CWE-200 · Information Disclosure (page 71)
Page 71 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-7439 | High | 7.5 | 2017-05-26 | NetApp OnCommand Unified Manager Core Package 5.x before 5.2.2P1 might allow remote attackers to obtain sensitive information via vectors involving error messa… |
CVE-2016-7977 | Medium | 5.5 | 2017-05-23 | Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently read arbitrary files via the use of the .li… |
CVE-2016-10073 | High | 7.5 | 2017-05-23 | The from method in library/core/class.email.php in Vanilla Forums before 2.3.1 allows remote attackers to spoof the email domain in sent messages and potential… |
CVE-2015-6586 | High | 7.5 | 2017-05-23 | The mDNS module in Huawei WLAN AC6005, AC6605, and ACU2 devices with software before V200R006C00SPC100 allows remote attackers to obtain sensitive information… |
CVE-2015-5383 | High | 7.5 | 2017-05-23 | Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs director… |
CVE-2015-5382 | Medium | 6.5 | 2017-05-23 | program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the… |
CVE-2017-9150 | Medium | 5.5 | 2017-05-22 | The do_check function in kernel/bpf/verifier.c in the Linux kernel before 4.11.1 does not make the allow_ptr_leaks value available for restricting the output o… |
CVE-2017-9149 | High | 7.5 | 2017-05-22 | Metadata Anonymisation Toolkit (MAT) 0.6 and 0.6.1 silently fails to perform "Clean metadata" actions upon invocation from the Nautilus contextual menu, which… |
CVE-2017-6987 | Medium | 5.5 | 2017-05-22 | An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS bef… |
CVE-2017-2507 | Medium | 5.5 | 2017-05-22 | An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS bef… |
CVE-2017-6647 | Medium | 5.3 | 2017-05-22 | A vulnerability in the web interface of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to access sensitive Tempora… |
CVE-2017-6646 | Medium | 5.3 | 2017-05-22 | A vulnerability in the web interface of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to access sensitive Order i… |
CVE-2017-6645 | Medium | 5.3 | 2017-05-22 | A vulnerability in the web interface of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to access sensitive Virtual… |
CVE-2017-6644 | Medium | 5.3 | 2017-05-22 | A vulnerability in the web interface of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to access sensitive informa… |
CVE-2017-6643 | Medium | 5.3 | 2017-05-22 | A vulnerability in the web interface of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to access sensitive Virtual… |
CVE-2017-6642 | Medium | 5.3 | 2017-05-22 | A vulnerability in the web interface of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to access sensitive informa… |
CVE-2017-9134 | High | 7.5 | 2017-05-21 | An information-leakage issue was discovered on Mimosa Client Radios before 2.2.3 and Mimosa Backhaul Radios before 2.2.3. There is a page in the web interface… |
CVE-2014-9970 | High | 7.5 | 2017-05-21 | jasypt before 1.9.2 allows a timing attack against the password hash comparison. |
CVE-2017-6621 | High | 7.5 | 2017-05-18 | A vulnerability in the web interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to access sensitive data. The at… |
CVE-2017-4017 | Medium | 5.3 | 2017-05-17 | User Name Disclosure in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to view user information via the appliance web i… |
CVE-2017-4016 | Medium | 5.3 | 2017-05-17 | Web Server method disclosure in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to exploit and find another hole via HTT… |
CVE-2017-4013 | Medium | 5.3 | 2017-05-17 | Banner Disclosure in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to obtain product information via HTTP response hea… |
CVE-2017-7488 | Medium | 4.3 | 2017-05-16 | Authconfig version 6.2.8 is vulnerable to an Information exposure while using SSSD to authenticate against remote server resulting in the leak of information a… |
CVE-2017-6651 | High | 7.5 | 2017-05-16 | A vulnerability in Cisco WebEx Meetings Server could allow unauthenticated, remote attackers to gain information that could allow them to access scheduled cust… |
CVE-2015-9001 | Medium | 5.5 | 2017-05-16 | In TrustZone an information exposure vulnerability can potentially occur in all Android releases from CAF using the Linux kernel. |
CVE-2016-9735 | Medium | 4.3 | 2017-05-15 | IBM Jazz Foundation could allow an authenticated user to obtain sensitive information from stack traces. IBM X-Force ID: 119781, |
