CWE-200 · Information Disclosure (page 70)
Page 70 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-15700 | High | 8.8 | 2017-12-18 | A flaw in the org.apache.sling.auth.core.AuthUtil#isRedirectValid method in Apache Sling Authentication Service 1.4.0 allows an attacker, through the Sling log… |
CVE-2017-15104 | High | 7.8 | 2017-12-18 | An access flaw was found in Heketi 5, where the heketi.json configuration file was world readable. An attacker having local access to the Heketi server could r… |
CVE-2017-17735 | Critical | 9.8 | 2017-12-18 | CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in cookies. |
CVE-2017-17734 | Critical | 9.8 | 2017-12-18 | CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in sessions. |
CVE-2017-3194 | High | 8.1 | 2017-12-16 | Pandora iOS app prior to version 8.3.2 fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attacker to conduct man-i… |
CVE-2017-3185 | Critical | 9.8 | 2017-12-16 | ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC have a web application that uses the GET method to process requests… |
CVE-2017-14184 | High | 8.8 | 2017-12-15 | An Information Disclosure vulnerability in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for Mac OSX 5.6.0 and below versions and Fort… |
CVE-2017-12373 | Medium | 5.9 | 2017-12-15 | A vulnerability in the TLS protocol implementation of legacy Cisco ASA 5500 Series (ASA 5505, 5510, 5520, 5540, and 5550) devices could allow an unauthenticate… |
CVE-2017-17556 | Medium | 5.1 | 2017-12-15 | A debug tool in Synaptics TouchPad drivers allows local users with administrative access to obtain sensitive information about keyboard scan codes by modifying… |
CVE-2017-16787 | Medium | 6.5 | 2017-12-15 | The Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote attackers to read arbitrary files by leveraging failure t… |
CVE-2017-17696 | Medium | 4.3 | 2017-12-15 | Techno - Portfolio Management Panel through 2017-11-16 allows full path disclosure via an invalid s parameter to panel/search.php. |
CVE-2017-16355 | Medium | 4.7 | 2017-12-14 | In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is runnin… |
CVE-2017-7738 | High | 7.2 | 2017-12-13 | An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.5, 5.2 and below versions allow an admin user with super_admin privile… |
CVE-2017-15530 | Low | 3.3 | 2017-12-13 | Prior to 4.4.1.10, the Norton Family Android App can be susceptible to an Information Disclosure issue. Information disclosure is a very common issue that atta… |
CVE-2017-17549 | Medium | 5.9 | 2017-12-13 | Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.5 before build 67.13, 11.0 before build 71.22, 11.1 before build 56.19, and 12… |
CVE-2017-11939 | Medium | 6.5 | 2017-12-12 | Microsoft Office 2016 Click-to-Run (C2R) allows an information disclosure vulnerability due to the way Microsoft Office enforces DRM copy/paste permissions, ak… |
CVE-2017-11934 | Medium | 5.5 | 2017-12-12 | Microsoft Office 2013 RT SP1, Microsoft Office 2013 SP1, and Microsoft Office 2016 allow an information disclosure vulnerability due to the way certain functio… |
CVE-2017-11927 | Medium | 6.5 | 2017-12-12 | Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Serv… |
CVE-2017-11919 | Medium | 5.3 | 2017-12-12 | ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, and Windows 1… |
CVE-2017-11906 | Medium | 5.3 | 2017-12-12 | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Windows 10 Gold… |
CVE-2017-11887 | Medium | 5.3 | 2017-12-12 | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Windows 10 Go… |
CVE-2017-16687 | Medium | 5.3 | 2017-12-12 | The user self-service tools of SAP HANA extended application services, classic user self-service, a part of SAP HANA Database versions 1.00 and 2.00, can be mi… |
CVE-2017-8865 | Medium | 5.9 | 2017-12-11 | Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 do not provide sufficient protections against capture-replay attacks, allowing an a… |
CVE-2017-1613 | Medium | 5.3 | 2017-12-11 | IBM Connections 6.0 could allow an unauthenticated remote attacker to gain unauthenticated or unauthorized access to non-sensitive Engagement Center template d… |
CVE-2017-1507 | Medium | 4.3 | 2017-12-11 | IBM Jazz Foundation Products could disclose sensitive information during a scan that could lead to further attacks against the system. IBM X-Force ID: 129619. |
CVE-2015-8470 | Medium | 6.5 | 2017-12-11 | The console in Puppet Enterprise 3.7.x, 3.8.x, and 2015.2.x does not set the secure flag for the JSESSIONID cookie in an HTTPS session, which makes it easier f… |
