CWE-200 · Information Disclosure (page 66)
Page 66 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-10351 | Medium | 6.2 | 2017-10-19 | Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products (subcomponent: Application Server). Supported versions that a… |
CVE-2017-10343 | Medium | 6.5 | 2017-10-19 | Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (subcomponent: Import/Export). Supported versions that are affect… |
CVE-2017-10339 | Medium | 5.9 | 2017-10-19 | Vulnerability in the Oracle Hospitality Suite8 component of Oracle Hospitality Applications (subcomponent: WebConnect). Supported versions that are affected ar… |
CVE-2017-10337 | Medium | 5.4 | 2017-10-19 | Vulnerability in the Oracle Hospitality Suite8 component of Oracle Hospitality Applications (subcomponent: Leisure). Supported versions that are affected are 8… |
CVE-2017-10335 | High | 7.5 | 2017-10-19 | Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products (subcomponent: Elastic Search). Supported versions that are a… |
CVE-2017-10334 | Medium | 4.3 | 2017-10-19 | Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Container). Supported versions that are affected are 10.3… |
CVE-2017-10332 | High | 7.5 | 2017-10-19 | Vulnerability in the Oracle Universal Work Queue component of Oracle E-Business Suite (subcomponent: Administration). Supported versions that are affected are… |
CVE-2017-10331 | Medium | 5.3 | 2017-10-19 | Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Diagnostics). Supported versions that are affected a… |
CVE-2017-10328 | High | 7.5 | 2017-10-19 | Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Diagnostics). Supported versions that are affected a… |
CVE-2017-10324 | Medium | 5.3 | 2017-10-19 | Vulnerability in the Oracle Applications Technology Stack component of Oracle E-Business Suite (subcomponent: Oracle Forms). Supported versions that are affect… |
CVE-2017-10319 | Medium | 5.3 | 2017-10-19 | Vulnerability in the Oracle Hospitality Suite8 component of Oracle Hospitality Applications (subcomponent: Leisure). Supported versions that are affected are 8… |
CVE-2017-10318 | Medium | 4.7 | 2017-10-19 | Vulnerability in the Oracle Hospitality Suite8 component of Oracle Hospitality Applications (subcomponent: WebConnect). Supported versions that are affected ar… |
CVE-2017-10317 | Medium | 4.0 | 2017-10-19 | Vulnerability in the Oracle Hospitality Suite8 component of Oracle Hospitality Applications (subcomponent: WebConnect). Supported versions that are affected ar… |
CVE-2017-10316 | Medium | 6.5 | 2017-10-19 | Vulnerability in the Oracle Hospitality Suite8 component of Oracle Hospitality Applications (subcomponent: WebConnect). Supported versions that are affected ar… |
CVE-2017-10310 | High | 7.5 | 2017-10-19 | Vulnerability in the Oracle Hyperion Financial Reporting component of Oracle Hyperion (subcomponent: Security Models). The supported version that is affected i… |
CVE-2017-10300 | Medium | 5.3 | 2017-10-19 | Vulnerability in the Siebel CRM Desktop component of Oracle Siebel CRM (subcomponent: Siebel Business Service Issues). Supported versions that are affected are… |
CVE-2017-10299 | Medium | 4.3 | 2017-10-19 | Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Security). Supported versions that are affected are 9.3.5… |
CVE-2017-10287 | Medium | 4.3 | 2017-10-19 | Vulnerability in the PeopleSoft Enterprise FSCM component of Oracle PeopleSoft Products (subcomponent: Strategic Sourcing). The supported version that is affec… |
CVE-2017-10280 | Medium | 6.5 | 2017-10-19 | Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Test Framework). Supported versions that are affe… |
CVE-2017-10261 | Medium | 6.5 | 2017-10-19 | Vulnerability in the XML Database component of Oracle Database Server. Supported versions that are affected are 11.2.0.4 and 12.1.0.2. Easily exploitable vulne… |
CVE-2017-10259 | High | 7.5 | 2017-10-19 | Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). The supported version that is affected is 1… |
CVE-2017-10197 | Medium | 4.6 | 2017-10-19 | Vulnerability in the Oracle Hospitality OPERA 5 Property Services component of Oracle Hospitality Applications (subcomponent: Folios). The supported version th… |
CVE-2017-10194 | Low | 2.7 | 2017-10-19 | Vulnerability in the Oracle Integrated Lights Out Manager (ILOM) component of Oracle Sun Systems Products Suite (subcomponent: System Management). The supporte… |
CVE-2017-10164 | Medium | 4.3 | 2017-10-19 | Vulnerability in the PeopleSoft Enterprise FSCM component of Oracle PeopleSoft Products (subcomponent: Staffing Front Office). The supported version that is af… |
