CWE-200 · Information Disclosure (page 58)
Page 58 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-9074 | Medium | 5.9 | 2018-06-11 | An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in Network Security Services (NSS) 3.26.1… |
CVE-2016-9062 | Low | 3.3 | 2018-06-11 | Private browsing mode leaves metadata information, such as URLs, for sites visited in "browser.db" and "browser.db-wal" files within the Firefox profile after… |
CVE-2016-5288 | Medium | 5.9 | 2018-06-11 | Web content could access information in the HTTP cache if e10s is disabled. This can reveal some visited URLs and the contents of those pages. This issue affec… |
CVE-2018-12089 | High | 7.5 | 2018-06-11 | In Octopus Deploy version 2018.5.1 to 2018.5.7, a user with Task View is able to view a password for a Service Fabric Cluster, when the Service Fabric Cluster… |
CVE-2018-1281 | Medium | 6.5 | 2018-06-08 | The clustered setup of Apache MXNet allows users to specify which IP address and port the scheduler will listen on via the DMLC_PS_ROOT_URI and DMLC_PS_ROOT_PO… |
CVE-2018-4252 | Medium | 4.6 | 2018-06-08 | An issue was discovered in certain Apple products. iOS before 11.4 is affected. The issue involves the "Siri" component. It allows physically proximate attacke… |
CVE-2018-4244 | Medium | 4.6 | 2018-06-08 | An issue was discovered in certain Apple products. iOS before 11.4 is affected. The issue involves the "Siri Contacts" component. It allows physically proximat… |
CVE-2018-4239 | Medium | 4.6 | 2018-06-08 | An issue was discovered in certain Apple products. iOS before 11.4 is affected. The issue involves the "Magnifier" component. It allows physically proximate at… |
CVE-2018-4226 | Medium | 5.5 | 2018-06-08 | An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. iCloud before 7.5 on Windows is affected. iTu… |
CVE-2018-4224 | Medium | 5.5 | 2018-06-08 | An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. iCloud before 7.5 on Windows is affected. iTu… |
CVE-2018-4223 | Medium | 5.5 | 2018-06-08 | An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS before 11.4 is affected. watchOS before… |
CVE-2018-4221 | High | 7.5 | 2018-06-08 | An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. The issue involves the "Security" component… |
CVE-2018-4196 | High | 7.8 | 2018-06-08 | An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the "Accessibility Framework" component. It allows atta… |
CVE-2018-4171 | Medium | 5.5 | 2018-06-08 | An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the "Bluetooth" component. It allows attackers to obtai… |
CVE-2018-4159 | Medium | 5.5 | 2018-06-08 | An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the "Graphics Drivers" component. It allows attackers t… |
CVE-2018-4141 | Medium | 5.5 | 2018-06-08 | An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the "Intel Graphics Driver" component. It allows attack… |
CVE-2012-0433 | Low | 3.3 | 2018-06-08 | The install-chef-suse.sh script shipped with crowbar before 2012-10-02 is creating files containing confidential data with insecure permissions, allowing local… |
CVE-2018-11409 | Medium | 5.3 | 2018-06-08 | Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, as demonstrated by discover… |
CVE-2018-0335 | High | 7.8 | 2018-06-07 | A vulnerability in the web portal authentication process of Cisco Prime Collaboration Provisioning could allow an unauthenticated, local attacker to view sensi… |
CVE-2017-16225 | High | 7.5 | 2018-06-07 | aegir is a module to help automate JavaScript project management. Version 12.0.0 through and including 12.0.7 bundled and published to npm the user (that perfo… |
CVE-2017-16206 | High | 7.5 | 2018-06-07 | The cofee-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. |
CVE-2017-16205 | High | 7.5 | 2018-06-07 | The coffescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. |
CVE-2017-16204 | High | 7.5 | 2018-06-07 | The jquey module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. |
CVE-2017-16203 | High | 7.5 | 2018-06-07 | The coffe-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. |
CVE-2017-16202 | High | 7.5 | 2018-06-07 | The cofeescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. |
CVE-2017-16126 | Medium | 5.3 | 2018-06-07 | The module botbait is a tool to be used to track bot and automated tools usage with-in the npm ecosystem. botbait is known to record and track user information… |
