CWE-200 · Information Disclosure (page 63)
Page 63 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-9998 | Medium | 6.5 | 2018-07-05 | Open-Xchange OX App Suite before 7.6.3-rev37, 7.8.x before 7.8.2-rev40, 7.8.3 before 7.8.3-rev48, and 7.8.4 before 7.8.4-rev28 include folder names in API erro… |
CVE-2018-12021 | Medium | 6.5 | 2018-07-05 | Singularity 2.3.0 through 2.5.1 is affected by an incorrect access control on systems supporting overlay file system. When using the overlay option, a maliciou… |
CVE-2018-9185 | High | 8.1 | 2018-07-05 | An information disclosure vulnerability in Fortinet FortiOS 6.0.0 and below versions reveals user's web portal login credentials in a Javascript file sent to c… |
CVE-2018-13123 | Critical | 9.8 | 2018-07-03 | onefilecms.php in OneFileCMS through 2017-10-08 might allow attackers to read arbitrary files via the i and f parameters, as demonstrated by ?i=etc/&f=passwd&p… |
CVE-2018-7776 | Medium | 4.3 | 2018-07-03 | The vulnerability exists within error.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. System information is returned to the attac… |
CVE-2018-10596 | High | 7.1 | 2018-07-03 | Medtronic 2090 CareLink Programmer uses a virtual private network connection to securely download updates. It does not verify it is still connected to this v… |
CVE-2018-12892 | Critical | 9.9 | 2018-07-02 | An issue was discovered in Xen 4.7 through 4.10.x. libxl fails to pass the readonly flag to qemu when setting up a SCSI disk, due to what was probably an erron… |
CVE-2018-12990 | Medium | 5.3 | 2018-06-30 | phpwcms 1.8.9 allows remote attackers to discover the installation path via an invalid csrf_token_value field. |
CVE-2018-12997 | High | 7.5 | 2018-06-29 | Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128… |
CVE-2018-12927 | High | 7.5 | 2018-06-28 | Northern Electric & Power (NEP) inverter devices allow remote attackers to obtain potentially sensitive information via a direct request for the nep/status/ind… |
CVE-2018-12926 | High | 7.5 | 2018-06-28 | Pharos Controls devices allow remote attackers to obtain potentially sensitive information via a direct request for the default/index.lsp or default/log.lsp UR… |
CVE-2018-12923 | High | 7.5 | 2018-06-28 | BWS Systems HA-Bridge devices allow remote attackers to obtain potentially sensitive information via a direct request for the #!/system URI. |
CVE-2018-12921 | High | 7.5 | 2018-06-28 | Electro Industries GaugeTech Nexus devices allow remote attackers to obtain potentially sensitive information via a direct request for the meter_information.ht… |
CVE-2018-12920 | High | 7.5 | 2018-06-28 | Brickstream 2300 devices allow remote attackers to obtain potentially sensitive information via a direct request for the basic.html#ipsettings or basic.html#da… |
CVE-2018-1553 | Medium | 5.3 | 2018-06-27 | IBM WebSphere Application Server Liberty prior to 18.0.0.2 could allow a remote attacker to obtain sensitive information, caused by mishandling of exceptions b… |
CVE-2018-1306 | High | 7.5 | 2018-06-27 | The PortletV3AnnotatedDemo Multipart Portlet war file code provided in Apache Pluto version 3.0.0 could allow a remote attacker to obtain sensitive information… |
CVE-2018-5436 | Medium | 6.5 | 2018-06-27 | The Spotfire server component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contain multiple vulner… |
CVE-2018-12908 | Critical | 9.8 | 2018-06-27 | Brynamics "Online Trade - Online trading and cryptocurrency investment system" allows remote attackers to obtain sensitive information via a direct request for… |
CVE-2018-12907 | High | 7.5 | 2018-06-27 | In Rclone 1.42, use of "rclone sync" to migrate data between two Google Cloud Storage buckets might allow attackers to trigger the transmission of any URL's co… |
