CWE-200 · Information Disclosure (page 67)
Page 67 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2014-2029 | High | 8.1 | 2017-09-29 | The automatic version check functionality in the tools in Percona Toolkit 2.1 allows man-in-the-middle attackers to obtain sensitive information or execute arb… |
CVE-2017-14775 | Medium | 5.9 | 2017-09-28 | Laravel before 5.5.10 mishandles the remember_me token verification process because DatabaseUserProvider does not have constant-time token comparison. |
CVE-2015-5070 | Low | 3.1 | 2017-09-26 | The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.4 and… |
CVE-2015-5069 | Medium | 4.3 | 2017-09-26 | The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.3 and… |
CVE-2017-9960 | Medium | 5.3 | 2017-09-26 | An information disclosure vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the system response to error… |
CVE-2015-8707 | Critical | 9.8 | 2017-09-26 | Password reset tokens in Magento CE before 1.9.2.2, and Magento EE before 1.14.2.2 are passed via a GET request and not canceled after use, which allows remote… |
CVE-2015-0238 | Low | 3.3 | 2017-09-26 | selinux-policy as packaged in Red Hat OpenShift 2 allows attackers to obtain process listing information via a privilege escalation attack. |
CVE-2014-8889 | Medium | 5.3 | 2017-09-26 | Dropbox SDK for Android before 1.6.2 might allow remote attackers to obtain sensitive information via crafted malware or via a drive-by download attack. |
CVE-2015-8251 | Medium | 5.9 | 2017-09-25 | OpenStage 60 and OpenScape Desk Phone IP 55G SIP V3, OpenStage 15, 20E, 20 and 40 and OpenScape Desk Phone IP 35G SIP V3, OpenScape Desk Phone IP 35G Eco SIP V… |
CVE-2015-7846 | Medium | 4.6 | 2017-09-25 | Huawei S7700, S9700, S9300 before V200R07C00SPC500, and AR200, AR1200, AR2200, AR3200 before V200R005C20SPC200 allows attackers with physical access to the CF… |
CVE-2017-1346 | Low | 2.5 | 2017-09-25 | IBM Business Process Manager 7.5, 8.0, and 8.5 temporarily stores files in a temporary folder during offline installs which could be read by a local user withi… |
CVE-2017-9393 | Critical | 9.8 | 2017-09-22 | CA Identity Manager r12.6 to r12.6 SP8, 14.0, and 14.1 allows remote attackers to potentially identify passwords of locked accounts through an exhaustive searc… |
CVE-2017-14653 | Medium | 6.5 | 2017-09-22 | member/Orderinfo.asp in ASP4CMS AspCMS 2.7.2 allows remote authenticated users to read arbitrary order information via a modified OrderNo parameter. |
CVE-2017-14680 | High | 7.5 | 2017-09-21 | ZKTeco ZKTime Web 2.0.1.12280 allows remote attackers to obtain sensitive employee metadata via a direct request for a PDF document. |
CVE-2017-9676 | Medium | 4.7 | 2017-09-21 | In all Qualcomm products with Android releases from CAF using the Linux kernel, potential use after free scenarios and race conditions can occur when accessing… |
CVE-2017-8281 | Medium | 4.7 | 2017-09-21 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a race condition can allow access to already freed memory while querying event… |
CVE-2017-11040 | Medium | 5.5 | 2017-09-21 | In all Qualcomm products with Android releases from CAF using the Linux kernel, when reading from sysfs nodes, one can read more information than it is allowed… |
CVE-2017-11001 | Medium | 5.5 | 2017-09-21 | In all Qualcomm products with Android releases from CAF using the Linux kernel, the length of the MAC address is not checked which may cause out of bounds read. |
CVE-2017-10996 | Medium | 5.5 | 2017-09-21 | In all Qualcomm products with Android releases from CAF using the Linux kernel, out of bounds access is possible in c_show(), due to compat_hwcap_str[] not bei… |
CVE-2015-8559 | High | 7.5 | 2017-09-21 | The knife bootstrap command in chef Infra client before version 15.4.45 leaks the validator.pem private RSA key to /var/log/messages. |
CVE-2015-5284 | Critical | 9.8 | 2017-09-21 | ipa-kra-install in FreeIPA before 4.2.2 puts the CA agent certificate and private key in /etc/httpd/alias/kra-agent.pem, which is world readable. |
CVE-2015-9231 | High | 7.5 | 2017-09-20 | iTerm2 3.x before 3.1.1 allows remote attackers to discover passwords by reading DNS queries. A new (default) feature was added to iTerm2 version 3.0.0 (and un… |
