CWE-200 · Information Disclosure (page 69)
Page 69 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-15112 | High | 7.8 | 2018-01-20 | keycloak-httpd-client-install versions before 0.8 allow users to insecurely pass password through command line, leaking it via command history and process info… |
CVE-2017-14082 | High | 7.5 | 2018-01-19 | An uninitialized pointer information disclosure vulnerability in Trend Micro Mobile Security (Enterprise) versions 9.7 and below could allow an unauthenticated… |
CVE-2017-15713 | Medium | 6.5 | 2018-01-19 | Vulnerability in Apache Hadoop 0.23.x, 2.x before 2.7.5, 2.8.x before 2.8.3, and 3.0.0-alpha through 3.0.0-beta1 allows a cluster user to expose private files… |
CVE-2018-0111 | Medium | 5.3 | 2018-01-18 | A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to access sensitive data about the application. An attacker coul… |
CVE-2018-0109 | Low | 2.7 | 2018-01-18 | A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to access sensitive data about the application. An attacker could… |
CVE-2018-0106 | Low | 3.3 | 2018-01-18 | A vulnerability in the ConfD server of the Cisco Elastic Services Controller (ESC) could allow an unauthenticated, local attacker to access sensitive informati… |
CVE-2018-0105 | Medium | 5.3 | 2018-01-18 | A vulnerability in the web framework of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to view sensitive data. The vulner… |
CVE-2017-10262 | Medium | 5.9 | 2018-01-18 | Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). The supported version that is affected is 1… |
CVE-2018-5728 | Medium | 5.3 | 2018-01-16 | Cobham Sea Tel 121 build 222701 devices allow remote attackers to obtain potentially sensitive information via a /cgi-bin/getSysStatus request, as demonstrated… |
CVE-2018-5726 | Critical | 9.8 | 2018-01-16 | MASTER IPCAMERA01 3.3.4.2103 devices allow remote attackers to obtain sensitive information via a crafted HTTP request, as demonstrated by the username, passwo… |
CVE-2015-7484 | Medium | 4.3 | 2018-01-16 | IBM Rational Engineering Lifecycle Manager 3.0 before 3.0.1.6 iFix7 Interim Fix 1 and 4.0 before 4.0.7 iFix10 allow remote authenticated users with access to l… |
CVE-2018-5682 | Medium | 5.3 | 2018-01-13 | PrestaShop 1.7.2.4 allows user enumeration via the Reset Password feature, by noticing which reset attempts do not produce a "This account does not exist" erro… |
CVE-2017-13222 | High | 7.5 | 2018-01-12 | An information disclosure vulnerability in the Upstream kernel kernel. Product: Android. Versions: Android kernel. Android ID: A-38159576. |
CVE-2017-13218 | Medium | 4.7 | 2018-01-12 | Access to CNTVCT_EL0 in Small Cell SoC, Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear could be used for side channel attacks and this could lead… |
CVE-2017-13207 | High | 7.5 | 2018-01-12 | An information disclosure vulnerability in the Android media framework (stagefright mpeg4writer). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android I… |
CVE-2017-13206 | High | 7.5 | 2018-01-12 | An information disclosure vulnerability in the Android media framework (aacdec). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. An… |
CVE-2017-13205 | Critical | 9.1 | 2018-01-12 | An information disclosure vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-64550… |
CVE-2017-13204 | Critical | 9.1 | 2018-01-12 | An information disclosure vulnerability in the Android media framework (libavc). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-6438023… |
CVE-2017-13203 | Critical | 9.1 | 2018-01-12 | An information disclosure vulnerability in the Android media framework (libavc). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-6312263… |
CVE-2017-13202 | High | 7.5 | 2018-01-12 | An information disclosure vulnerability in the Android media framework (libeffects). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1… |
CVE-2017-13201 | High | 7.5 | 2018-01-12 | An information disclosure vulnerability in the Android media framework (mediadrm). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1… |
CVE-2017-13200 | High | 7.5 | 2018-01-12 | An information disclosure vulnerability in the Android media framework (av) related to id3 unsynchronization. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8… |
