CWE-200 · Information Disclosure (page 51)
Page 51 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-12884 | High | 7.5 | 2019-05-10 | OX Software GmbH App Suite 7.8.4 and earlier is affected by: Information Exposure. |
CVE-2018-1990 | Medium | 5.3 | 2019-05-10 | IBM Cloud App Management V2018.2.0, V2018.4.0, and V2018.4.1 could allow an attacker to obtain sensitive configuration information using a specially crafted HT… |
CVE-2016-1600 | High | 7.5 | 2019-05-09 | The ServiceNow driver in NetIQ Identity Manager versions prior to 4.6 are susceptible to an information disclosure vulnerability. |
CVE-2018-2008 | Medium | 4.3 | 2019-05-07 | IBM TRIRIGA Application Platform 3.5.3 and 3.6.0 could disclose sensitive information to an authenticated user that could aid in further attacks against the sy… |
CVE-2018-19456 | High | 7.5 | 2019-05-07 | The WP Backup+ (aka WPbackupplus) plugin through 2018-11-22 for WordPress allows remote attackers to obtain sensitive information from server folders and files… |
CVE-2018-13991 | Medium | 5.3 | 2019-05-07 | The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 leaks private information in firmware images. |
CVE-2018-18977 | High | 7.5 | 2019-05-06 | An issue was discovered in the Ascensia Contour NEXT ONE application for Android before 2019-01-15. An attacker may reverse engineer the codebase to extract se… |
CVE-2018-18975 | High | 7.5 | 2019-05-06 | An issue was discovered in the Ascensia Contour NEXT ONE app for iOS before 2019-01-15. An attacker may proxy communications between the app and Ascensia backe… |
CVE-2018-4071 | High | 8.8 | 2019-05-06 | An exploitable Information Disclosure vulnerability exists in the ACEManager EmbeddedAceGet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. T… |
CVE-2018-4070 | High | 8.8 | 2019-05-06 | An exploitable Information Disclosure vulnerability exists in the ACEManager EmbeddedAceGet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. T… |
CVE-2018-4067 | Medium | 6.5 | 2019-05-06 | An exploitable information disclosure vulnerability exists in the ACEManager template_load.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A speci… |
CVE-2018-4069 | High | 7.5 | 2019-05-06 | An information disclosure vulnerability exists in the ACEManager authentication functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The ACEManager authent… |
CVE-2018-4068 | Medium | 5.3 | 2019-05-06 | An exploitable information disclosure vulnerability exists in the ACEManager functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A HTTP request can result… |
CVE-2019-3797 | Low | 3.5 | 2019-05-06 | This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith… |
CVE-2019-1692 | Medium | 5.3 | 2019-05-03 | A vulnerability in the web-based management interface of Cisco Application Policy Infrastructure Controller (APIC) Software could allow an unauthenticated, rem… |
CVE-2019-1589 | Medium | 4.6 | 2019-05-03 | A vulnerability in the Trusted Platform Module (TPM) functionality of software for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructur… |
CVE-2019-11633 | High | 7.5 | 2019-05-01 | HoneyPress through 2016-09-27 can be fingerprinted by attackers because of the ingrained unique www.atxsec.com and ayylmao.wpengine.com hostnames within the fa… |
CVE-2018-20510 | Medium | 5.5 | 2019-04-30 | The print_binder_transaction_ilocked function in drivers/android/binder.c in the Linux kernel 4.14.90 allows local users to obtain sensitive address informatio… |
CVE-2018-20509 | Medium | 5.5 | 2019-04-30 | The print_binder_ref_olocked function in drivers/android/binder.c in the Linux kernel 4.14.90 allows local users to obtain sensitive address information by rea… |
CVE-2018-1961 | Medium | 5.3 | 2019-04-29 | IBM Emptoris Contract Management 10.0.0 and 10.1.3.0 could disclose sensitive information from detailed information from error messages. IBM X-Force ID: 153657. |
CVE-2018-18511 | Medium | 4.3 | 2019-04-26 | Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note: This only affects… |
CVE-2019-3868 | Low | 3.8 | 2019-04-24 | Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an… |
CVE-2019-10247 | Medium | 5.3 | 2019-04-22 | In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will re… |
CVE-2019-10246 | Medium | 5.3 | 2019-04-22 | In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory nam… |
CVE-2011-3147 | High | 8.6 | 2019-04-22 | Versions of nova before 2012.1 could expose hypervisor host files to a guest operating system when processing a maliciously constructed qcow filesystem. |