CVE-2017-16081 | High | 7.5 | 2018-06-07 | cross-env.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16080 | High | 7.5 | 2018-06-07 | nodesass was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16079 | High | 7.5 | 2018-06-07 | smb was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16078 | High | 7.5 | 2018-06-07 | shadowsock was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16077 | High | 7.5 | 2018-06-07 | mongose was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16076 | High | 7.5 | 2018-06-07 | proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16075 | High | 7.5 | 2018-06-07 | http-proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16074 | High | 7.5 | 2018-06-07 | crossenv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16073 | High | 7.5 | 2018-06-07 | noderequest was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16072 | High | 7.5 | 2018-06-07 | nodemailer.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16071 | High | 7.5 | 2018-06-07 | nodemailer-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16070 | High | 7.5 | 2018-06-07 | nodecaffe was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16069 | High | 7.5 | 2018-06-07 | nodeffmpeg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16068 | High | 7.5 | 2018-06-07 | ffmepg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16067 | High | 7.5 | 2018-06-07 | node-opencv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16066 | High | 7.5 | 2018-06-07 | opencv.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16065 | High | 7.5 | 2018-06-07 | openssl.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16064 | High | 7.5 | 2018-06-07 | node-openssl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16063 | High | 7.5 | 2018-06-07 | node-opensl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16060 | High | 7.5 | 2018-06-07 | babelcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16059 | High | 7.5 | 2018-06-07 | mssql-node was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16058 | High | 7.5 | 2018-06-07 | gruntcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16057 | High | 7.5 | 2018-06-07 | nodemssql was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16056 | High | 7.5 | 2018-06-07 | mssql.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2018-10198 | Medium | 4.3 | 2018-06-06 | An issue was discovered in OTRS 6.0.x before 6.0.7. An attacker who is logged into OTRS as a customer can use the ticket overview screen to disclose internal a… |
CVE-2017-1476 | Medium | 5.9 | 2018-06-06 | IBM Security Access Manager Appliance 7.0.0, 8.0.0 through 8.0.1.6, and 9.0.0 through 9.0.3.1 could allow a remote attacker to obtain sensitive information, ca… |
CVE-2017-1474 | Medium | 5.3 | 2018-06-06 | IBM Security Access Manager Appliance 7.0.0, 8.0.0 through 8.0.1.6, and 9.0.0 through 9.0.3.1 discloses sensitive information to unauthorized users. The inform… |
CVE-2018-1000196 | Medium | 6.5 | 2018-06-05 | A exposure of sensitive information vulnerability exists in Jenkins Gitlab Hook Plugin 1.4.2 and older in gitlab_notifier.rb, views/gitlab_notifier/global.erb… |
CVE-2018-10599 | Medium | 5.3 | 2018-06-05 | IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Monitors MX (MX400-550) Rev J-M and (X3/MX10… |
CVE-2018-1000191 | Medium | 6.5 | 2018-06-05 | A exposure of sensitive information vulnerability exists in Jenkins Black Duck Detect Plugin 1.4.0 and older in DetectPostBuildStepDescriptor.java that allows… |
CVE-2018-1000190 | Medium | 6.5 | 2018-06-05 | A exposure of sensitive information vulnerability exists in Jenkins Black Duck Hub Plugin 4.0.0 and older in PostBuildScanDescriptor.java that allows attackers… |
CVE-2018-1000187 | Medium | 6.5 | 2018-06-05 | A exposure of sensitive information vulnerability exists in Jenkins Kubernetes Plugin 1.7.0 and older in ContainerExecDecorator.java that results in sensitive… |
CVE-2018-1000186 | Medium | 6.5 | 2018-06-05 | A exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin 1.41.0 and older in GhprbGitHubAuth.java that allows att… |
CVE-2018-1000183 | Medium | 6.5 | 2018-06-05 | A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.0 and older in GitHubServerConfig.java that allows attackers with Overal… |
CVE-2018-1332 | Medium | 6.5 | 2018-06-05 | Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose a vulnerability that could allow a user to impersonate another… |
CVE-2018-1000181 | High | 7.5 | 2018-06-05 | Kitura 2.3.0 and earlier have an unintended read access to unauthorised files and folders that can be exploited by a crafted URL resulting in information discl… |
CVE-2018-11554 | Critical | 9.8 | 2018-06-05 | The forgotten-password feature in index.php/member/reset/reset_email.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information Exposure issue and… |
CVE-2017-12092 | Low | 3.7 | 2018-06-04 | An exploitable file write vulnerability exists in the memory module functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before. A specially cr… |
CVE-2017-16055 | High | 7.5 | 2018-06-04 | `sqlserver` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16054 | High | 7.5 | 2018-06-04 | `nodefabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16053 | High | 7.5 | 2018-06-04 | `fabric-js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16052 | High | 7.5 | 2018-06-04 | `node-fabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16051 | High | 7.5 | 2018-06-04 | `sqliter` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16050 | High | 7.5 | 2018-06-04 | `sqlite.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16049 | High | 7.5 | 2018-06-04 | `nodesqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16048 | High | 7.5 | 2018-06-04 | `node-sqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16045 | High | 7.5 | 2018-06-04 | `jquery.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16044 | High | 7.5 | 2018-06-04 | `d3.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16024 | Medium | 6.5 | 2018-06-04 | The sync-exec module is used to simulate child_process.execSync in node versions <0.11.9. Sync-exec uses tmp directories as a buffer before returning values. O… |
