CWE-200 · Information Disclosure (page 64)
Page 64 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-7812 | Medium | 5.3 | 2018-06-11 | If web content on a page is dragged onto portions of the browser UI, such as the tab bar, links can be opened that otherwise would not be allowed to open. This… |
CVE-2017-7808 | Medium | 5.3 | 2018-06-11 | A content security policy (CSP) "frame-ancestors" directive containing origins with paths allows for comparisons against those paths instead of the origin. Thi… |
CVE-2017-7787 | High | 7.5 | 2018-06-11 | Same-origin policy protections can be bypassed on pages with embedded iframes during page reloads, allowing the iframes to access content on the top level page… |
CVE-2017-7768 | Medium | 5.5 | 2018-06-11 | The Mozilla Maintenance Service can be invoked by an unprivileged user to read 32 bytes of any arbitrary file on the local system by convincing the service tha… |
CVE-2017-7759 | High | 7.5 | 2018-06-11 | Android intent URLs given to Firefox for Android can be used to navigate from HTTP or HTTPS URLs to local "file:" URLs, allowing for the reading of local data… |
CVE-2017-5454 | High | 7.5 | 2018-06-11 | A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in the file picker thr… |
CVE-2017-5425 | High | 7.5 | 2018-06-11 | The Gecko Media Plugin sandbox allows access to local files that match specific regular expressions. On OS OX, this matching allows access to some data in subd… |
CVE-2017-5414 | Medium | 5.5 | 2018-06-11 | The file picker dialog can choose and display the wrong local default directory when instantiated. On some operating systems, this can lead to information disc… |
CVE-2017-5408 | Medium | 5.3 | 2018-06-11 | Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting such cross-origin use, leading to potential informa… |
CVE-2017-5407 | Medium | 6.5 | 2018-06-11 | Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract pixel values from a targeted user. This c… |
CVE-2017-5385 | High | 7.5 | 2018-06-11 | Data sent with in multipart channels, such as the multipart/x-mixed-replace MIME type, will ignore the referrer-policy response header, leading to potential in… |
CVE-2017-5384 | Medium | 5.9 | 2018-06-11 | Proxy Auto-Config (PAC) files can specify a JavaScript function called for all URL requests with the full URL path which exposes more information than would be… |
CVE-2017-5382 | High | 7.5 | 2018-06-11 | Feed preview for RSS feeds can be used to capture errors and exceptions generated by privileged content, allowing for the exposure of internal information not… |
CVE-2017-5378 | High | 7.5 | 2018-06-11 | Hashed codes of JavaScript objects are shared between pages. This allows for pointer leaks because an object's address can be discovered through hash codes, an… |
CVE-2016-9904 | High | 7.5 | 2018-06-11 | An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by another compartment/zone in specific contexts. This could be u… |
CVE-2016-9074 | Medium | 5.9 | 2018-06-11 | An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in Network Security Services (NSS) 3.26.1… |
CVE-2016-9062 | Low | 3.3 | 2018-06-11 | Private browsing mode leaves metadata information, such as URLs, for sites visited in "browser.db" and "browser.db-wal" files within the Firefox profile after… |
CVE-2016-5288 | Medium | 5.9 | 2018-06-11 | Web content could access information in the HTTP cache if e10s is disabled. This can reveal some visited URLs and the contents of those pages. This issue affec… |
CVE-2018-12089 | High | 7.5 | 2018-06-11 | In Octopus Deploy version 2018.5.1 to 2018.5.7, a user with Task View is able to view a password for a Service Fabric Cluster, when the Service Fabric Cluster… |
CVE-2018-1281 | Medium | 6.5 | 2018-06-08 | The clustered setup of Apache MXNet allows users to specify which IP address and port the scheduler will listen on via the DMLC_PS_ROOT_URI and DMLC_PS_ROOT_PO… |
CVE-2018-4252 | Medium | 4.6 | 2018-06-08 | An issue was discovered in certain Apple products. iOS before 11.4 is affected. The issue involves the "Siri" component. It allows physically proximate attacke… |
CVE-2018-4244 | Medium | 4.6 | 2018-06-08 | An issue was discovered in certain Apple products. iOS before 11.4 is affected. The issue involves the "Siri Contacts" component. It allows physically proximat… |
CVE-2018-4239 | Medium | 4.6 | 2018-06-08 | An issue was discovered in certain Apple products. iOS before 11.4 is affected. The issue involves the "Magnifier" component. It allows physically proximate at… |
CVE-2018-4226 | Medium | 5.5 | 2018-06-08 | An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. iCloud before 7.5 on Windows is affected. iTu… |
CVE-2018-4224 | Medium | 5.5 | 2018-06-08 | An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. iCloud before 7.5 on Windows is affected. iTu… |
CVE-2018-4223 | Medium | 5.5 | 2018-06-08 | An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS before 11.4 is affected. watchOS before… |
CVE-2018-4221 | High | 7.5 | 2018-06-08 | An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. The issue involves the "Security" component… |
