CWE-200 · Information Disclosure (page 68)
Page 68 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-7272 | Medium | 6.5 | 2018-02-21 | The REST APIs in ForgeRock AM before 5.5.0 include SSOToken IDs as part of the URL, which allows attackers to obtain sensitive information by finding an ID val… |
CVE-2018-6487 | Critical | 9.8 | 2018-02-20 | Remote Disclosure of Information in Micro Focus Universal CMDB Foundation Software, version numbers 10.10, 10.11, 10.20, 10.21, 10.22, 10.30, 10.31, 4.10, 4.11… |
CVE-2018-5477 | Medium | 5.8 | 2018-02-20 | An Information Exposure issue was discovered in ABB netCADOPS Web Application Version 3.4 and prior, netCADOPS Web Application Version 7.1 and prior, netCADOPS… |
CVE-2017-18192 | High | 7.5 | 2018-02-20 | smart/calculator/gallerylock/CalculatorActivity.java in the "Photo,Video Locker-Calculator" application through 18 for Android allows attackers to access files… |
CVE-2015-9256 | Medium | 5.3 | 2018-02-20 | Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information via access to device/VM restore mount points, because they do not have ACLs… |
CVE-2015-9255 | Medium | 5.3 | 2018-02-20 | Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information about data, software versions, configuration, and virtual machines via a re… |
CVE-2018-7251 | Critical | 9.8 | 2018-02-19 | An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error (s… |
CVE-2018-6591 | Medium | 5.3 | 2018-02-19 | Converse.js and Inverse.js through 3.3 allow remote attackers to obtain sensitive information because it is too difficult to determine whether safe publication… |
CVE-2018-7210 | High | 7.5 | 2018-02-18 | An issue was discovered in iDashboards 9.6b. It allows remote attackers to obtain sensitive information via a direct request for the idb/config?CMD=installLice… |
CVE-2018-7209 | High | 7.5 | 2018-02-18 | An issue was discovered in iDashboards 9.6b. It allows remote attackers to obtain sensitive information via a direct request for the idashboards/config.xml URI… |
CVE-2018-1000068 | Medium | 5.3 | 2018-02-16 | An improper input validation vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to access plugin r… |
CVE-2017-8985 | Medium | 5.3 | 2018-02-15 | HPE XP Storage using Hitachi Global Link Manager (HGLM) has a local authenticated information disclosure vulnerability in HGLM version HGLM 6.3.0-00 to 8.5.2-0… |
CVE-2017-8980 | High | 7.5 | 2018-02-15 | A Remote Disclosure of Information vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found. |
CVE-2017-8978 | Medium | 4.6 | 2018-02-15 | A Remote Unauthorized Disclosure of Information vulnerability in HPE IceWall Products version MFA 4.0 proxy was found. |
CVE-2017-8970 | Medium | 5.3 | 2018-02-15 | A remote unauthenticated disclosure of information vulnerability in HPE Matrix Operating Environment version 7.6 LR1 was found. |
CVE-2017-8952 | High | 7.5 | 2018-02-15 | A Disclosure of Sensitive Information vulnerability in HPE SiteScope version v11.2x, v11.3x was found. |
CVE-2017-8951 | High | 7.8 | 2018-02-15 | A Disclosure of Sensitive Information vulnerability in HPE SiteScope version v11.2x, v11.3x was found. |
CVE-2017-8950 | Medium | 5.5 | 2018-02-15 | A Disclosure of Sensitive Information vulnerability in HPE SiteScope version v11.2x, v11.3x was found. |
CVE-2017-8944 | High | 7.5 | 2018-02-15 | A Remote Disclosure of Information vulnerability in HPE Cloud Optimizer version v3.0x was found. |
CVE-2017-5811 | High | 7.5 | 2018-02-15 | A remote code execution vulnerability in HPE Network Automation version 9.1x, 9.2x, 10.0x, 10.1x and 10.2x were found. |