CVE-2017-10154 | Medium | 5.3 | 2017-10-19 | Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). The supported version that is affected is 1… |
CVE-2017-10152 | Medium | 6.5 | 2017-10-19 | Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Container). Supported versions that are affected are 10.3… |
CVE-2017-10037 | High | 7.5 | 2017-10-19 | Vulnerability in the Oracle BI Publisher component of Oracle Fusion Middleware (subcomponent: Web Service API). Supported versions that are affected are 11.1.1… |
CVE-2017-15610 | Medium | 6.5 | 2017-10-19 | An issue was discovered in Octopus before 3.17.7. When the special Guest user account is granted the CertificateExportPrivateKey permission, and Guest Access i… |
CVE-2017-12289 | Medium | 4.4 | 2017-10-19 | A vulnerability in conditional, verbose debug logging for the IPsec feature of Cisco IOS XE Software could allow an authenticated, local attacker to display se… |
CVE-2017-12284 | Medium | 5.5 | 2017-10-19 | A vulnerability in the web interface of Cisco Jabber for Windows Client could allow an authenticated, local attacker to retrieve user profile information, whic… |
CVE-2015-3400 | Medium | 4.3 | 2017-10-18 | sharenfs 0.6.4, when built with commits bcdd594 and 7d08880 from the zfs repository, provides world readable access to the shared zfs file system, which might… |
CVE-2014-8491 | Medium | 5.3 | 2017-10-18 | The Grand Flagallery plugin before 4.25 for WordPress allows remote attackers to obtain the installation path via a request to (1) flagallery-skins/banner_widg… |
CVE-2017-15589 | Medium | 6.5 | 2017-10-18 | An issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to obtain sensitive information from the host OS (or an arbitrary guest OS) becaus… |
CVE-2017-15583 | Medium | 6.5 | 2017-10-18 | The embedded web server on ABB Fox515T 1.0 devices is vulnerable to Local File Inclusion. It accepts a parameter that specifies a file for display or for use a… |
CVE-2017-15577 | High | 7.5 | 2017-10-18 | Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles the rendering of wiki links, which allows remote attackers to obtain sensitive information. |
CVE-2017-15576 | High | 7.5 | 2017-10-18 | Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles Time Entry rendering in activity views, which allows remote attackers to obtain sensitive information. |
CVE-2017-14009 | Medium | 6.5 | 2017-10-17 | An Information Exposure issue was discovered in ProMinent MultiFLEX M10a Controller web interface. When an authenticated user uses the Change Password feature… |
CVE-2017-15537 | Medium | 5.5 | 2017-10-17 | The x86/fpu (Floating Point Unit) subsystem in the Linux kernel before 4.13.5, when a processor supports the xsave feature but not the xsaves feature, does not… |
CVE-2017-9368 | High | 7.5 | 2017-10-16 | An information disclosure vulnerability in the BlackBerry Workspaces Server could result in an attacker gaining access to source code for server-side applicati… |
CVE-2014-9147 | High | 7.5 | 2017-10-16 | Fiyo CMS 2.0.1.8 allows remote attackers to obtain sensitive information via a direct request to the database backup file in .backup/. |
CVE-2016-1265 | Critical | 9.8 | 2017-10-13 | A remote unauthenticated network based attacker with access to Junos Space may execute arbitrary code on Junos Space or gain access to devices managed by Junos… |
CVE-2017-8693 | Medium | 5.5 | 2017-10-13 | The Microsoft Graphics Component on Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an information disclosure vulnerability in… |
CVE-2017-11817 | Medium | 4.7 | 2017-10-13 | The Microsoft Windows Kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT… |
CVE-2017-11816 | Medium | 5.5 | 2017-10-13 | The Microsoft Windows Graphics Device Interface (GDI) on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and… |
CVE-2017-11815 | Medium | 5.3 | 2017-10-13 | The Microsoft Server Block Message (SMB) on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows… |
CVE-2017-11814 | Medium | 5.5 | 2017-10-13 | The Microsoft Windows Kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT… |
CVE-2017-11801 | High | 7.5 | 2017-10-13 | ChakraCore allows an attacker to execute arbitrary code in the context of the current user, due to how the ChakraCore scripting engine handles objects in memor… |
CVE-2017-11797 | High | 7.5 | 2017-10-13 | ChakraCore allows an attacker to execute arbitrary code in the context of the current user, due to how the ChakraCore scripting engine handles objects in memor… |