CVE-2018-1614 | Medium | 5.8 | 2018-06-26 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using malformed SAML responses from the SAML identity provider could allow a remote attacker to obtain… |
CVE-2018-3760 | High | 7.5 | 2018-06-26 | There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted request… |
CVE-2018-4861 | Medium | 4.9 | 2018-06-26 | A vulnerability has been identified in SCALANCE M875 (All versions). An authenticated remote attacker with access to the web interface (443/tcp), could potenti… |
CVE-2018-10663 | High | 7.5 | 2018-06-26 | An issue was discovered in multiple models of Axis IP Cameras. There is an Incorrect Size Calculation. |
CVE-2018-1000609 | Medium | 6.5 | 2018-06-26 | A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in ConfigurationAsCode.java that allows… |
CVE-2018-1000603 | High | 8.8 | 2018-06-26 | A exposure of sensitive information vulnerability exists in Jenkins Openstack Cloud Plugin 2.35 and earlier in BootSource.java, InstancesToRun.java, JCloudsCle… |
CVE-2018-1000601 | Medium | 6.5 | 2018-06-26 | A arbitrary file read vulnerability exists in Jenkins SSH Credentials Plugin 1.13 and earlier in BasicSSHUserPrivateKey.java that allows attackers with a Jenki… |
CVE-2018-1000600 | High | 8.8 | 2018-06-26 | A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCredentialsCreator.java that allows attacker… |
CVE-2018-1000549 | Medium | 5.3 | 2018-06-26 | Wekan version 1.04.0 contains a Email / Username Enumeration vulnerability in Register' and 'Forgot your password?' pages that can result in A remote attacker… |
CVE-2018-1000535 | High | 7.5 | 2018-06-26 | lms version <= LMS_011123 contains a Local File Disclosure vulnerability in File reading functionality in LMS module that can result in Possible to read files… |
CVE-2018-10852 | Low | 3.8 | 2018-06-26 | The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a mess… |
CVE-2018-0584 | High | 7.5 | 2018-06-26 | IIJ SmartKey App for Android version 2.1.0 and earlier allows remote attackers to bypass authentication [effect_of_bypassing_authentication] via unspecified ve… |
CVE-2018-0575 | Medium | 5.3 | 2018-06-26 | baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction in mail form to vie… |
CVE-2018-0528 | Medium | 4.3 | 2018-06-26 | Cybozu Office 10.0.0 to 10.7.0 allows authenticated attackers to bypass authentication to view the schedules that are not permitted to access via unspecified v… |
CVE-2018-0526 | Medium | 4.3 | 2018-06-26 | Cybozu Office 10.0.0 to 10.7.0 allow remote attackers to display an image located in an external server via unspecified vectors. |
CVE-2018-12735 | High | 7.5 | 2018-06-25 | SAJ Solar Inverter allows remote attackers to obtain potentially sensitive information via a direct request for the inverter_info.htm or english_main.htm URI. |
CVE-2018-12716 | Medium | 4.3 | 2018-06-25 | The API service on Google Home and Chromecast devices before mid-July 2018 does not prevent DNS rebinding attacks from reading the scan_results JSON data, whic… |
CVE-2018-12684 | High | 7.1 | 2018-06-22 | Out-of-bounds Read in the send_ssi_file function in civetweb.c in CivetWeb through 1.10 allows attackers to cause a Denial of Service or Information Disclosure… |
CVE-2017-7568 | Medium | 5.3 | 2018-06-22 | NetApp OnCommand Unified Manager for 7-Mode (core package) versions prior to 5.2.3 may disclose sensitive LDAP account information to authenticated users when… |
CVE-2018-1655 | Medium | 4.0 | 2018-06-22 | IBM AIX 5.3, 6.1, 7.1, and 7.2 contains a vulnerability in the rmsock command that may be used to expose kernel memory. IBM X-Force ID: 144748. |
CVE-2018-12634 | Critical | 9.8 | 2018-06-22 | CirCarLife Scada before 4.3 allows remote attackers to obtain sensitive information via a direct request for the html/log or services/system/info.html URI. |
