CWE-200 · Information Disclosure (page 56)
Page 56 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-14928 | High | 7.5 | 2018-08-03 | /contingency/servlet/ServletFileDownload executes as root and provides unauthenticated access to files via the file parameter. |
CVE-2018-1999041 | Medium | 5.5 | 2018-08-01 | An exposure of sensitive information vulnerability exists in Jenkins Tinfoil Security Plugin 1.6.1 and earlier in TinfoilScanRecorder.java that allows attacker… |
CVE-2018-1999040 | High | 8.8 | 2018-08-01 | An exposure of sensitive information vulnerability exists in Jenkins Kubernetes Plugin 1.10.1 and earlier in KubernetesCloud.java that allows attackers to capt… |
CVE-2018-1999033 | Medium | 6.5 | 2018-08-01 | An exposure of sensitive information vulnerability exists in Jenkins Anchore Container Image Scanner Plugin 10.16 and earlier in AnchoreBuilder.java that allow… |
CVE-2018-1999031 | Medium | 6.5 | 2018-08-01 | An exposure of sensitive information vulnerability exists in Jenkins meliora-testlab Plugin 1.14 and earlier in TestlabNotifier.java that allows attackers with… |
CVE-2018-1999030 | Medium | 5.4 | 2018-08-01 | An exposure of sensitive information vulnerability exists in Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin 1.3.1 and earlier in ArtifactoryChoiceLis… |
CVE-2018-1999028 | High | 8.8 | 2018-08-01 | An exposure of sensitive information vulnerability exists in Jenkins Accurev Plugin 0.7.16 and earlier in AccurevSCM.java that allows attackers to capture cred… |
CVE-2016-8637 | Medium | 5.0 | 2018-08-01 | A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'early cpio' is used… |
CVE-2018-14316 | Medium | 6.5 | 2018-07-31 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is requir… |
CVE-2018-11621 | Medium | 6.5 | 2018-07-31 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is requir… |
CVE-2018-11620 | Medium | 6.5 | 2018-07-31 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is requir… |
CVE-2018-5544 | High | 7.5 | 2018-07-31 | When the F5 BIG-IP APM 13.0.0-13.1.1 or 12.1.0-12.1.3 renders certain pages (pages with a logon agent or a confirm box), the BIG-IP APM may disclose configurat… |
CVE-2018-14432 | Medium | 5.3 | 2018-07-31 | In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass inten… |
CVE-2018-14685 | Critical | 9.8 | 2018-07-28 | The add function in www/Lib/Lib/Action/Admin/TplAction.class.php in Gxlcms v1.1.4 allows remote attackers to read arbitrary files via a crafted index.php?s=Adm… |
CVE-2017-2651 | Low | 3.7 | 2018-07-27 | jenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure while using the feature to send emails to a dynamically created list of us… |
CVE-2017-2624 | Medium | 5.9 | 2018-07-27 | It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a series of valid cookies. If the cookie is co… |
CVE-2017-12173 | Medium | 4.3 | 2018-07-27 | It was found that sssd's sysdb_search_user_by_upn_res() function before 1.16.0 did not sanitize requests when querying its local cache and was vulnerable to in… |
CVE-2017-2622 | Medium | 5.9 | 2018-07-27 | An accessibility flaw was found in the OpenStack Workflow (mistral) service where a service log directory was improperly made world readable. A malicious syste… |
CVE-2018-14602 | High | 7.5 | 2018-07-27 | An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. Information Disclosure can oc… |
CVE-2017-2582 | Medium | 6.5 | 2018-07-26 | It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values wit… |
CVE-2017-12167 | Medium | 5.5 | 2018-07-26 | It was found in EAP 7 before 7.0.9 that properties based files of the management and the application realm configuration that contain user to role mapping are… |