CVE-2015-2826 | Medium | 5.3 | 2017-09-20 | WordPress Simple Ads Manager plugin 2.5.94 and 2.5.96 allows remote attackers to obtain sensitive information. |
CVE-2015-8224 | Low | 3.7 | 2017-09-20 | Huawei P8 before GRA-CL00C92B210, before GRA-L09C432B200, before GRA-TL00C01B210, and before GRA-UL00C00B210 allows remote attackers to obtain user equipment (… |
CVE-2017-8770 | High | 7.5 | 2017-09-20 | There is LFD (local file disclosure) on BE126 WIFI repeater 1.0 devices that allows attackers to read the entire filesystem on the device via a crafted getpage… |
CVE-2015-4682 | Medium | 6.5 | 2017-09-19 | Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows remote authenticated users to obtain the installation path via an HTTP POST request to PlcmR… |
CVE-2015-1849 | Medium | 5.9 | 2017-09-19 | AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.1 allows attackers to obtain sensitive information via vectors involv… |
CVE-2014-9616 | High | 7.5 | 2017-09-19 | Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to obtain sensitive information by making a request that redirects… |
CVE-2014-8174 | Critical | 9.8 | 2017-09-19 | eDeploy makes it easier for remote attackers to execute arbitrary code by leveraging use of HTTP to download files. |
CVE-2017-12616 | High | 7.5 | 2017-09-19 | When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resour… |
CVE-2017-12157 | Medium | 4.3 | 2017-09-18 | In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access. |
CVE-2017-0785 | Medium | 6.5 | 2017-09-14 | A information disclosure vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0… |
CVE-2017-0783 | Medium | 6.5 | 2017-09-14 | A information disclosure vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0… |
CVE-2017-13761 | Medium | 6.5 | 2017-09-14 | The Fastly CDN module before 1.2.26 for Magento2, when used with a third-party authentication plugin, might allow remote authenticated users to obtain sensitiv… |
CVE-2017-1490 | Medium | 5.3 | 2017-09-14 | An unspecified vulnerability in the Lifecycle Query Engine of Jazz Reporting Service 6.0 through 6.0.4 could disclose highly sensitive information. |
CVE-2017-1002100 | Medium | 6.5 | 2017-09-14 | Default access permissions for Persistent Volumes (PVs) created by the Kubernetes Azure cloud provider in versions 1.6.0 to 1.6.5 are set to "container" which… |
CVE-2015-7880 | Medium | 4.3 | 2017-09-13 | The Entity Registration module 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to obtain sensitive event registration information by leveraging the "… |
CVE-2017-14404 | High | 7.5 | 2017-09-13 | The EyesOfNetwork web interface (aka eonweb) 5.1-0 allows local file inclusion via the tool_list parameter (aka the url_tool variable) to module/tool_all/selec… |
CVE-2017-8739 | Medium | 4.3 | 2017-09-13 | Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to obtain information to further compromise the user's system, due to the way that the Microsoft… |
CVE-2017-8736 | Medium | 4.3 | 2017-09-13 | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, and Microsoft Edge and Intern… |
CVE-2017-8719 | Medium | 4.7 | 2017-09-13 | The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Wind… |
CVE-2017-8713 | Medium | 5.3 | 2017-09-13 | The Windows Hyper-V component on Microsoft Windows Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016… |
CVE-2017-8712 | Medium | 5.3 | 2017-09-13 | The Windows Hyper-V component on Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an information disclosure vulnerability when it fails to prope… |
CVE-2017-8711 | Medium | 5.3 | 2017-09-13 | The Windows Hyper-V component on Microsoft Windows 10 1607 and Windows Server 2016 allows an information disclosure vulnerability when it fails to properly val… |
CVE-2017-8709 | Medium | 4.7 | 2017-09-13 | The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Wind… |
CVE-2017-8708 | Medium | 4.7 | 2017-09-13 | The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Wind… |
CVE-2017-8707 | Medium | 5.3 | 2017-09-13 | The Windows Hyper-V component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 Gold, 1511, 1607, and 1… |
CVE-2017-8706 | Medium | 5.3 | 2017-09-13 | The Windows Hyper-V component on Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an information disclosure vulnerability when i… |