CVE-2017-7495 | Medium | 5.5 | 2017-05-15 | fs/ext4/inode.c in the Linux kernel before 4.6.2, when ext4 data=ordered mode is used, mishandles a needs-flushing-before-commit list, which allows local users… |
CVE-2017-5655 | Medium | 6.5 | 2017-05-15 | In Ambari 2.2.2 through 2.4.2 and Ambari 2.5.0, sensitive data may be stored on disk in temporary files on the Ambari Server host. The temporary files are read… |
CVE-2016-8741 | High | 7.5 | 2017-05-15 | The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication. Among the choices are the S… |
CVE-2017-7486 | High | 7.5 | 2017-05-12 | PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign server passwords to any user having USAGE pri… |
CVE-2017-7484 | High | 7.5 | 2017-05-12 | It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x be… |
CVE-2016-4839 | Medium | 5.5 | 2017-05-12 | The Android Apps Money Forward (prior to v7.18.0), Money Forward for The Gunma Bank (prior to v1.2.0), Money Forward for SHIGA BANK (prior to v1.2.0), Money Fo… |
CVE-2017-0634 | Medium | 4.7 | 2017-05-12 | An information disclosure vulnerability in the Synaptics touchscreen driver could enable a local malicious application to access data outside of its permission… |
CVE-2017-0633 | Medium | 4.7 | 2017-05-12 | An information disclosure vulnerability in the Broadcom Wi-Fi driver could enable a local malicious component to access data outside of its permission levels… |
CVE-2017-0632 | Medium | 4.7 | 2017-05-12 | An information disclosure vulnerability in the Qualcomm sound codec driver could enable a local malicious application to access data outside of its permission… |
CVE-2017-0631 | Medium | 4.7 | 2017-05-12 | An information disclosure vulnerability in the Qualcomm camera driver could enable a local malicious application to access data outside of its permission level… |
CVE-2017-0630 | Medium | 4.7 | 2017-05-12 | An information disclosure vulnerability in the kernel trace subsystem could enable a local malicious application to access data outside of its permission level… |
CVE-2017-0629 | Medium | 4.7 | 2017-05-12 | An information disclosure vulnerability in the Qualcomm camera driver could enable a local malicious application to access data outside of its permission level… |
CVE-2017-0628 | Medium | 4.7 | 2017-05-12 | An information disclosure vulnerability in the Qualcomm camera driver could enable a local malicious application to access data outside of its permission level… |
CVE-2017-0627 | Medium | 4.7 | 2017-05-12 | An information disclosure vulnerability in the kernel UVC driver could enable a local malicious application to access data outside of its permission levels. Th… |
CVE-2017-0626 | Medium | 5.5 | 2017-05-12 | An information disclosure vulnerability in the Qualcomm crypto engine driver could enable a local malicious application to access data outside of its permissio… |
CVE-2017-0625 | Medium | 5.5 | 2017-05-12 | An information disclosure vulnerability in the MediaTek command queue driver could enable a local malicious application to access data outside of its permissio… |
CVE-2017-0624 | Medium | 5.5 | 2017-05-12 | An information disclosure vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to access data outside of its permission levels… |
CVE-2017-0602 | Medium | 5.5 | 2017-05-12 | An information disclosure vulnerability in Bluetooth could allow a local malicious application to bypass operating system protections that isolate application… |
CVE-2017-0598 | Medium | 5.5 | 2017-05-12 | An information disclosure vulnerability in the Framework APIs could enable a local malicious application to bypass operating system protections that isolate ap… |
CVE-2016-10296 | Medium | 4.7 | 2017-05-12 | An information disclosure vulnerability in the Qualcomm shared memory driver could enable a local malicious application to access data outside of its permissio… |
CVE-2016-10295 | Medium | 4.7 | 2017-05-12 | An information disclosure vulnerability in the Qualcomm LED driver could enable a local malicious application to access data outside of its permission levels… |
CVE-2016-10294 | Medium | 4.7 | 2017-05-12 | An information disclosure vulnerability in the Qualcomm power driver could enable a local malicious application to access data outside of its permission levels… |
