CWE-200 · Information Disclosure (page 50)
Page 50 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-1084 | Medium | 6.5 | 2019-07-15 | An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. An authenticated a… |
CVE-2019-1073 | Medium | 5.5 | 2019-07-15 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnera… |
CVE-2019-1071 | Medium | 5.5 | 2019-07-15 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnera… |
CVE-2019-1010299 | Medium | 5.3 | 2019-07-15 | The Rust Programming Language Standard Library 1.18.0 and later is affected by: CWE-200: Information Exposure. The impact is: Contents of uninitialized memory… |
CVE-2014-10374 | Medium | 6.5 | 2019-07-15 | On Fitbit activity-tracker devices, certain addresses never change. According to the popets-2019-0036.pdf document, this leads to "permanent trackability" and… |
CVE-2019-1010024 | Medium | 5.3 | 2019-07-15 | GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE… |
CVE-2019-4193 | High | 7.5 | 2019-07-11 | IBM Jazz for Service Management 1.1.3 and 1.1.3.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parti… |
CVE-2019-0048 | Medium | 5.8 | 2019-07-11 | On EX4300 Series switches with TCAM optimization enabled, incoming multicast traffic matches an implicit loopback filter rule first, since it has high priority… |
CVE-2018-1968 | Medium | 5.3 | 2019-07-11 | IBM Security Identity Manager 7.0.1 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system… |
CVE-2019-11268 | Medium | 4.3 | 2019-07-11 | Cloud Foundry UAA version prior to 73.3.0, contain endpoints that contains improper escaping. An authenticated malicious user with basic read privileges for on… |
CVE-2018-14831 | Medium | 4.9 | 2019-07-10 | An arbitrary file read vulnerability in DamiCMS v6.0.0 allows remote authenticated administrators to read any files in the server via a crafted /admin.php?s=Tp… |
CVE-2019-11991 | Critical | 9.8 | 2019-07-09 | HPE has identified a vulnerability in HPE 3PAR Service Processor (SP) version 4.1 through 4.4. HPE 3PAR Service Processor (SP) version 4.1 through 4.4 has a re… |
CVE-2018-14529 | High | 7.5 | 2019-07-05 | Invoxia NVX220 devices allow access to /bin/sh via escape from a restricted CLI, leading to disclosure of password hashes. |
CVE-2019-13314 | High | 7.8 | 2019-07-05 | virt-bootstrap 1.1.0 allows local users to discover a root password by listing a process, because this password may be present in the --root-password option to… |
CVE-2019-13313 | High | 7.8 | 2019-07-05 | libosinfo 1.5.0 allows local users to discover credentials by listing a process, because credentials are passed to osinfo-install-script via the command line. |
CVE-2019-5601 | Medium | 6.5 | 2019-07-03 | In FreeBSD 12.0-STABLE before r347474, 12.0-RELEASE before 12.0-RELEASE-p7, 11.2-STABLE before r347475, and 11.2-RELEASE before 11.2-RELEASE-p11, a bug in the… |
CVE-2018-14865 | Medium | 6.5 | 2019-07-03 | Report engine in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier does not use secure options when passing document… |
CVE-2018-11215 | Critical | 9.8 | 2019-07-03 | Remote code execution is possible in Cloudera Data Science Workbench version 1.3.0 and prior releases via unspecified attack vectors. |
CVE-2019-10183 | Low | 3.2 | 2019-07-03 | Virt-install(1) utility used to provision new virtual machines has introduced an option '--unattended' to create VMs without user interaction. This option acce… |
CVE-2017-11578 | Medium | 5.9 | 2019-07-02 | It was discovered as a part of the research on IoT devices in the most recent firmware for Blipcare device that the device allows to connect to web management… |
CVE-2019-7259 | High | 8.8 | 2019-07-02 | Linear eMerge E3-Series devices allow Authorization Bypass with Information Disclosure. |
CVE-2019-4140 | High | 7.1 | 2019-07-02 | IBM Tivoli Storage Manager Server (IBM Spectrum Protect 7.1 and 8.1) could allow a local user to replace existing databases by restoring old data. IBM X-Force… |
CVE-2019-13075 | Medium | 5.3 | 2019-06-30 | Tor Browser through 8.5.3 has an information exposure vulnerability. It allows remote attackers to detect the browser's language via vectors involving an IFRAM… |
CVE-2019-13055 | Medium | 6.5 | 2019-06-29 | Certain Logitech Unifying devices allow attackers to dump AES keys and addresses, leading to the capability of live decryption of Radio Frequency transmissions… |
