CWE-200 · Information Disclosure (page 57)
Page 57 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-5210 | Critical | 9.8 | 2019-05-23 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Information Exposure. |
CVE-2017-15652 | Medium | 5.5 | 2019-05-23 | Artifex Ghostscript 9.22 is affected by: Obtain Information. The impact is: obtain sensitive information. The component is: affected source code file, affected… |
CVE-2018-7844 | High | 7.5 | 2019-05-22 | A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause… |
CVE-2018-7848 | High | 7.5 | 2019-05-22 | A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause… |
CVE-2017-9809 | Medium | 5.3 | 2019-05-22 | OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Information Exposure. |
CVE-2017-6514 | Medium | 5.3 | 2019-05-22 | WordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain sensitive information (Path Disclosure) via a /wp-json/oembed/1.0/… |
CVE-2018-1991 | Low | 2.7 | 2019-05-22 | IBM API Connect 5.0.0.0, and 5.0.8.6 could could return sensitive information that could provide critical information as to the underlying software stack in CM… |
CVE-2018-2005 | Low | 3.3 | 2019-05-20 | IBM BigFix Platform 9.2 and 9.5 stores potentially sensitive information in process memory that could be read by a local attacker with elevated permissions. IB… |
CVE-2019-7353 | Critical | 9.1 | 2019-05-17 | An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 11.7.x before 11.7.4. GitLab Releases were vulnerable to an authori… |
CVE-2019-10109 | Medium | 5.3 | 2019-05-15 | An Information Exposure issue (issue 1 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 1… |
CVE-2019-1731 | Medium | 4.4 | 2019-05-15 | A vulnerability in the SSH CLI key management functionality of Cisco NX-OS Software could allow an authenticated, local attacker to expose a user's private SSH… |
CVE-2019-6574 | High | 7.5 | 2019-05-14 | A vulnerability has been identified in SINAMICS PERFECT HARMONY GH180 with NXG I control, MLFBs: 6SR2...-, 6SR3...-, 6SR4...- (All Versions with option G21, G2… |
CVE-2019-6572 | Critical | 9.1 | 2019-05-14 | A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15.1 Update 1), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All ve… |
CVE-2018-16656 | High | 7.5 | 2019-05-14 | DoBox_CstmBox_Info.model.htm on Kyocera TASKalfa 4002i and 6002i devices allows remote attackers to read the documents of arbitrary users via a modified HTTP r… |
CVE-2018-12301 | High | 7.5 | 2019-05-13 | Unvalidated URL in Download Manager in Seagate NAS OS version 4.3.15.1 allows attackers to access the loopback interface via a Download URL of 127.0.0.1 or loc… |
CVE-2019-5437 | Medium | 5.3 | 2019-05-10 | Information exposure through the directory listing in npm's harp module allows to access files that are supposed to be ignored according to the harp server rul… |
CVE-2018-7083 | High | 7.5 | 2019-05-10 | If a process running within Aruba Instant crashes, it may leave behind a "core dump", which contains the memory contents of the process at the time it crashed… |
CVE-2017-12884 | High | 7.5 | 2019-05-10 | OX Software GmbH App Suite 7.8.4 and earlier is affected by: Information Exposure. |
CVE-2018-1990 | Medium | 5.3 | 2019-05-10 | IBM Cloud App Management V2018.2.0, V2018.4.0, and V2018.4.1 could allow an attacker to obtain sensitive configuration information using a specially crafted HT… |
CVE-2016-1600 | High | 7.5 | 2019-05-09 | The ServiceNow driver in NetIQ Identity Manager versions prior to 4.6 are susceptible to an information disclosure vulnerability. |
CVE-2018-2008 | Medium | 4.3 | 2019-05-07 | IBM TRIRIGA Application Platform 3.5.3 and 3.6.0 could disclose sensitive information to an authenticated user that could aid in further attacks against the sy… |
CVE-2018-19456 | High | 7.5 | 2019-05-07 | The WP Backup+ (aka WPbackupplus) plugin through 2018-11-22 for WordPress allows remote attackers to obtain sensitive information from server folders and files… |
CVE-2018-13991 | Medium | 5.3 | 2019-05-07 | The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 leaks private information in firmware images. |
CVE-2018-18977 | High | 7.5 | 2019-05-06 | An issue was discovered in the Ascensia Contour NEXT ONE application for Android before 2019-01-15. An attacker may reverse engineer the codebase to extract se… |
CVE-2018-18975 | High | 7.5 | 2019-05-06 | An issue was discovered in the Ascensia Contour NEXT ONE app for iOS before 2019-01-15. An attacker may proxy communications between the app and Ascensia backe… |