CVE-2017-11794 | Medium | 4.3 | 2017-10-13 | Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to obtain information to further compromise the user's system, due to how Microsoft Edge handles… |
CVE-2017-11790 | Medium | 4.3 | 2017-10-13 | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold… |
CVE-2017-11785 | Medium | 5.5 | 2017-10-13 | The Microsoft Windows Kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT… |
CVE-2017-11784 | Medium | 5.5 | 2017-10-13 | The Microsoft Windows Kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT… |
CVE-2017-11776 | High | 7.5 | 2017-10-13 | Microsoft Outlook 2016 allows an attacker to obtain the email content of a user, due to how Outlook 2016 discloses user email content, aka "Microsoft Outlook I… |
CVE-2017-11772 | High | 7.5 | 2017-10-13 | The Microsoft Windows Search component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT… |
CVE-2017-11765 | Medium | 5.5 | 2017-10-13 | The Microsoft Windows Kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT… |
CVE-2017-12849 | Medium | 5.3 | 2017-10-12 | Response discrepancy in the login and password reset forms in SilverStripe CMS before 3.5.5 and 3.6.x before 3.6.1 allows remote attackers to enumerate users v… |
CVE-2017-15277 | Medium | 6.5 | 2017-10-12 | ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when processing a GIF file that has neither a gl… |
CVE-2017-15236 | High | 7.5 | 2017-10-11 | Tiandy IP cameras 5.56.17.120 do not properly restrict a certain proprietary protocol, which allows remote attackers to read settings via a crafted request to… |
CVE-2017-15212 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can at least see the names of tags of a private project of another user. |
CVE-2017-15210 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can see thumbnails of pictures from a private project of another user. |
CVE-2017-15205 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can download attachments from a private project of another user. |
CVE-2017-15198 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can edit a category of a private project of another user. |
CVE-2017-1538 | Medium | 6.5 | 2017-10-10 | IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.2 could allow an authenticated user to obtain sensitive information from an undocumen… |
CVE-2017-11051 | High | 7.5 | 2017-10-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, information disclosure is possible in function… |
CVE-2015-6918 | Medium | 6.3 | 2017-10-10 | salt before 2015.5.5 leaks git usernames and passwords to the log. |
CVE-2017-14943 | High | 7.5 | 2017-10-10 | Trapeze TransitMaster is vulnerable to information disclosure (emails / hashed passwords) via a modified userID field in JSON data to ManageSubscriber.aspx/Get… |
CVE-2017-14603 | High | 7.5 | 2017-10-10 | In Asterisk 11.x before 11.25.3, 13.x before 13.17.2, and 14.x before 14.6.2 and Certified Asterisk 11.x before 11.6-cert18 and 13.x before 13.13-cert6, insuff… |
CVE-2017-14971 | Medium | 5.5 | 2017-10-09 | Infocus Mondopad 2.2.08 is vulnerable to a Hashed Credential Disclosure vulnerability. The attacker provides a crafted Microsoft Office document containing a l… |
CVE-2015-1828 | Medium | 5.9 | 2017-10-06 | The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-th… |
CVE-2017-14085 | Medium | 5.3 | 2017-10-06 | Information disclosure vulnerabilities in Trend Micro OfficeScan 11.0 and XG may allow unauthenticated users who can access the OfficeScan server to query the… |
CVE-2017-9628 | Medium | 5.3 | 2017-10-05 | An Information Exposure issue was discovered in Saia Burgess Controls PCD Controllers with PCD firmware versions prior to 1.28.16 or 1.24.69. In certain circum… |
CVE-2017-1000114 | Low | 3.1 | 2017-10-05 | The Datadog Plugin stores an API key to access the Datadog service in the global Jenkins configuration. While the API key is stored encrypted on disk, it was t… |
CVE-2017-1000113 | Medium | 5.5 | 2017-10-05 | The Deploy to container Plugin stored passwords unencrypted as part of its configuration. This allowed users with Jenkins master local file system access, or u… |
CVE-2017-1000108 | High | 7.5 | 2017-10-05 | The Pipeline: Input Step Plugin by default allowed users with Item/Read access to a pipeline to interact with the step to provide input. This has been changed… |
CVE-2017-1000100 | Medium | 6.5 | 2017-10-05 | When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit… |