CVE-2017-8695 | Medium | 5.3 | 2017-09-13 | Windows Uniscribe in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold… |
CVE-2017-8688 | Medium | 5.5 | 2017-09-13 | Windows GDI+ on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 151… |
CVE-2017-8687 | Medium | 5.5 | 2017-09-13 | The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Wind… |
CVE-2017-8685 | Medium | 5.5 | 2017-09-13 | Windows GDI+ on Microsoft Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows information disclosure by the way it discloses kernel memory addresses… |
CVE-2017-8684 | Medium | 5.5 | 2017-09-13 | Windows GDI+ on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT 8.1, allows informati… |
CVE-2017-8683 | Medium | 5.5 | 2017-09-13 | Windows graphics on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold… |
CVE-2017-8681 | Medium | 5.5 | 2017-09-13 | The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Wind… |
CVE-2017-8680 | Medium | 5.5 | 2017-09-13 | The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT 8.1 a… |
CVE-2017-8679 | Medium | 5.5 | 2017-09-13 | The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Wind… |
CVE-2017-8678 | Medium | 5.5 | 2017-09-13 | The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Wind… |
CVE-2017-8677 | Medium | 5.5 | 2017-09-13 | The Windows GDI+ component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Window… |
CVE-2017-8676 | Low | 3.3 | 2017-09-13 | The Windows Graphics Device Interface (GDI) in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windo… |
CVE-2017-8648 | Medium | 4.3 | 2017-09-13 | Microsoft Edge in Microsoft Windows Version 1703 allows an attacker to obtain information to further compromise the user's system, due to the way that Microsof… |
CVE-2017-8643 | Medium | 4.3 | 2017-09-13 | Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to leave a malicious website open during user clipboa… |
CVE-2017-8597 | Medium | 4.3 | 2017-09-13 | Microsoft Edge in Microsoft Windows 10 Version 1703 allows an attacker to obtain information to further compromise the user's system, due to the way that Micro… |
CVE-2017-11761 | Medium | 5.3 | 2017-09-13 | Microsoft Exchange Server 2013 and Microsoft Exchange Server 2016 allow an input sanitization issue with Microsoft Exchange that could potentially result in un… |
CVE-2017-1434 | Medium | 4.7 | 2017-09-12 | IBM DB2 for Linux, UNIX and Windows 11.1 (includes DB2 Connect Server) under unusual circumstances, could expose highly sensitive information in the error log… |
CVE-2017-1162 | High | 7.5 | 2017-09-12 | IBM QRadar 7.2 and 7.3 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force I… |
CVE-2017-1000250 | Medium | 6.5 | 2017-09-12 | All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sens… |
CVE-2015-4688 | Medium | 5.3 | 2017-09-11 | Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allow remote attackers to enumerate user accounts via a series of requests. |
CVE-2017-14269 | Critical | 9.8 | 2017-09-11 | EE 4GEE WiFi MBB (before EE60_00_05.00_31) devices allow remote attackers to obtain sensitive information via a JSONP endpoint, as demonstrated by passwords an… |
CVE-2017-14240 | High | 7.5 | 2017-09-11 | There is a sensitive information disclosure vulnerability in document.php in Dolibarr ERP/CRM version 6.0.0 via the file parameter. |
CVE-2017-0793 | Medium | 5.5 | 2017-09-08 | A information disclosure vulnerability in the N/A memory subsystem. Product: Android. Versions: Android kernel. Android ID: A-35764946. |
CVE-2017-0792 | Medium | 6.5 | 2017-09-08 | A information disclosure vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: Android kernel. Android ID: A-37305578. References: B-V2017052… |
CVE-2017-0779 | Medium | 5.5 | 2017-09-08 | A information disclosure vulnerability in the Android media framework (audioflinger). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1… |
CVE-2017-0778 | High | 7.1 | 2017-09-08 | A information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-62133227. |
CVE-2017-0777 | Medium | 5.5 | 2017-09-08 | A information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-38342499. |
CVE-2017-0776 | Medium | 5.5 | 2017-09-08 | A information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-38496660. |