CVE-2018-4071 | High | 8.8 | 2019-05-06 | An exploitable Information Disclosure vulnerability exists in the ACEManager EmbeddedAceGet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. T… |
CVE-2018-4070 | High | 8.8 | 2019-05-06 | An exploitable Information Disclosure vulnerability exists in the ACEManager EmbeddedAceGet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. T… |
CVE-2018-4067 | Medium | 6.5 | 2019-05-06 | An exploitable information disclosure vulnerability exists in the ACEManager template_load.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A speci… |
CVE-2018-4069 | High | 7.5 | 2019-05-06 | An information disclosure vulnerability exists in the ACEManager authentication functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The ACEManager authent… |
CVE-2018-4068 | Medium | 5.3 | 2019-05-06 | An exploitable information disclosure vulnerability exists in the ACEManager functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A HTTP request can result… |
CVE-2019-3797 | Low | 3.5 | 2019-05-06 | This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith… |
CVE-2019-1692 | Medium | 5.3 | 2019-05-03 | A vulnerability in the web-based management interface of Cisco Application Policy Infrastructure Controller (APIC) Software could allow an unauthenticated, rem… |
CVE-2019-1589 | Medium | 4.6 | 2019-05-03 | A vulnerability in the Trusted Platform Module (TPM) functionality of software for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructur… |
CVE-2019-11633 | High | 7.5 | 2019-05-01 | HoneyPress through 2016-09-27 can be fingerprinted by attackers because of the ingrained unique www.atxsec.com and ayylmao.wpengine.com hostnames within the fa… |
CVE-2018-20510 | Medium | 5.5 | 2019-04-30 | The print_binder_transaction_ilocked function in drivers/android/binder.c in the Linux kernel 4.14.90 allows local users to obtain sensitive address informatio… |
CVE-2018-20509 | Medium | 5.5 | 2019-04-30 | The print_binder_ref_olocked function in drivers/android/binder.c in the Linux kernel 4.14.90 allows local users to obtain sensitive address information by rea… |
CVE-2018-1961 | Medium | 5.3 | 2019-04-29 | IBM Emptoris Contract Management 10.0.0 and 10.1.3.0 could disclose sensitive information from detailed information from error messages. IBM X-Force ID: 153657. |
CVE-2018-18511 | Medium | 4.3 | 2019-04-26 | Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note: This only affects… |
CVE-2019-3868 | Low | 3.8 | 2019-04-24 | Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an… |
CVE-2019-10247 | Medium | 5.3 | 2019-04-22 | In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will re… |
CVE-2019-10246 | Medium | 5.3 | 2019-04-22 | In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory nam… |
CVE-2011-3147 | High | 8.6 | 2019-04-22 | Versions of nova before 2012.1 could expose hypervisor host files to a guest operating system when processing a maliciously constructed qcow filesystem. |
CVE-2019-11403 | Critical | 9.8 | 2019-04-22 | In Gradle Enterprise before 2018.5.2, Build Cache Nodes would reflect the configured password back when viewing the HTML page source of the settings page. |
CVE-2018-1729 | Medium | 5.3 | 2019-04-19 | IBM QRadar SIEM 7.3 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID… |
CVE-2019-9225 | Medium | 5.3 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Cont… |
CVE-2019-9179 | Low | 3.7 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposu… |
CVE-2019-9175 | Medium | 5.3 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposu… |
CVE-2018-13378 | High | 7.2 | 2019-04-17 | An information disclosure vulnerability in Fortinet FortiSIEM 5.2.0 and below versions exposes the LDAP server plaintext password via the HTML source code. |
CVE-2018-13808 | Critical | 9.1 | 2019-04-17 | A vulnerability has been identified in CP 1604 (All versions), CP 1616 (All versions). An attacker with network access to port 23/tcp could extract internal co… |
CVE-2018-6239 | Medium | 5.5 | 2019-04-12 | NVIDIA Jetson TX2 contains a vulnerability by means of speculative execution where local and unprivileged code may access the contents of cached information in… |
CVE-2019-0040 | Critical | 9.1 | 2019-04-10 | On Junos OS, rpcbind should only be listening to port 111 on the internal routing instance (IRI). External packets destined to port 111 should be dropped. Due… |