CVE-2018-12632 | Medium | 5.3 | 2018-06-21 | Redatam7 (formerly Redatam WebServer) allows remote attackers to discover the installation path via an invalid LFN parameter to the /redbin/rpwebutilities.exe/… |
CVE-2018-3665 | Medium | 5.6 | 2018-06-21 | System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially allow a local process to infer data… |
CVE-2018-12594 | High | 7.5 | 2018-06-20 | Reliable Controls MACH-ProWebCom 7.80 devices allow remote attackers to obtain sensitive information via a direct request for the data/fileinfo.xml or job/job… |
CVE-2018-12592 | High | 7.5 | 2018-06-20 | Polycom RealPresence Web Suite before 2.2.0 does not block a user's video for a few seconds upon joining a meeting (when the user has explicitly chosen to turn… |
CVE-2018-12098 | Medium | 5.5 | 2018-06-19 | The liblnk_data_block_read function in liblnk_data_block.c in liblnk through 2018-04-19 allows remote attackers to cause an information disclosure (heap-based… |
CVE-2018-12097 | Medium | 5.5 | 2018-06-19 | The liblnk_location_information_read_data function in liblnk_location_information.c in liblnk through 2018-04-19 allows remote attackers to cause an informatio… |
CVE-2018-11731 | Medium | 5.5 | 2018-06-19 | The libfsntfs_mft_entry_read_attributes function in libfsntfs_mft_entry.c in libfsntfs through 2018-04-20 allows remote attackers to cause an information discl… |
CVE-2018-11729 | Medium | 5.5 | 2018-06-19 | The libfsntfs_mft_entry_read_header function in libfsntfs_mft_entry.c in libfsntfs through 2018-04-20 allows remote attackers to cause an information disclosur… |
CVE-2018-11728 | Medium | 5.5 | 2018-06-19 | The libfsntfs_reparse_point_values_read_data function in libfsntfs_reparse_point_values.c in libfsntfs through 2018-04-20 allows remote attackers to cause an i… |
CVE-2018-11727 | Medium | 5.5 | 2018-06-19 | The libfsntfs_attribute_read_from_mft function in libfsntfs_attribute.c in libfsntfs through 2018-04-20 allows remote attackers to cause an information disclos… |
CVE-2018-1073 | Medium | 5.3 | 2018-06-19 | The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and invalid passwords, allowing an attacker to… |
CVE-2018-12557 | Critical | 9.8 | 2018-06-19 | An issue was discovered in Zuul 3.x before 3.1.0. If nodes become offline during the build, the no_log attribute of a task is ignored. If the unreachable error… |
CVE-2018-1090 | Medium | 5.5 | 2018-06-18 | In Pulp before version 2.16.2, secrets are passed into override_config when triggering a task and then become readable to all users with read access on the dis… |
CVE-2018-12525 | Medium | 5.3 | 2018-06-18 | An issue was discovered in perfSONAR Monitoring and Debugging Dashboard (MaDDash) 2.0.2. A direct request to /images/ provides a directory listing. |
CVE-2018-12524 | Medium | 5.3 | 2018-06-18 | An issue was discovered in perfSONAR Monitoring and Debugging Dashboard (MaDDash) 2.0.2. A direct request to /lib/ provides a directory listing. |
CVE-2018-12523 | Medium | 5.3 | 2018-06-18 | An issue was discovered in perfSONAR Monitoring and Debugging Dashboard (MaDDash) 2.0.2. A direct request to /etc/ provides a directory listing. |
CVE-2018-12522 | Medium | 5.3 | 2018-06-18 | An issue was discovered in perfSONAR Monitoring and Debugging Dashboard (MaDDash) 2.0.2. A direct request to /style/ provides a directory listing. |
CVE-2018-12027 | High | 8.8 | 2018-06-17 | An Insecure Permissions vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 causes information disclosure in the following situation: given a… |
CVE-2018-12337 | Medium | 4.6 | 2018-06-17 | Reliance on Security Through Obscurity vulnerability in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows an attacker to partially extract confidential configurati… |
