CWE-200 · Information Disclosure (page 63)
Page 63 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-13207 | High | 7.5 | 2018-01-12 | An information disclosure vulnerability in the Android media framework (stagefright mpeg4writer). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android I… |
CVE-2017-13206 | High | 7.5 | 2018-01-12 | An information disclosure vulnerability in the Android media framework (aacdec). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. An… |
CVE-2017-13205 | Critical | 9.1 | 2018-01-12 | An information disclosure vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-64550… |
CVE-2017-13204 | Critical | 9.1 | 2018-01-12 | An information disclosure vulnerability in the Android media framework (libavc). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-6438023… |
CVE-2017-13203 | Critical | 9.1 | 2018-01-12 | An information disclosure vulnerability in the Android media framework (libavc). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-6312263… |
CVE-2017-13202 | High | 7.5 | 2018-01-12 | An information disclosure vulnerability in the Android media framework (libeffects). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1… |
CVE-2017-13201 | High | 7.5 | 2018-01-12 | An information disclosure vulnerability in the Android media framework (mediadrm). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1… |
CVE-2017-13200 | High | 7.5 | 2018-01-12 | An information disclosure vulnerability in the Android media framework (av) related to id3 unsynchronization. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8… |
CVE-2017-13188 | Critical | 9.1 | 2018-01-12 | An information disclosure vulnerability in the Android media framework (aac). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-65280786. |
CVE-2017-13187 | Critical | 9.1 | 2018-01-12 | An information disclosure vulnerability in the Android media framework (libhevc). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-650341… |
CVE-2017-13185 | Critical | 9.1 | 2018-01-12 | An information disclosure vulnerability in the Android media framework (libhevc). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-65123471. |
CVE-2017-0846 | High | 7.5 | 2018-01-12 | An information disclosure vulnerability in the Android framework (clipboardservice). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. And… |
CVE-2017-16741 | Medium | 5.3 | 2018-01-12 | An Information Exposure issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1.0 to 1.32. A remote… |
CVE-2015-2298 | High | 7.5 | 2018-01-12 | node/utils/ExportEtherpad.js in Etherpad 1.5.x before 1.5.2 might allow remote attackers to obtain sensitive information by leveraging an improper substring ch… |
CVE-2014-6437 | Critical | 9.8 | 2018-01-12 | Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices allow remote attackers to obtain sensitive device configuration information via vectors involving t… |
CVE-2017-1681 | Low | 3.3 | 2018-01-11 | IBM WebSphere Application Server (IBM Liberty for Java for Bluemix 3.15) could allow a local attacker to obtain sensitive information, caused by improper handl… |
CVE-2017-1478 | Low | 3.3 | 2018-01-11 | IBM Security Access Manager Appliance 9.0.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 128613. |
CVE-2018-0014 | Medium | 4.3 | 2018-01-10 | Juniper Networks ScreenOS devices do not pad Ethernet packets with zeros, and thus some packets can contain fragments of system memory or data from previous pa… |
CVE-2018-0013 | Medium | 6.5 | 2018-01-10 | A local file inclusion vulnerability in Juniper Networks Junos Space Network Management Platform may allow an authenticated user to retrieve files from the sys… |
CVE-2017-15850 | High | 7.5 | 2018-01-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, userspace can read values from audio codec regi… |
CVE-2017-14870 | High | 7.5 | 2018-01-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while updating the recovery message for eMMC de… |
CVE-2017-14869 | High | 7.5 | 2018-01-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while performing update of FOTA partition, unin… |
CVE-2017-11079 | Critical | 9.8 | 2018-01-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing sparse image, uninitialized he… |