CVE-2017-1000099 | Medium | 6.5 | 2017-10-05 | When asking to get a file from a file:// URL, libcurl provides a feature that outputs meta-data about the file using HTTP-like headers. The code doing this wou… |
CVE-2017-1000094 | Medium | 6.5 | 2017-10-05 | Docker Commons Plugin provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use to authenticate with a… |
CVE-2017-1000087 | Medium | 4.3 | 2017-10-05 | GitHub Branch Source provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use. This functionality did… |
CVE-2017-14991 | Medium | 5.5 | 2017-10-04 | The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel before 4.13.4 allows local users to obtain sensitive information from uninitialized kernel heap-… |
CVE-2017-1126 | Medium | 5.3 | 2017-10-04 | IBM WebSphere Message Broker (IBM Integration Bus 9.0 and 10.0) could allow an unauthorized user to obtain sensitive information about software versions that c… |
CVE-2017-11122 | High | 7.5 | 2017-10-04 | On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56, an attacker can trigger an information leak due to insufficient length validation, related to ICMPv6 route… |
CVE-2017-0825 | High | 7.5 | 2017-10-04 | An information disclosure vulnerability in the Broadcom wifi driver. Product: Android. Versions: Android kernel. Android ID: A-37305633. References: B-V2017063… |
CVE-2017-0823 | High | 7.5 | 2017-10-04 | An information disclosure vulnerability in the Android system (rild). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android I… |
CVE-2017-0817 | High | 7.5 | 2017-10-04 | An information disclosure vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1… |
CVE-2017-0816 | Medium | 5.5 | 2017-10-04 | An information disclosure vulnerability in the Android media framework (libeffects). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7… |
CVE-2017-0815 | Medium | 5.5 | 2017-10-04 | An information disclosure vulnerability in the Android media framework (libeffects). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7… |
CVE-2017-0814 | High | 7.5 | 2017-10-04 | An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62800140. |
CVE-2017-0808 | High | 7.5 | 2017-10-04 | An information disclosure vulnerability in the Android framework (file system). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62301183. |
CVE-2017-9797 | Medium | 6.5 | 2017-10-03 | When an Apache Geode cluster before v1.2.1 is operating in secure mode, an unauthenticated client can enter multi-user authentication mode and send metadata me… |
CVE-2017-14772 | Low | 3.3 | 2017-10-03 | Skybox Manager Client Application is prone to information disclosure via a username enumeration attack. A local unauthenticated attacker could exploit the flaw… |
CVE-2017-14770 | Medium | 5.5 | 2017-10-03 | Skybox Manager Client Application prior to 8.5.501 is prone to an information disclosure vulnerability of user password hashes. A local authenticated attacker… |
CVE-2017-14494 | Medium | 5.9 | 2017-10-03 | dnsmasq before 2.78, when configured as a relay, allows remote attackers to obtain sensitive memory information via vectors involving handling DHCPv6 forwarded… |
CVE-2014-0043 | Medium | 5.3 | 2017-10-03 | In Apache Wicket 1.5.10 or 6.13.0, by issuing requests to special urls handled by Wicket, it is possible to check for the existence of particular classes in th… |
CVE-2017-14955 | Medium | 5.9 | 2017-10-02 | Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain se… |
CVE-2017-14954 | Medium | 5.5 | 2017-10-02 | The waitid implementation in kernel/exit.c in the Linux kernel through 4.13.4 accesses rusage data structures in unintended cases, which allows local users to… |
CVE-2017-14941 | Medium | 6.5 | 2017-10-02 | Jaspersoft JasperReports 4.7 suffers from a saved credential disclosure vulnerability, which allows a remote authenticated user to retrieve stored Data Source… |
CVE-2017-9794 | Medium | 4.3 | 2017-09-30 | When a cluster is operating in secure mode, a user with read privileges for specific data regions can use the gfsh command line utility to execute queries. In… |
CVE-2017-13991 | Medium | 5.3 | 2017-09-30 | An information leakage vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows disclosure of… |
CVE-2017-13990 | Medium | 5.3 | 2017-09-30 | An information leakage vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows disclosure of… |
CVE-2015-1027 | Medium | 5.9 | 2017-09-29 | The version checking subroutine in percona-toolkit before 2.2.13 and xtrabackup before 2.2.9 was vulnerable to silent HTTP downgrade attacks and Man In The Mid… |