CWE-200 · Information Disclosure (page 52)
Page 52 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-4061 | Medium | 5.3 | 2019-02-27 | IBM BigFix Platform 9.2 and 9.5 could allow an attacker to query the relay remotely and gather information about the updates and fixlets deployed to the associ… |
CVE-2018-1775 | Medium | 6.5 | 2019-02-27 | IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products versions 7.5 through 8.2 could allow an authenticated user to dow… |
CVE-2018-11845 | Medium | 5.5 | 2019-02-25 | Usage of non-time-constant comparison functions can lead to information leakage through side channel analysis in Snapdragon Auto, Snapdragon Compute, Snapdrago… |
CVE-2019-9126 | High | 7.5 | 2019-02-25 | An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. There is an information disclosure vulnerability via requests for the router_info.xml document. T… |
CVE-2014-10079 | Medium | 5.3 | 2019-02-23 | In Vembu StoreGrid 4.4.x, the front page of the server web interface leaks the private IP address in the "ipaddress" hidden form value of the HTML source code… |
CVE-2019-1681 | High | 7.5 | 2019-02-21 | A vulnerability in the TFTP service of Cisco Network Convergence System 1000 Series software could allow an unauthenticated, remote attacker to retrieve arbitr… |
CVE-2018-1950 | Medium | 4.3 | 2019-02-21 | IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance generates an error message that includes sensitive information about it… |
CVE-2018-1949 | Medium | 4.3 | 2019-02-21 | IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance discloses sensitive information to unauthorized users. The information… |
CVE-2019-3610 | Medium | 5.6 | 2019-02-13 | Data Leakage Attacks vulnerability in Microsoft Windows client in McAfee True Key (TK) 3.1.9211.0 and earlier allows local users to expose confidential data vi… |
CVE-2018-12006 | Medium | 5.5 | 2019-02-11 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Users with no extra privileges can potentially acces… |
CVE-2018-20776 | High | 7.5 | 2019-02-11 | Frog CMS 0.9.5 provides a directory listing for a /public request. |
CVE-2019-7628 | Medium | 5.9 | 2019-02-08 | Pagure 5.2 leaks API keys by e-mailing them to users. Few e-mail servers validate TLS certificates, so it is easy for man-in-the-middle attackers to read these… |
CVE-2018-1296 | High | 7.5 | 2019-02-07 | In Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, and 2.5.0 to 2.7.5, HDFS exposes extended attribute key/value pairs during listXAttrs, verifying… |
CVE-2019-7535 | Medium | 5.3 | 2019-02-07 | index.php in Gurock TestRail 5.3.0.3603 returns potentially sensitive information for an invalid request, as demonstrated by full path disclosure and the ident… |
CVE-2019-1003021 | Medium | 4.3 | 2019-02-06 | An exposure of sensitive information vulnerability exists in Jenkins OpenId Connect Authentication Plugin 1.4 and earlier in OicSecurityRealm/config.jelly that… |
CVE-2019-1003018 | Medium | 4.3 | 2019-02-06 | An exposure of sensitive information vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm/config.jelly that all… |
CVE-2018-18334 | High | 7.5 | 2019-02-05 | A vulnerability in the Private Browser of Trend Micro Dr. Safety for Android (Consumer) versions below 3.0.1478 could allow an remote attacker to bypass the Sa… |
CVE-2017-1177 | Medium | 5.3 | 2019-02-05 | IBM BigFix Compliance 1.7 through 1.9.91 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the sys… |
CVE-2018-15659 | Medium | 6.5 | 2019-02-05 | An issue was discovered in 42Gears SureMDM before 2018-11-27, related to the access policy for Silverlight applications. Cross-origin access is possible. |
CVE-2018-15658 | High | 7.5 | 2019-02-05 | An issue was discovered in 42Gears SureMDM before 2018-11-27. By visiting the page found at /console/ConsolePage/Master.html, an attacker is able to see the ma… |
CVE-2018-15656 | High | 7.5 | 2019-02-05 | An issue was discovered in the registration API endpoint in 42Gears SureMDM before 2018-11-27. An attacker can submit a GET request to /api/register/:email, wh… |
CVE-2018-15655 | Medium | 6.5 | 2019-02-05 | An issue was discovered in 42Gears SureMDM before 2018-11-27, related to CORS settings. Cross-origin access is possible. |
CVE-2019-7388 | High | 7.5 | 2019-02-05 | An issue was discovered in /bin/goahead on D-Link DIR-823G devices with firmware 1.02B03. There is incorrect access control allowing remote attackers to get se… |
CVE-2018-1675 | Medium | 6.8 | 2019-02-04 | IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 could expose password hashes in stored in system memory on target systems that are configured… |
