-02 | In cPanel before 64.0.21, Horde MySQL to SQLite conversion can leak a database password (SEC-234). |
CVE-2017-18428 | Low | 2.5 | 2019-08-02 | In cPanel before 66.0.2, Apache HTTP Server domlogs become temporarily world-readable during log processing (SEC-290). |
CVE-2017-18424 | Low | 3.3 | 2019-08-02 | In cPanel before 66.0.2, the Apache HTTP Server configuration file is changed to world-readable when rebuilt (SEC-274). |
CVE-2017-18396 | Medium | 5.5 | 2019-08-02 | cPanel before 68.0.15 allows arbitrary file-read operations via Exim vdomainaliases (SEC-329). |
CVE-2017-18391 | Low | 2.5 | 2019-08-02 | cPanel before 68.0.15 allows attackers to read backup files because they are world-readable during a short time interval (SEC-323). |
CVE-2016-10815 | Medium | 6.5 | 2019-08-01 | cPanel before 57.9999.54 allows arbitrary file-read operations for Webmail accounts via Branding APIs (SEC-120). |
CVE-2018-20952 | Medium | 6.5 | 2019-08-01 | cPanel before 68.0.27 creates world-readable files during use of WHM Apache Includes Editor (SEC-388). |
CVE-2018-20946 | Low | 3.3 | 2019-08-01 | cPanel before 68.0.27 allows attackers to read zone information because a world-readable archive is created by the archive_sync_zones script (SEC-355). |
CVE-2018-20944 | Low | 3.3 | 2019-08-01 | cPanel before 68.0.27 allows attackers to read a copy of httpd.conf that is created during a syntax test (SEC-353). |
CVE-2018-20943 | Low | 2.5 | 2019-08-01 | cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon a post-update task (SEC-352). |
CVE-2018-20942 | Low | 2.5 | 2019-08-01 | cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon configuring crontab (SEC-351). |
CVE-2018-20941 | Medium | 5.6 | 2019-08-01 | cPanel before 68.0.27 allows arbitrary file-read operations via restore adminbin (SEC-349). |
CVE-2018-20939 | Low | 3.3 | 2019-08-01 | cPanel before 68.0.27 allows a user to discover contents of directories (that are not owned by that user) by leveraging backups (SEC-339). |
CVE-2016-10844 | Medium | 6.5 | 2019-08-01 | The chcpass script in cPanel before 11.54.0.4 reveals a password hash (SEC-77). |
CVE-2018-20913 | Medium | 4.9 | 2019-08-01 | cPanel before 70.0.23 allows attackers to read the root accesshash via the WHM /cgi/trustclustermaster.cgi (SEC-364). |
CVE-2018-20902 | Medium | 5.5 | 2019-08-01 | cPanel before 71.9980.37 allows attackers to read root's crontab file by leveraging ClamAV installation (SEC-408). |
CVE-2018-20894 | Low | 3.3 | 2019-08-01 | cPanel before 74.0.0 makes web-site contents accessible to other local users via Git repositories (SEC-443). |
CVE-2018-20889 | Medium | 4.4 | 2019-08-01 | cPanel before 74.0.0 allows certain file-read operations via password file caching (SEC-425). |
CVE-2019-10156 | Medium | 5.4 | 2019-07-30 | A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclos… |
CVE-2018-20870 | Medium | 5.5 | 2019-07-30 | The WebDAV transport feature in cPanel before 76.0.8 enables debug logging (SEC-467). |
CVE-2018-17211 | Medium | 5.3 | 2019-07-29 | An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. An unauthenticated attacker can view details about the printers associated wit… |
CVE-2015-9288 | Medium | 6.5 | 2019-07-29 | The Unity Web Player plugin before 4.6.6f2 and 5.x before 5.0.3f2 allows attackers to read messages or access online services via a victim's credentials |
CVE-2019-14280 | Medium | 5.3 | 2019-07-26 | In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potential… |
CVE-2019-0202 | High | 7.5 | 2019-07-26 | The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versions 0.9.1-incubating… |
CVE-2018-13897 | High | 7.5 | 2019-07-25 | Clients hostname gets added to DNS record on device which is running dnsmasq resulting in an information exposure in Snapdragon Auto, Snapdragon Connectivity… |
CVE-2019-8286 | Medium | 4.3 | 2019-07-18 | Information Disclosure in Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security versions up to 2019 could potentially disclose unique Pro… |
CVE-2019-1010283 | High | 7.5 | 2019-07-17 | Univention Corporate Server univention-directory-notifier 12.0.1-3 and earlier is affected by: CWE-213: Intentional Information Exposure. The impact is: Loss o… |
CVE-2018-2022 | Medium | 5.3 | 2019-07-17 | IBM QRadar SIEM 7.2 and 7.3 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Fo… |
CVE-2019-1575 | High | 8.8 | 2019-07-16 | Information disclosure in PAN-OS 7.1.23 and earlier, PAN-OS 8.0.18 and earlier, PAN-OS 8.1.8-h4 and earlier, and PAN-OS 9.0.2 and earlier may allow for an auth… |
CVE-2019-1116 | Medium | 6.5 | 2019-07-15 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis… |
CVE-2019-1112 | Medium | 5.5 | 2019-07-15 | An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel Information Disclosur… |
CVE-2019-1108 | Medium | 6.5 | 2019-07-15 | An information disclosure vulnerability exists when the Windows RDP client improperly discloses the contents of its memory, aka 'Remote Desktop Protocol Client… |
CVE-2019-1101 | Medium | 6.5 | 2019-07-15 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis… |
CVE-2019-1100 | Medium | 6.5 | 2019-07-15 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis… |
CVE-2019-1099 | Medium | 6.5 | 2019-07-15 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis… |
CVE-2019-1098 | Medium | 6.5 | 2019-07-15 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis… |
CVE-2019-1097 | Medium | 5.5 | 2019-07-15 | An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Information Disclosure Vulner… |
CVE-2019-1096 | Medium | 5.5 | 2019-07-15 | An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerabili… |
CVE-2019-1095 | Medium | 6.5 | 2019-07-15 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis… |
CVE-2019-1094 | Medium | 6.5 | 2019-07-15 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis… |
CVE-2019-1093 | Medium | 5.5 | 2019-07-15 | An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Information Disclosure Vulner… |
CVE-2019-1091 | Medium | 5.5 | 2019-07-15 | An information disclosure vulnerability exists when Unistore.dll fails to properly handle objects in memory, aka 'Microsoft unistore.dll Information Disclosure… |