CVE-2017-11066 | High | 7.5 | 2018-01-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while flashing ubi image an uninitialized memor… |
CVE-2014-5004 | High | 7.8 | 2018-01-10 | lib/brbackup.rb in the brbackup gem 0.1.1 for Ruby places the database password on the mysql command line, which allows local users to obtain sensitive informa… |
CVE-2014-5001 | High | 7.8 | 2018-01-10 | lib/ksymfony1.rb in the kcapifony gem 2.1.6 for Ruby places database user passwords on the (1) mysqldump, (2) pg_dump, (3) mysql, and (4) psql command lines, w… |
CVE-2014-5000 | High | 7.8 | 2018-01-10 | The login function in lib/lawn.rb in the lawn-login gem 0.0.7 for Ruby places credentials on the curl command line, which allows local users to obtain sensitiv… |
CVE-2014-4999 | High | 7.8 | 2018-01-10 | vendor/plugins/dataset/lib/dataset/database/mysql.rb in the kajam gem 1.0.3.rc2 for Ruby places the mysql user password on the (1) mysqldump command line in th… |
CVE-2014-4998 | High | 7.8 | 2018-01-10 | test/tc_database.rb in the lean-ruport gem 0.3.8 for Ruby places the mysql user password on the mysqldump command line, which allows local users to obtain sens… |
CVE-2014-4997 | High | 7.8 | 2018-01-10 | lib/commands/setup.rb in the point-cli gem 0.0.1 for Ruby places credentials on the curl command line, which allows local users to obtain sensitive information… |
CVE-2014-4995 | High | 7.0 | 2018-01-10 | Race condition in lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to obtain sensitive information by reading the MySQL roo… |
CVE-2014-4993 | High | 7.8 | 2018-01-10 | (1) lib/backup/cli/utility.rb in the backup-agoddard gem 3.0.28 and (2) lib/backup/cli/utility.rb in the backup_checksum gem 3.0.23 for Ruby place credentials… |
CVE-2014-4992 | High | 7.8 | 2018-01-10 | lib/cap-strap/helpers.rb in the cap-strap gem 0.1.5 for Ruby places credentials on the useradd command line, which allows local users to obtain sensitive infor… |
CVE-2014-4991 | High | 7.8 | 2018-01-10 | (1) lib/dataset/database/mysql.rb and (2) lib/dataset/database/postgresql.rb in the codders-dataset gem 1.3.2.1 for Ruby place credentials on the mysqldump com… |
CVE-2017-12169 | High | 7.5 | 2018-01-10 | It was found that FreeIPA 4.2.0 and later could disclose password hashes to users having the 'System: Read Stage Users' permission. A remote, authenticated att… |
CVE-2017-9796 | Medium | 5.3 | 2018-01-10 | When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL quer… |
CVE-2017-9795 | High | 7.5 | 2018-01-10 | When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL quer… |
CVE-2017-12622 | High | 7.1 | 2018-01-10 | When an Apache Geode cluster before v1.3.0 is operating in secure mode and an authenticated user connects to a Geode cluster using the gfsh tool with HTTP, the… |
CVE-2017-12697 | Medium | 5.9 | 2018-01-09 | A Man-in-the-Middle issue was discovered in General Motors (GM) and Shanghai OnStar (SOS) SOS iOS Client 7.1. Successful exploitation of this vulnerability may… |
CVE-2012-3353 | High | 7.5 | 2018-01-09 | The Apache Sling JCR ContentLoader 2.1.4 XmlReader used in the Sling JCR content loader module makes it possible to import arbitrary files in the content repos… |
CVE-2014-5394 | Medium | 5.9 | 2018-01-08 | Multiple Huawei Campus switches allow remote attackers to enumerate usernames via vectors involving use of SSH by the maintenance terminal. |
CVE-2018-5266 | High | 7.5 | 2018-01-08 | Cobham Sea Tel 121 build 222701 devices allow remote attackers to obtain potentially sensitive information about valid usernames by reading the loginName lines… |
CVE-2017-4948 | High | 7.1 | 2018-01-05 | VMware Workstation (14.x before 14.1.0 and 12.x) and Horizon View Client (4.x before 4.7.0) contain an out-of-bounds read vulnerability in TPView.dll. On Works… |
CVE-2017-1669 | Low | 3.7 | 2018-01-04 | IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized part… |
CVE-2018-0800 | Medium | 5.3 | 2018-01-04 | Microsoft Edge in Microsoft Windows 10 1709 allows an attacker to obtain information to further compromise the user's system, due to how the scripting engine h… |