CVE-2019-7312 | Medium | 5.3 | 2019-02-03 | Limited plaintext disclosure exists in PRIMX Zed Entreprise for Windows before 6.1.2240, Zed Entreprise for Windows (ANSSI qualification submission) before 6.1… |
CVE-2018-18941 | Critical | 9.8 | 2019-01-31 | In Vignette Content Management version 6, it is possible to gain remote access to administrator privileges by discovering the admin password in the vgn/ccb/use… |
CVE-2018-19440 | Medium | 5.3 | 2019-01-30 | ARM Trusted Firmware-A allows information disclosure. |
CVE-2018-12610 | Medium | 5.3 | 2019-01-30 | OX App Suite 7.8.4 and earlier allows Information Exposure. |
CVE-2018-1976 | Medium | 4.9 | 2019-01-29 | IBM API Connect 5.0.0.0 through 5.0.8.4 is impacted by sensitive information disclosure via a REST API that could allow a user with administrative privileges t… |
CVE-2016-10740 | Medium | 4.9 | 2019-01-29 | Various resources in Atlassian Crowd before version 2.10.1 allow remote attackers with administration rights to learn the passwords of configured LDAP director… |
CVE-2018-16889 | Medium | 5.5 | 2019-01-28 | Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaint… |
CVE-2018-5497 | Medium | 4.4 | 2019-01-24 | Clustered Data ONTAP versions prior to 9.1P16, 9.3P10 and 9.4P5 are susceptible to a vulnerability which discloses sensitive information to an unauthorized use… |
CVE-2019-1657 | Medium | 4.3 | 2019-01-24 | A vulnerability in Cisco AMP Threat Grid could allow an authenticated, remote attacker to access sensitive information. The vulnerability is due to unsafe crea… |
CVE-2019-1645 | Medium | 4.3 | 2019-01-24 | A vulnerability in the Cisco Connected Mobile Experiences (CMX) software could allow an unauthenticated, adjacent attacker to access sensitive data on an affec… |
CVE-2018-0187 | Medium | 6.5 | 2019-01-23 | A vulnerability in the Admin portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain confidential information fo… |
CVE-2018-2026 | Medium | 4.3 | 2019-01-23 | IBM Financial Transaction Manager 3.2.1 for Digital Payments could allow an authenticated user to obtain a directory listing of internal product files. IBM X-F… |
CVE-2017-18332 | Medium | 5.5 | 2019-01-18 | Security keys are logged when any WCDMA call is configured or reconfigured in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9607… |
CVE-2018-19718 | Medium | 5.3 | 2019-01-18 | Adobe Connect versions 9.8.1 and earlier have a session token exposure vulnerability. Successful exploitation could lead to exposure of the privileges granted… |
CVE-2019-0647 | Medium | 6.5 | 2019-01-17 | An information disclosure vulnerability exists when Team Foundation Server does not properly handle variables marked as secret, aka "Team Foundation Server Inf… |
CVE-2018-5738 | Medium | 5.3 | 2019-01-16 | Change #4777 (introduced in October 2017) introduced an unforeseen issue in releases which were issued after that date, affecting which clients are permitted t… |
CVE-2019-3811 | Medium | 5.2 | 2019-01-15 | A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty str… |
CVE-2019-3803 | Medium | 4.5 | 2019-01-12 | Pivotal Concourse, all versions prior to 4.2.2, puts the user access token in a url during the login flow. A remote attacker who gains access to a user's brows… |
CVE-2018-16866 | Low | 3.3 | 2019-01-11 | An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'. A local attacker can use this flaw… |
CVE-2018-4217 | High | 7.5 | 2019-01-11 | In macOS High Sierra before 10.13.5, a privacy issue in the handling of Open Directory records was addressed with improved indexing. |
CVE-2018-4186 | High | 7.5 | 2019-01-11 | In Safari before 11.1, an information leakage issue existed in the handling of downloads in Safari Private Browsing. This issue was addressed with additional v… |
CVE-2018-4185 | High | 7.5 | 2019-01-11 | In iOS before 11.3, tvOS before 11.3, watchOS before 4.3, and macOS before High Sierra 10.13.4, an information disclosure issue existed in the transition of pr… |
CVE-2018-4179 | Medium | 5.5 | 2019-01-11 | In macOS High Sierra before 10.13.4, there was an issue with the handling of smartcard PINs. This issue was addressed with additional logic. |
CVE-2016-4644 | Medium | 6.5 | 2019-01-11 | In iOS before 9.3.3, tvOS before 9.2.2, and OS X El Capitan before v10.11.6 and Security Update 2016-004, a downgrade issue existed with HTTP authentication cr… |