CVE-2019-11403 | Critical | 9.8 | 2019-04-22 | In Gradle Enterprise before 2018.5.2, Build Cache Nodes would reflect the configured password back when viewing the HTML page source of the settings page. |
CVE-2018-1729 | Medium | 5.3 | 2019-04-19 | IBM QRadar SIEM 7.3 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID… |
CVE-2019-9225 | Medium | 5.3 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Cont… |
CVE-2019-9179 | Low | 3.7 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposu… |
CVE-2019-9175 | Medium | 5.3 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposu… |
CVE-2018-13378 | High | 7.2 | 2019-04-17 | An information disclosure vulnerability in Fortinet FortiSIEM 5.2.0 and below versions exposes the LDAP server plaintext password via the HTML source code. |
CVE-2018-13808 | Critical | 9.1 | 2019-04-17 | A vulnerability has been identified in CP 1604 (All versions), CP 1616 (All versions). An attacker with network access to port 23/tcp could extract internal co… |
CVE-2018-6239 | Medium | 5.5 | 2019-04-12 | NVIDIA Jetson TX2 contains a vulnerability by means of speculative execution where local and unprivileged code may access the contents of cached information in… |
CVE-2019-0040 | Critical | 9.1 | 2019-04-10 | On Junos OS, rpcbind should only be listening to port 111 on the internal routing instance (IRI). External packets destined to port 111 should be dropped. Due… |
CVE-2018-13366 | Medium | 5.3 | 2019-04-09 | An information disclosure vulnerability in Fortinet FortiOS 6.0.1, 5.6.7 and below allows attacker to reveals serial number of FortiGate via hostname field def… |
CVE-2019-10243 | Medium | 5.3 | 2019-04-09 | In Eclipse Kura versions up to 4.0.0, Kura exposes the underlying Ui Web server version in its replies. This can be used as a hint by an attacker to specifical… |
CVE-2019-4051 | Medium | 5.3 | 2019-04-08 | Some URIs in IBM API Connect 2018.1 and 2018.4.1.3 disclose system specification information like the machine id, system uuid, filesystem paths, network interf… |
CVE-2018-1999 | Medium | 4.3 | 2019-04-08 | IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could reveal sensitive version information about the server from error pages that could aid a… |
CVE-2018-1885 | Medium | 5.3 | 2019-04-08 | IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow an unauthenticated attacker to obtain sensitve information using a specially crac… |
CVE-2018-20449 | Medium | 5.5 | 2019-04-04 | The hidma_chan_stats function in drivers/dma/qcom/hidma_dbg.c in the Linux kernel 4.14.90 allows local users to obtain sensitive address information by reading… |
CVE-2018-11971 | Medium | 5.5 | 2019-04-04 | Interrupt exit code flow may undermine access control policy set forth by secure world can lead to potential secure asset leakage in Snapdragon Auto, Snapdrago… |
CVE-2018-4445 | Medium | 4.3 | 2019-04-03 | "Clear History and Website Data" did not clear the history. The issue was addressed with improved data deletion. This issue affected versions prior to iOS 12.1… |
CVE-2018-4431 | Medium | 5.5 | 2019-04-03 | A memory initialization issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, macOS Mojave 10.14.2, tvOS 12.1.1… |
CVE-2018-4430 | Low | 2.4 | 2019-04-03 | A lock screen issue allowed access to contacts on a locked device. This issue was addressed with improved state management. This issue affected versions prior… |
CVE-2018-4403 | Medium | 5.5 | 2019-04-03 | This issue was addressed by removing additional entitlements. This issue affected versions prior to macOS Mojave 10.14.1. |
CVE-2018-4388 | Medium | 4.6 | 2019-04-03 | A lock screen issue allowed access to the share function on a locked device. This issue was addressed by restricting options offered on a locked device. This i… |
CVE-2018-4387 | Low | 2.4 | 2019-04-03 | A lock screen issue allowed access to photos via Reply With Message on a locked device. This issue was addressed with improved state management. This issue aff… |
CVE-2018-4380 | Medium | 5.5 | 2019-04-03 | A lock screen issue allowed access to photos and contacts on a locked device. This issue was addressed by restricting options offered on a locked device. This… |
CVE-2018-4379 | Medium | 5.5 | 2019-04-03 | A lock screen issue allowed access to the share function on a locked device. This issue was addressed by restricting options offered on a locked device. This i… |
CVE-2018-4355 | Medium | 5.5 | 2019-04-03 | A configuration issue was addressed with additional restrictions. This issue affected versions prior to iOS 12, macOS Mojave 10.14. |