CVE-2017-3111 | High | 7.5 | 2017-12-09 | An issue was discovered in Adobe Experience Manager 6.3, 6.2, 6.1, 6.0. Sensitive tokens are included in http GET requests under certain circumstances. |
CVE-2017-16369 | Medium | 6.5 | 2017-12-09 | An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versi… |
CVE-2017-11273 | Medium | 5.5 | 2017-12-09 | An issue was discovered in Adobe Digital Editions 4.5.6 and earlier versions. Adobe Digital Editions parses crafted XML files in an unsafe manner, which could… |
CVE-2017-16854 | Medium | 6.5 | 2017-12-08 | In Open Ticket Request System (OTRS) through 3.3.20, 4 through 4.0.26, 5 through 5.0.24, and 6 through 6.0.1, an attacker who is logged in as a customer can us… |
CVE-2017-17463 | High | 7.5 | 2017-12-08 | Vivo modems allow remote attackers to obtain sensitive information by reading the index.cgi?page=wifi HTML source code, as demonstrated by ssid and psk_wepkey… |
CVE-2017-1000410 | High | 7.5 | 2017-12-07 | The Linux kernel version 3.3-rc1 and later is affected by a vulnerability lies in the processing of incoming L2CAP commands - ConfigRequest, and ConfigResponse… |
CVE-2017-3738 | Medium | 5.9 | 2017-12-07 | There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are affected. Analysis s… |
CVE-2017-1497 | Low | 3.7 | 2017-12-07 | IBM Sterling File Gateway 2.2 could allow an unauthorized user to view files they should not have access to providing they know the directory location of the f… |
CVE-2017-1487 | Medium | 6.5 | 2017-12-07 | IBM Sterling File Gateway 2.2 could allow an authenticated attacker to obtain sensitive information such as login ids on the system. IBM X-Force ID: 128626. |
CVE-2017-1481 | Medium | 4.3 | 2017-12-07 | IBM Sterling B2B Integrator Standard Edition 5.2 allows a user to view sensitive information that belongs to another user. IBM X-Force ID: 128619. |
CVE-2017-1355 | Low | 3.7 | 2017-12-07 | IBM Atlas eDiscovery Process Management 6.0.3 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties h… |
CVE-2017-1353 | Low | 3.5 | 2017-12-07 | IBM Atlas eDiscovery Process Management 6.0.3 could allow an authenticated attacker to obtain sensitive information when an unsuspecting user clicks on unsafe… |
CVE-2017-1342 | Medium | 4.3 | 2017-12-07 | IBM Insights Foundation for Energy 2.0 could reveal sensitive information in error messages to authenticated users that could e used to conduct further attacks… |
CVE-2017-17449 | Medium | 4.7 | 2017-12-07 | The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel through 4.14.4, when CONFIG_NLMON is enabled, does not restrict observat… |
CVE-2017-17068 | High | 7.5 | 2017-12-06 | A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12. This vulnerability allows an attacker to acquire auth… |
CVE-2017-13175 | High | 7.5 | 2017-12-06 | An information disclosure vulnerability in the NVIDIA libwilhelm. Product: Android. Versions: Android kernel. Android ID A-64339309. References: N-CVE-2017-131… |
CVE-2017-13169 | High | 7.5 | 2017-12-06 | An information disclosure vulnerability in the kernel camera server. Product: Android. Versions: Android kernel. Android ID A-37512375. |
CVE-2017-13164 | High | 7.5 | 2017-12-06 | An information disclosure vulnerability in the kernel binder driver. Product: Android. Versions: Android kernel. Android ID A-36007193. |
CVE-2017-13159 | High | 7.5 | 2017-12-06 | An information disclosure vulnerability in the Android system (activitymanagerservice). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0… |
CVE-2017-13158 | High | 7.5 | 2017-12-06 | An information disclosure vulnerability in the Android system (activitymanagerservice). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0… |
CVE-2017-13157 | High | 7.5 | 2017-12-06 | An information disclosure vulnerability in the Android system (activitymanagerservice). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0… |
CVE-2017-13152 | High | 7.5 | 2017-12-06 | An information disclosure vulnerability in the Android media framework (libmedia drm). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. A… |
CVE-2017-13150 | Critical | 9.1 | 2017-12-06 | An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-38328132. |
CVE-2017-13149 | Critical | 9.1 | 2017-12-06 | An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-65719872. |
CVE-2017-0879 | Critical | 9.1 | 2017-12-06 | An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-65025028. |