CVE-2016-10293 | Medium | 4.7 | 2017-05-12 | An information disclosure vulnerability in the Qualcomm video driver could enable a local malicious application to access data outside of its permission levels… |
CVE-2017-0276 | Medium | 5.9 | 2017-05-12 | Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1, Windows… |
CVE-2017-0275 | Medium | 5.9 | 2017-05-12 | Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1, Windows… |
CVE-2017-0274 | Medium | 5.9 | 2017-05-12 | Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1, Windows… |
CVE-2017-0271 | Medium | 5.9 | 2017-05-12 | Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1, Windows… |
CVE-2017-0270 | Medium | 5.9 | 2017-05-12 | Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1, Windows… |
CVE-2017-0268 | Medium | 5.9 | 2017-05-12 | Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1, Windows… |
CVE-2017-0267 | Medium | 5.9 | 2017-05-12 | Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1, Windows… |
CVE-2017-0259 | Medium | 4.7 | 2017-05-12 | The Windows kernel in Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows authenti… |
CVE-2017-0258 | Medium | 4.7 | 2017-05-12 | The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gol… |
CVE-2017-0245 | Medium | 4.7 | 2017-05-12 | The kernel-mode drivers in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1 and Windows Server 2012 Gold allow a local authenticated attacker to execute a spe… |
CVE-2017-0242 | Medium | 5.5 | 2017-05-12 | An information disclosure vulnerability exists in the way some ActiveX objects are instantiated, aka "Microsoft ActiveX Information Disclosure Vulnerability." |
CVE-2017-0220 | Medium | 4.7 | 2017-05-12 | The Windows kernel in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Windows Server 2012 Gold allows authenticated attackers to obtain sensitive inform… |
CVE-2017-0190 | Medium | 4.4 | 2017-05-12 | The GDI component in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold… |
CVE-2017-0175 | Medium | 4.7 | 2017-05-12 | The Windows kernel in Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows authenticated attackers to obtain sensitive information via a specially craf… |
CVE-2017-8360 | Medium | 5.5 | 2017-05-12 | Conexant Systems mictray64 task, as used on HP Elite, EliteBook, ProBook, and ZBook systems, leaks sensitive data (keystrokes) to any process. In mictray64.exe… |
CVE-2017-8899 | High | 8.1 | 2017-05-11 | Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has a composite of Stored XSS and Information Disclosure issues in the attachments feature f… |
CVE-2017-8878 | Medium | 6.5 | 2017-05-10 | ASUS RT-AC* and RT-N* devices with firmware before 3.0.0.4.380.7378 allow remote authenticated users to discover the Wi-Fi password via WPS_info.xml. |
CVE-2017-8877 | Medium | 6.5 | 2017-05-10 | ASUS RT-AC* and RT-N* devices with firmware through 3.0.0.4.380.7378 allow JSONP Information Disclosure such as the SSID. |
CVE-2017-5892 | High | 7.5 | 2017-05-10 | ASUS RT-AC* and RT-N* devices with firmware before 3.0.0.4.380.7378 allow JSONP Information Disclosure such as a network map. |
CVE-2017-3067 | High | 7.5 | 2017-05-09 | Adobe Experience Manager Forms versions 6.2, 6.1, 6.0 have an information disclosure vulnerability resulting from abuse of the pre-population service in AEM Fo… |
CVE-2017-0895 | Low | 3.5 | 2017-05-08 | Nextcloud Server before 10.0.4 and 11.0.2 are vulnerable to disclosure of calendar and addressbook names to other logged-in users. Note that no actual content… |
CVE-2017-7923 | High | 8.8 | 2017-05-06 | A Password in Configuration File issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0… |
CVE-2016-8916 | Medium | 5.5 | 2017-05-05 | IBM Tivoli Storage Manager 5.5, 6.1-6.4, and 7.1 stores password information in a log file that could be read by a local user when a set password command is is… |
CVE-2017-3732 | Medium | 5.9 | 2017-05-04 | There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL 1.0.2 before 1.0.2k and 1.1.0 before 1.1.0d. No EC algorithms are affec… |
CVE-2017-6626 | Medium | 5.3 | 2017-05-03 | A vulnerability in the Cisco Finesse Notification Service for Cisco Unified Contact Center Enterprise (UCCE) 11.5(1) and 11.6(1) could allow an unauthenticated… |
CVE-2017-5481 | High | 8.8 | 2017-05-03 | Trend Micro OfficeScan 11.0 before SP1 CP 6325 and XG before CP 1352 allows remote authenticated users to gain privileges by leveraging a leak of an encrypted… |