CVE-2017-12163 | Medium | 4.1 | 2018-07-26 | An information leak flaw was found in the way SMB1 protocol was implemented by Samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.6.8. A malicious cl… |
CVE-2017-7526 | Medium | 6.1 | 2018-07-26 | libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method fo… |
CVE-2018-14083 | High | 7.5 | 2018-07-25 | LICA miniCMTS E8K(u/i/...) devices allow remote attackers to obtain sensitive information via a direct POST request for the inc/user.ini file, leading to disco… |
CVE-2018-10627 | Critical | 9.8 | 2018-07-24 | Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. An attacker can u… |
CVE-2018-5386 | High | 7.5 | 2018-07-24 | Some Navarino Infinity functions, up to version 2.2, placed in the URL can bypass any authentication mechanism leading to an information leak. |
CVE-2016-5649 | Critical | 9.8 | 2018-07-24 | A vulnerability is in the 'BSW_cxttongr.htm' page of the Netgear DGN2200, version DGN2200-V1.0.0.50_7.0.50, and DGND3700, version DGND3700-V1.0.0.17_1.0.17, wh… |
CVE-2016-5638 | High | 7.5 | 2018-07-24 | There are few web pages associated with the genie app on the Netgear WNDR4500 running firmware version V1.0.1.40_1.0.6877. Genie app adds some capabilities ove… |
CVE-2017-18104 | Medium | 5.9 | 2018-07-24 | The Webhooks component of Atlassian Jira before version 7.6.7 and from version 7.7.0 before version 7.11.0 allows remote attackers who are able to observe or o… |
CVE-2018-14328 | Critical | 9.8 | 2018-07-23 | Brynamics "Online Trade - Online trading and cryptocurrency investment system" allows remote attackers to obtain sensitive information via a direct request for… |
CVE-2018-1999006 | Medium | 4.3 | 2018-07-23 | A exposure of sensitive information vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in Plugin.java that allows attackers to determine th… |
CVE-2018-1999009 | High | 8.1 | 2018-07-23 | October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in modules/system/traits/ViewMaker.php#244 (makeFileContents function) tha… |
CVE-2018-1679 | Medium | 5.3 | 2018-07-20 | IBM Sterling B2B Integrator Standard Edition 5.2 through 5.2.6 could allow an unauthenticated user to obtain sensitive information that could be used in furthe… |
CVE-2018-1564 | Medium | 4.4 | 2018-07-20 | IBM Sterling B2B Integrator Standard Edition 5.2 through 5.2.6 could allow a local user with administrator privileges to obtain user passwords found in debuggi… |
CVE-2018-1470 | Medium | 4.3 | 2018-07-20 | IBM Sterling File Gateway 2.2.0 through 2.2.6 could allow a remote authenticated attacker to obtain sensitive information displayed in the URL that could lead… |
CVE-2018-1398 | Medium | 5.3 | 2018-07-20 | IBM Sterling File Gateway 2.2.0 through 2.2.6 could allow a remote attacker to download certain files that could contain sensitive information. IBM X-Force ID… |
CVE-2017-1633 | Medium | 4.3 | 2018-07-20 | IBM Sterling B2B Integrator 5.2 through 5.2.6 could allow an authenticated attacker to obtain sensitive variable name information using specially crafted HTTP… |
CVE-2017-1544 | Low | 2.4 | 2018-07-20 | IBM Sterling B2B Integrator Standard Edition (IBM Sterling File Gateway 2.2.0 through 2.2.6) caches usernames and passwords in browsers that could be used by a… |
CVE-2016-10727 | Critical | 9.8 | 2018-07-20 | camel/providers/imapx/camel-imapx-server.c in the IMAPx component in GNOME evolution-data-server before 3.21.2 proceeds with cleartext data containing a passwo… |
CVE-2018-1587 | Medium | 4.3 | 2018-07-19 | IBM Rational Rhapsody Design Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 and IBM Rational Software Architect Design Manager 5.0 through 5.0.2 and 6.0 throu… |
