CWE-200 · Information Disclosure (page 65)
Page 65 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-11036 | Critical | 9.1 | 2018-05-31 | Ruckus SmartZone (formerly Virtual SmartCell Gateway or vSCG) 3.5.0, 3.5.1, 3.6.0, and 3.6.1 (Essentials and High Scale) on vSZ, SZ-100, SZ-300, and SCG-200 de… |
CVE-2018-11565 | Medium | 5.3 | 2018-05-30 | Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 are vulnerable to mentioning the usernames that are already taken by people regis… |
CVE-2018-11437 | Medium | 6.5 | 2018-05-30 | The mobi_reconstruct_parts function in parse_rawml.c in Libmobi 0.3 allows remote attackers to cause information disclosure (read access violation) via a craft… |
CVE-2018-11435 | Medium | 6.5 | 2018-05-30 | The mobi_decompress_huffman_internal function in compression.c in Libmobi 0.3 allows remote attackers to cause information disclosure (read access violation) v… |
CVE-2017-16062 | High | 7.5 | 2018-05-29 | node-tkinter was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16061 | High | 7.5 | 2018-05-29 | tkinter was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16047 | High | 7.5 | 2018-05-29 | mysqljs was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2018-1369 | Low | 3.7 | 2018-05-29 | IBM Security Guardium Big Data Intelligence (SonarG) 3.1 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorize… |
CVE-2017-1768 | Medium | 4.3 | 2018-05-29 | IBM Security Guardium Big Data Intelligence (SonarG) 3.1 generates an error message that includes sensitive information about its environment, users, or associ… |
CVE-2018-10732 | Medium | 5.3 | 2018-05-28 | The REST API in Dataiku DSS before 4.2.3 allows remote attackers to obtain sensitive information (i.e., determine if a username is valid) because of profile pi… |
CVE-2018-11517 | Medium | 5.3 | 2018-05-28 | mySCADA myPRO 7 allows remote attackers to discover all ProjectIDs in a project by sending all of the prj parameter values from 870000 to 875000 in t=0&rq=0 re… |
CVE-2018-11508 | Medium | 5.5 | 2018-05-28 | The compat_get_timex function in kernel/compat.c in the Linux kernel before 4.16.9 allows local users to obtain sensitive information from kernel memory via ad… |
CVE-2018-11505 | High | 7.5 | 2018-05-26 | The Werewolf Online application 0.8.8 for Android allows attackers to discover the Firebase token by reading logcat output. |
CVE-2017-14185 | Medium | 5.3 | 2018-05-25 | An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.8 and 5.2 all versions allows SSL VPN web portal users to access inter… |
CVE-2018-6234 | Medium | 5.5 | 2018-05-25 | An Out-of-Bounds Read Information Disclosure vulnerability in Trend Micro Maximum Security (Consumer) 2018 could allow a local attacker to disclose sensitive i… |
CVE-2018-1467 | Medium | 5.3 | 2018-05-25 | The IBM Storwize V7000 Unified management Web interface 1.6 exposes internal cluster details to unauthenticated users. IBM X-Force ID: 140398. |
CVE-2018-11469 | Medium | 5.9 | 2018-05-25 | Incorrect caching of responses to requests including an Authorization header in HAProxy 1.8.0 through 1.8.9 (if cache enabled) allows attackers to achieve info… |
CVE-2017-1752 | Medium | 4.9 | 2018-05-25 | IBM UrbanCode Deploy 6.1 and 6.2 could allow an authenticated privileged user to obtain highly sensitive information. IBM X-Force ID: 135547. |
CVE-2018-1135 | Medium | 6.5 | 2018-05-25 | An issue was discovered in Moodle 3.x. Students who posted on forums and exported the posts to portfolios can download any stored Moodle file by changing the d… |
CVE-2013-3023 | High | 8.1 | 2018-05-24 | IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.2 and 7.2.0 through 7.2.1.4 might allow remote attackers to obtain sensitive information about… |
CVE-2013-3018 | Medium | 5.3 | 2018-05-24 | The AXIS webapp in deploy-tomcat/axis in IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.2 and 7.2.0 through 7.2.1.4 allows remote attackers to… |
CVE-2018-10652 | High | 7.5 | 2018-05-23 | There is a Sensitive Data Leakage issue in Citrix XenMobile Server 10.7 before RP3. |
CVE-2017-2609 | Medium | 4.3 | 2018-05-22 | jenkins before versions 2.44, 2.32.2 is vulnerable to an information disclosure vulnerability in search suggestions (SECURITY-385). The autocomplete feature on… |
CVE-2018-11327 | Medium | 4.3 | 2018-05-22 | An issue was discovered in Joomla! Core before 3.8.8. Inadequate checks allowed users to see the names of tags that were either unpublished or published with r… |
