CWE-200 · Information Disclosure (page 53)
Page 53 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-20151 | High | 7.5 | 2018-12-14 | In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual configuration were chosen… |
CVE-2018-19413 | Medium | 4.3 | 2018-12-14 | A vulnerability in the API of SonarSource SonarQube before 7.4 could allow an authenticated user to discover sensitive information such as valid user-account l… |
CVE-2018-19039 | Medium | 6.5 | 2018-12-13 | Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permissions. |
CVE-2018-12076 | Medium | 4.2 | 2018-12-13 | A vulnerability in the UPC bar code of the Avanti Markets MarketCard could allow an unauthenticated, local attacker to access funds within the customer's Marke… |
CVE-2018-1886 | Medium | 5.3 | 2018-12-13 | IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 discloses sensitive information to unauthorized users. The information ca… |
CVE-2018-1805 | Medium | 4.3 | 2018-12-13 | IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 generates an error message that includes sensitive information about its… |
CVE-2018-13811 | Medium | 5.5 | 2018-12-13 | A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) (All Versions < V15.1). Password hashes with insufficient computational effort could allow a… |
CVE-2018-8033 | High | 7.5 | 2018-12-13 | In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webto… |
CVE-2018-15718 | High | 7.5 | 2018-12-12 | Open Dental before version 18.4 transmits the entire user database over the network when a remote unauthenticated user accesses the command prompt. This allows… |
CVE-2018-1481 | Low | 3.7 | 2018-12-12 | IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 stores sensitive information in URL parameters. This may lead to information disclosure if unaut… |
CVE-2018-1476 | Medium | 5.3 | 2018-12-12 | IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 discloses sensitive information to unauthorized users. The information can be used to mount furt… |
CVE-2018-15328 | High | 7.5 | 2018-12-12 | On BIG-IP 14.0.x, 13.x, 12.x, and 11.x, Enterprise Manager 3.1.1, BIG-IQ 6.x, 5.x, and 4.x, and iWorkflow 2.x, the passphrases for SNMPv3 users and trap destin… |
CVE-2018-8580 | Medium | 4.3 | 2018-12-12 | An information disclosure vulnerability exists where certain modes of the search function in Microsoft SharePoint Server are vulnerable to cross-site search at… |
CVE-2018-19968 | Medium | 6.5 | 2018-12-11 | An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have… |
CVE-2018-15800 | High | 8.1 | 2018-12-10 | Cloud Foundry Bits Service, versions prior to 2.18.0, includes an information disclosure vulnerability. A remote malicious user may execute a timing attack to… |
CVE-2018-3988 | Medium | 4.7 | 2018-12-10 | Signal Messenger for Android 4.24.8 may expose private information when using "disappearing messages." If a user uses the photo feature available in the "attac… |
CVE-2018-1957 | Medium | 4.0 | 2018-12-10 | IBM WebSphere Application Server 9 could allow sensitive information to be available caused by mishandling of data by the application based on an incorrect ret… |
CVE-2018-1000862 | Medium | 4.3 | 2018-12-10 | An information exposure vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in DirectoryBrowserSupport.java that allows attackers with t… |
CVE-2018-19962 | High | 7.8 | 2018-12-08 | An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because small IOMMU mappings ar… |
CVE-2018-1663 | Medium | 5.9 | 2018-12-07 | IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, 7.6, and 2018.4 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enab… |
CVE-2018-16603 | Medium | 5.9 | 2018-12-06 | An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middlewar… |
CVE-2018-16602 | Medium | 5.9 | 2018-12-06 | An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middlewar… |
CVE-2018-16600 | Medium | 5.9 | 2018-12-06 | An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middlewar… |
CVE-2018-16599 | Medium | 5.9 | 2018-12-06 | An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middlewar… |
CVE-2018-16527 | Medium | 5.9 | 2018-12-06 | Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component allow in… |
CVE-2018-16524 | Medium | 5.9 | 2018-12-06 | Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component allow in… |
CVE-2018-9554 | Medium | 5.5 | 2018-12-06 | In dumpExtractors of IMediaExtractor.cp, there is a possible disclosure of recently accessed media files due to a permissions bypass. This could lead to local… |