CVE-2017-5803 | High | 7.5 | 2018-02-15 | A Remote Disclosure of Information vulnerability in HPE NonStop Servers using SSH Service version L series: T0801L02 through T0801L02^ABX; J and H series: T080… |
CVE-2017-5801 | High | 7.5 | 2018-02-15 | A Remote Unauthorized Access to Data vulnerability in HPE Business Process Monitor version v09.2x, v09.30 was found. |
CVE-2017-5797 | High | 7.5 | 2018-02-15 | A Remote Unauthenticated Disclosure of Information vulnerability in HPE Intelligent Management Center (IMC) SOM version v7.3 (E0501) was found. |
CVE-2017-5795 | Medium | 6.5 | 2018-02-15 | A Local Arbitrary File Download vulnerability in HPE Intelligent Management Center (IMC) version PLAT 7.2 E0403P06 was found. |
CVE-2017-5788 | Medium | 5.5 | 2018-02-15 | A Local Disclosure of Sensitive Information vulnerability in HPE NonStop Software Essentials version T0894 T0894H02 through T0894H02^AAI was found. |
CVE-2017-5785 | Medium | 6.5 | 2018-02-15 | A remote information disclosure vulnerability in HPE Matrix Operating Environment version v7.6 was found. |
CVE-2017-12555 | Medium | 6.5 | 2018-02-15 | A remote arbitrary file download and disclosure of information vulnerability in HPE Intelligent Management Center (iMC) Service Operation Management (SOM) vers… |
CVE-2017-12543 | Medium | 6.5 | 2018-02-15 | A remote disclosure of information vulnerability in Moonshot Remote Console Administrator Prior to 2.50, iLO4 prior to v2.53, iLO3 prior to v1.89 and iLO2 prio… |
CVE-2016-8531 | Medium | 5.3 | 2018-02-15 | A remote information disclosure vulnerability in HPE Matrix Operating Environment version 7.6 was found. |
CVE-2016-8525 | High | 7.5 | 2018-02-15 | A Remote Disclosure of Information vulnerability in HPE iMC PLAT version v7.2 E0403P06 and earlier was found. The problem was resolved in iMC PLAT 7.3 E0504 or… |
CVE-2016-8514 | Medium | 6.5 | 2018-02-15 | A remote information disclosure in HPE Version Control Repository Manager (VCRM) was found. The problem impacts all versions prior to 7.6. |
CVE-2018-7056 | Medium | 5.3 | 2018-02-15 | RoomWizard before 4.4.x allows remote attackers to obtain potentially sensitive information about IP addresses via /getGroupTimeLineJSON.action. |
CVE-2017-12723 | Low | 3.7 | 2018-02-15 | A Password in Configuration File issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The pump stor… |
CVE-2018-0855 | Medium | 4.3 | 2018-02-15 | The Microsoft Windows Embedded OpenType (EOT) font engine in Microsoft Windows 7 SP1 and Windows Server 2008 R2 allows information disclosure, due to how the W… |
CVE-2018-0843 | Medium | 4.7 | 2018-02-15 | The Windows kernel in Windows 10 version 1709 and Windows Server, version 1709 allows an information disclosure vulnerability due to how objects in memory are… |
CVE-2018-0839 | Medium | 4.3 | 2018-02-15 | Microsoft Edge in Microsoft Windows 10 1703 allows information disclosure, due to how Edge handles objects in memory, aka "Microsoft Edge Information Disclosur… |
CVE-2018-0830 | Medium | 4.7 | 2018-02-15 | The Windows kernel in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703… |
CVE-2018-0829 | Medium | 4.7 | 2018-02-15 | The Windows kernel in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703… |
CVE-2018-0763 | Low | 3.1 | 2018-02-15 | Microsoft Edge in Microsoft Windows 10 1703 and 1709 allows information disclosure, due to how Edge handles objects in memory, aka "Microsoft Edge Information… |
CVE-2018-0761 | Medium | 5.5 | 2018-02-15 | The Microsoft Windows Embedded OpenType (EOT) font engine in Microsoft Windows 7 SP1 and Windows Server 2008 R2 allows information disclosure, due to how the W… |