CVE-2018-7268 | Medium | 5.5 | 2018-05-21 | MagniComp SysInfo before 10-H81, as shipped with BMC BladeLogic Automation and other products, contains an information exposure vulnerability in which a local… |
CVE-2018-4925 | High | 7.5 | 2018-05-19 | Adobe Digital Editions versions 4.5.7 and below have an exploitable Out-of-bounds read vulnerability. Successful exploitation could lead to information disclos… |
CVE-2018-5256 | High | 7.5 | 2018-05-18 | CoreOS Tectonic 1.7.x before 1.7.9-tectonic.4 and 1.8.x before 1.8.4-tectonic.3 mounts a direct proxy to the kubernetes cluster at /api/kubernetes/ which is ac… |
CVE-2018-1465 | Medium | 5.3 | 2018-05-17 | IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7… |
CVE-2018-1464 | Medium | 6.5 | 2018-05-17 | IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7… |
CVE-2018-1438 | High | 7.5 | 2018-05-17 | IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7… |
CVE-2018-1433 | High | 7.5 | 2018-05-17 | IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7… |
CVE-2018-1276 | Medium | 6.5 | 2018-05-17 | Windows 2012R2 stemcells, versions prior to 1200.17, contain an information exposure vulnerability on vSphere. A remote user with the ability to push apps can… |
CVE-2018-8714 | Medium | 6.1 | 2018-05-17 | Honeywell MatrikonOPC OPC Controller before 5.1.0.0 allows local users to transfer arbitrary files from a host computer and consequently obtain sensitive infor… |
CVE-2018-10729 | Medium | 5.3 | 2018-05-17 | All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 allow reading the configuration file by an unauthenticated… |
CVE-2018-9948 | Medium | 6.5 | 2018-05-17 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is requi… |
CVE-2018-9946 | Medium | 6.5 | 2018-05-17 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is requi… |
CVE-2018-1175 | Medium | 6.5 | 2018-05-17 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is requi… |
CVE-2018-1174 | Medium | 6.5 | 2018-05-17 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is requi… |
CVE-2017-2603 | Low | 2.6 | 2018-05-15 | Jenkins before versions 2.44, 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API. This could leak sensitive data such as API token… |
CVE-2017-2600 | Medium | 4.3 | 2018-05-15 | In jenkins before versions 2.44, 2.32.2 node monitor data could be viewed by low privilege users via the remote API. These included system configuration and ru… |
CVE-2017-12128 | High | 7.5 | 2018-05-14 | An exploitable information disclosure vulnerability exists in the Server Agent functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted TCP packe… |
CVE-2018-11037 | Medium | 6.5 | 2018-05-14 | In Exiv2 0.26, the Exiv2::PngImage::printStructure function in pngimage.cpp allows remote attackers to cause an information leak via a crafted file. |
CVE-2018-1118 | Low | 2.3 | 2018-05-10 | Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/v… |
CVE-2018-6254 | Low | 3.3 | 2018-05-10 | In Android before the 2018-05-05 security patch level, NVIDIA Media Server contains an out-of-bounds read (due to improper input validation) vulnerability whic… |
CVE-2018-6246 | Medium | 5.3 | 2018-05-10 | In Android before the 2018-05-05 security patch level, NVIDIA Widevine Trustlet contains a vulnerability in Widevine TA where the software reads data past the… |
CVE-2018-10950 | Medium | 5.3 | 2018-05-10 | mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 before 8.6.0.Patch10 allows Information Exposure through Verbose Err… |
CVE-2018-8860 | Medium | 6.5 | 2018-05-09 | In Vecna VGo Robot versions prior to 3.0.3.52164, an attacker may be able to capture firmware updates through the adjacent network. |
CVE-2018-8163 | Medium | 5.5 | 2018-05-09 | An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel Information Disclosur… |
CVE-2018-8160 | Medium | 6.5 | 2018-05-09 | An information disclosure vulnerability exists in Outlook when a message is opened, aka "Microsoft Outlook Information Disclosure Vulnerability." This affects… |
CVE-2018-8145 | High | 7.5 | 2018-05-09 | An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could provide an attacker with information to… |
CVE-2018-8141 | Medium | 4.7 | 2018-05-09 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera… |
CVE-2018-8127 | Medium | 5.5 | 2018-05-09 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera… |
