CWE-200 · Information Disclosure (page 54)
Page 54 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-1606 | Medium | 4.3 | 2018-11-06 | IBM Jazz based applications (IBM Rational Collaborative Lifecycle Management 5.0 through 5.02 and 6.0 through 6.0.6, IBM Rational DOORS Next Generation 5.0 thr… |
CVE-2018-17907 | Low | 3.3 | 2018-11-05 | When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior and tampering with the value of an offset, an attacker can force the applicatio… |
CVE-2018-16849 | Low | 3.1 | 2018-11-02 | A flaw was found in openstack-mistral. By manipulating the SSH private key filename, the std.ssh action can be used to disclose the presence of arbitrary files… |
CVE-2018-1878 | Medium | 5.3 | 2018-11-02 | IBM Robotic Process Automation with Automation Anywhere 11 could disclose sensitive information in a web request that could aid in future attacks against the s… |
CVE-2018-3947 | High | 8.1 | 2018-11-01 | An exploitable information disclosure vulnerability exists in the phone-to-camera communications of Yi Home Camera 27US 1.8.7.0D. An attacker can sniff network… |
CVE-2018-3928 | High | 7.5 | 2018-11-01 | An exploitable code execution vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted set of UDP packets… |
CVE-2018-13281 | Medium | 4.3 | 2018-10-31 | Information exposure vulnerability in SYNO.Core.ACL in Synology DiskStation Manager (DSM) before 6.2-23739-2 allows remote authenticated users to determine the… |
CVE-2018-16467 | Medium | 5.3 | 2018-10-30 | A missing check in Nextcloud Server prior to 14.0.0 could give unauthorized access to the previews of single file password protected shares. |
CVE-2018-1380 | Low | 2.7 | 2018-10-29 | IBM InfoSphere Master Data Management Collaboration Server 11.4, 11.5, and 11.6 could allow an authenticated user with CA level access to change change their c… |
CVE-2018-18778 | Medium | 6.5 | 2018-10-29 | ACME mini_httpd before 1.30 lets remote users read arbitrary files. |
CVE-2018-18710 | Medium | 5.5 | 2018-10-29 | An issue was discovered in the Linux kernel through 4.19. An information leak in cdrom_ioctl_select_disc in drivers/cdrom/cdrom.c could be used by local attack… |
CVE-2018-6559 | Low | 3.3 | 2018-10-26 | The Linux kernel, as used in Ubuntu 18.04 LTS and Ubuntu 18.10, allows local users to obtain names of files in which they would not normally be able to access… |
CVE-2018-18658 | High | 7.5 | 2018-10-26 | An issue was discovered in Arcserve Unified Data Protection (UDP) through 6.5 Update 4. There is a DDI-VRT-2018-20 Unauthenticated Sensitive Information Disclo… |
CVE-2018-18657 | High | 7.5 | 2018-10-26 | An issue was discovered in Arcserve Unified Data Protection (UDP) through 6.5 Update 4. There is a DDI-VRT-2018-18 Unauthenticated Sensitive Information Disclo… |
CVE-2018-11846 | Medium | 4.7 | 2018-10-26 | The use of a non-time-constant memory comparison operation can lead to timing/side channel attacks in Snapdragon Mobile in version SD 210/SD 212/SD 205, SD 845… |
CVE-2018-18655 | Medium | 4.3 | 2018-10-26 | Prayer through 1.3.5 sends a Referer header, containing a user's username, when a user clicks on a link in their email because header.t lacks a no-referrer set… |
CVE-2018-18566 | Medium | 5.3 | 2018-10-24 | The SIP service in Polycom VVX 500 and 601 devices 5.8.0.12848 and earlier allow remote attackers to obtain sensitive phone configuration information by levera… |
CVE-2018-18467 | High | 7.5 | 2018-10-23 | An issue was discovered in Daniel Gultsch Conversations 2.3.4. It is possible to spoof a custom message to an existing opened conversation by sending an intent. |
CVE-2017-18300 | Medium | 5.5 | 2018-10-23 | Secure display content could be accessed by third party trusted application after creating a fault in other trusted applications in Snapdragon Mobile, Snapdrag… |
CVE-2018-18428 | High | 7.5 | 2018-10-19 | TP-Link TL-SC3130 1.6.18P12_121101 devices allow unauthenticated RTSP stream access, as demonstrated by a /jpg/image.jpg URI. |
CVE-2018-12673 | High | 7.5 | 2018-10-19 | An attacker with remote access to the SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B) web interface can disclose in… |
CVE-2018-12671 | Critical | 9.8 | 2018-10-19 | An attacker with remote access to the SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B) web interface can disclose in… |
CVE-2018-18390 | High | 7.5 | 2018-10-19 | User Enumeration in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1. |
CVE-2018-15765 | Low | 3.4 | 2018-10-18 | Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains an Information Exposure vulnerability. The log file contents store sensitive data inclu… |