CVE-2018-0760 | Medium | 5.5 | 2018-02-15 | The Microsoft Windows Embedded OpenType (EOT) font engine in Microsoft Windows 7 SP1, Windows Server 2008 R2, and Windows Server 2012 allows information disclo… |
CVE-2018-0755 | Medium | 5.5 | 2018-02-15 | The Microsoft Windows Embedded OpenType (EOT) font engine in Microsoft Windows 7 SP1 and Windows Server 2008 R2 allows information disclosure, due to how the W… |
CVE-2017-15709 | Low | 3.7 | 2018-02-13 | When using the OpenWire protocol in ActiveMQ versions 5.14.0 to 5.15.2 it was found that certain system details (such as the OS and kernel version) are exposed… |
CVE-2018-6293 | High | 7.5 | 2018-02-13 | Arbitrary File Read in Saperion Web Client version 7.5.2 83166. |
CVE-2017-13246 | High | 7.5 | 2018-02-12 | A information disclosure vulnerability in the Upstream kernel network driver. Product: Android. Versions: Android kernel. ID: A-36279469. |
CVE-2017-13243 | High | 7.5 | 2018-02-12 | A information disclosure vulnerability in the Android system (ui). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. ID: A-38258991. |
CVE-2017-13242 | High | 7.5 | 2018-02-12 | A information disclosure vulnerability in the Android system (bluetooth). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. ID: A-62672248. |
CVE-2017-13241 | High | 7.5 | 2018-02-12 | A information disclosure vulnerability in the Android media framework (libstagefright_soft_avcenc). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1… |
CVE-2017-13240 | High | 7.5 | 2018-02-12 | A information disclosure vulnerability in the Android framework (crypto framework). Product: Android. Versions: 8.0, 8.1. ID: A-68694819. |
CVE-2017-13239 | High | 7.5 | 2018-02-12 | A information disclosure vulnerability in the Android framework (ui framework). Product: Android. Versions: 8.0. ID: A-66244132. |
CVE-2017-13238 | Medium | 4.2 | 2018-02-12 | In XBLRamDump mode, there is a debug feature that can be used to dump memory contents, if an attacker has physical access to the device. This could lead to loc… |
CVE-2017-13232 | High | 7.5 | 2018-02-12 | In audioserver, there is an out-of-bounds write due to a log statement using %s with an array that may not be NULL terminated. This could lead to local informa… |
CVE-2018-6881 | Medium | 5.3 | 2018-02-12 | EmpireCMS 6.6 allows remote attackers to discover the full path via an array value for a parameter to admin/tool/ShowPic.php. |
CVE-2018-1052 | Medium | 6.5 | 2018-02-09 | Memory disclosure vulnerability in table partitioning was found in postgresql 10.x before 10.2, allowing an authenticated attacker to read arbitrary bytes of s… |
CVE-2012-3331 | Medium | 5.3 | 2018-02-08 | IBM Sametime allows remote attackers to obtain sensitive information from the Sametime Log database via a direct request to STLOG.NSF. IBM X-Force ID: 78048. |
CVE-2018-6846 | Medium | 5.3 | 2018-02-08 | Z-BlogPHP 1.5.1 allows remote attackers to discover the full path via a direct request to zb_system/function/lib/upload.php. |
CVE-2018-0140 | Medium | 6.5 | 2018-02-08 | A vulnerability in the spam quarantine of Cisco Email Security Appliance and Cisco Content Security Management Appliance could allow an authenticated, remote a… |
CVE-2018-0134 | Medium | 5.3 | 2018-02-08 | A vulnerability in the RADIUS authentication module of Cisco Policy Suite could allow an unauthenticated, remote attacker to determine whether a subscriber use… |
CVE-2018-0127 | Critical | 9.8 | 2018-02-08 | A vulnerability in the web interface of Cisco RV132W ADSL2+ Wireless-N VPN Routers and Cisco RV134W VDSL2 Wireless-AC VPN Routers could allow an unauthenticate… |
CVE-2018-1388 | High | 7.5 | 2018-02-07 | GSKit V7 may disclose side channel information via discrepancies between valid and invalid PKCS#1 padding. IBM X-Force ID: 138212. |