CVE-2018-8123 | Medium | 4.3 | 2018-05-09 | An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerabili… |
CVE-2018-10770 | Critical | 9.8 | 2018-05-09 | download.rsp on ShenZhen Anni "5 in 1 XVR" devices allows remote attackers to download the configuration (without a login) to discover the password. |
CVE-2017-2606 | Medium | 4.3 | 2018-05-08 | Jenkins before versions 2.44, 2.32.2 is vulnerable to an information exposure in the internal API that allows access to item names that should not be visible (… |
CVE-2018-6921 | Medium | 5.5 | 2018-05-08 | In FreeBSD before 11.1-STABLE(r332066) and 11.1-RELEASE-p10, due to insufficient initialization of memory copied to userland in the network subsystem, small am… |
CVE-2018-6920 | Medium | 5.5 | 2018-05-08 | In FreeBSD before 11.1-STABLE(r332303), 11.1-RELEASE-p10, 10.4-STABLE(r332321), and 10.4-RELEASE-p9, due to insufficient initialization of memory copied to use… |
CVE-2018-1000176 | Medium | 6.5 | 2018-05-08 | An exposure of sensitive information vulnerability exists in Jenkins Email Extension Plugin 2.61 and older in src/main/resources/hudson/plugins/emailext/Extend… |
CVE-2018-10734 | Critical | 9.8 | 2018-05-08 | KONGTOP DVR devices A303, A403, D303, D305, and D403 contain a backdoor that prints the login password via a Print_Password function call in certain circumstan… |
CVE-2018-10229 | Medium | 4.8 | 2018-05-04 | A hardware vulnerability in GPU memory modules allows attackers to accelerate micro-architectural attacks through the use of the JavaScript WebGL API. |
CVE-2017-1743 | Medium | 4.3 | 2018-05-04 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper handling of Administra… |
CVE-2018-0288 | Medium | 5.3 | 2018-05-02 | A vulnerability in Cisco WebEx Recording Format (WRF) Player could allow an unauthenticated, remote attacker to access sensitive data about the application. An… |
CVE-2018-0278 | Medium | 6.5 | 2018-05-02 | A vulnerability in the management console of Cisco Firepower System Software could allow an unauthenticated, remote attacker to access sensitive data about the… |
CVE-2018-0245 | Medium | 5.3 | 2018-05-02 | A vulnerability in the REST API of Cisco 5500 and 8500 Series Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to view sy… |
CVE-2018-1468 | Medium | 4.3 | 2018-05-02 | IBM API Connect 5.0.8.1 and 5.0.8.2 could allow a user to get access to internal environment and sensitive API details to which they are not authorized. IBM X-… |
CVE-2013-4209 | Low | 3.3 | 2018-05-01 | Automatic Bug Reporting Tool (ABRT) before 2.1.6 allows local users to obtain sensitive information about arbitrary files via vectors related to sha1sums. |
CVE-2018-10583 | High | 7.5 | 2018-05-01 | An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate an SMB connection e… |
CVE-2018-10581 | Medium | 5.4 | 2018-05-01 | In Octopus Deploy 3.4.x before 2018.4.7, an authenticated user is able to view/update/save variable values within the Tenant Variables area for Environments th… |
CVE-2018-10545 | Medium | 4.7 | 2018-04-29 | An issue was discovered in PHP before 5.6.35, 7.0.x before 7.0.29, 7.1.x before 7.1.16, and 7.2.x before 7.2.4. Dumpable FPM child processes allow bypassing op… |
CVE-2018-10523 | Medium | 5.3 | 2018-04-27 | CMS Made Simple (CMSMS) through 2.2.7 contains a physical path leakage Vulnerability via /modules/DesignManager/action.ajax_get_templates.php, /modules/DesignM… |
CVE-2018-10522 | Medium | 4.9 | 2018-04-27 | In CMS Made Simple (CMSMS) through 2.2.7, the "file view" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitab… |
CVE-2018-10516 | Medium | 6.5 | 2018-04-27 | In CMS Made Simple (CMSMS) through 2.2.7, the "file rename" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploit… |
CVE-2015-1857 | Medium | 5.3 | 2018-04-27 | The odl-mdsal-apidocs feature in OpenDaylight Helium allow remote attackers to obtain sensitive information by leveraging missing AAA restrictions. |
CVE-2018-10472 | Medium | 5.6 | 2018-04-27 | An issue was discovered in Xen through 4.10.x allowing x86 HVM guest OS users (in certain configurations) to read arbitrary dom0 files via QMP live insertion o… |
CVE-2017-1116 | Medium | 4.3 | 2018-04-27 | IBM Campaign 8.6, 9.0, 9.1, 9.1.1, 9.1.2, and 10.0 contains excessive details on the client side which could provide information useful for an authenticated us… |
CVE-2018-1074 | High | 7.7 | 2018-04-26 | ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentials, including cleart… |