CVE-2018-0766 | Medium | 4.3 | 2018-01-04 | Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to obtain information to further compromise the… |
CVE-2017-5754 | Medium | 5.6 | 2018-01-04 | Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker wit… |
CVE-2017-1000413 | Medium | 5.9 | 2018-01-02 | Linaro's open source TEE solution called OP-TEE, version 2.4.0 (and older) is vulnerable a timing attack in the Montgomery parts of libMPA in OP-TEE resulting… |
CVE-2017-1000412 | High | 7.5 | 2018-01-02 | Linaro's open source TEE solution called OP-TEE, version 2.4.0 (and older) is vulnerable to the bellcore attack in the LibTomCrypt code resulting in compromise… |
CVE-2018-3813 | Critical | 9.8 | 2018-01-01 | getConfigExportFile.cgi on FLIR Brickstream 2300 devices 2.0 4.1.53.166 has Incorrect Access Control, as demonstrated by reading the AVI_USER_ID and AVI_USER_P… |
CVE-2013-7400 | High | 7.5 | 2017-12-29 | The Direct Mail (direct_mail) extension before 3.1.2 for TYPO3 allows remote attackers to obtain sensitive information by leveraging improper checking of authe… |
CVE-2017-17926 | Medium | 5.3 | 2017-12-27 | PHP Scripts Mall Professional Service Script has a predicable registration URL, which makes it easier for remote attackers to register with an invalid or spoof… |
CVE-2017-17898 | High | 7.5 | 2017-12-27 | Dolibarr ERP/CRM version 6.0.4 does not block direct requests to *.tpl.php files, which allows remote attackers to obtain sensitive information. |
CVE-2017-17864 | Low | 3.3 | 2017-12-27 | kernel/bpf/verifier.c in the Linux kernel through 4.14.8 mishandles states_equal comparisons between the pointer data type and the UNKNOWN_VALUE data type, whi… |
CVE-2017-1698 | Medium | 5.3 | 2017-12-27 | IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 could reveal sensitive information from an error message that could lead to further attacks against the system. IBM… |
CVE-2017-13869 | Medium | 5.5 | 2017-12-25 | An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before… |
CVE-2017-13868 | Medium | 5.5 | 2017-12-25 | An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before… |
CVE-2017-13865 | Medium | 5.5 | 2017-12-25 | An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before… |
CVE-2017-13864 | Medium | 5.9 | 2017-12-25 | An issue was discovered in certain Apple products. iCloud before 7.2 on Windows is affected. iTunes before 12.7.2 on Windows is affected. The issue involves th… |
CVE-2017-15328 | High | 7.5 | 2017-12-22 | Huawei HG8245H version earlier than V300R018C00SPC110 has an authentication bypass vulnerability. An attacker can access a specific URL of the affect product… |
CVE-2017-15321 | Low | 3.7 | 2017-12-22 | Huawei FusionSphere OpenStack V100R006C000SPC102 (NFV) has an information leak vulnerability due to the use of a low version transmission protocol by default… |
CVE-2017-17692 | High | 7.5 | 2017-12-21 | Samsung Internet Browser 5.4.02.3 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code that re… |
CVE-2017-5262 | High | 8.0 | 2017-12-20 | In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the SNMP read-only (RO) community string has access to sensitive information by OID refere… |
CVE-2017-6094 | Critical | 9.8 | 2017-12-20 | CPEs used by subscribers on the access network receive their individual configuration settings from a central GAPS instance. A CPE identifies itself by the MAC… |
CVE-2017-1596 | Medium | 5.5 | 2017-12-20 | IBM Security Guardium 10.0 Database Activity Monitor could allow a local attacker to obtain highly sensitive information via unspecified vectors. IBM X-Force I… |
CVE-2017-1595 | Medium | 5.5 | 2017-12-20 | IBM Security Guardium 10.0 Database Activity Monitor could allow a local attacker to obtain highly sensitive information via unspecified vectors. IBM X-Force I… |
CVE-2017-1423 | Medium | 5.3 | 2017-12-20 | IBM WebSphere Portal 8.5 and 9.0 exposes backend server URLs that are configured for usage by the Web Application Bridge component. IBM X-Force ID: 127476. |
CVE-2017-1261 | Low | 3.3 | 2017-12-20 | IBM Security Guardium 10.0 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 124736. |
CVE-2017-1257 | Medium | 4.3 | 2017-12-20 | IBM Security Guardium 10.0 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-For… |