CVE-2016-4643 | Medium | 6.5 | 2019-01-11 | In iOS before 9.3.3, tvOS before 9.2.2, and OS X El Capitan before v10.11.6 and Security Update 2016-004, a validation issue existed in the parsing of 407 resp… |
CVE-2018-15456 | Medium | 4.3 | 2019-01-10 | A vulnerability in the Admin Portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to view saved passwords in plain text… |
CVE-2018-0474 | High | 8.8 | 2019-01-10 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view digest cred… |
CVE-2019-5884 | Medium | 5.9 | 2019-01-10 | php/elFinder.class.php in elFinder before 2.1.45 leaks information if PHP's curl extension is enabled and safe_mode or open_basedir is not set. |
CVE-2018-20681 | Medium | 6.1 | 2019-01-09 | mate-screensaver before 1.20.2 in MATE Desktop Environment allows physically proximate attackers to view screen content and possibly control applications. By u… |
CVE-2018-16192 | Medium | 6.5 | 2019-01-09 | Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allow an attacker on the same ne… |
CVE-2018-1000410 | High | 7.8 | 2019-01-09 | An information exposure vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier, and the Stapler framework used by these releases, in core/s… |
CVE-2018-6179 | Medium | 6.5 | 2019-01-09 | Insufficient enforcement of file access permission in the activeTab case in Extensions in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced… |
CVE-2018-6164 | Medium | 6.5 | 2019-01-09 | Insufficient origin checks for CSS content in Blink in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to leak cross-origin data via a crafted HT… |
CVE-2018-6147 | Medium | 5.5 | 2019-01-09 | Lack of secure text entry mode in Browser UI in Google Chrome on Mac prior to 67.0.3396.62 allowed a local attacker to obtain potentially sensitive information… |
CVE-2018-6137 | Medium | 6.5 | 2019-01-09 | CSS Paint API in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2018-6117 | Medium | 6.5 | 2019-01-09 | Confusing settings in Autofill in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to obtain potentially sensitive information from process memor… |
CVE-2018-6109 | Medium | 6.5 | 2019-01-09 | readAsText() can indefinitely read the file picked by the user, rather than only once at the time the file is picked in File API in Google Chrome prior to 66.0… |
CVE-2018-6093 | Medium | 6.5 | 2019-01-09 | Insufficient origin checks in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2018-16078 | Medium | 6.5 | 2019-01-09 | Unsafe handling of credit card details in Autofill in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to obtain potentially sensitive information… |
CVE-2019-0545 | High | 7.5 | 2019-01-08 | An information disclosure vulnerability exists in .NET Framework and .NET Core which allows bypassing Cross-origin Resource Sharing (CORS) configurations, aka… |
CVE-2018-1993 | Medium | 4.0 | 2019-01-08 | IBM Spectrum Scale (GPFS) 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.2.3, and 5.0.0 where the use of Local Read Only Cache (LROC) is enabled may caused read operation on a… |
CVE-2018-1932 | Medium | 4.9 | 2019-01-08 | IBM API Connect 5.0.0.0 through 5.0.8.4 is affected by a vulnerability in the role-based access control in the management server that could allow an authentica… |
CVE-2018-3986 | Medium | 5.5 | 2019-01-03 | An exploitable information disclosure vulnerability exists in the "Secret Chats" functionality of the Telegram Android messaging application version 4.9.0. The… |
CVE-2018-16870 | Medium | 5.9 | 2019-01-03 | It was found that wolfssl before 3.15.7 is vulnerable to a new variant of the Bleichenbacher attack to perform downgrade attacks against TLS. This may lead to… |
CVE-2018-16876 | Medium | 5.3 | 2019-01-03 | ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible d… |
CVE-2017-18326 | Medium | 5.5 | 2019-01-03 | Cryptographic keys are printed in modem debug messages in snapdragon mobile and snapdragon wear in versions MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM96… |
CVE-2017-18324 | Medium | 5.5 | 2019-01-03 | Cryptographic key material leaked in debug messages - GERAN in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M… |
CVE-2017-18322 | Medium | 5.5 | 2019-01-03 | Cryptographic key material leaked in WCDMA debug messages in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MD… |
CVE-2017-18321 | Medium | 5.5 | 2019-01-03 | Security keys used by the terminal and NW for a session could be leaked in snapdragon mobile in versions MDM9650, MDM9655, SD 835, SDA660. |
CVE-2018-7900 | Medium | 6.5 | 2019-01-02 | There is an information leak vulnerability in some Huawei HG products. An attacker may obtain information about the HG device by exploiting this vulnerability. |