CVE-2016-9590 | Medium | 6.5 | 2018-04-26 | puppet-swift before versions 8.2.1, 9.4.4 is vulnerable to an information-disclosure in Red Hat OpenStack Platform director's installation of Object Storage (s… |
CVE-2017-9284 | Medium | 4.8 | 2018-04-26 | IDM 4.6 Identity Applications prior to 4.6.2.1 may expose sensitive information. |
CVE-2018-10424 | Low | 2.7 | 2018-04-26 | mc-admin/post-edit.php in MiniCMS 1.10 allows full path disclosure via a modified id field. |
CVE-2018-10423 | Low | 2.7 | 2018-04-26 | mc-admin/post.php in MiniCMS 1.10 allows remote attackers to obtain a directory listing of the top-level directory of the web root via a link that becomes avai… |
CVE-2014-0882 | Medium | 6.5 | 2018-04-25 | Integrated Management Module II (IMM2) on IBM Flex System, NeXtScale, System x3xxx, and System x iDataPlex systems might allow remote authenticated users to ob… |
CVE-2014-0872 | Medium | 4.1 | 2018-04-25 | The installation process in IBM Security Key Lifecycle Manager 2.5 stores unencrypted credentials, which might allow local users to obtain sensitive informatio… |
CVE-2018-1059 | Medium | 6.1 | 2018-04-24 | The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addr… |
CVE-2017-1734 | Medium | 4.3 | 2018-04-24 | IBM Jazz Team Server affecting the following IBM Rational Products: Collaborative Lifecycle Management (CLM), Rational DOORS Next Generation (RDNG), Rational E… |
CVE-2017-1725 | Medium | 4.3 | 2018-04-24 | IBM Jazz Team Server affecting the following IBM Rational Products: Collaborative Lifecycle Management (CLM), Rational DOORS Next Generation (RDNG), Rational E… |
CVE-2018-8880 | High | 7.5 | 2018-04-23 | Lutron Quantum BACnet Integration 2.0 (firmware 3.2.243) doesn't check for correct user authentication before showing the /deviceIP information, which leads to… |
CVE-2014-0912 | Medium | 5.3 | 2018-04-20 | IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote attackers to obtain sensitive product information via vectors relate… |
CVE-2014-6112 | Medium | 5.9 | 2018-04-20 | IBM Tivoli Identity Manager 5.1.x before 5.1.0.15-ISS-TIM-IF0057 and Security Identity Manager 6.0.x before 6.0.0.4-ISS-SIM-IF0001 and 7.0.x before 7.0.0.0-ISS… |
CVE-2014-6109 | Medium | 5.3 | 2018-04-20 | IBM Tivoli Identity Manager 5.1.x before 5.1.0.15-ISS-TIM-IF0057 and Security Identity Manager 6.0.x before 6.0.0.4-ISS-SIM-IF0001 and 7.0.x before 7.0.0.0-ISS… |
CVE-2014-6108 | Medium | 5.9 | 2018-04-20 | IBM Tivoli Identity Manager 5.1.x before 5.1.0.15-ISS-TIM-IF0057 and Security Identity Manager 6.0.x before 6.0.0.4-ISS-SIM-IF0001 and 7.0.x before 7.0.0.0-ISS… |
CVE-2014-4782 | Medium | 6.5 | 2018-04-20 | IBM InfoSphere BigInsights 2.1.2 allows remote authenticated users to discover SMTP server credentials via vectors related to the Alert management service. IBM… |
CVE-2018-10245 | Medium | 5.3 | 2018-04-20 | A Full Path Disclosure vulnerability in AWStats through 7.6 allows remote attackers to know where the config file is allocated, obtaining the full path of the… |
CVE-2018-0269 | Medium | 4.3 | 2018-04-19 | A vulnerability in the web framework of the Cisco Digital Network Architecture Center (DNA Center) could allow an unauthenticated, remote attacker to communica… |
CVE-2018-0267 | Medium | 6.5 | 2018-04-19 | A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, local attacker to view sensitive data that should be… |
CVE-2018-0266 | Medium | 4.3 | 2018-04-19 | A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view sensitive data. The vulnerab… |
CVE-2017-3776 | High | 7.5 | 2018-04-19 | Lenovo Help Android mobile app versions earlier than 6.1.2.0327 allowed information to be transmitted over an HTTP channel, permitting others observing the cha… |
CVE-2018-10219 | Medium | 5.3 | 2018-04-19 | baijiacms V3 has physical path leakage via an index.php?mod=mobile&name=member&do=index request. |
CVE-2018-7244 | Medium | 5.3 | 2018-04-18 | An information disclosure vulnerability exists In Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UPS and MGE STS. The integ… |
CVE-2018-1240 | High | 8.0 | 2018-04-18 | Dell EMC ViPR Controller, versions after 3.0.0.38, contain an information exposure vulnerability in the VRRP. VRRP defaults to an insecure configuration in Lin… |
CVE-2016-8220 | High | 7.5 | 2018-04-18 | Pivotal Gemfire for PCF, versions 1.6.x prior to 1.6.5.0 and 1.7.x prior to 1.7.1.0, contain an information disclosure vulnerability. The application inadverte… |