CWE-200 · Information Disclosure (page 58)
Page 58 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-17483 | Low | 2.9 | 2019-03-21 | Lobby Track Desktop could allow a local attacker to obtain sensitive information, caused by an error in Reports while in kiosk mode. By visiting the kiosk and… |
CVE-2018-17482 | Medium | 4.0 | 2019-03-21 | Lobby Track Desktop could allow a local attacker to obtain sensitive information, caused by an error in Reports while in kiosk mode. By visiting the kiosk and… |
CVE-2018-15532 | Low | 3.8 | 2019-03-21 | SynTP.sys in Synaptics Touchpad drivers before 2018-06-06 allows local users to obtain sensitive information about freed kernel addresses. |
CVE-2018-18205 | High | 7.5 | 2019-03-15 | Topvision CC8800 CMTS C-E devices allow remote attackers to obtain sensitive information via a direct request for /WebContent/startup.tar.gz with userName=admi… |
CVE-2018-17956 | High | 7.8 | 2019-03-15 | In yast2-samba-provision up to and including version 1.0.1 the password for samba shares was provided on the command line to tools used by yast2-samba-provisio… |
CVE-2018-1929 | Medium | 4.3 | 2019-03-14 | IBM Rational Engineering Lifecycle Manager 5.0 through 6.0.6 could allow a malicious user to be allowed to view any view if he knows the URL link of a the view… |
CVE-2018-12224 | Low | 3.3 | 2019-03-14 | Buffer leakage in igdkm64.sys in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15.36.x.5057), 20.19… |
CVE-2015-2254 | Critical | 9.1 | 2019-03-13 | Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to capture and change patch loading information resulting in t… |
CVE-2019-3615 | Medium | 5.3 | 2019-03-12 | Data Leakage Attacks vulnerability in the web interface in McAfee Database Security prior to the 4.6.6 March 2019 update allows local users to expose passwords… |
CVE-2018-17944 | Medium | 4.9 | 2019-03-12 | On certain Lexmark devices that communicate with an LDAP or SMTP server, a malicious administrator can discover LDAP or SMTP credentials by changing that serve… |
CVE-2018-2009 | Medium | 6.5 | 2019-03-11 | IBM API Connect v2018.1 and 2018.4.1 is affected by an information disclosure vulnerability in the consumer API. Any registered user can obtain a list of all o… |
CVE-2018-1902 | Low | 3.1 | 2019-03-11 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to spoof connection information which could be used to launch further att… |
CVE-2019-3781 | High | 8.8 | 2019-03-07 | Cloud Foundry CLI, versions prior to v6.43.0, improperly exposes passwords when verbose/trace/debugging is turned on. A local unauthenticated or remote authent… |
CVE-2018-11783 | High | 7.5 | 2019-03-07 | sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin. The plugin doesn't… |
CVE-2019-6206 | Critical | 9.8 | 2019-03-04 | An issue existed with autofill resuming after it was canceled. The issue was addressed with improved state management. This issue is fixed in iOS 12.1.3. Passw… |
CVE-2018-12400 | Medium | 5.3 | 2019-02-28 | In private browsing mode on Firefox for Android, favicons are cached in the cache/icons folder as they are in non-private mode. This allows information leakage… |
CVE-2018-12397 | High | 7.1 | 2019-02-28 | A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed… |
CVE-2019-4061 | Medium | 5.3 | 2019-02-27 | IBM BigFix Platform 9.2 and 9.5 could allow an attacker to query the relay remotely and gather information about the updates and fixlets deployed to the associ… |
CVE-2018-1775 | Medium | 6.5 | 2019-02-27 | IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products versions 7.5 through 8.2 could allow an authenticated user to dow… |
CVE-2018-11845 | Medium | 5.5 | 2019-02-25 | Usage of non-time-constant comparison functions can lead to information leakage through side channel analysis in Snapdragon Auto, Snapdragon Compute, Snapdrago… |
CVE-2019-9126 | High | 7.5 | 2019-02-25 | An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. There is an information disclosure vulnerability via requests for the router_info.xml document. T… |
CVE-2014-10079 | Medium | 5.3 | 2019-02-23 | In Vembu StoreGrid 4.4.x, the front page of the server web interface leaks the private IP address in the "ipaddress" hidden form value of the HTML source code… |
CVE-2019-1681 | High | 7.5 | 2019-02-21 | A vulnerability in the TFTP service of Cisco Network Convergence System 1000 Series software could allow an unauthenticated, remote attacker to retrieve arbitr… |
CVE-2018-1950 | Medium | 4.3 | 2019-02-21 | IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance generates an error message that includes sensitive information about it… |