CVE-2018-18487 | High | 7.5 | 2018-10-18 | In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, the database backup filename generation uses mt_rand() unsafely, resulting in predictable database ba… |
CVE-2018-12374 | Medium | 4.3 | 2018-10-18 | Plaintext of decrypted emails can leak through by user submitting an embedded form by pressing enter key within a text input field. This vulnerability affects… |
CVE-2018-12373 | Medium | 6.5 | 2018-10-18 | dDecrypted S/MIME parts hidden with CSS or the plaintext HTML tag can leak plaintext when included in a HTML reply/forward. This vulnerability affects Thunderb… |
CVE-2018-12372 | Medium | 6.5 | 2018-10-18 | Decrypted S/MIME parts, when included in HTML crafted for an attack, can leak plaintext when included in a a HTML reply/forward. This vulnerability affects Thu… |
CVE-2018-12365 | Medium | 6.5 | 2018-10-18 | A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system without user consent or interaction. Th… |
CVE-2018-12358 | Medium | 4.3 | 2018-10-18 | Service workers can use redirection to avoid the tainting of cross-origin resources in some instances, allowing a malicious site to read responses which are su… |
CVE-2018-0442 | High | 7.5 | 2018-10-17 | A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol component of Cisco Wireless LAN Controller (WLC) Software could all… |
CVE-2018-14597 | Medium | 5.3 | 2018-10-17 | CA Technologies Identity Governance 12.6, 14.0, 14.1, and 14.2 and CA Identity Suite Virtual Appliance 14.0, 14.1, and 14.2 provide telling error messages that… |
CVE-2018-18376 | High | 7.5 | 2018-10-16 | goform/getWlanClientInfo in Orange AirBox Y858_FL_01.16_04 allows remote attackers to discover information about currently connected devices (hostnames, IP add… |
CVE-2018-18073 | Medium | 6.3 | 2018-10-15 | Artifex Ghostscript allows attackers to bypass a sandbox protection mechanism by leveraging exposure of system operators in the saved execution stack in an err… |
CVE-2018-18289 | High | 7.5 | 2018-10-14 | The MESILAT Zabbix plugin before 1.1.15 for Atlassian Confluence allows attackers to read arbitrary files. |
CVE-2018-18287 | Medium | 5.3 | 2018-10-14 | On ASUS RT-AC58U 3.0.0.4.380_6516 devices, remote attackers can discover hostnames and IP addresses by reading dhcpLeaseInfo data in the HTML source code of th… |
CVE-2018-8890 | High | 7.5 | 2018-10-12 | An information disclosure vulnerability in the Management Console of BlackBerry UEM 12.8.0 and 12.8.1 could allow an attacker to take over a UEM user's session… |
CVE-2018-1838 | Medium | 5.3 | 2018-10-12 | IBM WebSphere Application Server 8.5 and 9.0 in IBM Cloud could allow a remote attacker to obtain sensitive information caused by improper handling of password… |
CVE-2018-1708 | Medium | 6.5 | 2018-10-11 | IBM Spectrum Symphony 7.1.2 and 7.2.0.2 could allow an authenticated user to obtain sensitive user information such as passwords through the WebUI. IBM X-Force… |
CVE-2018-12161 | Medium | 6.5 | 2018-10-10 | Insufficient session validation in the webserver component of the Intel Rapid Web Server 3 may allow an unauthenticated user to potentially disclose informatio… |
CVE-2018-12158 | Medium | 6.0 | 2018-10-10 | Insufficient input validation in BIOS update utility in Intel NUC FW kits downloaded before May 24, 2018 may allow a privileged user to potentially trigger a d… |
CVE-2018-17917 | Medium | 5.3 | 2018-10-10 | All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use MAC addresses to enumerate potential Cloud IDs. Using… |
CVE-2018-8472 | Medium | 5.5 | 2018-10-10 | An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, allowing an attacker to r… |
CVE-2018-8427 | Medium | 5.5 | 2018-10-10 | An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka "Microsoft Graphics Components Infor… |
CVE-2018-8330 | Medium | 5.5 | 2018-10-10 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera… |
CVE-2018-8292 | High | 7.5 | 2018-10-10 | An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information… |
CVE-2018-1753 | Medium | 4.3 | 2018-10-08 | IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 generates an error message that includes sensitive information about its environment, users, or associated d… |
CVE-2018-1743 | Medium | 5.3 | 2018-10-08 | IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 discloses sensitive information to unauthorized users. The information can be used to mount further attacks… |
CVE-2018-1000803 | Medium | 5.3 | 2018-10-08 | Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. This attack appear to be ex… |