CVE-2018-4196 | High | 7.8 | 2018-06-08 | An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the "Accessibility Framework" component. It allows atta… |
CVE-2018-4171 | Medium | 5.5 | 2018-06-08 | An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the "Bluetooth" component. It allows attackers to obtai… |
CVE-2018-4159 | Medium | 5.5 | 2018-06-08 | An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the "Graphics Drivers" component. It allows attackers t… |
CVE-2018-4141 | Medium | 5.5 | 2018-06-08 | An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the "Intel Graphics Driver" component. It allows attack… |
CVE-2012-0433 | Low | 3.3 | 2018-06-08 | The install-chef-suse.sh script shipped with crowbar before 2012-10-02 is creating files containing confidential data with insecure permissions, allowing local… |
CVE-2018-11409 | Medium | 5.3 | 2018-06-08 | Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, as demonstrated by discover… |
CVE-2018-0335 | High | 7.8 | 2018-06-07 | A vulnerability in the web portal authentication process of Cisco Prime Collaboration Provisioning could allow an unauthenticated, local attacker to view sensi… |
CVE-2017-16225 | High | 7.5 | 2018-06-07 | aegir is a module to help automate JavaScript project management. Version 12.0.0 through and including 12.0.7 bundled and published to npm the user (that perfo… |
CVE-2017-16206 | High | 7.5 | 2018-06-07 | The cofee-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. |
CVE-2017-16205 | High | 7.5 | 2018-06-07 | The coffescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. |
CVE-2017-16204 | High | 7.5 | 2018-06-07 | The jquey module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. |
CVE-2017-16203 | High | 7.5 | 2018-06-07 | The coffe-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. |
CVE-2017-16202 | High | 7.5 | 2018-06-07 | The cofeescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. |
CVE-2017-16126 | Medium | 5.3 | 2018-06-07 | The module botbait is a tool to be used to track bot and automated tools usage with-in the npm ecosystem. botbait is known to record and track user information… |
CVE-2017-16081 | High | 7.5 | 2018-06-07 | cross-env.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16080 | High | 7.5 | 2018-06-07 | nodesass was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16079 | High | 7.5 | 2018-06-07 | smb was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16078 | High | 7.5 | 2018-06-07 | shadowsock was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16077 | High | 7.5 | 2018-06-07 | mongose was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16076 | High | 7.5 | 2018-06-07 | proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16075 | High | 7.5 | 2018-06-07 | http-proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16074 | High | 7.5 | 2018-06-07 | crossenv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16073 | High | 7.5 | 2018-06-07 | noderequest was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16072 | High | 7.5 | 2018-06-07 | nodemailer.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16071 | High | 7.5 | 2018-06-07 | nodemailer-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16070 | High | 7.5 | 2018-06-07 | nodecaffe was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16069 | High | 7.5 | 2018-06-07 | nodeffmpeg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16068 | High | 7.5 | 2018-06-07 | ffmepg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16067 | High | 7.5 | 2018-06-07 | node-opencv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16066 | High | 7.5 | 2018-06-07 | opencv.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16065 | High | 7.5 | 2018-06-07 | openssl.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16064 | High | 7.5 | 2018-06-07 | node-openssl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16063 | High | 7.5 | 2018-06-07 | node-opensl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16060 | High | 7.5 | 2018-06-07 | babelcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16059 | High | 7.5 | 2018-06-07 | mssql-node was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16058 | High | 7.5 | 2018-06-07 | gruntcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16057 | High | 7.5 | 2018-06-07 | nodemssql was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16056 | High | 7.5 | 2018-06-07 | mssql.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2018-10198 | Medium | 4.3 | 2018-06-06 | An issue was discovered in OTRS 6.0.x before 6.0.7. An attacker who is logged into OTRS as a customer can use the ticket overview screen to disclose internal a… |
CVE-2017-1476 | Medium | 5.9 | 2018-06-06 | IBM Security Access Manager Appliance 7.0.0, 8.0.0 through 8.0.1.6, and 9.0.0 through 9.0.3.1 could allow a remote attacker to obtain sensitive information, ca… |
CVE-2017-1474 | Medium | 5.3 | 2018-06-06 | IBM Security Access Manager Appliance 7.0.0, 8.0.0 through 8.0.1.6, and 9.0.0 through 9.0.3.1 discloses sensitive information to unauthorized users. The inform… |