CVE-2018-13366 | Medium | 5.3 | 2019-04-09 | An information disclosure vulnerability in Fortinet FortiOS 6.0.1, 5.6.7 and below allows attacker to reveals serial number of FortiGate via hostname field def… |
CVE-2019-10243 | Medium | 5.3 | 2019-04-09 | In Eclipse Kura versions up to 4.0.0, Kura exposes the underlying Ui Web server version in its replies. This can be used as a hint by an attacker to specifical… |
CVE-2019-4051 | Medium | 5.3 | 2019-04-08 | Some URIs in IBM API Connect 2018.1 and 2018.4.1.3 disclose system specification information like the machine id, system uuid, filesystem paths, network interf… |
CVE-2018-1999 | Medium | 4.3 | 2019-04-08 | IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could reveal sensitive version information about the server from error pages that could aid a… |
CVE-2018-1885 | Medium | 5.3 | 2019-04-08 | IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow an unauthenticated attacker to obtain sensitve information using a specially crac… |
CVE-2018-20449 | Medium | 5.5 | 2019-04-04 | The hidma_chan_stats function in drivers/dma/qcom/hidma_dbg.c in the Linux kernel 4.14.90 allows local users to obtain sensitive address information by reading… |
CVE-2018-11971 | Medium | 5.5 | 2019-04-04 | Interrupt exit code flow may undermine access control policy set forth by secure world can lead to potential secure asset leakage in Snapdragon Auto, Snapdrago… |
CVE-2018-4445 | Medium | 4.3 | 2019-04-03 | "Clear History and Website Data" did not clear the history. The issue was addressed with improved data deletion. This issue affected versions prior to iOS 12.1… |
CVE-2018-4431 | Medium | 5.5 | 2019-04-03 | A memory initialization issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, macOS Mojave 10.14.2, tvOS 12.1.1… |
CVE-2018-4430 | Low | 2.4 | 2019-04-03 | A lock screen issue allowed access to contacts on a locked device. This issue was addressed with improved state management. This issue affected versions prior… |
CVE-2018-4403 | Medium | 5.5 | 2019-04-03 | This issue was addressed by removing additional entitlements. This issue affected versions prior to macOS Mojave 10.14.1. |
CVE-2018-4388 | Medium | 4.6 | 2019-04-03 | A lock screen issue allowed access to the share function on a locked device. This issue was addressed by restricting options offered on a locked device. This i… |
CVE-2018-4387 | Low | 2.4 | 2019-04-03 | A lock screen issue allowed access to photos via Reply With Message on a locked device. This issue was addressed with improved state management. This issue aff… |
CVE-2018-4380 | Medium | 5.5 | 2019-04-03 | A lock screen issue allowed access to photos and contacts on a locked device. This issue was addressed by restricting options offered on a locked device. This… |
CVE-2018-4379 | Medium | 5.5 | 2019-04-03 | A lock screen issue allowed access to the share function on a locked device. This issue was addressed by restricting options offered on a locked device. This i… |
CVE-2018-4355 | Medium | 5.5 | 2019-04-03 | A configuration issue was addressed with additional restrictions. This issue affected versions prior to iOS 12, macOS Mojave 10.14. |
CVE-2018-4352 | Low | 3.3 | 2019-04-03 | A consistency issue existed in the handling of application snapshots. The issue was addressed with improved handling of notes deletions. This issue affected ve… |
CVE-2018-4325 | Low | 2.4 | 2019-04-03 | A logic issue was addressed with improved restrictions. This issue affected versions prior to iOS 12. |
CVE-2018-4311 | High | 8.1 | 2019-04-03 | The issue was addressed by removing origin information. This issue affected versions prior to iOS 12, watchOS 5, Safari 12, iTunes 12.9 for Windows, iCloud for… |
CVE-2018-4300 | Medium | 5.9 | 2019-04-03 | The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web interface when the web inte… |
CVE-2018-4289 | Medium | 5.5 | 2019-04-03 | An information disclosure issue was addressed by removing the vulnerable code. This issue affected versions prior to macOS High Sierra 10.13.6. |
CVE-2018-4052 | Medium | 5.5 | 2019-04-02 | An exploitable local information leak vulnerability exists in the privileged helper tool of GOG Galaxy's Games, version 1.2.47 for macOS. An attacker can pass… |
CVE-2018-1917 | Low | 3.5 | 2019-04-02 | IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could allow an authenticated user to access JSP files and disclose sensitive information. IBM X-Force ID… |
CVE-2018-1874 | Medium | 4.6 | 2019-04-02 | IBM API Connect 5.0.0.0 through 5.0.8.5 could display highly sensitive information to an attacker with physical access to the system. IBM X-Force ID: 151636. |
