CWE-200 · Information Disclosure (page 55)
Page 55 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-16639 | Medium | 4.3 | 2018-09-14 | Tor Browser on Windows before 8.0 allows remote attackers to bypass the intended anonymity feature and discover a client IP address, a different vulnerability… |
CVE-2018-1698 | Medium | 5.3 | 2018-09-13 | IBM Maximo Asset Management 7.6 through 7.6.3 could allow an unauthenticated attacker to obtain sensitive information from error messages. IBM X-Force ID: 1459… |
CVE-2018-15310 | Medium | 4.3 | 2018-09-13 | A vulnerability in BIG-IP APM portal access 11.5.1-11.5.7, 11.6.0-11.6.3, and 12.1.0-12.1.3 discloses the BIG-IP software version in rewritten pages. |
CVE-2018-8452 | Medium | 4.3 | 2018-09-13 | An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft browsers, aka "Scripting Engin… |
CVE-2018-8446 | Medium | 5.5 | 2018-09-13 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera… |
CVE-2018-8445 | Medium | 5.5 | 2018-09-13 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera… |
CVE-2018-8444 | Medium | 5.9 | 2018-09-13 | An information disclosure vulnerability exists in the way that the Microsoft Server Message Block 2.0 (SMBv2) server handles certain requests, aka "Windows SMB… |
CVE-2018-8443 | Medium | 5.5 | 2018-09-13 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera… |
CVE-2018-8442 | Medium | 5.5 | 2018-09-13 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera… |
CVE-2018-8434 | Medium | 5.4 | 2018-09-13 | An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a… |
CVE-2018-8433 | Medium | 4.7 | 2018-09-13 | An information disclosure vulnerability exists when the Windows Graphics component improperly handles objects in memory, aka "Microsoft Graphics Component Info… |
CVE-2018-8429 | Medium | 5.5 | 2018-09-13 | An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel Information Disclosur… |
CVE-2018-8424 | Medium | 6.5 | 2018-09-13 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows GDI Information Dis… |
CVE-2018-8422 | Medium | 6.5 | 2018-09-13 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows GDI Information Dis… |
CVE-2018-8366 | Low | 3.1 | 2018-09-13 | An information disclosure vulnerability exists when the Microsoft Edge Fetch API incorrectly handles a filtered response type, aka "Microsoft Edge Information… |
CVE-2018-8336 | Medium | 5.5 | 2018-09-13 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera… |
CVE-2018-8315 | Medium | 4.2 | 2018-09-13 | An information disclosure vulnerability exists when the browser scripting engine improperly handle object types, aka "Microsoft Scripting Engine Information Di… |
CVE-2018-8271 | Medium | 5.5 | 2018-09-13 | An information disclosure vulnerability exists in Windows when the Windows bowser.sys kernel-mode driver fails to properly handle objects in memory, aka "Windo… |
CVE-2018-16977 | Medium | 5.3 | 2018-09-12 | Monstra CMS V3.0.4 has an information leakage risk (e.g., PATH, DOCUMENT_ROOT, and SERVER_ADMIN) in libraries/Gelato/ErrorHandler/Resources/Views/Errors/except… |
CVE-2018-7921 | Medium | 6.5 | 2018-09-12 | Huawei B315s-22 products with software of 21.318.01.00.26 have an information leak vulnerability. Unauthenticated adjacent attackers may exploit this vulnerabi… |
CVE-2018-16948 | High | 7.5 | 2018-09-12 | An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several RPC server routines did not fully initialize their output variables before ret… |
CVE-2016-0715 | Medium | 5.9 | 2018-09-11 | Pivotal Cloud Foundry Elastic Runtime version 1.4.0 through 1.4.5, 1.5.0 through 1.5.11 and 1.6.0 through 1.6.11 is vulnerable to a remote information disclosu… |
CVE-2016-7047 | Medium | 4.3 | 2018-09-11 | A flaw was found in the CloudForms API before 5.6.3.0, 5.7.3.1 and 5.8.1.2. A user with permissions to use the MiqReportResults capability within the API could… |
CVE-2018-16705 | Critical | 9.8 | 2018-09-10 | FURUNO FELCOM 250 and 500 devices allow unauthenticated access to the xml/permission.xml file containing all of the system's usernames and passwords. This incl… |
CVE-2016-7061 | Low | 3.5 | 2018-09-10 | An information disclosure vulnerability was found in JBoss Enterprise Application Platform before 7.0.4. It was discovered that when configuring RBAC and marki… |
CVE-2016-7078 | Medium | 4.3 | 2018-09-10 | foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature. When a user is assigned _no_ organizations/loca… |
