CWE-200 · Information Disclosure (page 49)
Page 49 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-31547 | Medium | 4.3 | 2021-04-22 | An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. Its AbuseFilterCheckMatch API reveals suppressed edits and usernames to unpr… |
CVE-2021-31545 | Medium | 5.3 | 2021-04-22 | An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. The page_recent_contributors leaked the existence of certain deleted MediaWi… |
CVE-2021-29450 | Medium | 6.5 | 2021-04-15 | Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. This requ… |
CVE-2021-27850 | Critical | 9.8 | 2021-04-15 | A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5… |
CVE-2020-7270 | Medium | 4.9 | 2021-04-15 | Exposure of Sensitive Information in the web interface in McAfee Advanced Threat Defense (ATD) prior to 4.12.2 allows remote authenticated users to view sensit… |
CVE-2020-7269 | Medium | 4.9 | 2021-04-15 | Exposure of Sensitive Information in the web interface in McAfee Advanced Threat Defense (ATD) prior to 4.12.2 allows remote authenticated users to view sensit… |
CVE-2021-24227 | High | 7.5 | 2021-04-12 | The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the… |
CVE-2021-24226 | High | 7.5 | 2021-04-12 | In the AccessAlly WordPress plugin before 3.5.7, the file "resource/frontend/product/product-shortcode.php" responsible for the [accessally_order_form] shortco… |
CVE-2021-25376 | Low | 3.1 | 2021-04-09 | An improper synchronization logic in Samsung Email prior to version 6.1.41.0 can leak messages in certain mailbox in plain text when STARTTLS negotiation is fa… |
CVE-2021-25375 | Medium | 6.5 | 2021-04-09 | Using predictable index for attachments in Samsung Email prior to version 6.1.41.0 allows remote attackers to get attachments of another emails when users open… |
CVE-2021-25364 | Medium | 4.0 | 2021-04-09 | A pendingIntent hijacking vulnerability in Secure Folder prior to SMR APR-2021 Release 1 allows unprivileged applications to access contact information. |
CVE-2021-25357 | Medium | 5.6 | 2021-04-09 | A pendingIntent hijacking vulnerability in Create Movie prior to SMR APR-2021 Release 1 in Android O(8.x) and P(9.0), 3.4.81.1 in Android Q(10,0), and 3.6.80.7… |
CVE-2021-30156 | Medium | 4.3 | 2021-04-09 | An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Special:Contributions can leak that a "hidden" user exists. |
CVE-2021-3413 | Medium | 6.3 | 2021-04-08 | A flaw was found in Red Hat Satellite in tfm-rubygem-foreman_azure_rm in versions before 2.2.0. A credential leak was identified which will expose Azure Resour… |
CVE-2021-1406 | Medium | 4.9 | 2021-04-08 | A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could… |
CVE-2021-24170 | High | 7.5 | 2021-04-05 | The REST API endpoint get_users in the User Profile Picture WordPress plugin before 2.5.0 returned more information than was required for its functionality to… |
CVE-2021-24167 | High | 7.5 | 2021-04-05 | When visiting a site running Web-Stat < 1.4.0, the "wts_web_stat_load_init" function used the visitor’s browser to send an XMLHttpRequest request to https://wt… |
CVE-2021-24164 | Medium | 4.3 | 2021-04-05 | In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and… |
CVE-2021-24163 | High | 8.8 | 2021-04-05 | The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protection, therefore maki… |
CVE-2020-11922 | Medium | 4.3 | 2021-04-02 | An issue was discovered in WiZ Colors A60 1.14.0. The device sends unnecessary information to the cloud controller server. Although this information is sent en… |
CVE-2021-21400 | High | 7.1 | 2021-04-02 | wire-webapp is an open-source front end for Wire, a secure collaboration platform. In wire-webapp before version 2021-03-15-production.0, when being prompted t… |
CVE-2021-21421 | High | 8.1 | 2021-04-01 | node-etsy-client is a NodeJs Etsy ReST API Client. Applications that are using node-etsy-client and reporting client error to the end user will offer api key v… |
CVE-2021-22876 | Medium | 5.3 | 2021-04-01 | curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP R… |
CVE-2021-28164 | Medium | 5.3 | 2021-04-01 | In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access prot… |
CVE-2021-28163 | Low | 2.7 | 2021-04-01 | In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of th… |
CVE-2021-21396 | Medium | 6.5 | 2021-03-26 | wire-server is an open-source back end for Wire, a secure collaboration platform. In wire-server from version 2021-02-16 and before version 2021-03-02, the cli… |