CVE-2018-1949 | Medium | 4.3 | 2019-02-21 | IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance discloses sensitive information to unauthorized users. The information… |
CVE-2019-3610 | Medium | 5.6 | 2019-02-13 | Data Leakage Attacks vulnerability in Microsoft Windows client in McAfee True Key (TK) 3.1.9211.0 and earlier allows local users to expose confidential data vi… |
CVE-2018-12006 | Medium | 5.5 | 2019-02-11 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Users with no extra privileges can potentially acces… |
CVE-2018-20776 | High | 7.5 | 2019-02-11 | Frog CMS 0.9.5 provides a directory listing for a /public request. |
CVE-2019-7628 | Medium | 5.9 | 2019-02-08 | Pagure 5.2 leaks API keys by e-mailing them to users. Few e-mail servers validate TLS certificates, so it is easy for man-in-the-middle attackers to read these… |
CVE-2018-1296 | High | 7.5 | 2019-02-07 | In Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, and 2.5.0 to 2.7.5, HDFS exposes extended attribute key/value pairs during listXAttrs, verifying… |
CVE-2019-7535 | Medium | 5.3 | 2019-02-07 | index.php in Gurock TestRail 5.3.0.3603 returns potentially sensitive information for an invalid request, as demonstrated by full path disclosure and the ident… |
CVE-2019-1003021 | Medium | 4.3 | 2019-02-06 | An exposure of sensitive information vulnerability exists in Jenkins OpenId Connect Authentication Plugin 1.4 and earlier in OicSecurityRealm/config.jelly that… |
CVE-2019-1003018 | Medium | 4.3 | 2019-02-06 | An exposure of sensitive information vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm/config.jelly that all… |
CVE-2018-18334 | High | 7.5 | 2019-02-05 | A vulnerability in the Private Browser of Trend Micro Dr. Safety for Android (Consumer) versions below 3.0.1478 could allow an remote attacker to bypass the Sa… |
CVE-2017-1177 | Medium | 5.3 | 2019-02-05 | IBM BigFix Compliance 1.7 through 1.9.91 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the sys… |
CVE-2018-15659 | Medium | 6.5 | 2019-02-05 | An issue was discovered in 42Gears SureMDM before 2018-11-27, related to the access policy for Silverlight applications. Cross-origin access is possible. |
CVE-2018-15658 | High | 7.5 | 2019-02-05 | An issue was discovered in 42Gears SureMDM before 2018-11-27. By visiting the page found at /console/ConsolePage/Master.html, an attacker is able to see the ma… |
CVE-2018-15656 | High | 7.5 | 2019-02-05 | An issue was discovered in the registration API endpoint in 42Gears SureMDM before 2018-11-27. An attacker can submit a GET request to /api/register/:email, wh… |
CVE-2018-15655 | Medium | 6.5 | 2019-02-05 | An issue was discovered in 42Gears SureMDM before 2018-11-27, related to CORS settings. Cross-origin access is possible. |
CVE-2019-7388 | High | 7.5 | 2019-02-05 | An issue was discovered in /bin/goahead on D-Link DIR-823G devices with firmware 1.02B03. There is incorrect access control allowing remote attackers to get se… |
CVE-2018-1675 | Medium | 6.8 | 2019-02-04 | IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 could expose password hashes in stored in system memory on target systems that are configured… |
CVE-2019-7312 | Medium | 5.3 | 2019-02-03 | Limited plaintext disclosure exists in PRIMX Zed Entreprise for Windows before 6.1.2240, Zed Entreprise for Windows (ANSSI qualification submission) before 6.1… |
CVE-2018-18941 | Critical | 9.8 | 2019-01-31 | In Vignette Content Management version 6, it is possible to gain remote access to administrator privileges by discovering the admin password in the vgn/ccb/use… |
CVE-2018-19440 | Medium | 5.3 | 2019-01-30 | ARM Trusted Firmware-A allows information disclosure. |
CVE-2018-12610 | Medium | 5.3 | 2019-01-30 | OX App Suite 7.8.4 and earlier allows Information Exposure. |
CVE-2018-1976 | Medium | 4.9 | 2019-01-29 | IBM API Connect 5.0.0.0 through 5.0.8.4 is impacted by sensitive information disclosure via a REST API that could allow a user with administrative privileges t… |
CVE-2016-10740 | Medium | 4.9 | 2019-01-29 | Various resources in Atlassian Crowd before version 2.10.1 allow remote attackers with administration rights to learn the passwords of configured LDAP director… |
CVE-2018-16889 | Medium | 5.5 | 2019-01-28 | Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaint… |
CVE-2018-5497 | Medium | 4.4 | 2019-01-24 | Clustered Data ONTAP versions prior to 9.1P16, 9.3P10 and 9.4P5 are susceptible to a vulnerability which discloses sensitive information to an unauthorized use… |