CVE-2019-10175 | Medium | 6.5 | 2019-06-28 | A flaw was found in the containerized-data-importer in virt-cdi-cloner, version 1.4, where the host-assisted cloning feature does not determine whether the req… |
CVE-2018-20812 | High | 7.5 | 2019-06-28 | An information exposure issue where IPv6 DNS traffic would be sent outside of the VPN tunnel (when Traffic Enforcement was enabled) exists in Pulse Secure Puls… |
CVE-2018-20811 | Medium | 5.3 | 2019-06-28 | A hidden RPC service issue was found with Pulse Secure Pulse Connect Secure 8.3RX before 8.3R2 and 8.1RX before 8.1R12. |
CVE-2018-6177 | Medium | 4.3 | 2019-06-27 | Information leak in media engine in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2018-6168 | Medium | 6.5 | 2019-06-27 | Information leak in media engine in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to obtain potentially sensitive information from process memo… |
CVE-2018-6159 | Medium | 6.5 | 2019-06-27 | Insufficient policy enforcement in ServiceWorker in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to obtain potentially sensitive information f… |
CVE-2018-6150 | Medium | 6.5 | 2019-06-27 | Incorrect handling of CORS in ServiceWorker in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2018-6134 | Medium | 6.5 | 2019-06-27 | Information leak in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to bypass no-referrer policy via a crafted HTML page. |
CVE-2018-20073 | Medium | 5.5 | 2019-06-27 | Use of extended attributes in downloads in Google Chrome prior to 72.0.3626.81 allowed a local attacker to read download URLs via the filesystem. |
CVE-2018-1734 | Medium | 4.3 | 2019-06-27 | IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1 discloses sensitive information in error messages that may be used by a malicious user to o… |
CVE-2018-2013 | Medium | 5.3 | 2019-06-25 | IBM API Connect 2018.1 through 2018.4.1.5 could disclose sensitive information to an unauthorized user that could aid in further attacks against the system. IB… |
CVE-2018-2011 | Medium | 5.3 | 2019-06-25 | IBM API Connect 2018.1 through 2018.4.1.5 could allow an attacker to obtain sensitive information from a specially crafted HTTP request that could aid an attac… |
CVE-2014-9699 | High | 7.5 | 2019-06-24 | The MakerBot Replicator 5G printer runs an Apache HTTP Server with directory indexing enabled. Apache logs, system logs, design files (i.e., a history of print… |
CVE-2019-11648 | High | 7.5 | 2019-06-24 | An information leakage exists in Micro Focus NetIQ Self Service Password Reset Software all versions prior to version 4.4. The vulnerability could be exploited… |
CVE-2018-15665 | Medium | 5.3 | 2019-06-21 | An issue was discovered in Cloudera Data Science Workbench (CDSW) 1.2.x through 1.4.0. Unauthenticated users can get a list of user accounts. |
CVE-2016-7404 | Critical | 9.8 | 2019-06-21 | OpenStack Magnum passes OpenStack credentials into the Heat templates creating its instances. While these should just be used for retrieving the instances' SSL… |
CVE-2019-11233 | High | 7.5 | 2019-06-19 | EXCELLENT INFOTEK BiYan v1.57 ~ v2.8 allows an attacker to leak user information without being authenticated, by sending a LOGIN_ID element to the auth/main/as… |
CVE-2017-1107 | Medium | 4.3 | 2019-06-19 | IBM Marketing Platform 9.1.0, 9.1.2, 10.0, and 10.1 exposes sensitive information in the headers that could be used by an authenticated attacker in further att… |
CVE-2017-8337 | High | 8.8 | 2019-06-18 | An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of executing… |
CVE-2018-18839 | Medium | 5.3 | 2019-06-18 | An issue was discovered in Netdata 1.10.0. Full Path Disclosure (FPD) exists via api/v1/alarms. NOTE: the vendor says "is intentional. |
CVE-2017-10719 | Medium | 6.5 | 2019-06-17 | Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the device has default Wi-Fi credenti… |
CVE-2019-5017 | Medium | 5.3 | 2019-06-17 | An exploitable information disclosure vulnerability exists in the KCodes NetUSB.ko kernel module that enables the ReadySHARE Printer functionality of at least… |
CVE-2019-5016 | Critical | 9.1 | 2019-06-17 | An exploitable arbitrary memory read vulnerability exists in the KCodes NetUSB.ko kernel module which enables the ReadySHARE Printer functionality of at least… |