CVE-2018-1935 | Medium | 4.3 | 2018-12-06 | IBM Connections 5.0, 5.5, and 6.0 could allow an authenticated user to obtain sensitive information from invalid request error messages. IBM X-Force ID: 153315. |
CVE-2018-1505 | Medium | 4.0 | 2018-12-06 | IBM i2 Enterprise Insight Analysis 2.1.7 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 141413. |
CVE-2018-12155 | Medium | 5.5 | 2018-12-05 | Data leakage in cryptographic libraries for Intel IPP before 2019 update1 release may allow an authenticated user to potentially enable information disclosure… |
CVE-2018-15773 | Medium | 4.3 | 2018-12-05 | Dell Encryption (formerly Dell Data Protection | Encryption) v10.1.0 and earlier contain an information disclosure vulnerability. A malicious user with physica… |
CVE-2018-1732 | Medium | 5.3 | 2018-12-05 | IBM QRadar Advisor with Watson 1.14.0 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system… |
CVE-2018-1697 | Medium | 4.3 | 2018-12-05 | IBM Maximo Asset Management 7.6 could allow an authenticated user to enumerate usernames using a specially crafted HTTP request. IBM X-Force ID: 145966. |
CVE-2018-1568 | Medium | 4.0 | 2018-12-05 | IBM QRadar SIEM 7.2 and 7.3 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 143118. |
CVE-2018-18648 | High | 7.5 | 2018-12-04 | An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Information Exposure T… |
CVE-2018-18645 | Medium | 4.3 | 2018-12-04 | An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows for Information Exp… |
CVE-2018-18644 | Medium | 6.5 | 2018-12-04 | An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows Information Ex… |
CVE-2018-18640 | Medium | 6.5 | 2018-12-04 | An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Information Exposure T… |
CVE-2018-17976 | Medium | 6.5 | 2018-12-04 | An issue was discovered in GitLab Community Edition 11.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. There is Information Exposure via Epic… |
CVE-2018-17975 | Medium | 5.3 | 2018-12-04 | An issue was discovered in GitLab Community Edition 11.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. There is Information Exposure via the G… |
CVE-2018-17939 | High | 7.5 | 2018-12-04 | An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. There is Information E… |
CVE-2018-5496 | Medium | 4.4 | 2018-12-04 | Data ONTAP operating in 7-Mode versions prior to 8.2.5P2 are susceptible to a vulnerability which discloses sensitive information to an unauthorized user. |
CVE-2018-6099 | Medium | 6.5 | 2018-12-04 | A lack of CORS checks in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak limited cross-origin data via a crafted HTML page. |
CVE-2018-6095 | Medium | 6.5 | 2018-12-04 | Inappropriate dismissal of file picker on keyboard events in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to read local files via a… |
CVE-2018-12318 | High | 8.8 | 2018-12-04 | Information disclosure in the SNMP settings page in ASUSTOR ADM version 3.1.1 allows attackers to obtain the SNMP password in cleartext. |
CVE-2018-12308 | Medium | 6.5 | 2018-12-04 | Encryption key disclosure in share.cgi in ASUSTOR ADM version 3.1.1 allows attackers to obtain the encryption key via the "encrypt_key" URL parameter. |
CVE-2018-19854 | Medium | 4.7 | 2018-12-04 | An issue was discovered in the Linux kernel before 4.19.3. crypto_report_one() and related functions in crypto/crypto_user.c (the crypto user configuration API… |
CVE-2018-3854 | High | 7.1 | 2018-12-03 | An exploitable information disclosure vulnerability exists in the password protection functionality of Quicken Deluxe 2018 for Mac version 5.2.2. A specially c… |
CVE-2018-14702 | High | 7.5 | 2018-12-03 | Incorrect access control in the /drobopix/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve sensit… |
CVE-2018-14696 | High | 7.5 | 2018-12-03 | Incorrect access control in the /mysql/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve sensitive… |
CVE-2018-14695 | High | 7.5 | 2018-12-03 | Incorrect access control in the /mysql/api/diags.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve diagnosti… |
CVE-2018-16477 | Medium | 6.5 | 2018-11-30 | A bypass vulnerability in Active Storage >= 5.2.0 for Google Cloud Storage and Disk services allow an attacker to modify the `content-disposition` and `content… |
CVE-2018-19120 | High | 7.5 | 2018-11-29 | The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger outbound TCP connections to arbitrary IP addresses, leading to discl… |