CVE-2019-1657 | Medium | 4.3 | 2019-01-24 | A vulnerability in Cisco AMP Threat Grid could allow an authenticated, remote attacker to access sensitive information. The vulnerability is due to unsafe crea… |
CVE-2019-1645 | Medium | 4.3 | 2019-01-24 | A vulnerability in the Cisco Connected Mobile Experiences (CMX) software could allow an unauthenticated, adjacent attacker to access sensitive data on an affec… |
CVE-2018-0187 | Medium | 6.5 | 2019-01-23 | A vulnerability in the Admin portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain confidential information fo… |
CVE-2018-2026 | Medium | 4.3 | 2019-01-23 | IBM Financial Transaction Manager 3.2.1 for Digital Payments could allow an authenticated user to obtain a directory listing of internal product files. IBM X-F… |
CVE-2017-18332 | Medium | 5.5 | 2019-01-18 | Security keys are logged when any WCDMA call is configured or reconfigured in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9607… |
CVE-2018-19718 | Medium | 5.3 | 2019-01-18 | Adobe Connect versions 9.8.1 and earlier have a session token exposure vulnerability. Successful exploitation could lead to exposure of the privileges granted… |
CVE-2019-0647 | Medium | 6.5 | 2019-01-17 | An information disclosure vulnerability exists when Team Foundation Server does not properly handle variables marked as secret, aka "Team Foundation Server Inf… |
CVE-2018-5738 | Medium | 5.3 | 2019-01-16 | Change #4777 (introduced in October 2017) introduced an unforeseen issue in releases which were issued after that date, affecting which clients are permitted t… |
CVE-2019-3811 | Medium | 5.2 | 2019-01-15 | A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty str… |
CVE-2019-3803 | Medium | 4.5 | 2019-01-12 | Pivotal Concourse, all versions prior to 4.2.2, puts the user access token in a url during the login flow. A remote attacker who gains access to a user's brows… |
CVE-2018-16866 | Low | 3.3 | 2019-01-11 | An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'. A local attacker can use this flaw… |
CVE-2018-4217 | High | 7.5 | 2019-01-11 | In macOS High Sierra before 10.13.5, a privacy issue in the handling of Open Directory records was addressed with improved indexing. |
CVE-2018-4186 | High | 7.5 | 2019-01-11 | In Safari before 11.1, an information leakage issue existed in the handling of downloads in Safari Private Browsing. This issue was addressed with additional v… |
CVE-2018-4185 | High | 7.5 | 2019-01-11 | In iOS before 11.3, tvOS before 11.3, watchOS before 4.3, and macOS before High Sierra 10.13.4, an information disclosure issue existed in the transition of pr… |
CVE-2018-4179 | Medium | 5.5 | 2019-01-11 | In macOS High Sierra before 10.13.4, there was an issue with the handling of smartcard PINs. This issue was addressed with additional logic. |
CVE-2016-4644 | Medium | 6.5 | 2019-01-11 | In iOS before 9.3.3, tvOS before 9.2.2, and OS X El Capitan before v10.11.6 and Security Update 2016-004, a downgrade issue existed with HTTP authentication cr… |
CVE-2016-4643 | Medium | 6.5 | 2019-01-11 | In iOS before 9.3.3, tvOS before 9.2.2, and OS X El Capitan before v10.11.6 and Security Update 2016-004, a validation issue existed in the parsing of 407 resp… |
CVE-2018-15456 | Medium | 4.3 | 2019-01-10 | A vulnerability in the Admin Portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to view saved passwords in plain text… |
CVE-2018-0474 | High | 8.8 | 2019-01-10 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view digest cred… |
CVE-2019-5884 | Medium | 5.9 | 2019-01-10 | php/elFinder.class.php in elFinder before 2.1.45 leaks information if PHP's curl extension is enabled and safe_mode or open_basedir is not set. |
CVE-2018-20681 | Medium | 6.1 | 2019-01-09 | mate-screensaver before 1.20.2 in MATE Desktop Environment allows physically proximate attackers to view screen content and possibly control applications. By u… |
CVE-2018-16192 | Medium | 6.5 | 2019-01-09 | Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allow an attacker on the same ne… |
CVE-2018-1000410 | High | 7.8 | 2019-01-09 | An information exposure vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier, and the Stapler framework used by these releases, in core/s… |
CVE-2018-6179 | Medium | 6.5 | 2019-01-09 | Insufficient enforcement of file access permission in the activeTab case in Extensions in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced… |
CVE-2018-6164 | Medium | 6.5 | 2019-01-09 | Insufficient origin checks for CSS content in Blink in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to leak cross-origin data via a crafted HT… |