CVE-2018-12336 | Critical | 9.8 | 2018-06-17 | Undocumented Factory Backdoor in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows the vendor to extract confidential information via remote root SSH access. |
CVE-2018-12329 | Medium | 5.9 | 2018-06-17 | Protection Mechanism Failure in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows a local attacker to duplicate an authentication factor via cloning. |
CVE-2018-5751 | Medium | 6.5 | 2018-06-16 | The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 allows… |
CVE-2018-12481 | Critical | 9.8 | 2018-06-15 | The Olive Tree Ftp Server application 1.32 for Android has a "Sensitive Data on the Clipboard" vulnerability, as demonstrated by reading the "User password" fi… |
CVE-2018-6672 | Medium | 5.7 | 2018-06-15 | Information disclosure vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.0 through 5.3.3 and 5.9.0 through 5.9.1 allows authenticated users to view sensit… |
CVE-2018-12440 | Medium | 4.7 | 2018-06-15 | BoringSSL through 2018-06-14 allows a memory-cache side-channel attack on DSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover a D… |
CVE-2018-12439 | Medium | 4.7 | 2018-06-15 | MatrixSSL through 3.9.5 Open allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover a… |
CVE-2018-12438 | Medium | 4.9 | 2018-06-15 | The Elliptic Curve Cryptography library (aka sunec or libsunec) allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Num… |
CVE-2018-12437 | Medium | 4.9 | 2018-06-15 | LibTomCrypt through 1.18.1 allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover an… |
CVE-2018-12436 | Medium | 4.7 | 2018-06-15 | wolfcrypt/src/ecc.c in wolfSSL before 3.15.1.patch allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem o… |
CVE-2018-12435 | Medium | 5.9 | 2018-06-15 | Botan 2.5.0 through 2.6.0 before 2.7.0 allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP, rel… |
CVE-2018-12434 | Medium | 4.7 | 2018-06-15 | LibreSSL before 2.6.5 and 2.7.x before 2.7.4 allows a memory-cache side-channel attack on DSA and ECDSA signatures, aka the Return Of the Hidden Number Problem… |
CVE-2018-12433 | Medium | 4.9 | 2018-06-15 | cryptlib through 3.4.4 allows a memory-cache side-channel attack on DSA and ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover… |
CVE-2018-8246 | Medium | 5.5 | 2018-06-14 | An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel Information Disclosur… |
CVE-2018-8239 | Medium | 5.5 | 2018-06-14 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows GDI Information Dis… |
CVE-2018-8234 | Medium | 4.3 | 2018-06-14 | An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerabili… |
CVE-2018-8209 | High | 8.0 | 2018-06-14 | An information disclosure vulnerability exists when Windows allows a normal user to access the Wireless LAN profile of an administrative user, aka "Windows Wir… |
CVE-2018-8207 | Medium | 4.7 | 2018-06-14 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera… |
CVE-2018-0871 | Medium | 4.3 | 2018-06-14 | An information disclosure vulnerability exists when Edge improperly marks files, aka "Microsoft Edge Information Disclosure Vulnerability." This affects Micros… |
CVE-2018-1393 | Low | 3.1 | 2018-06-13 | IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.6 could allow an authenticated user to execute a specially crafted command that could… |
CVE-2018-12227 | Medium | 5.3 | 2018-06-12 | An issue was discovered in Asterisk Open Source 13.x before 13.21.1, 14.x before 14.7.7, and 15.x before 15.4.1 and Certified Asterisk 13.18-cert before 13.18-… |
CVE-2018-5182 | High | 7.5 | 2018-06-11 | If a text string that happens to be a filename in the operating system's native format is dragged and dropped onto the addressbar the specified local file will… |