CVE-2017-1785 | Medium | 4.3 | 2018-02-07 | IBM API Connect 5.0.7 and 5.0.8 could allow an authenticated remote user to modify query parameters to obtain sensitive information. IBM X-Force ID: 136859. |
CVE-2018-6806 | Medium | 6.5 | 2018-02-07 | Marked 2 through 2.5.11 allows remote attackers to read arbitrary files via a crafted HTML document that triggers a redirect to an x-marked://preview?text= URL… |
CVE-2018-6790 | Medium | 5.3 | 2018-02-07 | An issue was discovered in KDE Plasma Workspace before 5.12.0. dataengines/notifications/notificationsengine.cpp allows remote attackers to discover client IP… |
CVE-2016-3954 | Medium | 5.5 | 2018-02-06 | web2py before 2.14.2 allows remote attackers to obtain the session_cookie_key value via a direct request to examples/simple_examples/status. NOTE: this issue… |
CVE-2017-6200 | Medium | 6.5 | 2018-02-06 | Sandstorm before build 0.203 allows remote attackers to read any specified file under /etc or /run via the sandbox backup function. The root cause is that the… |
CVE-2013-4317 | Medium | 4.3 | 2018-02-06 | In Apache CloudStack 4.1.0 and 4.1.1, when calling the CloudStack API call listProjectAccounts as a regular, non-administrative user, the user is able to see i… |
CVE-2018-6610 | High | 7.5 | 2018-02-05 | Information Leakage exists in the jLike 1.0 component for Joomla! via a task=getUserByCommentId request. |
CVE-2015-1418 | High | 7.8 | 2018-02-05 | The do_ed_script function in pch.c in GNU patch through 2.7.6, and patch in FreeBSD 10.1 before 10.1-RELEASE-p17, 10.2 before 10.2-BETA2-p3, 10.2-RC1 before 10… |
CVE-2018-6188 | High | 7.5 | 2018-02-05 | django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive informa… |
CVE-2018-6596 | Critical | 9.1 | 2018-02-03 | webhooks/base.py in Anymail (aka django-anymail) before 1.2.1 is prone to a timing attack vulnerability on the WEBHOOK_AUTHORIZATION secret, which allows remot… |
CVE-2016-0312 | High | 7.5 | 2018-02-02 | IBM TRIRIGA Application Platform before 3.3.2 allows remote attackers to obtain sensitive information via vectors related to granting unauthenticated access to… |
CVE-2018-6526 | Medium | 5.3 | 2018-02-02 | view_all_bug_page.php in MantisBT 2.10.0-development before 2018-02-02 allows remote attackers to discover the full path via an invalid filter parameter, relat… |
CVE-2018-1192 | High | 8.8 | 2018-02-01 | In Cloud Foundry Foundation cf-release versions prior to v285; cf-deployment versions prior to v1.7; UAA 4.5.x versions prior to 4.5.5, 4.8.x versions prior to… |
CVE-2015-2204 | High | 7.5 | 2018-02-01 | Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to bypass an intended access restriction and obtain sensitive inform… |
CVE-2015-2203 | Medium | 6.5 | 2018-02-01 | Evergreen 2.5.9, 2.6.7, and 2.7.4 allows remote authenticated users with STAFF_LOGIN permission to obtain sensitive settings history information by leveraging… |
CVE-2013-7435 | Medium | 6.5 | 2018-02-01 | The open-ils.pcrud endpoint in Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to obtain sensitive settings history… |
CVE-2018-6470 | Medium | 5.3 | 2018-02-01 | Nibbleblog 4.0.5 on macOS defaults to having .DS_Store in each directory, causing DS_Store information to leak. |
CVE-2017-16911 | Medium | 4.7 | 2018-01-31 | The vhci_hcd driver in the Linux Kernel before version 4.14.8 and 4.4.114 allows allows local attackers to disclose kernel memory addresses. Successful exploit… |
CVE-2018-6460 | High | 7.5 | 2018-01-31 | Hotspot Shield runs a webserver with a static IP address 127.0.0.1 and port 895. The web server uses JSONP and hosts sensitive information including configurat… |