CVE-2017-7995 | Low | 3.8 | 2017-05-03 | Xen PV guest before Xen 4.3 checked access permissions to MMIO ranges only after accessing them, allowing host PCI device space memory reads, leading to inform… |
CVE-2016-0382 | Medium | 4.0 | 2017-05-03 | The IBM Tealeaf Consumer Experience 8.7, 8.8, and 9.0 portal exposes some of its operational state in a form that may be accidentally captured and exposed by n… |
CVE-2017-7216 | Medium | 6.5 | 2017-05-02 | The Management Web Interface in Palo Alto Networks PAN-OS before 7.1.9 allows remote authenticated users to obtain sensitive information via unspecified reques… |
CVE-2016-5810 | Medium | 4.9 | 2017-05-02 | upAdminPg.asp in Advantech WebAccess before 8.1_20160519 allows remote authenticated administrators to obtain sensitive password information via unspecified ve… |
CVE-2016-5006 | Critical | 9.8 | 2017-05-02 | The Cloud Controller in Cloud Foundry before 239 logs user-provided service objects at creation, which allows attackers to obtain sensitive user credential inf… |
CVE-2016-4442 | Medium | 5.3 | 2017-05-02 | The rack-mini-profiler gem before 0.10.1 for Ruby allows remote attackers to obtain sensitive information about allocated strings and objects by leveraging inc… |
CVE-2016-10351 | Medium | 5.5 | 2017-05-01 | Telegram Desktop 0.10.19 uses 0755 permissions for $HOME/.TelegramDesktop, which allows local users to obtain sensitive authentication information via standard… |
CVE-2017-7644 | Medium | 6.5 | 2017-04-29 | The Management Web Interface in Palo Alto Networks PAN-OS before 6.1.17, 7.x before 7.0.15, and 7.1.x before 7.1.9 allows remote authenticated users to obtain… |
CVE-2017-1141 | Medium | 4.3 | 2017-04-28 | IBM Insights Foundation for Energy 1.0, 1.5, and 1.6 could allow an authenticated user to obtain sensitive information from error messages. IBM X-Force ID: 121… |
CVE-2017-2109 | Low | 2.5 | 2017-04-28 | Cybozu KUNAI for Android 3.0.4 to 3.0.5.1 allow remote attackers to obtain log information through a malicious Android application. |
CVE-2017-2105 | Medium | 5.9 | 2017-04-28 | The TVer App for Android 3.2.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and o… |
CVE-2017-2104 | Medium | 5.9 | 2017-04-28 | The Business LaLa Call App for Android 1.4.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof… |
CVE-2017-2103 | Medium | 5.9 | 2017-04-28 | The LaLa Call App for Android 2.4.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers… |
CVE-2017-2093 | Medium | 4.3 | 2017-04-28 | Cybozu Garoon 3.0.0 to 4.2.3 allow remote attackers to obtain tokens used for CSRF protection via unspecified vectors. |
CVE-2017-7415 | High | 7.5 | 2017-04-27 | Atlassian Confluence 6.x before 6.0.7 allows remote attackers to bypass authentication and read any blog or page via the drafts diff REST resource. |
CVE-2017-8057 | Medium | 5.3 | 2017-04-25 | In Joomla! 3.4.0 through 3.6.5 (fixed in 3.7.0), multiple files caused full path disclosures on systems with enabled error reporting. |
CVE-2017-7983 | Medium | 5.3 | 2017-04-25 | In Joomla! 1.5.0 through 3.6.5 (fixed in 3.7.0), mail sent using the JMail API leaked the used PHPMailer version in the mail headers. |
CVE-2017-8109 | High | 7.8 | 2017-04-25 | The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might l… |
CVE-2017-3560 | Medium | 4.3 | 2017-04-24 | Vulnerability in the Oracle Hospitality OPERA 5 Property Services component of Oracle Hospitality Applications (subcomponent: OXI Interface). Supported version… |
CVE-2017-3556 | Medium | 5.3 | 2017-04-24 | Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: File Management). Supported versions that are affect… |
CVE-2017-3552 | Medium | 4.3 | 2017-04-24 | Vulnerability in the Oracle Hospitality OPERA 5 Property Services component of Oracle Hospitality Applications (subcomponent: OPERA Room Image/Picture Setup)… |
CVE-2017-3527 | Medium | 5.3 | 2017-04-24 | Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Fluid Core). Supported versions that are affected… |
CVE-2017-3498 | Low | 3.3 | 2017-04-24 | Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). The supported version that is affected is 11.3. Easily "exp… |
CVE-2015-7247 | Critical | 9.8 | 2017-04-24 | D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 discloses usernames, passwords, keys, values, and web account hashes (super and admin) i… |
CVE-2017-2334 | High | 7.5 | 2017-04-24 | An information leak vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a network-based maliciou… |