CVE-2018-4352 | Low | 3.3 | 2019-04-03 | A consistency issue existed in the handling of application snapshots. The issue was addressed with improved handling of notes deletions. This issue affected ve… |
CVE-2018-4325 | Low | 2.4 | 2019-04-03 | A logic issue was addressed with improved restrictions. This issue affected versions prior to iOS 12. |
CVE-2018-4311 | High | 8.1 | 2019-04-03 | The issue was addressed by removing origin information. This issue affected versions prior to iOS 12, watchOS 5, Safari 12, iTunes 12.9 for Windows, iCloud for… |
CVE-2018-4300 | Medium | 5.9 | 2019-04-03 | The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web interface when the web inte… |
CVE-2018-4289 | Medium | 5.5 | 2019-04-03 | An information disclosure issue was addressed by removing the vulnerable code. This issue affected versions prior to macOS High Sierra 10.13.6. |
CVE-2018-4052 | Medium | 5.5 | 2019-04-02 | An exploitable local information leak vulnerability exists in the privileged helper tool of GOG Galaxy's Games, version 1.2.47 for macOS. An attacker can pass… |
CVE-2018-1917 | Low | 3.5 | 2019-04-02 | IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could allow an authenticated user to access JSP files and disclose sensitive information. IBM X-Force ID… |
CVE-2018-1874 | Medium | 4.6 | 2019-04-02 | IBM API Connect 5.0.0.0 through 5.0.8.5 could display highly sensitive information to an attacker with physical access to the system. IBM X-Force ID: 151636. |
CVE-2018-1625 | Medium | 4.3 | 2019-04-02 | IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 generates an error message that includes sensitive information about its environment, users, o… |
CVE-2018-1623 | Medium | 4.0 | 2019-04-02 | IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-F… |
CVE-2018-13297 | Medium | 5.3 | 2019-04-01 | Information exposure vulnerability in SYNO.SynologyDrive.Files in Synology Drive before 1.1.2-10562 allows remote attackers to obtain sensitive system informat… |
CVE-2018-13295 | Medium | 4.3 | 2019-04-01 | Information exposure vulnerability in SYNO.Personal.Application.Info in Synology Application Service before 1.5.4-0320 allows remote authenticated users to obt… |
CVE-2018-13294 | Medium | 4.3 | 2019-04-01 | Information exposure vulnerability in SYNO.Personal.Profile in Synology Application Service before 1.5.4-0320 allows remote authenticated users to obtain sensi… |
CVE-2018-13292 | Medium | 4.3 | 2019-04-01 | Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote authenticated users to obtain… |
CVE-2018-13291 | Medium | 4.3 | 2019-04-01 | Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology DiskStation Manager (DSM) before 6.2.1-23824 allows remote authenticated users to ob… |
CVE-2018-13290 | Medium | 4.3 | 2019-04-01 | Information exposure vulnerability in SYNO.Core.ACL in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote authenticated users to determine the exi… |
CVE-2018-13289 | Medium | 5.3 | 2019-04-01 | Information exposure vulnerability in SYNO.FolderSharing.List in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote attackers to obtain sensitive… |
CVE-2018-13288 | Medium | 5.3 | 2019-04-01 | Information exposure vulnerability in SYNO.FolderSharing.List in Synology File Station before 1.2.3-0252 and before 1.1.5-0125 allows remote attackers to obtai… |
CVE-2019-3869 | High | 7.2 | 2019-03-28 | When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious use… |
CVE-2019-1762 | Medium | 4.4 | 2019-03-28 | A vulnerability in the Secure Storage feature of Cisco IOS and IOS XE Software could allow an authenticated, local attacker to access sensitive system informat… |
CVE-2018-19643 | Medium | 4.7 | 2019-03-27 | Information leakage issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5. |
CVE-2015-1012 | High | 7.5 | 2019-03-25 | Wireless keys are stored in plain text on version 5 of the Hospira LifeCare PCA Infusion System. According to Hospira, version 3 of the LifeCare PCA Infusion S… |
CVE-2017-7510 | High | 8.8 | 2019-03-25 | In ovirt-engine 4.1, if a host was provisioned with cloud-init, the root password could be revealed through the REST interface. |
CVE-2015-3952 | High | 7.5 | 2019-03-25 | Wireless keys are stored in plain text on Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq I… |
CVE-2019-7436 | Medium | 6.5 | 2019-03-21 | PHP Scripts Mall Opensource Classified Ads Script 3.2.2 has directory traversal via a direct request for a listing of an uploads directory. |