CVE-2018-6412 | High | 7.5 | 2018-01-31 | In the function sbusfb_ioctl_helper() in drivers/video/fbdev/sbuslib.c in the Linux kernel through 4.15, an integer signedness error allows arbitrary informati… |
CVE-2017-1784 | Medium | 5.5 | 2018-01-29 | IBM Cognos Analytics 11.0 could produce results in temporary files that contain highly sensitive information that can be read by a local user. IBM X-Force ID… |
CVE-2018-6008 | High | 7.5 | 2018-01-29 | Arbitrary File Download exists in the Jtag Members Directory 5.3.7 component for Joomla! via the download_file parameter. |
CVE-2017-1515 | Medium | 4.3 | 2018-01-26 | IBM Doors Web Access 9.5 and 9.6 could allow an authenticated user to obtain sensitive information from HTTP internal server error responses. IBM X-Force ID: 1… |
CVE-2018-6015 | High | 7.5 | 2018-01-26 | An issue was discovered in the "Email Subscribers & Newsletters" plugin before 3.4.8 for WordPress. Sending an HTTP POST request to a URI with /?es=export at t… |
CVE-2018-5750 | Medium | 5.5 | 2018-01-26 | The acpi_smbus_hc_add function in drivers/acpi/sbshc.c in the Linux kernel through 4.14.15 allows local users to obtain sensitive address information by readin… |
CVE-2017-1000399 | Medium | 4.3 | 2018-01-26 | The Jenkins 2.73.1 and earlier, 2.83 and earlier remote API at /queue/item/(ID)/api showed information about tasks in the queue (typically builds waiting to st… |
CVE-2017-1000398 | Medium | 4.3 | 2018-01-26 | The remote API in Jenkins 2.73.1 and earlier, 2.83 and earlier at /computer/(agent-name)/api showed information about tasks (typically builds) currently runnin… |
CVE-2017-1000395 | Medium | 4.3 | 2018-01-26 | Jenkins 2.73.1 and earlier, 2.83 and earlier provides information about Jenkins user accounts which is generally available to anyone with Overall/Read permissi… |
CVE-2017-1000505 | Medium | 6.5 | 2018-01-25 | In Jenkins Script Security Plugin version 1.36 and earlier, users with the ability to configure sandboxed Groovy scripts are able to use a type coercion featur… |
CVE-2018-4835 | Medium | 5.3 | 2018-01-25 | A vulnerability has been identified in TeleControl Server Basic < V3.1. An attacker with network access to the TeleControl Server Basic's port 8000/tcp could b… |
CVE-2018-5319 | High | 7.5 | 2018-01-24 | RAVPower FileHub 2.000.056 allows remote users to steal sensitive information via a crafted HTTP request. |
CVE-2017-2744 | Medium | 5.5 | 2018-01-23 | The vulnerability allows attacker to extract binaries into protected file system locations in HP Support Assistant before 12.7.26.1. |
CVE-2017-16609 | High | 7.5 | 2018-01-23 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Netgain Enterprise Manager. Authentication is not r… |
CVE-2017-16607 | High | 7.5 | 2018-01-23 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Netgain Enterprise Manager. Authentication is not r… |
CVE-2017-16596 | Medium | 6.5 | 2018-01-23 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 10… |
CVE-2017-16595 | Medium | 6.5 | 2018-01-23 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 10… |
CVE-2017-16592 | Medium | 6.5 | 2018-01-23 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 10… |
CVE-2017-16591 | Medium | 6.5 | 2018-01-23 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Systems Enterprise Manager 7.2.699 build 10… |
CVE-2018-6014 | Medium | 6.5 | 2018-01-23 | Subsonic v6.1.3 has an insecure allow-access-from domain="*" Flash cross-domain policy that allows an attacker to retrieve sensitive user information via a rea… |
CVE-2018-1044 | Medium | 4.3 | 2018-01-22 | In Moodle 3.x, quiz web services allow students to see quiz results when it is prohibited in the settings. |