CVE-2018-20609 | Medium | 5.3 | 2018-12-30 | imcat 4.4 allows remote attackers to obtain potentially sensitive configuration information via the root/tools/adbug/check.php URI. |
CVE-2018-20608 | High | 7.5 | 2018-12-30 | imcat 4.4 allows remote attackers to read phpinfo output via the root/tools/adbug/binfo.php?phpinfo1 URI. |
CVE-2018-20607 | Medium | 5.3 | 2018-12-30 | imcat 4.4 allows remote attackers to obtain potentially sensitive debugging information via the root/tools/adbug/binfo.php URI. |
CVE-2018-20606 | High | 7.5 | 2018-12-30 | imcat 4.4 allows full path disclosure via a dev.php?tools-ipaddr&api=Pcoln&uip= URI. |
CVE-2018-20602 | High | 7.5 | 2018-12-30 | Lei Feng TV CMS (aka LFCMS) 3.8.6 allows full path disclosure via the /install.php?s=/1 URI. |
CVE-2018-14986 | High | 7.5 | 2018-12-28 | The Leagoo Z5C Android device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contains a pre-installed… |
CVE-2018-14984 | High | 7.5 | 2018-12-28 | The Leagoo Z5C Android device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contains a pre-installed… |
CVE-2018-14979 | Medium | 4.7 | 2018-12-28 | The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/US_Phone/ASUS_X008_1:7.0/NRD90M/US_Phone-14.14.1711.92-20171208:user/release-keys contai… |
CVE-2018-20571 | High | 7.5 | 2018-12-28 | DamiCMS 6.0.1 allows remote attackers to read arbitrary files via a crafted admin.php?s=Tpl/Add/id request, as demonstrated by admin.php?s=Tpl/Add/id/.\Public\… |
CVE-2018-20511 | Medium | 5.5 | 2018-12-27 | An issue was discovered in the Linux kernel before 4.18.11. The ipddp_ioctl function in drivers/net/appletalk/ipddp.c allows local users to obtain sensitive ke… |
CVE-2018-11741 | Critical | 9.8 | 2018-12-26 | NEC Univerge Sv9100 WebPro 6.00.00 devices have Predictable Session IDs that result in Account Information Disclosure via Home.htm?sessionId=#####&GOTO(8) URIs. |
CVE-2018-20483 | High | 7.8 | 2018-12-26 | set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of t… |
CVE-2018-20478 | High | 7.5 | 2018-12-26 | An issue was discovered in S-CMS 1.0. It allows reading certain files, such as PHP source code, via the admin/download.php DownName parameter with a mixed-case… |
CVE-2018-8919 | High | 8.3 | 2018-12-24 | Information exposure vulnerability in SYNO.Core.Desktop.SessionData in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to steal c… |
CVE-2018-20371 | Critical | 9.8 | 2018-12-23 | PhotoRange Photo Vault 1.2 appends the password to the URI for authorization, which makes it easier for remote attackers to bypass intended GET restrictions vi… |
CVE-2018-18441 | High | 7.5 | 2018-12-20 | D-Link DCS series Wi-Fi cameras expose sensitive information regarding the device configuration. The affected devices include many of DCS series, such as: DCS-… |
CVE-2018-17244 | Medium | 6.5 | 2018-12-20 | Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Directory, LDAP, Nativ… |
CVE-2018-20307 | Medium | 4.3 | 2018-12-20 | Pulse Secure Virtual Traffic Manager 9.9 versions prior to 9.9r2 and 10.4r1 allow a remote authenticated user to obtain sensitive historical activity informati… |
CVE-2018-16883 | Low | 2.5 | 2018-12-19 | sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "allowed_uids" configuration parameter. If sensitiv… |
CVE-2017-15031 | High | 7.5 | 2018-12-18 | In all versions of ARM Trusted Firmware up to and including v1.4, not initializing or saving/restoring the PMCR_EL0 register can leak secure world timing infor… |
CVE-2018-7812 | High | 7.5 | 2018-12-17 | An Information Exposure through Discrepancy vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where th… |
CVE-2018-19976 | Medium | 5.5 | 2018-12-17 | In YARA 3.8.1, bytecode in a specially crafted compiled rule is exposed to information about its environment, in libyara/exec.c. This is a consequence of the d… |
CVE-2017-1272 | Low | 3.7 | 2018-12-17 | IBM Security Guardium 10.0 and 10.5 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access… |
CVE-2018-20170 | Medium | 5.3 | 2018-12-17 | OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth… |
CVE-2017-18355 | High | 7.5 | 2018-12-17 | Installed packages are exposed by node_modules in Rendertron 1.0.0, allowing remote attackers to read absolute paths on the server by examining the "_where" at… |
CVE-2018-20154 | Medium | 4.3 | 2018-12-14 | The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated users to discover all subscriber e-mail addresses. |