CVE-2018-15433 | Medium | 4.3 | 2018-10-05 | A vulnerability in the server backup function of Cisco Prime Infrastructure could allow an authenticated, remote attacker to view sensitive information. The vu… |
CVE-2018-15432 | Medium | 4.3 | 2018-10-05 | A vulnerability in the server backup function of Cisco Prime Infrastructure could allow an authenticated, remote attacker to view sensitive information. The vu… |
CVE-2018-15407 | Medium | 5.5 | 2018-10-05 | A vulnerability in the installation process of Cisco HyperFlex Software could allow an authenticated, local attacker to read sensitive information. The vulnera… |
CVE-2018-0425 | Critical | 9.8 | 2018-10-05 | A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco… |
CVE-2018-1723 | Medium | 6.2 | 2018-10-05 | IBM Spectrum Scale 4.1.1.0, 4.1.1.20, 4.2.0.0, 4.2.3.10, 5.0.0 and 5.0.1.2 could allow an unprivileged, authenticated user with access to a GPFS node to read a… |
CVE-2014-10076 | High | 7.5 | 2018-10-05 | The wp-db-backup plugin 2.2.4 for WordPress relies on a five-character string for access control, which makes it easier for remote attackers to read backup arc… |
CVE-2018-17891 | Low | 3.7 | 2018-10-04 | Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream server where there is… |
CVE-2018-13258 | Medium | 5.3 | 2018-10-04 | Mediawiki 1.31 before 1.31.1 misses .htaccess files in the provided tarball used to protect some directories that shouldn't be web accessible. |
CVE-2018-1670 | Low | 3.1 | 2018-10-04 | IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.2 could allow an authenticated user to obtain sensitive product configuration informa… |
CVE-2017-5658 | Medium | 5.3 | 2018-10-04 | The statistics generator in Apache Pony Mail 0.7 to 0.9 was found to be returning timestamp data without proper authorization checks. This could lead to derive… |
CVE-2018-16051 | Medium | 6.5 | 2018-10-03 | An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. There is Orphaned Upload File… |
CVE-2018-14822 | Critical | 9.8 | 2018-10-02 | Entes EMG12 versions 2.57 and prior an information exposure through query strings vulnerability in the web interface has been identified, which may allow an at… |
CVE-2018-6262 | Low | 2.5 | 2018-10-02 | NVIDIA GeForce Experience prior to 3.15 contains a vulnerability when GameStream is enabled where limited sensitive user information may be available to users… |
CVE-2015-9269 | High | 7.5 | 2018-10-01 | The export/content.php exportarticle feature in the wordpress-mobile-pack plugin before 2.1.3 2015-06-03 for WordPress allows remote attackers to obtain sensit… |
CVE-2018-17216 | Medium | 6.5 | 2018-10-01 | An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is password hash exposure to privileged users. |
CVE-2018-17780 | Medium | 6.5 | 2018-09-29 | Telegram Desktop (aka tdesktop) 1.3.14, and Telegram 3.3.0.0 WP8.1 on Windows, leaks end-user public and private IP addresses during a call because of an unsaf… |
CVE-2018-17781 | High | 7.5 | 2018-09-29 | Foxit PhantomPDF and Reader before 9.3 allow remote attackers to trigger Uninitialized Object Information Disclosure because creation of ArrayBuffer and DataVi… |
CVE-2018-17155 | Medium | 5.5 | 2018-09-28 | In FreeBSD before 11.2-STABLE(r338983), 11.2-RELEASE-p4, 11.1-RELEASE-p15, 10.4-STABLE(r338984), and 10.4-RELEASE-p13, due to insufficient initialization of me… |
CVE-2018-16712 | Medium | 6.5 | 2018-09-26 | IObit Advanced SystemCare, which includes Monitor_win10_x64.sys or Monitor_win7_x64.sys, 1.2.0.5 (and possibly earlier versions) allows a user to send a specia… |
CVE-2018-16969 | Medium | 4.3 | 2018-09-26 | Citrix ShareFile StorageZones Controller before 5.4.2 has Information Exposure Through an Error Message. |
CVE-2018-17555 | High | 7.5 | 2018-09-26 | The web component on ARRIS TG2492LG-NA 061213 devices allows remote attackers to obtain sensitive information via the /snmpGet oids parameter. |
CVE-2018-14803 | Medium | 5.3 | 2018-09-26 | Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The Philips e-Alert contains a banner disclosure vulnerability that could allow attackers to… |
CVE-2018-16672 | Medium | 6.5 | 2018-09-26 | An issue was discovered in CIRCONTROL CirCarLife before 4.3. Due to the storage of multiple sensitive information elements in a JSON format at /services/system… |
CVE-2018-7907 | Medium | 5.5 | 2018-09-26 | Some Huawei products Agassi-L09 AGS-L09C100B257CUSTC100D001, AGS-L09C170B253CUSTC170D001, AGS-L09C199B251CUSTC199D001, AGS-L09C229B003CUSTC229D001, Agassi-W09… |
CVE-2018-6053 | Low | 3.3 | 2018-09-25 | Inappropriate implementation in New Tab Page in Google Chrome prior to 64.0.3282.119 allowed a local attacker to view website thumbnail images after clearing b… |