CVE-2018-1612 | Medium | 5.8 | 2018-07-17 | IBM QRadar Incident Forensics (IBM QRadar SIEM 7.2, and 7.3) could allow a remote attacker to bypass authentication and obtain sensitive information. IBM X-For… |
CVE-2018-13860 | High | 7.5 | 2018-07-17 | MusicCenter / Trivum Multiroom Setup Tool V8.76 - SNR 8604.26 - C4 Professional before V9.34 build 13381 - 12.07.18 allows unauthorized remote attackers to obt… |
CVE-2018-14333 | High | 8.1 | 2018-07-17 | TeamViewer through 13.1.1548 stores a password in Unicode format within TeamViewer.exe process memory between "[00 88] and "[00 00 00]" delimiters, which might… |
CVE-2018-10857 | Medium | 5.9 | 2018-07-16 | git-annex is vulnerable to a private data exposure and exfiltration attack. It could expose the content of files located outside the git-annex repository, or c… |
CVE-2018-10859 | Medium | 5.9 | 2018-07-16 | git-annex is vulnerable to an Information Exposure when decrypting files. A malicious server for a special remote could trick git-annex into decrypting a file… |
CVE-2018-0368 | High | 7.8 | 2018-07-16 | A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an authenticated, local attacker to access sensitive information on an affected… |
CVE-2013-0522 | High | 7.0 | 2018-07-16 | The Notes Client Single Logon feature in IBM Notes 8.0, 8.0.1, 8.0.2, 8.5, 8.5.1, 8.5.2, 8.5.3, and 9.0 on Windows allows local users to discover passwords via… |
CVE-2013-0570 | Medium | 5.3 | 2018-07-13 | The Fibre Channel over Ethernet (FCoE) feature in IBM System Networking and Blade Network Technology (BNT) switches running IBM Networking Operating System (ak… |
CVE-2016-9499 | Medium | 5.3 | 2018-07-13 | Accellion FTP server prior to version FTA_9_12_220 only returns the username in the server response if the username is invalid. An attacker may use this inform… |
CVE-2016-9491 | Medium | 4.9 | 2018-07-13 | ManageEngine Applications Manager 12 and 13 before build 13690 allows an authenticated user, who is able to access /register.do page (most likely limited to ad… |
CVE-2016-6548 | Critical | 9.8 | 2018-07-13 | The Zizai Tech Nut mobile app makes requests via HTTP instead of HTTPS. These requests contain the user's authenticated session token with the URL. An attacker… |
CVE-2016-6547 | High | 7.8 | 2018-07-13 | The Zizai Tech Nut mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file. |
CVE-2016-6546 | High | 7.8 | 2018-07-13 | The iTrack Easy mobile application stores the account password used to authenticate to the cloud API in base64-encoding in the cache.db file. The base64 encodi… |
CVE-2016-6542 | Low | 3.7 | 2018-07-13 | The iTrack device tracking ID number, also called "LosserID" in the web API, can be obtained by being in the range of an iTrack device. The tracker ID is the d… |
CVE-2017-1395 | Medium | 5.9 | 2018-07-13 | IBM Security Identity Governance and Intelligence Virtual Appliance 5.2 through 5.2.3.2 could allow a remote attacker to obtain sensitive information, caused b… |
CVE-2017-1367 | Low | 3.7 | 2018-07-13 | IBM Security Identity Governance and Intelligence Virtual Appliance 5.2 through 5.2.3.2 stores sensitive information in URL parameters. This may lead to inform… |
CVE-2017-14709 | High | 7.4 | 2018-07-12 | The komoot GmbH "Komoot - Cycling & Hiking Maps" app before 9.3.2 -- aka komoot-cycling-hiking-maps/id447374873 -- for iOS does not verify X.509 certificates f… |
CVE-2018-8024 | Medium | 5.4 | 2018-07-12 | In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to construct a URL pointing to a Spark cluster's UI's job and sta… |
CVE-2018-1334 | Medium | 4.7 | 2018-07-12 | In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark appli… |