CVE-2017-13188 | Critical | 9.1 | 2018-01-12 | An information disclosure vulnerability in the Android media framework (aac). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-65280786. |
CVE-2017-13187 | Critical | 9.1 | 2018-01-12 | An information disclosure vulnerability in the Android media framework (libhevc). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-650341… |
CVE-2017-13185 | Critical | 9.1 | 2018-01-12 | An information disclosure vulnerability in the Android media framework (libhevc). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-65123471. |
CVE-2017-0846 | High | 7.5 | 2018-01-12 | An information disclosure vulnerability in the Android framework (clipboardservice). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. And… |
CVE-2017-16741 | Medium | 5.3 | 2018-01-12 | An Information Exposure issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1.0 to 1.32. A remote… |
CVE-2015-2298 | High | 7.5 | 2018-01-12 | node/utils/ExportEtherpad.js in Etherpad 1.5.x before 1.5.2 might allow remote attackers to obtain sensitive information by leveraging an improper substring ch… |
CVE-2014-6437 | Critical | 9.8 | 2018-01-12 | Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices allow remote attackers to obtain sensitive device configuration information via vectors involving t… |
CVE-2017-1681 | Low | 3.3 | 2018-01-11 | IBM WebSphere Application Server (IBM Liberty for Java for Bluemix 3.15) could allow a local attacker to obtain sensitive information, caused by improper handl… |
CVE-2017-1478 | Low | 3.3 | 2018-01-11 | IBM Security Access Manager Appliance 9.0.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 128613. |
CVE-2018-0014 | Medium | 4.3 | 2018-01-10 | Juniper Networks ScreenOS devices do not pad Ethernet packets with zeros, and thus some packets can contain fragments of system memory or data from previous pa… |
CVE-2018-0013 | Medium | 6.5 | 2018-01-10 | A local file inclusion vulnerability in Juniper Networks Junos Space Network Management Platform may allow an authenticated user to retrieve files from the sys… |
CVE-2017-15850 | High | 7.5 | 2018-01-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, userspace can read values from audio codec regi… |
CVE-2017-14870 | High | 7.5 | 2018-01-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while updating the recovery message for eMMC de… |
CVE-2017-14869 | High | 7.5 | 2018-01-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while performing update of FOTA partition, unin… |
CVE-2017-11079 | Critical | 9.8 | 2018-01-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing sparse image, uninitialized he… |
CVE-2017-11066 | High | 7.5 | 2018-01-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while flashing ubi image an uninitialized memor… |
CVE-2014-5004 | High | 7.8 | 2018-01-10 | lib/brbackup.rb in the brbackup gem 0.1.1 for Ruby places the database password on the mysql command line, which allows local users to obtain sensitive informa… |
CVE-2014-5001 | High | 7.8 | 2018-01-10 | lib/ksymfony1.rb in the kcapifony gem 2.1.6 for Ruby places database user passwords on the (1) mysqldump, (2) pg_dump, (3) mysql, and (4) psql command lines, w… |
CVE-2014-5000 | High | 7.8 | 2018-01-10 | The login function in lib/lawn.rb in the lawn-login gem 0.0.7 for Ruby places credentials on the curl command line, which allows local users to obtain sensitiv… |
CVE-2014-4999 | High | 7.8 | 2018-01-10 | vendor/plugins/dataset/lib/dataset/database/mysql.rb in the kajam gem 1.0.3.rc2 for Ruby places the mysql user password on the (1) mysqldump command line in th… |
CVE-2014-4998 | High | 7.8 | 2018-01-10 | test/tc_database.rb in the lean-ruport gem 0.3.8 for Ruby places the mysql user password on the mysqldump command line, which allows local users to obtain sens… |
CVE-2014-4997 | High | 7.8 | 2018-01-10 | lib/commands/setup.rb in the point-cli gem 0.0.1 for Ruby places credentials on the curl command line, which allows local users to obtain sensitive information… |
CVE-2014-4995 | High | 7.0 | 2018-01-10 | Race condition in lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to obtain sensitive information by reading the MySQL roo… |