CVE-2018-6052 | Medium | 4.3 | 2018-09-25 | Lack of support for a non standard no-referrer policy value in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to obtain referrer detai… |
CVE-2018-6045 | Medium | 6.5 | 2018-09-25 | Insufficient policy enforcement in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user local file data via a cr… |
CVE-2018-6037 | Medium | 6.5 | 2018-09-25 | Inappropriate implementation in autofill in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to obtain autofill data with insufficient user gestu… |
CVE-2018-6035 | High | 8.8 | 2018-09-25 | Insufficient policy enforcement in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user local file data via a cr… |
CVE-2018-15967 | High | 7.5 | 2018-09-25 | Adobe Flash Player versions 30.0.0.154 and earlier have a privilege escalation vulnerability. Successful exploitation could lead to information disclosure. |
CVE-2018-15964 | High | 7.5 | 2018-09-25 | Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a use of a component with a known vulnerabili… |
CVE-2018-15962 | Medium | 5.3 | 2018-09-25 | Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a directory listing vulnerability. Successful… |
CVE-2018-10498 | Medium | 5.5 | 2018-09-24 | This vulnerability allows local attackers to disclose sensitive information on vulnerable installations of Samsung Email Fixed in version 5.0.02.16. An attacke… |
CVE-2018-15615 | High | 7.2 | 2018-09-24 | A vulnerability in the Supervisor component of Avaya Call Management System allows local administrative user to extract sensitive information from users connec… |
CVE-2018-17404 | Medium | 5.3 | 2018-09-23 | The SBIbuddy (aka com.sbi.erupee) application 1.41 and 1.42 for Android might allow an attacker to sniff private information such as mobile number, PAN number… |
CVE-2018-17402 | Medium | 5.3 | 2018-09-23 | The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for Android might allow attackers to discover the Credit/Debit card number, expiratio… |
CVE-2018-14731 | High | 7.5 | 2018-09-21 | An issue was discovered in HMRServer.js in Parcel parcel-bundler. Attackers are able to steal developer's code because the origin of requests is not checked by… |
CVE-2018-14730 | High | 7.5 | 2018-09-21 | An issue was discovered in Browserify-HMR. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server… |
CVE-2013-7203 | Medium | 5.5 | 2018-09-21 | gitolite before commit fa06a34 might allow local users to read arbitrary files in repositories via vectors related to the user umask when running gitolite setu… |
CVE-2018-8023 | Medium | 5.9 | 2018-09-21 | Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token (JWT). In Apache Mesos versions pre-1.4.2, 1.5.0, 1… |
CVE-2018-1685 | Medium | 5.5 | 2018-09-21 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 contains a vulnerability in db2cacpy that could allow a local user… |
CVE-2018-1800 | Medium | 5.1 | 2018-09-20 | IBM Sterling B2B Integrator Standard Edition 5.2.6.0 and 6.2.6.1 could allow a local user to obtain highly sensitive information during a short time period whe… |
CVE-2018-3831 | High | 8.8 | 2018-09-19 | Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured via the API. The Elas… |
CVE-2018-3826 | Medium | 6.5 | 2018-09-19 | In Elasticsearch versions 6.0.0-beta1 to 6.2.4 a disclosure flaw was found in the _snapshot API. When the access_key and security_key parameters are set using… |
CVE-2018-16671 | Medium | 5.3 | 2018-09-18 | An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is system software information disclosure due to lack of authentication for /html/device-id. |
CVE-2018-11275 | Medium | 5.5 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, when flashing image using FastbootLib if size is no… |
CVE-2018-14642 | Medium | 5.3 | 2018-09-18 | An information leak vulnerability was found in Undertow. If all headers are not written out in the first write() call then the code that handles flushing the b… |
CVE-2018-16959 | Medium | 5.3 | 2018-09-18 | An issue was discovered in Oracle WebCenter Interaction Portal 10.3.3. The portal component is delivered with an insecure default User Profile community config… |
CVE-2017-14443 | Medium | 6.5 | 2018-09-17 | An exploitable information leak vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation incorrectly checks the number… |
CVE-2018-17091 | Medium | 5.4 | 2018-09-16 | An issue was discovered in DonLinkage 6.6.8. It allows remote attackers to obtain potentially sensitive information via a direct request for files/temporary.tx… |
CVE-2018-16288 | High | 8.6 | 2018-09-14 | LG SuperSign CMS allows reading of arbitrary files via signEzUI/playlist/edit/upload/..%2f URIs. |