CVE-2018-15979 | High | 7.5 | 2018-11-29 | Adobe Acrobat and Reader versions 2019.008.20080 and earlier, 2017.011.30105 and earlier, and 2015.006.30456 and earlier have a ntlm sso hash theft vulnerabili… |
CVE-2018-7977 | High | 7.5 | 2018-11-27 | There is an information leakage vulnerability on several Huawei products. Due to insufficient communication protection for specific services, a remote, unautho… |
CVE-2018-7961 | Medium | 6.5 | 2018-11-27 | There is a smart SMS verification code vulnerability in some Huawei smart phones. An attacker should trick a user to access malicious Website or malicious App… |
CVE-2018-7946 | Medium | 4.3 | 2018-11-27 | There is an information leak vulnerability in some Huawei smartphones. An attacker may do some specific configuration in the smartphone and trick a user into i… |
CVE-2018-13352 | High | 7.5 | 2018-11-27 | Session Exposure in the web application for TerraMaster TOS version 3.1.03 allows attackers to view active session tokens in a world-readable directory. |
CVE-2018-10142 | High | 7.5 | 2018-11-27 | The Expedition Migration tool 1.0.106 and earlier may allow an unauthenticated attacker to enumerate files on the operating system. |
CVE-2018-6266 | Medium | 5.5 | 2018-11-27 | NVIDIA GeForce Experience contains a vulnerability in all versions prior to 3.16 on Windows where a local user may obtain third party integration parameters, w… |
CVE-2018-19609 | Medium | 6.5 | 2018-11-27 | ShowDoc 2.4.1 allows remote attackers to obtain sensitive information by navigating with a modified page_id, as demonstrated by reading note content, or discov… |
CVE-2018-13319 | High | 7.5 | 2018-11-26 | Incorrect access control in get_portal_info in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to determine sensitive device information via an unauthen… |
CVE-2018-16862 | Medium | 5.3 | 2018-11-26 | A security flaw was found in the Linux kernel in a way that the cleancache subsystem clears an inode after the final file truncation (removal). The new file cr… |
CVE-2018-1843 | Medium | 4.1 | 2018-11-21 | The Identity and Access Management (IAM) services (IBM Cloud Private 3.1.0) do not use a secure channel, such as SSL, to exchange information only when accesse… |
CVE-2018-18865 | High | 8.1 | 2018-11-20 | The Royal browser extensions TS before 4.3.60728 (Release Date 2018-07-28) and TSX before 3.3.1 (Release Date 2018-09-13) allow Credentials Disclosure. |
CVE-2018-16224 | Medium | 5.3 | 2018-11-20 | Incorrect access control for the diagnostic files of the iSmartAlarm Cube One through 2.2.4.10 allows an attacker to retrieve them via a specifically crafted T… |
CVE-2018-1841 | Medium | 6.2 | 2018-11-19 | IBM Cloud Private 2.1.0 could allow a local user to obtain the CA Private Key due to it being world readable in boot/master node. IBM X-Force ID: 150901. |
CVE-2018-7360 | Critical | 9.6 | 2018-11-16 | All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by information exposure vulnerability, which may allow an unauthenticated attacker to get… |
CVE-2018-1639 | Medium | 4.3 | 2018-11-16 | The Report Builder of Jazz Reporting Service 5.0 through 5.0.2 and 6.0 through 6.0.6 could allow an authenticated user to obtain sensitive information beyond i… |
CVE-2018-9071 | Medium | 5.3 | 2018-11-16 | Lenovo Chassis Management Module (CMM) prior to version 2.0.0 allows unauthenticated users to retrieve information related to the current authentication config… |
CVE-2018-5407 | Medium | 4.7 | 2018-11-15 | Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'p… |
CVE-2018-9543 | Medium | 5.5 | 2018-11-14 | In trim_device of f2fs_format_utils.c, it is possible that the data partition is not wiped during a factory reset. This could lead to local information disclos… |
CVE-2018-9526 | High | 7.5 | 2018-11-14 | In device configuration data, there is an improperly configured setting. This could lead to remote disclosure of device location. User interaction is not neede… |
CVE-2018-6082 | Medium | 4.7 | 2018-11-14 | Including port 22 in the list of allowed FTP ports in Networking in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially enumerate int… |
CVE-2018-6079 | Medium | 6.5 | 2018-11-14 | Inappropriate sharing of TEXTURE_2D_ARRAY/TEXTURE_3D data between tabs in WebGL in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross… |
CVE-2018-6077 | Medium | 6.5 | 2018-11-14 | Displacement map filters being applied to cross-origin images in Blink SVG rendering in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak… |