CVE-2016-0708 | Medium | 5.9 | 2018-07-11 | Applications deployed to Cloud Foundry, versions v166 through v227, may be vulnerable to a remote disclosure of information, including, but not limited to envi… |
CVE-2013-0589 | High | 7.5 | 2018-07-11 | IBM iNotes before 8.5.3 Fix Pack 6 and 9.x before 9.0.1 allows remote attackers to bypass the remote image filtering mechanism and obtain sensitive information… |
CVE-2018-8325 | Medium | 4.3 | 2018-07-11 | An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerabili… |
CVE-2018-8324 | Medium | 4.3 | 2018-07-11 | An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerabili… |
CVE-2018-8305 | Medium | 6.5 | 2018-07-11 | An information disclosure vulnerability exists in Windows Mail Client when a message is opened, aka "Windows Mail Client Information Disclosure Vulnerability."… |
CVE-2018-8297 | Medium | 4.3 | 2018-07-11 | An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerabili… |
CVE-2018-8289 | Medium | 4.3 | 2018-07-11 | An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerabili… |
CVE-2018-3652 | High | 7.6 | 2018-07-10 | Existing UEFI setting restrictions for DCI (Direct Connect Interface) in 5th and 6th generation Intel Xeon Processor E3 Family, Intel Xeon Scalable processors… |
CVE-2018-3619 | Medium | 4.6 | 2018-07-10 | Information disclosure vulnerability in storage media in systems with Intel Optane memory module with Whole Disk Encryption may allow an attacker to recover da… |
CVE-2018-10890 | Medium | 4.3 | 2018-07-10 | A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. It was possible for the core_course_get_categories web service to return hidden categor… |
CVE-2018-1423 | Medium | 4.3 | 2018-07-10 | IBM Jazz Foundation products could disclose sensitive information to an authenticated attacker that could be used in further attacks against the system. IBM X-… |
CVE-2018-1337 | Critical | 9.8 | 2018-07-10 | In Apache Directory LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for another thread to use the connection before the TLS l… |
CVE-2018-4993 | High | 7.5 | 2018-07-09 | Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have an NTLM SSO hash theft vulnerabil… |
CVE-2018-4965 | High | 7.5 | 2018-07-09 | Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Memory Corruption vulnerability… |
CVE-2018-1548 | Medium | 4.3 | 2018-07-09 | IBM API Connect 2018.1.0.0, 2018.2.1, 2018.2.2, 2018.2.3, and 2018.2.4 contains a vulnerability that could allow an authenticated user to obtain sensitive info… |
CVE-2018-1000402 | Medium | 4.3 | 2018-07-09 | Jenkins project Jenkins AWS CodeDeploy Plugin version 1.19 and earlier contains a File and Directory Information Exposure vulnerability in AWSCodeDeployPublish… |
CVE-2016-6540 | Medium | 6.5 | 2018-07-06 | Unauthenticated access to the cloud-based service maintained by TrackR Bravo is allowed for querying or sending GPS data for any Trackr device by using the tra… |
CVE-2016-6539 | Low | 3.5 | 2018-07-06 | The Trackr device ID is constructed of a manufacturer identifier of four zeroes followed by the BLE MAC address in reverse. The MAC address can be obtained by… |
CVE-2016-6538 | High | 8.8 | 2018-07-06 | The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file. Updated apps, version 5.1.6 fo… |
CVE-2017-15851 | High | 7.8 | 2018-07-06 | Lack of copy_from_user and information leak in function "msm_ois_subdev_do_ioctl, file msm_ois.c can lead to a camera crash in all Android releases(Android for… |
CVE-2018-5892 | High | 7.5 | 2018-07-06 | The Touch Pal application can collect user behavior data without awareness by the user in Snapdragon Mobile and Snapdragon Wear. |
CVE-2018-1546 | Medium | 5.9 | 2018-07-06 | IBM API Connect 5.0.0.0 through 5.0.8.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Tra… |