CVE-2018-1000196 | Medium | 6.5 | 2018-06-05 | A exposure of sensitive information vulnerability exists in Jenkins Gitlab Hook Plugin 1.4.2 and older in gitlab_notifier.rb, views/gitlab_notifier/global.erb… |
CVE-2018-10599 | Medium | 5.3 | 2018-06-05 | IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Monitors MX (MX400-550) Rev J-M and (X3/MX10… |
CVE-2018-1000191 | Medium | 6.5 | 2018-06-05 | A exposure of sensitive information vulnerability exists in Jenkins Black Duck Detect Plugin 1.4.0 and older in DetectPostBuildStepDescriptor.java that allows… |
CVE-2018-1000190 | Medium | 6.5 | 2018-06-05 | A exposure of sensitive information vulnerability exists in Jenkins Black Duck Hub Plugin 4.0.0 and older in PostBuildScanDescriptor.java that allows attackers… |
CVE-2018-1000187 | Medium | 6.5 | 2018-06-05 | A exposure of sensitive information vulnerability exists in Jenkins Kubernetes Plugin 1.7.0 and older in ContainerExecDecorator.java that results in sensitive… |
CVE-2018-1000186 | Medium | 6.5 | 2018-06-05 | A exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin 1.41.0 and older in GhprbGitHubAuth.java that allows att… |
CVE-2018-1000183 | Medium | 6.5 | 2018-06-05 | A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.0 and older in GitHubServerConfig.java that allows attackers with Overal… |
CVE-2018-1332 | Medium | 6.5 | 2018-06-05 | Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose a vulnerability that could allow a user to impersonate another… |
CVE-2018-1000181 | High | 7.5 | 2018-06-05 | Kitura 2.3.0 and earlier have an unintended read access to unauthorised files and folders that can be exploited by a crafted URL resulting in information discl… |
CVE-2018-11554 | Critical | 9.8 | 2018-06-05 | The forgotten-password feature in index.php/member/reset/reset_email.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information Exposure issue and… |
CVE-2017-12092 | Low | 3.7 | 2018-06-04 | An exploitable file write vulnerability exists in the memory module functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before. A specially cr… |
CVE-2017-16055 | High | 7.5 | 2018-06-04 | `sqlserver` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16054 | High | 7.5 | 2018-06-04 | `nodefabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16053 | High | 7.5 | 2018-06-04 | `fabric-js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16052 | High | 7.5 | 2018-06-04 | `node-fabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16051 | High | 7.5 | 2018-06-04 | `sqliter` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16050 | High | 7.5 | 2018-06-04 | `sqlite.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16049 | High | 7.5 | 2018-06-04 | `nodesqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16048 | High | 7.5 | 2018-06-04 | `node-sqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16045 | High | 7.5 | 2018-06-04 | `jquery.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16044 | High | 7.5 | 2018-06-04 | `d3.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16024 | Medium | 6.5 | 2018-06-04 | The sync-exec module is used to simulate child_process.execSync in node versions <0.11.9. Sync-exec uses tmp directories as a buffer before returning values. O… |
CVE-2017-16007 | Medium | 5.9 | 2018-06-04 | node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for current web browsers and node.js-based servers. node-jose earlier… |
CVE-2018-3809 | Medium | 5.3 | 2018-06-01 | Information exposure through directory listings in serve 6.5.3 allows directory listing and file access even when they have been set to be ignored. |
CVE-2018-11195 | Medium | 6.8 | 2018-06-01 | Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 are vulnerable to the browser "back and refresh" attack. This allows malicious us… |
CVE-2018-5525 | Medium | 4.3 | 2018-06-01 | A local file vulnerability exists in the F5 BIG-IP Configuration utility on versions 13.0.0, 12.1.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 that expo… |
CVE-2018-11645 | Medium | 5.3 | 2018-06-01 | psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits the status command even if -dSAFER is used, which might allow remote attackers to determine the exist… |
CVE-2018-1532 | Medium | 4.3 | 2018-05-31 | IBM API Connect 5.0.0.0 through 5.0.8.2 does not properly update the SESSIONID with each request, which could allow a user to obtain the ID in further attacks… |
CVE-2016-10533 | High | 8.8 | 2018-05-31 | express-restify-mongoose is a module to easily create a flexible REST interface for mongoose models. express-restify-mongoose 2.4.2 and earlier and 3.0.X throu… |
CVE-2016-10530 | Medium | 5.9 | 2018-05-31 | The airbrake module 0.3.8 and earlier defaults to sending environment variables over HTTP. Environment variables can often times contain secret keys and other… |
CVE-2016-10519 | High | 7.5 | 2018-05-31 | A security issue was found in bittorrent-dht before 5.1.3 that allows someone to send a specific series of messages to a listening peer and get it to reveal in… |
CVE-2015-9236 | Medium | 5.3 | 2018-05-31 | Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at worst allowed cross-… |