CVE-2016-7077 | Medium | 4.3 | 2018-09-10 | foreman before 1.14.0 is vulnerable to an information leak. It was found that Foreman form helper does not authorize options for associated objects. Unauthoriz… |
CVE-2017-1679 | Medium | 5.5 | 2018-09-10 | IBM OpenPages GRC Platform 7.2, 7.3, 7.4, and 8.0 could allow an attacker to obtain sensitive information from error log files. IBM X-Force ID: 134001. |
CVE-2018-16710 | Critical | 9.1 | 2018-09-07 | OctoPrint through 1.3.9 allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests on port 8081. NOTE: the vendor d… |
CVE-2018-16658 | Medium | 6.1 | 2018-09-07 | An issue was discovered in the Linux kernel before 4.18.6. An information leak in cdrom_ioctl_drive_status in drivers/cdrom/cdrom.c could be used by local atta… |
CVE-2018-16307 | High | 7.5 | 2018-09-05 | An "Out-of-band resource load" issue was discovered on Xiaomi MIWiFi Xiaomi_55DD Version 2.8.50 devices. It is possible to induce the application to retrieve t… |
CVE-2018-15684 | Medium | 5.3 | 2018-09-05 | An issue was discovered in BTITeam XBTIT. PHP error logs are stored in an open directory (/include/logs) using predictable file names, which can lead to full p… |
CVE-2018-16539 | Medium | 5.5 | 2018-09-05 | In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checking in temp file handling to disclose con… |
CVE-2018-1353 | Medium | 4.3 | 2018-09-05 | An information disclosure vulnerability in Fortinet FortiManager 6.0.1 and below versions allows a standard user with adom assignment read the interface settin… |
CVE-2018-7938 | Low | 3.3 | 2018-09-04 | P10 Huawei smartphones with the versions before Victoria-AL00AC00B217 have an information leak vulnerability due to the lack of permission validation. An attac… |
CVE-2018-10927 | High | 8.1 | 2018-09-04 | A flaw was found in RPC request using gfs3_lookup_req in glusterfs server. An authenticated attacker could use this flaw to leak information and execute remote… |
CVE-2018-10913 | Medium | 6.5 | 2018-09-04 | An information disclosure vulnerability was discovered in glusterfs server. An attacker could issue a xattr request via glusterfs FUSE to determine the existen… |
CVE-2018-10911 | High | 7.5 | 2018-09-04 | A flaw was found in the way dic_unserialize function of glusterfs does not handle negative key length values. An attacker could use this flaw to read memory fr… |
CVE-2018-16323 | Medium | 6.5 | 2018-09-01 | ReadXBMImage in coders/xbm.c in ImageMagick before 7.0.8-9 leaves data uninitialized when processing an XBM file that has a negative pixel value. If the affect… |
CVE-2018-6259 | Low | 2.5 | 2018-08-31 | NVIDIA GeForce Experience all versions prior to 3.14.1 contains a potential vulnerability when GameStream is enabled, an attacker has system access, and certai… |
CVE-2018-15364 | Medium | 4.7 | 2018-08-30 | A Named Pipe Request Processing Out-of-Bounds Read Information Disclosure vulnerability in Trend Micro OfficeScan XG (12.0) could allow a local attacker to dis… |
CVE-2018-14902 | High | 7.5 | 2018-08-30 | The ContentProvider in the EPSON iPrint application 6.6.3 for Android does not properly restrict data access. This allows an attacker's application to read sca… |
CVE-2016-0205 | Low | 3.3 | 2018-08-30 | A vulnerability has been identified in IBM Cloud Orchestrator 2.3, 2.3.0.1, 2.4, and 2.4.0.1 that could allow an attacker after authentication to enumerate val… |
CVE-2014-6048 | Medium | 5.3 | 2018-08-28 | phpMyFAQ before 2.8.13 allows remote attackers to read arbitrary attachments via a direct request. |
CVE-2018-13391 | Medium | 5.3 | 2018-08-28 | The ProfileLinkUserFormat component of Jira Server before version 7.6.8, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from… |
CVE-2018-1705 | Medium | 6.5 | 2018-08-28 | IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 contain an information disclosure vulnerability that could allow an… |
CVE-2018-15919 | Medium | 5.3 | 2018-08-28 | Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a target system when GSS2… |
CVE-2017-15139 | High | 7.5 | 2018-08-27 | A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to c… |
CVE-2018-1644 | Low | 3.1 | 2018-08-27 | IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 9.0.0.0 - 9.0.0.4, 8.0.0.0 - 8.0.0.19, 8.0.1.0 - 8.0.1.13, 8.0.3.0 - 8.0.3.6, 8.0.4.0 -… |
CVE-2018-15698 | Medium | 6.5 | 2018-08-27 | ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to read any file on the file system when providing the full path to lo… |