CVE-2017-1559 | Low | 3.1 | 2018-07-06 | Multiple IBM Rational products could disclose sensitive information by an attacker that intercepts vulnerable requests. IBM X-Force ID: 131758. |
CVE-2017-1509 | Medium | 4.3 | 2018-07-06 | IBM Jazz Foundation products could allow an authenticated user to obtain sensitive information from a stack trace that could be used to aid future attacks. IBM… |
CVE-2017-1488 | Low | 3.7 | 2018-07-06 | An undisclosed vulnerability in Jazz common products exists with potential for information disclosure. IBM X-Force ID: 128627. |
CVE-2017-1239 | Medium | 4.3 | 2018-07-06 | IBM Quality Manager (RQM) 5.0.x and 6.0 through 6.0.5 could reveal sensitive information in HTTP 500 Internal Server Error responses. IBM X-Force ID: 124357. |
CVE-2018-9998 | Medium | 6.5 | 2018-07-05 | Open-Xchange OX App Suite before 7.6.3-rev37, 7.8.x before 7.8.2-rev40, 7.8.3 before 7.8.3-rev48, and 7.8.4 before 7.8.4-rev28 include folder names in API erro… |
CVE-2018-12021 | Medium | 6.5 | 2018-07-05 | Singularity 2.3.0 through 2.5.1 is affected by an incorrect access control on systems supporting overlay file system. When using the overlay option, a maliciou… |
CVE-2018-9185 | High | 8.1 | 2018-07-05 | An information disclosure vulnerability in Fortinet FortiOS 6.0.0 and below versions reveals user's web portal login credentials in a Javascript file sent to c… |
CVE-2018-13123 | Critical | 9.8 | 2018-07-03 | onefilecms.php in OneFileCMS through 2017-10-08 might allow attackers to read arbitrary files via the i and f parameters, as demonstrated by ?i=etc/&f=passwd&p… |
CVE-2018-7776 | Medium | 4.3 | 2018-07-03 | The vulnerability exists within error.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. System information is returned to the attac… |
CVE-2018-10596 | High | 7.1 | 2018-07-03 | Medtronic 2090 CareLink Programmer uses a virtual private network connection to securely download updates. It does not verify it is still connected to this v… |
CVE-2018-12892 | Critical | 9.9 | 2018-07-02 | An issue was discovered in Xen 4.7 through 4.10.x. libxl fails to pass the readonly flag to qemu when setting up a SCSI disk, due to what was probably an erron… |
CVE-2018-12990 | Medium | 5.3 | 2018-06-30 | phpwcms 1.8.9 allows remote attackers to discover the installation path via an invalid csrf_token_value field. |
CVE-2018-12997 | High | 7.5 | 2018-06-29 | Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128… |
CVE-2018-12927 | High | 7.5 | 2018-06-28 | Northern Electric & Power (NEP) inverter devices allow remote attackers to obtain potentially sensitive information via a direct request for the nep/status/ind… |
CVE-2018-12926 | High | 7.5 | 2018-06-28 | Pharos Controls devices allow remote attackers to obtain potentially sensitive information via a direct request for the default/index.lsp or default/log.lsp UR… |
CVE-2018-12923 | High | 7.5 | 2018-06-28 | BWS Systems HA-Bridge devices allow remote attackers to obtain potentially sensitive information via a direct request for the #!/system URI. |
CVE-2018-12921 | High | 7.5 | 2018-06-28 | Electro Industries GaugeTech Nexus devices allow remote attackers to obtain potentially sensitive information via a direct request for the meter_information.ht… |
CVE-2018-12920 | High | 7.5 | 2018-06-28 | Brickstream 2300 devices allow remote attackers to obtain potentially sensitive information via a direct request for the basic.html#ipsettings or basic.html#da… |
CVE-2018-1553 | Medium | 5.3 | 2018-06-27 | IBM WebSphere Application Server Liberty prior to 18.0.0.2 could allow a remote attacker to obtain sensitive information, caused by mishandling of exceptions b… |