CVE-2021-22172 | Medium | 4.3 | 2021-03-26 | Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inaccessible on the releases page |
CVE-2021-25369 | Medium | 6.2 | 2021-03-26 | An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel information to userspace. |
CVE-2020-35518 | Medium | 5.3 | 2021-03-26 | When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthentica… |
CVE-2021-23890 | Medium | 6.5 | 2021-03-26 | Information leak vulnerability in the Agent Handler of McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 allows an unauthenticated user to download McA… |
CVE-2021-25350 | Low | 2.0 | 2021-03-25 | Information Exposure vulnerability in Samsung Account prior to version 12.1.1.3 allows physically proximate attackers to access user information via log. |
CVE-2021-27908 | Medium | 5.8 | 2021-03-23 | In all versions prior to Mautic 3.3.2, secret parameters such as database credentials could be exposed publicly by an authorized admin user through leveraging… |
CVE-2021-21376 | Medium | 6.4 | 2021-03-23 | OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 loads various information about the current user… |
CVE-2021-28133 | Medium | 4.3 | 2021-03-18 | Zoom through 5.5.4 sometimes allows attackers to read private information on a participant's screen, even though the participant never attempted to share the p… |
CVE-2020-11221 | Medium | 5.5 | 2021-03-17 | Usage of syscall by non-secure entity can allow extraction of secure QTEE diagnostic information in clear text form due to insufficient checks in the syscall h… |
CVE-2020-11199 | Medium | 5.5 | 2021-03-17 | HLOS to access EL3 stack canary by just mapping imem region due to Improper access control and can lead to information exposure in Snapdragon Auto, Snapdragon… |
CVE-2021-20281 | Medium | 5.3 | 2021-03-15 | It was possible for some users without permission to view other users' full names to do so via the online users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3… |
CVE-2020-27290 | Medium | 4.3 | 2021-03-15 | In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, an information disclosure vulnerability in the ventilator allows attackers with physical access… |
CVE-2021-26923 | High | 7.5 | 2021-03-15 | An issue was discovered in Argo CD before 1.8.4. Accessing the endpoint /api/version leaks internal information for the system, and this endpoint is not protec… |
CVE-2021-20018 | Medium | 4.9 | 2021-03-13 | A post-authenticated vulnerability in SonicWall SMA100 allows an attacker to export the configuration file to the specified email address. This vulnerability i… |
CVE-2021-21364 | Medium | 5.3 | 2021-03-11 | swagger-codegen is an open-source project which contains a template-driven engine to generate documentation, API clients and server stubs in different language… |
CVE-2021-21360 | Medium | 5.3 | 2021-03-09 | Products.GenericSetup is a mini-framework for expressing the configured state of a Zope Site as a set of filesystem artifacts. In Products.GenericSetup before… |
CVE-2021-22134 | Medium | 4.3 | 2021-03-08 | A document disclosure flaw was found in Elasticsearch versions after 7.6.0 and before 7.11.0 when Document or Field Level Security is used. Get requests do not… |
CVE-2021-21336 | Medium | 6.5 | 2021-03-08 | Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an… |
CVE-2021-25333 | Low | 3.2 | 2021-03-04 | Improper access control in Samsung Pay mini application prior to v4.0.14 allows unauthorized access to balance information over the lockscreen via scanning spe… |
CVE-2021-25332 | Low | 3.2 | 2021-03-04 | Improper access control in Samsung Pay mini application prior to v4.0.14 allows unauthorized access to contacts information over the lockscreen in specific con… |
CVE-2021-25331 | Low | 3.2 | 2021-03-04 | Improper access control in Samsung Pay mini application prior to v4.0.14 allows unauthorized access to balance information over the lockscreen in specific cond… |
CVE-2021-25122 | High | 7.5 | 2021-03-01 | When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request head… |
CVE-2021-26566 | High | 8.3 | 2021-02-26 | Insertion of sensitive information into sent data vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-midd… |
CVE-2020-28199 | Critical | 9.1 | 2021-02-26 | best it Amazon Pay Plugin before 9.4.2 for Shopware exposes Sensitive Information to an Unauthorized Actor. |
CVE-2019-18947 | Low | 3.5 | 2021-02-26 | Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to information disclosure. |