CVE-2018-15697 | Medium | 6.5 | 2018-08-27 | ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to read any file on a share by providing the full path. For example, /… |
CVE-2018-15696 | Medium | 4.3 | 2018-08-27 | ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to enumerate all user accounts via user.cgi. |
CVE-2017-18345 | Critical | 9.8 | 2018-08-26 | The Joomanager component through 2.0.0 for Joomla! has an arbitrary file download issue, resulting in exposing the credentials of the database via an index.php… |
CVE-2018-11654 | High | 7.5 | 2018-08-24 | Information disclosure in Netwave IP camera at get_status.cgi (via HTTP on port 8000) allows an unauthenticated attacker to exfiltrate sensitive information fr… |
CVE-2018-11653 | Critical | 9.8 | 2018-08-24 | Information disclosure in Netwave IP camera at //etc/RT2870STA.dat (via HTTP on port 8000) allows an unauthenticated attacker to exfiltrate sensitive informati… |
CVE-2018-1755 | Medium | 5.9 | 2018-08-24 | IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, caused by incorrect transport being used when Liberty i… |
CVE-2018-1999046 | Medium | 4.3 | 2018-08-23 | A exposure of sensitive information vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in Computer.java that allows attackers With Overall/… |
CVE-2018-10919 | Medium | 4.3 | 2018-08-22 | The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because of missing access control checks. An authenticated attacker cou… |
CVE-2018-15668 | Medium | 5.3 | 2018-08-21 | An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. The "send" command in the airmail:// URL scheme allows an external application to send arbitrary em… |
CVE-2018-15661 | High | 7.5 | 2018-08-21 | An issue was discovered in the Ola Money (aka com.olacabs.olamoney) application 1.9.0 for Android. If an attacker controls an application with accessibility pe… |
CVE-2018-15534 | Critical | 9.8 | 2018-08-21 | Geutebrueck re_porter 16 before 7.8.974.20 has a possibility of unauthenticated access to sensitive information including usernames and hashes via a direct req… |
CVE-2018-15599 | Medium | 5.3 | 2018-08-21 | The recv_msg_userauth_request function in svr-auth.c in Dropbear through 2018.76 is prone to a user enumeration vulnerability because username validity affects… |
CVE-2018-14023 | Medium | 4.0 | 2018-08-20 | Open Whisper Signal (aka Signal-Desktop) before 1.15.0-beta.10 allows information leakage. |
CVE-2015-5160 | Medium | 5.5 | 2018-08-20 | libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka RBD), which allows local users to obtain sensitive inf… |
CVE-2018-14079 | High | 7.5 | 2018-08-20 | Wi2be SMART HP WMT R1.2.20_201400922 allows unauthorized remote attackers to obtain sensitive information via /Status/SystemStatusRpm.esp. |
CVE-2018-1000645 | Medium | 6.5 | 2018-08-20 | LibreHealthIO lh-ehr version <REL-2.0.0 contains an Authenticated Local File Disclosure vulnerability in Importing of templates allows local file disclosure th… |
CVE-2018-1000635 | Medium | 6.7 | 2018-08-20 | The Open Microscopy Environment OMERO.server version 5.4.0 to 5.4.6 contains a Information Exposure Through Sent Data vulnerability in OMERO.server that can re… |
CVE-2018-1000633 | High | 7.2 | 2018-08-20 | The Open Microscopy Environment OMERO.web version prior to 5.4.7 contains an Information Exposure Through Log Files vulnerability in the login form and change… |
CVE-2018-15594 | Medium | 5.5 | 2018-08-20 | arch/x86/kernel/paravirt.c in the Linux kernel before 4.18.1 mishandles certain indirect calls, which makes it easier for attackers to conduct Spectre-v2 attac… |
CVE-2017-1732 | Medium | 4.3 | 2018-08-17 | IBM Security Access Manager for Enterprise Single Sign-On 8.2.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be… |
CVE-2018-15357 | Medium | 6.5 | 2018-08-17 | An authenticated attacker with low privileges can extract password hash information for all users in Eltex ESP-200 firmware version 1.2.0. |
CVE-2018-8398 | Medium | 6.5 | 2018-08-15 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows GDI Information Dis… |
CVE-2018-8396 | Medium | 4.7 | 2018-08-15 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows GDI Information Dis… |
CVE-2018-8394 | Medium | 6.5 | 2018-08-15 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows GDI Information Dis… |
CVE-2018-8382 | Medium | 5.5 | 2018-08-15 | An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel Information Disclosur… |