CVE-2018-5181 | High | 7.5 | 2018-06-11 | If a URL using the "file:" protocol is dragged and dropped onto an open tab that is running in a different child process the tab will open a local file corresp… |
CVE-2018-5157 | High | 7.5 | 2018-06-11 | Same-origin protections for the PDF viewer can be bypassed, allowing a malicious site to intercept messages meant for the viewer. This could allow the site to… |
CVE-2018-5140 | Medium | 5.3 | 2018-06-11 | Image for moz-icons can be accessed through the "moz-icon:" protocol through script in web content even when otherwise prohibited. This could allow for informa… |
CVE-2018-5137 | High | 7.5 | 2018-06-11 | A legacy extension's non-contentaccessible, defined resources can be loaded by an arbitrary web page through script. This script does this by using a malicious… |
CVE-2018-5134 | High | 7.5 | 2018-06-11 | WebExtensions may use "view-source:" URLs to view local "file:" URL content, as well as content stored in "about:cache", bypassing restrictions that only allow… |
CVE-2018-5133 | Medium | 6.5 | 2018-06-11 | If the "app.support.baseURL" preference is changed by a malicious local program to contain HTML and script content, this content is not sanitized. It will be e… |
CVE-2018-5132 | Medium | 6.5 | 2018-06-11 | The Find API for WebExtensions can search some privileged pages, such as "about:debugging", if these pages are open in a tab. This could allow a malicious WebE… |
CVE-2018-5131 | Medium | 5.9 | 2018-06-11 | Under certain circumstances the "fetch()" API can return transient local copies of resources that were sent with a "no-store" or "no-cache" cache header instea… |
CVE-2018-5119 | Medium | 5.3 | 2018-06-11 | The reader view will display cross-origin content when CORS headers are set to prohibit the loading of cross-origin content by a site. This could allow access… |
CVE-2018-5118 | Medium | 5.3 | 2018-06-11 | The screenshot images displayed in the Activity Stream page displayed when a new tab is opened is created from the meta tags of websites. An issue was discover… |
CVE-2018-5115 | High | 7.5 | 2018-06-11 | If an HTTP authentication prompt is triggered by a background network request from a page or extension, it is displayed over the currently loaded foreground pa… |
CVE-2018-5114 | Medium | 5.3 | 2018-06-11 | If an existing cookie is changed to be "HttpOnly" while a document is open, the original value remains accessible through script until that document is closed… |
CVE-2018-5108 | Medium | 4.3 | 2018-06-11 | A Blob URL can violate origin attribute segregation, allowing it to be accessed from a private browsing tab and for data to be passed between the private brows… |
CVE-2018-5106 | Medium | 5.3 | 2018-06-11 | Style editor traffic in the Developer Tools can be routed through a service worker hosted on a third party website if a user selects error links when these too… |
CVE-2017-7847 | Medium | 4.3 | 2018-06-11 | Crafted CSS in an RSS feed can leak and reveal local path strings, which may contain user name. This vulnerability affects Thunderbird < 52.5.2. |
CVE-2017-7844 | Medium | 6.5 | 2018-06-11 | A combination of an external SVG image referenced on a page and the coloring of anchor links stored within this image can be used to determine which pages a us… |
CVE-2017-7843 | High | 7.5 | 2018-06-11 | When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not… |
CVE-2017-7842 | Medium | 5.3 | 2018-06-11 | If a document's Referrer Policy attribute is set to "no-referrer" sometimes two network requests are made for "<link>" elements instead of one. One of these re… |
CVE-2017-7831 | Medium | 5.3 | 2018-06-11 | A vulnerability where the security wrapper does not deny access to some exposed properties using the deprecated "_exposedProps_" mechanism on proxy objects. Th… |