CVE-2014-4993 | High | 7.8 | 2018-01-10 | (1) lib/backup/cli/utility.rb in the backup-agoddard gem 3.0.28 and (2) lib/backup/cli/utility.rb in the backup_checksum gem 3.0.23 for Ruby place credentials… |
CVE-2014-4992 | High | 7.8 | 2018-01-10 | lib/cap-strap/helpers.rb in the cap-strap gem 0.1.5 for Ruby places credentials on the useradd command line, which allows local users to obtain sensitive infor… |
CVE-2014-4991 | High | 7.8 | 2018-01-10 | (1) lib/dataset/database/mysql.rb and (2) lib/dataset/database/postgresql.rb in the codders-dataset gem 1.3.2.1 for Ruby place credentials on the mysqldump com… |
CVE-2017-12169 | High | 7.5 | 2018-01-10 | It was found that FreeIPA 4.2.0 and later could disclose password hashes to users having the 'System: Read Stage Users' permission. A remote, authenticated att… |
CVE-2017-9796 | Medium | 5.3 | 2018-01-10 | When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL quer… |
CVE-2017-9795 | High | 7.5 | 2018-01-10 | When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL quer… |
CVE-2017-12622 | High | 7.1 | 2018-01-10 | When an Apache Geode cluster before v1.3.0 is operating in secure mode and an authenticated user connects to a Geode cluster using the gfsh tool with HTTP, the… |
CVE-2017-12697 | Medium | 5.9 | 2018-01-09 | A Man-in-the-Middle issue was discovered in General Motors (GM) and Shanghai OnStar (SOS) SOS iOS Client 7.1. Successful exploitation of this vulnerability may… |
CVE-2012-3353 | High | 7.5 | 2018-01-09 | The Apache Sling JCR ContentLoader 2.1.4 XmlReader used in the Sling JCR content loader module makes it possible to import arbitrary files in the content repos… |
CVE-2014-5394 | Medium | 5.9 | 2018-01-08 | Multiple Huawei Campus switches allow remote attackers to enumerate usernames via vectors involving use of SSH by the maintenance terminal. |
CVE-2018-5266 | High | 7.5 | 2018-01-08 | Cobham Sea Tel 121 build 222701 devices allow remote attackers to obtain potentially sensitive information about valid usernames by reading the loginName lines… |
CVE-2017-4948 | High | 7.1 | 2018-01-05 | VMware Workstation (14.x before 14.1.0 and 12.x) and Horizon View Client (4.x before 4.7.0) contain an out-of-bounds read vulnerability in TPView.dll. On Works… |
CVE-2017-1669 | Low | 3.7 | 2018-01-04 | IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized part… |
CVE-2018-0800 | Medium | 5.3 | 2018-01-04 | Microsoft Edge in Microsoft Windows 10 1709 allows an attacker to obtain information to further compromise the user's system, due to how the scripting engine h… |
CVE-2018-0766 | Medium | 4.3 | 2018-01-04 | Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to obtain information to further compromise the… |
CVE-2017-5754 | Medium | 5.6 | 2018-01-04 | Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker wit… |
CVE-2017-1000413 | Medium | 5.9 | 2018-01-02 | Linaro's open source TEE solution called OP-TEE, version 2.4.0 (and older) is vulnerable a timing attack in the Montgomery parts of libMPA in OP-TEE resulting… |
CVE-2017-1000412 | High | 7.5 | 2018-01-02 | Linaro's open source TEE solution called OP-TEE, version 2.4.0 (and older) is vulnerable to the bellcore attack in the LibTomCrypt code resulting in compromise… |
CVE-2018-3813 | Critical | 9.8 | 2018-01-01 | getConfigExportFile.cgi on FLIR Brickstream 2300 devices 2.0 4.1.53.166 has Incorrect Access Control, as demonstrated by reading the AVI_USER_ID and AVI_USER_P… |
CVE-2013-7400 | High | 7.5 | 2017-12-29 | The Direct Mail (direct_mail) extension before 3.1.2 for TYPO3 allows remote attackers to obtain sensitive information by leveraging improper checking of authe… |
CVE-2017-17926 | Medium | 5.3 | 2017-12-27 | PHP Scripts Mall Professional Service Script has a predicable registration URL, which makes it easier for remote attackers to register with an invalid or spoof… |
CVE-2017-17898 | High | 7.5 | 2017-12-27 | Dolibarr ERP/CRM version 6.0.4 does not block direct requests to *.tpl.php files, which allows remote attackers to obtain sensitive information. |
CVE-2017-17864 | Low | 3.3 | 2017-12-27 | kernel/bpf/verifier.c in the Linux kernel through 4.14.8 mishandles states_equal comparisons between the pointer data type and the UNKNOWN_VALUE data type, whi… |