CVE-2017-11031 | High | 7.5 | 2017-12-05 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, the VIDIOC_G_SDE_ROTATOR_FENCE ioctl command ca… |
CVE-2017-12080 | Medium | 5.3 | 2017-12-04 | An information exposure vulnerability in default HTTP configuration file in Synology Photo Station before 6.8.1-3458 and before 6.3-2970 allows remote attacker… |
CVE-2017-12079 | High | 7.5 | 2017-12-04 | Files or directories accessible to external parties vulnerability in picasa.php in Synology Photo Station before 6.8.1-3458 and before 6.3-2970 allows remote a… |
CVE-2017-17104 | High | 7.5 | 2017-12-04 | Fiyo CMS 2.0.7 has an arbitrary file read vulnerability in dapur/apps/app_theme/libs/check_file.php via $_GET['src'] or $_GET['name']. |
CVE-2017-13664 | Critical | 9.8 | 2017-12-01 | Password file exposure in firmware in iSmartAlarm CubeOne version 2.2.4.8 and earlier allows attackers to execute arbitrary commands with administrative privil… |
CVE-2017-3764 | Medium | 5.3 | 2017-11-30 | A vulnerability was identified in Lenovo XClarity Administrator (LXCA) before 1.4.0 where LXCA user account names may be exposed to unauthenticated users with… |
CVE-2017-12365 | Medium | 4.3 | 2017-11-30 | A vulnerability in Cisco WebEx Event Center could allow an authenticated, remote attacker to view unlisted meeting information. The vulnerability is due to a d… |
CVE-2017-12361 | Medium | 4.0 | 2017-11-30 | A vulnerability in Cisco Jabber for Windows could allow an unauthenticated, local attacker to access sensitive communications made by the Jabber client. An att… |
CVE-2017-12354 | Medium | 5.3 | 2017-11-30 | A vulnerability in the web-based interface of Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to view sensitive inform… |
CVE-2017-17046 | Medium | 6.5 | 2017-11-28 | An issue was discovered in Xen through 4.9.x on the ARM platform allowing guest OS users to obtain sensitive information from DRAM after a reboot, because disj… |
CVE-2016-10702 | Medium | 6.1 | 2017-11-28 | Pebble Smartwatch devices through 4.3 mishandle UUID storage, which allows attackers to read an arbitrary application's flash storage, and access an arbitrary… |
CVE-2017-1570 | Medium | 4.3 | 2017-11-27 | IBM Jazz Foundation products could allow an authenticated user to obtain sensitive information from stack traces. IBM X-Force ID: 131852. |
CVE-2017-1484 | Medium | 4.3 | 2017-11-27 | IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 7.0 and 8.0 could allow an authenticated attacker to obtain information such as user pe… |
CVE-2017-1251 | Medium | 4.3 | 2017-11-27 | An undisclosed vulnerability in CLM applications may result in some administrative deployment parameters being shown to an attacker. IBM X-Force ID: 124631. |
CVE-2017-1240 | Medium | 4.3 | 2017-11-27 | IBM Rhapsody DM products could reveal sensitive information in HTTP 500 Internal Server Error responses. IBM X-Force ID: 124359. |
CVE-2016-6024 | Medium | 4.3 | 2017-11-27 | IBM Jazz technology based products might divulge information that might be useful in helping attackers through error messages. IBM X-Force ID: 116868. |
CVE-2017-16994 | Medium | 5.5 | 2017-11-27 | The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel before 4.14.2 mishandles holes in hugetlb ranges, which allows local users to obtain sensi… |
CVE-2017-13701 | Critical | 9.8 | 2017-11-23 | An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. The backup file contains sensitive information in a insecure way. There is no salt for pa… |
CVE-2017-8183 | Medium | 5.5 | 2017-11-22 | MTK platform in Huawei smart phones with software of earlier than Nice-AL00C00B160 versions, earlier than Nice-AL10C00B140 versions has a any memory access vul… |
CVE-2017-8136 | Medium | 5.5 | 2017-11-22 | HedEx Earlier than V200R006C00 versions has an arbitrary file download vulnerability. An attacker could exploit it to download arbitrary files on a target devi… |
CVE-2017-8130 | Medium | 6.5 | 2017-11-22 | The UMA product with software V200R001 and V300R001 has an information leak vulnerability. An attacker could exploit them to obtain some sensitive information… |
CVE-2017-8121 | Medium | 5.3 | 2017-11-22 | The UMA product with software V200R001 and V300R001 has an information leak vulnerability. An attacker could exploit them to obtain some sensitive information… |
CVE-2017-8118 | Low | 2.3 | 2017-11-22 | The UMA product with software V200R001 and V300R001 has an information leak vulnerability. An attacker could exploit them to obtain some sensitive information… |