CVE-2019-11407 | High | 7.2 | 2019-06-17 | app/operator_panel/index_inc.php in the Operator Panel module in FusionPBX 4.4.3 suffers from an information disclosure vulnerability due to excessive debug in… |
CVE-2019-12497 | Medium | 5.3 | 2019-06-17 | An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8, Community Edition 6.0.x through 6.0.19, and Community Edition 5.0.x through 5… |
CVE-2019-4173 | Medium | 6.5 | 2019-06-17 | IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 could allow a remote attacker to obtain sensitive information, caused by a flaw in the HTTP OP… |
CVE-2018-11942 | Medium | 5.5 | 2019-06-14 | Failure to initialize the reserved memory which is sent to the firmware might lead to exposure of 1 byte of uninitialized kernel SKB memory to FW in Snapdragon… |
CVE-2018-10946 | Medium | 6.8 | 2019-06-13 | An issue was discovered in versions earlier than 1.3.0-66872 for Polycom RealPresence Debut that allows attackers to arbitrarily read the admin user's password… |
CVE-2019-1081 | Medium | 4.2 | 2019-06-12 | An information disclosure vulnerability exists when affected Microsoft browsers improperly handle objects in memory. An attacker who successfully exploited thi… |
CVE-2019-1050 | Medium | 4.7 | 2019-06-12 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exp… |
CVE-2019-1049 | Medium | 4.7 | 2019-06-12 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exp… |
CVE-2019-1048 | Medium | 4.7 | 2019-06-12 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exp… |
CVE-2019-1047 | Medium | 4.7 | 2019-06-12 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exp… |
CVE-2019-1046 | Medium | 4.7 | 2019-06-12 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exp… |
CVE-2019-1023 | Medium | 6.5 | 2019-06-12 | An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft Edge. An attacker who successf… |
CVE-2019-1019 | High | 8.5 | 2019-06-12 | A security feature bypass vulnerability exists where a NETLOGON message is able to obtain the session key and sign messages. To exploit this vulnerability, an… |
CVE-2019-1016 | Medium | 4.7 | 2019-06-12 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exp… |
CVE-2019-1015 | Medium | 4.7 | 2019-06-12 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exp… |
CVE-2019-1013 | Medium | 4.7 | 2019-06-12 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exp… |
CVE-2019-1012 | Medium | 4.7 | 2019-06-12 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exp… |
CVE-2019-1011 | Medium | 4.7 | 2019-06-12 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exp… |
CVE-2019-1010 | Medium | 4.7 | 2019-06-12 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exp… |
CVE-2019-1009 | Medium | 4.7 | 2019-06-12 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exp… |
CVE-2019-0990 | Medium | 6.5 | 2019-06-12 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerab… |
CVE-2019-0977 | Medium | 4.7 | 2019-06-12 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exp… |
CVE-2019-3579 | Medium | 5.3 | 2019-06-06 | MyBB 1.8.19 allows remote attackers to obtain sensitive information because it discloses the username upon receiving a password-reset request that lacks the co… |
CVE-2018-7122 | Medium | 5.3 | 2019-06-05 | A remote disclosure of information vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. |
CVE-2019-9753 | Low | 3.5 | 2019-06-03 | An issue was discovered in Open Ticket Request System (OTRS) 7.x before 7.0.5. An attacker who is logged into OTRS as an agent or a customer user can use the s… |
CVE-2018-15131 | Medium | 5.3 | 2019-05-30 | An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 b… |
CVE-2018-12130 | Medium | 5.9 | 2019-05-30 | Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some microprocessors utilizing speculative execution may allow an authenticated user to p… |
CVE-2018-12127 | Medium | 5.6 | 2019-05-30 | Microarchitectural Load Port Data Sampling (MLPDS): Load ports on some microprocessors utilizing speculative execution may allow an authenticated user to poten… |
CVE-2018-12126 | Medium | 5.6 | 2019-05-30 | Microarchitectural Store Buffer Data Sampling (MSBDS): Store buffers on some microprocessors utilizing speculative execution may allow an authenticated user to… |