CVE-2011-3177 | High | 7.8 | 2017-09-08 | The YaST2 network created files with world readable permissions which could have allowed local users to read sensitive material out of network configuration fi… |
CVE-2017-2550 | High | 7.5 | 2017-09-08 | Vulnerability in Easy Joomla Backup v3.2.4. The software creates a copy of the backup in the web root with an easily guessable filename. |
CVE-2017-6793 | Medium | 6.5 | 2017-09-07 | A vulnerability in the Inventory Management feature of Cisco Prime Collaboration Provisioning Tool could allow an authenticated, remote attacker to view sensit… |
CVE-2017-12224 | Medium | 6.5 | 2017-09-07 | A vulnerability in the ability for guest users to join meetings via a hyperlink with Cisco Meeting Server could allow an authenticated, remote attacker to ente… |
CVE-2017-12216 | High | 8.8 | 2017-09-07 | A vulnerability in the web-based user interface of Cisco SocialMiner could allow an unauthenticated, remote attacker to have read and write access to informati… |
CVE-2015-8079 | Medium | 5.3 | 2017-09-07 | qt5-qtwebkit before 5.4 records private browsing URLs to its favicon database, WebpageIcons.db. |
CVE-2015-3250 | High | 7.5 | 2017-09-07 | Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors. |
CVE-2015-6250 | Medium | 5.3 | 2017-09-06 | simple-php-captcha before commit 9d65a945029c7be7bb6bc893759e74c5636be694 allows remote attackers to automatically generate the captcha response by running the… |
CVE-2015-5959 | Critical | 9.8 | 2017-09-06 | Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/sql-error.log. |
CVE-2015-3454 | High | 7.5 | 2017-09-06 | TelescopeJS before 0.15 leaks user bcrypt password hashes in websocket messages, which might allow remote attackers to obtain password hashes via a cross-site… |
CVE-2017-14156 | Medium | 5.5 | 2017-09-05 | The atyfb_ioctl function in drivers/video/fbdev/aty/atyfb_base.c in the Linux kernel through 4.12.10 does not initialize a certain data structure, which allows… |
CVE-2016-3086 | Critical | 9.8 | 2017-09-05 | The YARN NodeManager in Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the password for credential store provider used by the NodeManager to… |
CVE-2017-14140 | Medium | 5.5 | 2017-09-05 | The move_pages system call in mm/migrate.c in the Linux kernel before 4.12.9 doesn't check the effective uid of the target process, enabling a local attacker t… |
CVE-2017-10793 | High | 8.1 | 2017-09-03 | The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589, NVG599, and unspecified other devices, when IP Passthrough mode is not used, configures an sbdc.ha W… |
CVE-2017-14114 | Medium | 6.5 | 2017-09-02 | RTPproxy through 2.2.alpha.20160822 has a NAT feature that results in not properly determining the IP address and port number of the legitimate recipient of RT… |
CVE-2017-14099 | High | 7.5 | 2017-09-02 | In res/res_rtp_asterisk.c in Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cert17 and 13.x… |
CVE-2017-14053 | High | 7.5 | 2017-09-01 | NetApp OnCommand Unified Manager for Clustered Data ONTAP before 7.2P1 does not set the secure flag for an unspecified cookie in an HTTPS session, which makes… |
CVE-2017-12872 | Medium | 5.9 | 2017-09-01 | The (1) Htpasswd authentication source in the authcrypt module and (2) SimpleSAML_Session class in SimpleSAMLphp 1.14.11 and earlier allow remote attackers to… |
CVE-2017-12870 | Medium | 5.9 | 2017-09-01 | SimpleSAMLphp 1.14.12 and earlier make it easier for man-in-the-middle attackers to obtain sensitive information by leveraging use of the aesEncrypt and aesDec… |
CVE-2014-8675 | High | 7.5 | 2017-08-31 | Soplanning 1.32 and earlier generates static links for sharing ICAL calendars with embedded login information, which allows remote attackers to obtain a calend… |
CVE-2017-12734 | High | 7.5 | 2017-08-30 | A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V1.81.2). An attacker with network access to the integrated web serve… |
CVE-2016-5001 | Medium | 5.5 | 2017-08-30 | This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of HDFS. A local user o… |
CVE-2017-13774 | High | 7.8 | 2017-08-30 | Hikvision iVMS-4200 devices before v2.6.2.7 allow local users to generate password-recovery codes via unspecified vectors. |
CVE-2017-0379 | High | 7.5 | 2017-08-29 | Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret key, related to cip… |