CVE-2017-2733 | Medium | 5.5 | 2017-11-22 | Honor 6X smartphones with software versions earlier than BLN-AL10C00B357 and versions earlier than BLN-AL20C00B357 have an information leak vulnerability due t… |
CVE-2017-2732 | Medium | 5.5 | 2017-11-22 | Huawei Hilink APP Versions earlier before 5.0.25.306 has an information leak vulnerability. An attacker may trick a user into installing a malicious applicatio… |
CVE-2017-2730 | Low | 3.5 | 2017-11-22 | HUAWEI HiLink APP (for IOS) versions earlier before 5.0.25.306 and HUAWEI Tech Support APP (for IOS) versions earlier before 5.0.0 have an information leak vul… |
CVE-2017-2715 | High | 7.8 | 2017-11-22 | The Files APP 7.1.1.309 and earlier versions in some Huawei mobile phones has a brute-force password cracking vulnerability due to the improper design of the S… |
CVE-2017-2704 | High | 7.5 | 2017-11-22 | Smarthome 1.0.2.364 and earlier versions,HiAPP 7.3.0.303 and earlier versions,HwParentControl 2.0.0 and earlier versions,HwParentControlParent 5.1.0.12 and ear… |
CVE-2017-15099 | Medium | 6.5 | 2017-11-22 | INSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 disclose table contents that the invoker… |
CVE-2017-15098 | High | 8.1 | 2017-11-22 | Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x befor… |
CVE-2017-8863 | High | 7.5 | 2017-11-22 | Information disclosure of .esp source code on the Cohu 3960 allows an attacker to view sensitive information such as application logic with a simple web browse… |
CVE-2017-8860 | Medium | 6.5 | 2017-11-22 | Information disclosure through directory listing on the Cohu 3960HD allows an attacker to view and download source code, log files, and other sensitive device… |
CVE-2017-3157 | Medium | 5.5 | 2017-11-20 | By exploiting the way Apache OpenOffice before 4.1.4 renders embedded objects, an attacker could craft a document that allows reading in a file from the user's… |
CVE-2017-15110 | Medium | 4.3 | 2017-11-20 | In Moodle 3.x, students can find out email addresses of other students in the same course. Using search on the Participants page, students could search email a… |
CVE-2017-16894 | High | 7.5 | 2017-11-20 | In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env… |
CVE-2017-13702 | Medium | 5.3 | 2017-11-17 | An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. Cookies can be stolen, manipulated, and reused. |
CVE-2017-10888 | Medium | 5.5 | 2017-11-17 | BOOK WALKER for Windows Ver.1.2.9 and earlier, BOOK WALKER for Mac Ver.1.2.5 and earlier allow an attacker to access local files via unspecified vectors. |
CVE-2017-1000226 | Medium | 5.3 | 2017-11-17 | Stop User Enumeration 1.3.8 allows user enumeration via the REST API |
CVE-2017-1000234 | Medium | 5.3 | 2017-11-17 | I, Librarian version <=4.6 & 4.7 is vulnerable to Directory Enumeration in the jqueryFileTree.php resulting in attacker enumerating directories simply by navig… |
CVE-2017-1000199 | High | 7.5 | 2017-11-17 | tcmu-runner version 0.91 up to 1.20 is vulnerable to information disclosure in handler_qcow.so resulting in non-privileged users being able to check for existe… |
CVE-2017-15517 | Medium | 5.5 | 2017-11-17 | AltaVault OST Plug-in versions prior to 1.2.2 may allow attackers to obtain sensitive information via unspecified vectors. All users are urged to move to a fix… |
CVE-2017-0851 | Medium | 5.3 | 2017-11-16 | An information disclosure vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0… |
CVE-2017-0850 | Medium | 5.3 | 2017-11-16 | An information disclosure vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-64836941. |
CVE-2017-0849 | Medium | 5.3 | 2017-11-16 | An information disclosure vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-… |
CVE-2017-0848 | Medium | 5.3 | 2017-11-16 | An information disclosure vulnerability in the Android media framework (libeffects). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8… |
CVE-2017-0840 | High | 7.5 | 2017-11-16 | An information disclosure vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1… |
CVE-2017-0839 | High | 7.5 | 2017-11-16 | An information disclosure vulnerability in the Android media framework (libeffects). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8… |
CVE-2017-9701 | High | 7.5 | 2017-11-16 | In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing OEM unlock/unlock-go fastboot… |
CVE-2017-11028 | High | 7.5 | 2017-11-16 | In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the ISP Camera driver, the contents of an ar… |