CVE-2018-8370 | Low | 3.1 | 2018-08-15 | A information disclosure vulnerability exists when WebAudio Library improperly handles audio requests, aka "Microsoft Edge Information Disclosure Vulnerability… |
CVE-2018-8360 | High | 7.5 | 2018-08-15 | An information disclosure vulnerability exists in Microsoft .NET Framework that could allow an attacker to access information in multi-tenant environments, aka… |
CVE-2018-8348 | Medium | 4.7 | 2018-08-15 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera… |
CVE-2018-8341 | Medium | 4.7 | 2018-08-15 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera… |
CVE-2018-3646 | Medium | 5.6 | 2018-08-14 | Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data… |
CVE-2018-14348 | High | 8.1 | 2018-08-14 | libcgroup up to and including 0.41 creates /var/log/cgred with mode 0666 regardless of the configured umask, leading to disclosure of information. |
CVE-2018-15125 | High | 7.5 | 2018-08-13 | Sensitive Information Disclosure in Zipato Zipabox Smart Home Controller allows remote attacker get sensitive information that expands attack surface. |
CVE-2017-15138 | Medium | 5.0 | 2018-08-13 | The OpenShift Enterprise cluster-read can access webhook tokens which would allow an attacker with sufficient privileges to view confidential webhook tokens. |
CVE-2017-1286 | Medium | 6.5 | 2018-08-13 | Sensitive information about the configuration of the IBM UrbanCode Deploy 6.1 through 6.9.6.0 server and database can be obtained by a user who has been given… |
CVE-2018-14785 | High | 7.5 | 2018-08-10 | NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) with firmware 2.0.29.11 and prior. The directory of the device is listed openly without authenticat… |
CVE-2018-14782 | High | 7.5 | 2018-08-10 | NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) with firmware 2.0.29.11 and prior. The device allows access to configuration files and profiles wit… |
CVE-2018-7686 | High | 7.5 | 2018-08-09 | Information leakage vulnerability in NetIQ eDirectory before 9.1.1 HF1 due to shared memory usage. |
CVE-2018-14735 | High | 7.5 | 2018-08-09 | An Information Exposure issue was discovered in Hitachi Command Suite 8.5.3. A remote attacker may be able to exploit a flaw in the permission of messaging tha… |
CVE-2018-10915 | High | 8.5 | 2018-08-09 | A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an af… |
CVE-2018-5995 | Medium | 5.5 | 2018-08-07 | The pcpu_embed_first_chunk function in mm/percpu.c in the Linux kernel through 4.14.14 allows local users to obtain sensitive address information by reading dm… |
CVE-2018-5953 | Medium | 5.5 | 2018-08-07 | The swiotlb_print_info function in lib/swiotlb.c in the Linux kernel through 4.14.14 allows local users to obtain sensitive address information by reading dmes… |
CVE-2018-15132 | High | 7.5 | 2018-08-07 | An issue was discovered in ext/standard/link_win32.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8. The linkinfo funct… |
CVE-2017-2654 | Low | 3.7 | 2018-08-06 | jenkins-email-ext before version 2.57.1 is vulnerable to an Information Exposure. The Email Extension Plugins is able to send emails to a dynamically created l… |
CVE-2018-7071 | Medium | 4.3 | 2018-08-06 | HPE has identified a remote access to sensitive information vulnerability in HPE Network Function Virtualization Director (NFVD) 4.2.1 prior to gui patch 3. |
CVE-2018-7070 | Medium | 5.3 | 2018-08-06 | HPE has identified a remote disclosure of information vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1. This issue is resolve… |
CVE-2017-9000 | Critical | 9.8 | 2018-08-06 | ArubaOS, all versions prior to 6.3.1.25, 6.4 prior to 6.4.4.16, 6.5.x prior to 6.5.1.9, 6.5.2, 6.5.3 prior to 6.5.3.3, 6.5.4 prior to 6.5.4.2, 8.x prior to 8.1… |
CVE-2018-1528 | Medium | 4.3 | 2018-08-06 | IBM Maximo Asset Management 7.6 through 7.6.3 could allow an authenticated user to obtain sensitive information from the WhoAmI API. IBM X-Force ID: 142290. |
CVE-2017-1412 | Medium | 4.3 | 2018-08-06 | IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 generates an error message that includes sensitive information about its environment, us… |
CVE-2017-1409 | Medium | 5.3 | 2018-08-06 | IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 discloses sensitive information to unauthorized users. The information can be used to mo… |
CVE-2018-14941 | Medium | 6.5 | 2018-08-05 | Harmonic NSG 9000 devices allow remote authenticated users to read the webapp.py source code via a direct request for the /webapp.py URI. |