CVE-2021-21621 | Medium | 5.3 | 2021-02-24 | Jenkins Support Core Plugin 2.72 and earlier provides the serialized user authentication as part of the "About user (basic authentication details only)" inform… |
CVE-2021-20656 | Medium | 4.3 | 2021-02-24 | Exposure of information through directory listing in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an authenticated attacker to obtain the information… |
CVE-2021-21323 | Medium | 4.3 | 2021-02-23 | Brave is an open source web browser with a focus on privacy and security. In Brave versions 1.17.73-1.20.103, the CNAME adblocking feature added in Brave 1.17… |
CVE-2021-20256 | Medium | 5.3 | 2021-02-23 | A flaw was found in Red Hat Satellite. The BMC interface exposes the password through the API to an authenticated local attacker with view_hosts permission. Th… |
CVE-2021-26593 | High | 7.5 | 2021-02-23 | In Directus 8.x through 8.8.1, an attacker can see all users in the CMS using the API /users/{id}. For each call, they get in response a lot of information abo… |
CVE-2020-4953 | Medium | 4.3 | 2021-02-23 | IBM Planning Analytics 2.0 could allow a remote authenticated attacker to obtain information about an organization's internal structure by exposing sensitive i… |
CVE-2020-29075 | High | 7.1 | 2021-02-23 | Acrobat Reader DC versions 2020.013.20066 (and earlier), 2020.001.30010 (and earlier) and 2017.011.30180 (and earlier) are affected by an information exposure… |
CVE-2020-11281 | High | 7.5 | 2021-02-22 | Allowing RTT frames to be linked with non randomized MAC address by comparing the sequence numbers can lead to information disclosure. in Snapdragon Auto, Snap… |
CVE-2020-35681 | High | 7.4 | 2021-02-22 | Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. The legacy channels.http.AsgiHandler c… |
CVE-2021-21512 | High | 7.9 | 2021-02-19 | Dell EMC PowerProtect Cyber Recovery, version 19.7.0.1, contains an Information Disclosure vulnerability. A locally authenticated high privileged Cyber Recover… |
CVE-2020-35568 | Medium | 4.3 | 2021-02-16 | An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. An incomplete f… |
CVE-2021-21301 | Low | 2.6 | 2021-02-11 | Wire is an open-source collaboration platform. In Wire for iOS (iPhone and iPad) before version 3.75 there is a vulnerability where the video capture isn't sto… |
CVE-2021-21435 | Medium | 5.7 | 2021-02-08 | Article Bcc fields and agent personal information are shown when customer prints the ticket (PDF) via external interface. This issue affects: OTRS AG OTRS 7.0… |
CVE-2020-1779 | Medium | 4.3 | 2021-02-08 | When dynamic templates are used (OTRSTicketForms), admin can use OTRS tags which are not masked properly and can reveal sensitive information. This issue affec… |
CVE-2020-4640 | Medium | 4.1 | 2021-02-04 | Certain IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 configurations can result in sensitive information in the URL fragment ide… |
CVE-2020-14192 | Medium | 4.3 | 2021-02-02 | Affected versions of Atlassian Fisheye and Crucible allow remote attackers to view a product's SEN via an Information Disclosure vulnerability in the x-asen re… |
CVE-2021-26067 | Medium | 5.3 | 2021-01-28 | Affected versions of Atlassian Bamboo allow an unauthenticated remote attacker to view a stack trace that may reveal the path for the home directory in disk an… |
CVE-2020-4967 | Medium | 4.3 | 2021-01-27 | IBM Cloud Pak for Security (CP4S) 1.3.0.1 could disclose sensitive information through HTTP headers which could be used in further attacks against the system… |
CVE-2020-4815 | Medium | 5.3 | 2021-01-27 | IBM Cloud Pak for Security (CP4S) 1.4.0.0 could allow a remote user to obtain sensitive information from HTTP response headers that could be used in further at… |
CVE-2020-3687 | Medium | 5.5 | 2021-01-21 | Local privilege escalation in admin services in Windows environment can occur due to an arbitrary read issue. |
CVE-2020-19363 | Medium | 6.5 | 2021-01-20 | Vtiger CRM v7.2.0 allows an attacker to display hidden files, list directories by using /libraries and /layout directories. |
CVE-2020-28482 | Medium | 5.9 | 2021-01-19 | This affects the package fastify-csrf before 3.0.0. 1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: { path… |
CVE-2021-0212 | Medium | 5.0 | 2021-01-15 | An Information Exposure vulnerability in Juniper Networks Contrail Networking allows a locally authenticated attacker able to read files to retrieve administra… |