CVE-2018-13365 | Medium | 5.3 | 2019-05-29 | An Information Exposure vulnerability in Fortinet FortiOS 6.0.1, 5.6.5 and below, allow attackers to learn private IP as well as the hostname of FortiGate via… |
CVE-2019-9866 | Medium | 6.5 | 2019-05-29 | An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.7.7 and 11.8.x before 11.8.3. It allows Information Disclosure. |
CVE-2018-13885 | Medium | 5.5 | 2019-05-24 | Possible memory overread may be lead to access of sensitive data in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Sn… |
CVE-2018-12004 | Medium | 5.5 | 2019-05-24 | Secure keypad is unlocked with secure display still intact in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Con… |
CVE-2018-11976 | Medium | 5.5 | 2019-05-24 | ECDSA signature code leaks private keys from secure world to non-secure world in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consu… |
CVE-2018-10815 | Medium | 6.5 | 2019-05-24 | An issue was discovered in Cloudera Manager before 5.13.4, 5.14.x before 5.14.4, and 5.15.x before 5.15.1. A read-only user can access sensitive cluster inform… |
CVE-2017-11557 | Medium | 5.3 | 2019-05-23 | An issue was discovered in ZOHO ManageEngine Applications Manager 12.3. It is possible for an unauthenticated user to view the list of domain names and usernam… |
CVE-2017-5210 | Critical | 9.8 | 2019-05-23 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Information Exposure. |
CVE-2017-15652 | Medium | 5.5 | 2019-05-23 | Artifex Ghostscript 9.22 is affected by: Obtain Information. The impact is: obtain sensitive information. The component is: affected source code file, affected… |
CVE-2018-7844 | High | 7.5 | 2019-05-22 | A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause… |
CVE-2018-7848 | High | 7.5 | 2019-05-22 | A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause… |
CVE-2017-9809 | Medium | 5.3 | 2019-05-22 | OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Information Exposure. |
CVE-2017-6514 | Medium | 5.3 | 2019-05-22 | WordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain sensitive information (Path Disclosure) via a /wp-json/oembed/1.0/… |
CVE-2018-1991 | Low | 2.7 | 2019-05-22 | IBM API Connect 5.0.0.0, and 5.0.8.6 could could return sensitive information that could provide critical information as to the underlying software stack in CM… |
CVE-2018-2005 | Low | 3.3 | 2019-05-20 | IBM BigFix Platform 9.2 and 9.5 stores potentially sensitive information in process memory that could be read by a local attacker with elevated permissions. IB… |
CVE-2019-7353 | Critical | 9.1 | 2019-05-17 | An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 11.7.x before 11.7.4. GitLab Releases were vulnerable to an authori… |
CVE-2019-10109 | Medium | 5.3 | 2019-05-15 | An Information Exposure issue (issue 1 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 1… |
CVE-2019-1731 | Medium | 4.4 | 2019-05-15 | A vulnerability in the SSH CLI key management functionality of Cisco NX-OS Software could allow an authenticated, local attacker to expose a user's private SSH… |
CVE-2019-6574 | High | 7.5 | 2019-05-14 | A vulnerability has been identified in SINAMICS PERFECT HARMONY GH180 with NXG I control, MLFBs: 6SR2...-, 6SR3...-, 6SR4...- (All Versions with option G21, G2… |
CVE-2019-6572 | Critical | 9.1 | 2019-05-14 | A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15.1 Update 1), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All ve… |
CVE-2018-16656 | High | 7.5 | 2019-05-14 | DoBox_CstmBox_Info.model.htm on Kyocera TASKalfa 4002i and 6002i devices allows remote attackers to read the documents of arbitrary users via a modified HTTP r… |
CVE-2018-12301 | High | 7.5 | 2019-05-13 | Unvalidated URL in Download Manager in Seagate NAS OS version 4.3.15.1 allows attackers to access the loopback interface via a Download URL of 127.0.0.1 or loc… |
CVE-2019-5437 | Medium | 5.3 | 2019-05-10 | Information exposure through the directory listing in npm's harp module allows to access files that are supposed to be ignored according to the harp server rul… |
CVE-2018-7083 | High | 7.5 | 2019-05-10 | If a process running within Aruba Instant crashes, it may leave behind a "core dump", which contains the memory contents of the process at the time it crashed… |