CVE-2017-1698 | Medium | 5.3 | 2017-12-27 | IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 could reveal sensitive information from an error message that could lead to further attacks against the system. IBM… |
CVE-2017-13869 | Medium | 5.5 | 2017-12-25 | An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before… |
CVE-2017-13868 | Medium | 5.5 | 2017-12-25 | An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before… |
CVE-2017-13865 | Medium | 5.5 | 2017-12-25 | An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before… |
CVE-2017-13864 | Medium | 5.9 | 2017-12-25 | An issue was discovered in certain Apple products. iCloud before 7.2 on Windows is affected. iTunes before 12.7.2 on Windows is affected. The issue involves th… |
CVE-2017-15328 | High | 7.5 | 2017-12-22 | Huawei HG8245H version earlier than V300R018C00SPC110 has an authentication bypass vulnerability. An attacker can access a specific URL of the affect product… |
CVE-2017-15321 | Low | 3.7 | 2017-12-22 | Huawei FusionSphere OpenStack V100R006C000SPC102 (NFV) has an information leak vulnerability due to the use of a low version transmission protocol by default… |
CVE-2017-17692 | High | 7.5 | 2017-12-21 | Samsung Internet Browser 5.4.02.3 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code that re… |
CVE-2017-5262 | High | 8.0 | 2017-12-20 | In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the SNMP read-only (RO) community string has access to sensitive information by OID refere… |
CVE-2017-6094 | Critical | 9.8 | 2017-12-20 | CPEs used by subscribers on the access network receive their individual configuration settings from a central GAPS instance. A CPE identifies itself by the MAC… |
CVE-2017-1596 | Medium | 5.5 | 2017-12-20 | IBM Security Guardium 10.0 Database Activity Monitor could allow a local attacker to obtain highly sensitive information via unspecified vectors. IBM X-Force I… |
CVE-2017-1595 | Medium | 5.5 | 2017-12-20 | IBM Security Guardium 10.0 Database Activity Monitor could allow a local attacker to obtain highly sensitive information via unspecified vectors. IBM X-Force I… |
CVE-2017-1423 | Medium | 5.3 | 2017-12-20 | IBM WebSphere Portal 8.5 and 9.0 exposes backend server URLs that are configured for usage by the Web Application Bridge component. IBM X-Force ID: 127476. |
CVE-2017-1261 | Low | 3.3 | 2017-12-20 | IBM Security Guardium 10.0 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 124736. |
CVE-2017-1257 | Medium | 4.3 | 2017-12-20 | IBM Security Guardium 10.0 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-For… |
CVE-2017-17476 | High | 8.8 | 2017-12-20 | Open Ticket Request System (OTRS) 4.0.x before 4.0.28, 5.0.x before 5.0.26, and 6.0.x before 6.0.3, when cookie support is disabled, might allow remote attacke… |
CVE-2017-16589 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is requi… |
CVE-2017-16588 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is requi… |
CVE-2017-16584 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is requi… |
CVE-2017-16580 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is requi… |
CVE-2017-16579 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is requi… |
CVE-2017-16574 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is requi… |
CVE-2017-16573 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is requi… |
CVE-2017-14822 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is requi… |
CVE-2017-14821 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is requi… |
CVE-2017-14820 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is requi… |
CVE-2017-14819 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is requi… |
CVE-2017-14818 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to explo… |
CVE-2017-10956 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is requi… |
CVE-2017-17793 | High | 7.5 | 2017-12-20 | Information Disclosure vulnerability in creer_fichier_zip in admin/maintenance.php in BlogoText through 3.7.6 allows remote attackers to defeat a filename-rand… |
CVE-2017-17776 | Medium | 5.3 | 2017-12-20 | Paid To Read Script 2.0.5 has full path disclosure via an invalid admin/userview.php uid parameter. |
CVE-2017-16786 | Medium | 6.5 | 2017-12-19 | The Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote authenticated users with certain privileges to read arbit… |