CVE-2017-17476 | High | 8.8 | 2017-12-20 | Open Ticket Request System (OTRS) 4.0.x before 4.0.28, 5.0.x before 5.0.26, and 6.0.x before 6.0.3, when cookie support is disabled, might allow remote attacke… |
CVE-2017-16589 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is requi… |
CVE-2017-16588 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is requi… |
CVE-2017-16584 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is requi… |
CVE-2017-16580 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is requi… |
CVE-2017-16579 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is requi… |
CVE-2017-16574 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is requi… |
CVE-2017-16573 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is requi… |
CVE-2017-14822 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is requi… |
CVE-2017-14821 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is requi… |
CVE-2017-14820 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is requi… |
CVE-2017-14819 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is requi… |
CVE-2017-14818 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to explo… |
CVE-2017-10956 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is requi… |
CVE-2017-17793 | High | 7.5 | 2017-12-20 | Information Disclosure vulnerability in creer_fichier_zip in admin/maintenance.php in BlogoText through 3.7.6 allows remote attackers to defeat a filename-rand… |
CVE-2017-17776 | Medium | 5.3 | 2017-12-20 | Paid To Read Script 2.0.5 has full path disclosure via an invalid admin/userview.php uid parameter. |
CVE-2017-16786 | Medium | 6.5 | 2017-12-19 | The Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote authenticated users with certain privileges to read arbit… |
CVE-2017-15700 | High | 8.8 | 2017-12-18 | A flaw in the org.apache.sling.auth.core.AuthUtil#isRedirectValid method in Apache Sling Authentication Service 1.4.0 allows an attacker, through the Sling log… |
CVE-2017-15104 | High | 7.8 | 2017-12-18 | An access flaw was found in Heketi 5, where the heketi.json configuration file was world readable. An attacker having local access to the Heketi server could r… |
CVE-2017-17735 | Critical | 9.8 | 2017-12-18 | CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in cookies. |
CVE-2017-17734 | Critical | 9.8 | 2017-12-18 | CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in sessions. |
CVE-2017-3194 | High | 8.1 | 2017-12-16 | Pandora iOS app prior to version 8.3.2 fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attacker to conduct man-i… |
CVE-2017-3185 | Critical | 9.8 | 2017-12-16 | ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC have a web application that uses the GET method to process requests… |
CVE-2017-14184 | High | 8.8 | 2017-12-15 | An Information Disclosure vulnerability in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for Mac OSX 5.6.0 and below versions and Fort… |
CVE-2017-12373 | Medium | 5.9 | 2017-12-15 | A vulnerability in the TLS protocol implementation of legacy Cisco ASA 5500 Series (ASA 5505, 5510, 5520, 5540, and 5550) devices could allow an unauthenticate… |
CVE-2017-17556 | Medium | 5.1 | 2017-12-15 | A debug tool in Synaptics TouchPad drivers allows local users with administrative access to obtain sensitive information about keyboard scan codes by modifying… |
CVE-2017-16787 | Medium | 6.5 | 2017-12-15 | The Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote attackers to read arbitrary files by leveraging failure t… |
CVE-2017-17696 | Medium | 4.3 | 2017-12-15 | Techno - Portfolio Management Panel through 2017-11-16 allows full path disclosure via an invalid s parameter to panel/search.php. |
CVE-2017-16355 | Medium | 4.7 | 2017-12-14 | In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is runnin… |
CVE-2017-7738 | High | 7.2 | 2017-12-13 | An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.5, 5.2 and below versions allow an admin user with super_admin privile… |
CVE-2017-15530 | Low | 3.3 | 2017-12-13 | Prior to 4.4.1.10, the Norton Family Android App can be susceptible to an Information Disclosure issue. Information disclosure is a very common issue that atta… |