CVE-2019-7434 | Medium | 6.5 | 2019-03-21 | PHP Scripts Mall Rental Bike Script 2.0.3 has directory traversal via a direct request for a listing of an uploads directory. |
CVE-2019-7431 | Medium | 6.5 | 2019-03-21 | PHP Scripts Mall Image Sharing Script 1.3.4 has directory traversal via a direct request for a listing of an uploads directory. |
CVE-2019-7429 | Medium | 6.5 | 2019-03-21 | PHP Scripts Mall Property Rental Software 2.1.4 has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploa… |
CVE-2018-20555 | Critical | 9.8 | 2019-03-21 | The Design Chemical Social Network Tabs plugin 1.7.1 for WordPress allows remote attackers to discover Twitter access_token, access_token_secret, consumer_key… |
CVE-2018-19487 | High | 7.5 | 2019-03-21 | The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_employer_ajax_profile() function through the admin-ajax.ph… |
CVE-2018-18762 | Medium | 6.5 | 2019-03-21 | SaltOS 3.1 r8126 contains a database download vulnerability. |
CVE-2018-17502 | Medium | 4.0 | 2019-03-21 | The Receptionist for iPad could allow a local attacker to obtain sensitive information, caused by an error in the contact.json file. An attacker could exploit… |
CVE-2018-17484 | Medium | 4.0 | 2019-03-21 | Lobby Track Desktop could allow a local attacker to obtain sensitive information, caused by an error in Sample Database.mdb database while in kiosk mode. By us… |
CVE-2018-17483 | Low | 2.9 | 2019-03-21 | Lobby Track Desktop could allow a local attacker to obtain sensitive information, caused by an error in Reports while in kiosk mode. By visiting the kiosk and… |
CVE-2018-17482 | Medium | 4.0 | 2019-03-21 | Lobby Track Desktop could allow a local attacker to obtain sensitive information, caused by an error in Reports while in kiosk mode. By visiting the kiosk and… |
CVE-2018-15532 | Low | 3.8 | 2019-03-21 | SynTP.sys in Synaptics Touchpad drivers before 2018-06-06 allows local users to obtain sensitive information about freed kernel addresses. |
CVE-2018-18205 | High | 7.5 | 2019-03-15 | Topvision CC8800 CMTS C-E devices allow remote attackers to obtain sensitive information via a direct request for /WebContent/startup.tar.gz with userName=admi… |
CVE-2018-17956 | High | 7.8 | 2019-03-15 | In yast2-samba-provision up to and including version 1.0.1 the password for samba shares was provided on the command line to tools used by yast2-samba-provisio… |
CVE-2018-1929 | Medium | 4.3 | 2019-03-14 | IBM Rational Engineering Lifecycle Manager 5.0 through 6.0.6 could allow a malicious user to be allowed to view any view if he knows the URL link of a the view… |
CVE-2018-12224 | Low | 3.3 | 2019-03-14 | Buffer leakage in igdkm64.sys in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15.36.x.5057), 20.19… |
CVE-2015-2254 | Critical | 9.1 | 2019-03-13 | Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to capture and change patch loading information resulting in t… |
CVE-2019-3615 | Medium | 5.3 | 2019-03-12 | Data Leakage Attacks vulnerability in the web interface in McAfee Database Security prior to the 4.6.6 March 2019 update allows local users to expose passwords… |
CVE-2018-17944 | Medium | 4.9 | 2019-03-12 | On certain Lexmark devices that communicate with an LDAP or SMTP server, a malicious administrator can discover LDAP or SMTP credentials by changing that serve… |
CVE-2018-2009 | Medium | 6.5 | 2019-03-11 | IBM API Connect v2018.1 and 2018.4.1 is affected by an information disclosure vulnerability in the consumer API. Any registered user can obtain a list of all o… |
CVE-2018-1902 | Low | 3.1 | 2019-03-11 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to spoof connection information which could be used to launch further att… |
CVE-2019-3781 | High | 8.8 | 2019-03-07 | Cloud Foundry CLI, versions prior to v6.43.0, improperly exposes passwords when verbose/trace/debugging is turned on. A local unauthenticated or remote authent… |
CVE-2018-11783 | High | 7.5 | 2019-03-07 | sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin. The plugin doesn't… |
CVE-2019-6206 | Critical | 9.8 | 2019-03-04 | An issue existed with autofill resuming after it was canceled. The issue was addressed with improved state management. This issue is fixed in iOS 12.1.3. Passw… |
CVE-2018-12400 | Medium | 5.3 | 2019-02-28 | In private browsing mode on Firefox for Android, favicons are cached in the cache/icons folder as they are in non-private mode. This allows information leakage… |
CVE-2018-12397 | High | 7.1 | 2019-02-28 | A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed… |