CVE-2018-6075 | Medium | 6.5 | 2018-11-14 | Incorrect handling of specified filenames in file downloads in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a c… |
CVE-2018-6066 | Medium | 6.5 | 2018-11-14 | Lack of CORS checking by ResourceFetcher/ResourceLoader in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data vi… |
CVE-2018-17468 | Medium | 6.5 | 2018-11-14 | Incorrect handling of timer information during navigation in Blink in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obtain cross origin URLs… |
CVE-2018-3621 | Medium | 6.5 | 2018-11-14 | Insufficient input validation in the Intel Driver & Support Assistant before 3.6.0.4 may allow an unauthenticated user to potentially enable information disclo… |
CVE-2018-8565 | Medium | 5.5 | 2018-11-14 | An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka "Win32k Information Disclosure Vulnerabili… |
CVE-2018-8558 | Medium | 6.5 | 2018-11-14 | An information disclosure vulnerability exists when Microsoft Outlook fails to respect "Default link type" settings configured via the SharePoint Online Admin… |
CVE-2018-8454 | Medium | 5.5 | 2018-11-14 | An information disclosure vulnerability exists when Windows Audio Service fails to properly handle objects in memory, aka "Windows Audio Service Information Di… |
CVE-2018-6260 | Medium | 5.5 | 2018-11-13 | NVIDIA graphics driver contains a vulnerability that may allow access to application data processed on the GPU through a side channel exposed by the GPU perfor… |
CVE-2018-15771 | Medium | 5.5 | 2018-11-13 | Dell EMC RecoverPoint versions prior to 5.1.2.1 and RecoverPoint for VMs versions prior to 5.2.0.2 contain an information disclosure vulnerability. A malicious… |
CVE-2018-18591 | Medium | 6.8 | 2018-11-13 | A potential unauthorized disclosure of data vulnerability has been identified in Micro Focus Service Manager versions: 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40… |
CVE-2018-19246 | High | 7.5 | 2018-11-13 | PHP-Proxy 5.1.0 allows remote attackers to read local files if the default "pre-installed version" (intended for users who lack shell access to their web serve… |
CVE-2018-19226 | Medium | 5.3 | 2018-11-12 | An issue was discovered in LAOBANCMS 2.0. It allows remote attackers to list .txt files via a direct request for the /data/0/admin.txt URI. |
CVE-2018-19205 | High | 7.5 | 2018-11-12 | Roundcube before 1.3.7 mishandles GnuPG MDC integrity-protection warnings, which makes it easier for attackers to obtain sensitive information, a related issue… |
CVE-2018-19194 | Medium | 5.3 | 2018-11-12 | An issue was discovered in XiaoCms 20141229. /admin/index.php?c=database allows full path disclosure in a "failed to open stream" error message. |
CVE-2018-19148 | Low | 3.7 | 2018-11-10 | Caddy through 0.11.0 sends incorrect certificates for certain invalid requests, making it easier for attackers to enumerate hostnames. Specifically, when unabl… |
CVE-2018-19133 | Medium | 5.3 | 2018-11-09 | In Flarum Core 0.1.0-beta.7.1, a serious leak can get everyone's email address. |
CVE-2018-1857 | Medium | 4.8 | 2018-11-09 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1 could allow a user to bypass FGAC control and gain access to data they shouldn't be able… |
CVE-2017-1119 | Medium | 4.3 | 2018-11-09 | IBM Marketing Operations 9.1.0, 9.1.2, and 10.1 could allow a remote attacker to obtain sensitive information. An attacker could send a specially-crafted reque… |
CVE-2018-19046 | Medium | 4.7 | 2018-11-08 | keepalived 2.0.8 didn't check for existing plain files when writing data to a temporary file upon a call to PrintData or PrintStats. If a local attacker had pr… |
CVE-2018-19045 | High | 7.5 | 2018-11-08 | keepalived 2.0.8 used mode 0666 when creating new temporary files upon a call to PrintData or PrintStats, potentially leaking sensitive information. |
CVE-2018-15446 | Medium | 5.3 | 2018-11-08 | A vulnerability in Cisco Meeting Server could allow an unauthenticated, remote attacker to gain access to sensitive information. The vulnerability is due to im… |
CVE-2018-19075 | Medium | 5.3 | 2018-11-07 | An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5… |
CVE-2018-18590 | Critical | 9.6 | 2018-11-07 | A potential remote code execution and information disclosure vulnerability exists in Micro Focus Operations Bridge containerized suite versions 2017.11, 2018.0… |
CVE-2018-9489 | High | 7.5 | 2018-11-06 | When wifi is switched, function sendNetworkStateChangeBroadcast of WifiStateMachine.java broadcasts an intent including detailed wifi network information. This… |