CVE-2018-1625 | Medium | 4.3 | 2019-04-02 | IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 generates an error message that includes sensitive information about its environment, users, o… |
CVE-2018-1623 | Medium | 4.0 | 2019-04-02 | IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-F… |
CVE-2018-13297 | Medium | 5.3 | 2019-04-01 | Information exposure vulnerability in SYNO.SynologyDrive.Files in Synology Drive before 1.1.2-10562 allows remote attackers to obtain sensitive system informat… |
CVE-2018-13295 | Medium | 4.3 | 2019-04-01 | Information exposure vulnerability in SYNO.Personal.Application.Info in Synology Application Service before 1.5.4-0320 allows remote authenticated users to obt… |
CVE-2018-13294 | Medium | 4.3 | 2019-04-01 | Information exposure vulnerability in SYNO.Personal.Profile in Synology Application Service before 1.5.4-0320 allows remote authenticated users to obtain sensi… |
CVE-2018-13292 | Medium | 4.3 | 2019-04-01 | Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote authenticated users to obtain… |
CVE-2018-13291 | Medium | 4.3 | 2019-04-01 | Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology DiskStation Manager (DSM) before 6.2.1-23824 allows remote authenticated users to ob… |
CVE-2018-13290 | Medium | 4.3 | 2019-04-01 | Information exposure vulnerability in SYNO.Core.ACL in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote authenticated users to determine the exi… |
CVE-2018-13289 | Medium | 5.3 | 2019-04-01 | Information exposure vulnerability in SYNO.FolderSharing.List in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote attackers to obtain sensitive… |
CVE-2018-13288 | Medium | 5.3 | 2019-04-01 | Information exposure vulnerability in SYNO.FolderSharing.List in Synology File Station before 1.2.3-0252 and before 1.1.5-0125 allows remote attackers to obtai… |
CVE-2019-3869 | High | 7.2 | 2019-03-28 | When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious use… |
CVE-2019-1762 | Medium | 4.4 | 2019-03-28 | A vulnerability in the Secure Storage feature of Cisco IOS and IOS XE Software could allow an authenticated, local attacker to access sensitive system informat… |
CVE-2018-19643 | Medium | 4.7 | 2019-03-27 | Information leakage issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5. |
CVE-2015-1012 | High | 7.5 | 2019-03-25 | Wireless keys are stored in plain text on version 5 of the Hospira LifeCare PCA Infusion System. According to Hospira, version 3 of the LifeCare PCA Infusion S… |
CVE-2017-7510 | High | 8.8 | 2019-03-25 | In ovirt-engine 4.1, if a host was provisioned with cloud-init, the root password could be revealed through the REST interface. |
CVE-2015-3952 | High | 7.5 | 2019-03-25 | Wireless keys are stored in plain text on Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq I… |
CVE-2019-7436 | Medium | 6.5 | 2019-03-21 | PHP Scripts Mall Opensource Classified Ads Script 3.2.2 has directory traversal via a direct request for a listing of an uploads directory. |
CVE-2019-7434 | Medium | 6.5 | 2019-03-21 | PHP Scripts Mall Rental Bike Script 2.0.3 has directory traversal via a direct request for a listing of an uploads directory. |
CVE-2019-7431 | Medium | 6.5 | 2019-03-21 | PHP Scripts Mall Image Sharing Script 1.3.4 has directory traversal via a direct request for a listing of an uploads directory. |
CVE-2019-7429 | Medium | 6.5 | 2019-03-21 | PHP Scripts Mall Property Rental Software 2.1.4 has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploa… |
CVE-2018-20555 | Critical | 9.8 | 2019-03-21 | The Design Chemical Social Network Tabs plugin 1.7.1 for WordPress allows remote attackers to discover Twitter access_token, access_token_secret, consumer_key… |
CVE-2018-19487 | High | 7.5 | 2019-03-21 | The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_employer_ajax_profile() function through the admin-ajax.ph… |
CVE-2018-18762 | Medium | 6.5 | 2019-03-21 | SaltOS 3.1 r8126 contains a database download vulnerability. |
CVE-2018-17502 | Medium | 4.0 | 2019-03-21 | The Receptionist for iPad could allow a local attacker to obtain sensitive information, caused by an error in the contact.json file. An attacker could exploit… |
CVE-2018-17484 | Medium | 4.0 | 2019-03-21 | Lobby Track Desktop could allow a local attacker to obtain sensitive information, caused by an error in Sample Database.mdb database while in kiosk mode. By us… |