CVE-2021-0210 | Medium | 6.8 | 2021-01-15 | An Information Exposure vulnerability in J-Web of Juniper Networks Junos OS allows an unauthenticated attacker to elevate their privileges over the target syst… |
CVE-2021-24122 | Medium | 5.9 | 2021-01-14 | When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 a… |
CVE-2021-3031 | Medium | 4.3 | 2021-01-13 | Padding bytes in Ethernet packets on PA-200, PA-220, PA-500, PA-800, PA-2000 Series, PA-3000 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series firewal… |
CVE-2020-4079 | High | 7.7 | 2021-01-12 | Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 2.8.0, when the ajax endpoint for the "excel export" portal functiona… |
CVE-2021-21469 | High | 7.5 | 2021-01-12 | When security guidelines for SAP NetWeaver Master Data Management running on windows have not been thoroughly reviewed, it might be possible for an external op… |
CVE-2020-4336 | Medium | 5.3 | 2021-01-06 | IBM WebSphere eXtreme Scale 8.6.1 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access t… |
CVE-2020-4913 | Medium | 4.4 | 2021-01-04 | IBM Cloud Pak System 2.3 could reveal credential information in the HTTP response to a local privileged user. IBM X-Force ID: 191288. |
CVE-2020-35934 | Medium | 4.3 | 2021-01-01 | The Advanced Access Manager plugin before 6.6.2 for WordPress displays the unfiltered user object (including all metadata) upon login via the REST API (aam/v1/… |
CVE-2020-35611 | High | 7.5 | 2020-12-28 | An issue was discovered in Joomla! 2.5.0 through 3.9.22. The globlal configuration page does not remove secrets from the HTML output, disclosing the current va… |
CVE-2020-35710 | Medium | 5.3 | 2020-12-25 | Parallels Remote Application Server (RAS) 18 allows remote attackers to discover an intranet IP address because submission of the login form (even with blank c… |
CVE-2020-25192 | Medium | 5.3 | 2020-12-23 | The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower allows sensitive information to be displayed without proper authorization. |
CVE-2020-12518 | Medium | 5.5 | 2020-12-17 | On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an attacker can use the knowledge gained by reading the insufficiently protected sensitiv… |
CVE-2020-4908 | Medium | 5.3 | 2020-12-16 | IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 returns the product version and release information on the login dialog. This inf… |
CVE-2019-14480 | Critical | 9.8 | 2020-12-16 | AdRem NetCrunch 10.6.0.4587 has an Improper Session Handling vulnerability in the NetCrunch web client, which can lead to an authentication bypass or escalatio… |
CVE-2020-0488 | Medium | 6.5 | 2020-12-15 | In ihevc_inter_pred_chroma_copy_ssse3 of ihevc_inter_pred_filters_ssse3_intr.c, there is a possible information disclosure due to uninitialized data. This coul… |
CVE-2019-19283 | Medium | 5.3 | 2020-12-14 | A vulnerability has been identified in XHQ (All Versions < 6.1). The application's web server could expose non-sensitive information about the server's archite… |
CVE-2020-8284 | Low | 3.7 | 2020-12-14 | A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially… |
CVE-2020-8169 | High | 7.5 | 2020-12-14 | curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to th… |
CVE-2020-25179 | Critical | 9.8 | 2020-12-14 | GE Healthcare Imaging and Ultrasound Products may allow specific credentials to be exposed during transport over the network. |
CVE-2020-27134 | Critical | 9.9 | 2020-12-11 | Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an attacker to execute arbitrary programs o… |
CVE-2020-26417 | Medium | 5.3 | 2020-12-11 | Information disclosure via GraphQL in GitLab CE/EE 13.1 and later exposes private group and project membership. This affects versions >=13.6 to <13.6.2, >=13.5… |
CVE-2020-26415 | Medium | 4.3 | 2020-12-11 | Information about the starred projects for private user profiles was exposed via the GraphQL API starting from 12.2 via the REST API. This affects GitLab >=12… |
CVE-2020-26413 | Medium | 5.3 | 2020-12-11 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 13.6.2. Information disclosure via GraphQL results in user email… |
CVE-2020-9849 | Medium | 6.5 | 2020-12-08 | An information disclosure issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.0, iOS 14.0 and iPadOS 14… |
CVE-2020-17527 | High | 7.5 | 2020-12-03 | While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request… |
CVE-2020-5676 | High | 7.5 | 2020-12-03 | GROWI v4.1.3 and earlier allow remote attackers to obtain information which is not allowed to access via unspecified vectors. |