CVE-2017-16007 | Medium | 5.9 | 2018-06-04 | node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for current web browsers and node.js-based servers. node-jose earlier… |
CVE-2018-3809 | Medium | 5.3 | 2018-06-01 | Information exposure through directory listings in serve 6.5.3 allows directory listing and file access even when they have been set to be ignored. |
CVE-2018-11195 | Medium | 6.8 | 2018-06-01 | Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 are vulnerable to the browser "back and refresh" attack. This allows malicious us… |
CVE-2018-5525 | Medium | 4.3 | 2018-06-01 | A local file vulnerability exists in the F5 BIG-IP Configuration utility on versions 13.0.0, 12.1.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 that expo… |
CVE-2018-11645 | Medium | 5.3 | 2018-06-01 | psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits the status command even if -dSAFER is used, which might allow remote attackers to determine the exist… |
CVE-2018-1532 | Medium | 4.3 | 2018-05-31 | IBM API Connect 5.0.0.0 through 5.0.8.2 does not properly update the SESSIONID with each request, which could allow a user to obtain the ID in further attacks… |
CVE-2016-10533 | High | 8.8 | 2018-05-31 | express-restify-mongoose is a module to easily create a flexible REST interface for mongoose models. express-restify-mongoose 2.4.2 and earlier and 3.0.X throu… |
CVE-2016-10530 | Medium | 5.9 | 2018-05-31 | The airbrake module 0.3.8 and earlier defaults to sending environment variables over HTTP. Environment variables can often times contain secret keys and other… |
CVE-2016-10519 | High | 7.5 | 2018-05-31 | A security issue was found in bittorrent-dht before 5.1.3 that allows someone to send a specific series of messages to a listening peer and get it to reveal in… |
CVE-2015-9236 | Medium | 5.3 | 2018-05-31 | Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at worst allowed cross-… |
CVE-2018-11036 | Critical | 9.1 | 2018-05-31 | Ruckus SmartZone (formerly Virtual SmartCell Gateway or vSCG) 3.5.0, 3.5.1, 3.6.0, and 3.6.1 (Essentials and High Scale) on vSZ, SZ-100, SZ-300, and SCG-200 de… |
CVE-2018-11565 | Medium | 5.3 | 2018-05-30 | Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 are vulnerable to mentioning the usernames that are already taken by people regis… |
CVE-2018-11437 | Medium | 6.5 | 2018-05-30 | The mobi_reconstruct_parts function in parse_rawml.c in Libmobi 0.3 allows remote attackers to cause information disclosure (read access violation) via a craft… |
CVE-2018-11435 | Medium | 6.5 | 2018-05-30 | The mobi_decompress_huffman_internal function in compression.c in Libmobi 0.3 allows remote attackers to cause information disclosure (read access violation) v… |
CVE-2017-16062 | High | 7.5 | 2018-05-29 | node-tkinter was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16061 | High | 7.5 | 2018-05-29 | tkinter was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16047 | High | 7.5 | 2018-05-29 | mysqljs was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2018-1369 | Low | 3.7 | 2018-05-29 | IBM Security Guardium Big Data Intelligence (SonarG) 3.1 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorize… |
CVE-2017-1768 | Medium | 4.3 | 2018-05-29 | IBM Security Guardium Big Data Intelligence (SonarG) 3.1 generates an error message that includes sensitive information about its environment, users, or associ… |
CVE-2018-10732 | Medium | 5.3 | 2018-05-28 | The REST API in Dataiku DSS before 4.2.3 allows remote attackers to obtain sensitive information (i.e., determine if a username is valid) because of profile pi… |
CVE-2018-11517 | Medium | 5.3 | 2018-05-28 | mySCADA myPRO 7 allows remote attackers to discover all ProjectIDs in a project by sending all of the prj parameter values from 870000 to 875000 in t=0&rq=0 re… |
CVE-2018-11508 | Medium | 5.5 | 2018-05-28 | The compat_get_timex function in kernel/compat.c in the Linux kernel before 4.16.9 allows local users to obtain sensitive information from kernel memory via ad… |
CVE-2018-11505 | High | 7.5 | 2018-05-26 | The Werewolf Online application 0.8.8 for Android allows attackers to discover the Firebase token by reading logcat output. |
CVE-2017-14185 | Medium | 5.3 | 2018-05-25 | An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.8 and 5.2 all versions allows SSL VPN web portal users to access inter… |
CVE-2018-6234 | Medium | 5.5 | 2018-05-25 | An Out-of-Bounds Read Information Disclosure vulnerability in Trend Micro Maximum Security (Consumer) 2018 could allow a local attacker to disclose sensitive i… |