CVE-2018-6147 | Medium | 5.5 | 2019-01-09 | Lack of secure text entry mode in Browser UI in Google Chrome on Mac prior to 67.0.3396.62 allowed a local attacker to obtain potentially sensitive information… |
CVE-2018-6137 | Medium | 6.5 | 2019-01-09 | CSS Paint API in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2018-6117 | Medium | 6.5 | 2019-01-09 | Confusing settings in Autofill in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to obtain potentially sensitive information from process memor… |
CVE-2018-6109 | Medium | 6.5 | 2019-01-09 | readAsText() can indefinitely read the file picked by the user, rather than only once at the time the file is picked in File API in Google Chrome prior to 66.0… |
CVE-2018-6093 | Medium | 6.5 | 2019-01-09 | Insufficient origin checks in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2018-16078 | Medium | 6.5 | 2019-01-09 | Unsafe handling of credit card details in Autofill in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to obtain potentially sensitive information… |
CVE-2019-0545 | High | 7.5 | 2019-01-08 | An information disclosure vulnerability exists in .NET Framework and .NET Core which allows bypassing Cross-origin Resource Sharing (CORS) configurations, aka… |
CVE-2018-1993 | Medium | 4.0 | 2019-01-08 | IBM Spectrum Scale (GPFS) 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.2.3, and 5.0.0 where the use of Local Read Only Cache (LROC) is enabled may caused read operation on a… |
CVE-2018-1932 | Medium | 4.9 | 2019-01-08 | IBM API Connect 5.0.0.0 through 5.0.8.4 is affected by a vulnerability in the role-based access control in the management server that could allow an authentica… |
CVE-2018-3986 | Medium | 5.5 | 2019-01-03 | An exploitable information disclosure vulnerability exists in the "Secret Chats" functionality of the Telegram Android messaging application version 4.9.0. The… |
CVE-2018-16870 | Medium | 5.9 | 2019-01-03 | It was found that wolfssl before 3.15.7 is vulnerable to a new variant of the Bleichenbacher attack to perform downgrade attacks against TLS. This may lead to… |
CVE-2018-16876 | Medium | 5.3 | 2019-01-03 | ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible d… |
CVE-2017-18326 | Medium | 5.5 | 2019-01-03 | Cryptographic keys are printed in modem debug messages in snapdragon mobile and snapdragon wear in versions MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM96… |
CVE-2017-18324 | Medium | 5.5 | 2019-01-03 | Cryptographic key material leaked in debug messages - GERAN in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M… |
CVE-2017-18322 | Medium | 5.5 | 2019-01-03 | Cryptographic key material leaked in WCDMA debug messages in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MD… |
CVE-2017-18321 | Medium | 5.5 | 2019-01-03 | Security keys used by the terminal and NW for a session could be leaked in snapdragon mobile in versions MDM9650, MDM9655, SD 835, SDA660. |
CVE-2018-7900 | Medium | 6.5 | 2019-01-02 | There is an information leak vulnerability in some Huawei HG products. An attacker may obtain information about the HG device by exploiting this vulnerability. |
CVE-2018-20609 | Medium | 5.3 | 2018-12-30 | imcat 4.4 allows remote attackers to obtain potentially sensitive configuration information via the root/tools/adbug/check.php URI. |
CVE-2018-20608 | High | 7.5 | 2018-12-30 | imcat 4.4 allows remote attackers to read phpinfo output via the root/tools/adbug/binfo.php?phpinfo1 URI. |
CVE-2018-20607 | Medium | 5.3 | 2018-12-30 | imcat 4.4 allows remote attackers to obtain potentially sensitive debugging information via the root/tools/adbug/binfo.php URI. |
CVE-2018-20606 | High | 7.5 | 2018-12-30 | imcat 4.4 allows full path disclosure via a dev.php?tools-ipaddr&api=Pcoln&uip= URI. |
CVE-2018-20602 | High | 7.5 | 2018-12-30 | Lei Feng TV CMS (aka LFCMS) 3.8.6 allows full path disclosure via the /install.php?s=/1 URI. |
CVE-2018-14986 | High | 7.5 | 2018-12-28 | The Leagoo Z5C Android device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contains a pre-installed… |
CVE-2018-14984 | High | 7.5 | 2018-12-28 | The Leagoo Z5C Android device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contains a pre-installed… |
CVE-2018-14979 | Medium | 4.7 | 2018-12-28 | The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/US_Phone/ASUS_X008_1:7.0/NRD90M/US_Phone-14.14.1711.92-20171208:user/release-keys contai… |
CVE-2018-20571 | High | 7.5 | 2018-12-28 | DamiCMS 6.0.1 allows remote attackers to read arbitrary files via a crafted admin.php?s=Tpl/Add/id request, as demonstrated by admin.php?s=Tpl/Add/id/.\Public\… |