CWE-200 · Information Disclosure (page 72)
Page 72 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-7148 | Low | 3.3 | 2017-10-23 | An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Location Framework" component. It allows attackers to obt… |
CVE-2017-7142 | Medium | 5.3 | 2017-10-23 | An issue was discovered in certain Apple products. Safari before 11 is affected. The issue involves the "WebKit Storage" component. It allows attackers to bypa… |
CVE-2017-7141 | Medium | 5.3 | 2017-10-23 | An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the "Mail" component. It allows remote attackers to bypas… |
CVE-2017-7140 | Medium | 5.3 | 2017-10-23 | An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Keyboard Suggestions" component. It allows attackers to o… |
CVE-2017-7139 | Low | 2.4 | 2017-10-23 | An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Phone" component. It allows attackers to obtain sensitive… |
CVE-2017-7138 | Low | 3.3 | 2017-10-23 | An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the "Directory Utility" component. It allows local users… |
CVE-2017-7131 | Medium | 5.5 | 2017-10-23 | An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Bluetooth" component. It allows attackers to obtain sensi… |
CVE-2017-7116 | High | 7.5 | 2017-10-23 | An issue was discovered in certain Apple products. iOS before 11 is affected. tvOS before 11 is affected. watchOS before 4 is affected. The issue involves the… |
CVE-2017-7090 | High | 7.5 | 2017-10-23 | An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes be… |
CVE-2017-7082 | Low | 2.4 | 2017-10-23 | An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the "Screen Lock" component. It allows physically proxima… |
CVE-2017-13127 | High | 8.1 | 2017-10-20 | The VIP.com application for IOS and Android allows remote attackers to obtain sensitive information and hijack the authentication of users via a rogue access p… |
CVE-2017-2131 | Medium | 5.3 | 2017-10-20 | Panasonic KX-HJB1000 Home unit devices with firmware GHX1YG 14.50 or HJB1000_4.47 allow an attacker to bypass access restrictions to view the configuration men… |
CVE-2015-6668 | High | 7.5 | 2017-10-19 | The Job Manager plugin before 0.7.25 allows remote attackers to read arbitrary CV files via a brute force attack to the WordPress upload directory structure, r… |
CVE-2012-4382 | Medium | 4.9 | 2017-10-19 | MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not properly protect user block metadata, which allows remote administrators to read a user block reason… |
CVE-2017-10422 | Medium | 5.9 | 2017-10-19 | Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Updates Change Assistant). The supported version… |
CVE-2017-10421 | Medium | 6.5 | 2017-10-19 | Vulnerability in the Oracle Hospitality Suite8 component of Oracle Hospitality Applications (subcomponent: Leisure). Supported versions that are affected are 8… |
CVE-2017-10383 | Medium | 5.3 | 2017-10-19 | Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Interface). Supported versions that are affect… |
CVE-2017-10373 | High | 7.5 | 2017-10-19 | Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products (subcomponent: Health Center). Supported versions that are af… |
CVE-2017-10351 | Medium | 6.2 | 2017-10-19 | Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products (subcomponent: Application Server). Supported versions that a… |
CVE-2017-10343 | Medium | 6.5 | 2017-10-19 | Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (subcomponent: Import/Export). Supported versions that are affect… |
CVE-2017-10339 | Medium | 5.9 | 2017-10-19 | Vulnerability in the Oracle Hospitality Suite8 component of Oracle Hospitality Applications (subcomponent: WebConnect). Supported versions that are affected ar… |
CVE-2017-10337 | Medium | 5.4 | 2017-10-19 | Vulnerability in the Oracle Hospitality Suite8 component of Oracle Hospitality Applications (subcomponent: Leisure). Supported versions that are affected are 8… |
CVE-2017-10335 | High | 7.5 | 2017-10-19 | Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products (subcomponent: Elastic Search). Supported versions that are a… |
CVE-2017-10334 | Medium | 4.3 | 2017-10-19 | Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Container). Supported versions that are affected are 10.3… |
CVE-2017-10332 | High | 7.5 | 2017-10-19 | Vulnerability in the Oracle Universal Work Queue component of Oracle E-Business Suite (subcomponent: Administration). Supported versions that are affected are… |
CVE-2017-10331 | Medium | 5.3 | 2017-10-19 | Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Diagnostics). Supported versions that are affected a… |
CVE-2017-10328 | High | 7.5 | 2017-10-19 | Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Diagnostics). Supported versions that are affected a… |
CVE-2017-10324 | Medium | 5.3 | 2017-10-19 | Vulnerability in the Oracle Applications Technology Stack component of Oracle E-Business Suite (subcomponent: Oracle Forms). Supported versions that are affect… |
CVE-2017-10319 | Medium | 5.3 | 2017-10-19 | Vulnerability in the Oracle Hospitality Suite8 component of Oracle Hospitality Applications (subcomponent: Leisure). Supported versions that are affected are 8… |
CVE-2017-10318 | Medium | 4.7 | 2017-10-19 | Vulnerability in the Oracle Hospitality Suite8 component of Oracle Hospitality Applications (subcomponent: WebConnect). Supported versions that are affected ar… |
CVE-2017-10317 | Medium | 4.0 | 2017-10-19 | Vulnerability in the Oracle Hospitality Suite8 component of Oracle Hospitality Applications (subcomponent: WebConnect). Supported versions that are affected ar… |
CVE-2017-10316 | Medium | 6.5 | 2017-10-19 | Vulnerability in the Oracle Hospitality Suite8 component of Oracle Hospitality Applications (subcomponent: WebConnect). Supported versions that are affected ar… |
CVE-2017-10310 | High | 7.5 | 2017-10-19 | Vulnerability in the Oracle Hyperion Financial Reporting component of Oracle Hyperion (subcomponent: Security Models). The supported version that is affected i… |
CVE-2017-10300 | Medium | 5.3 | 2017-10-19 | Vulnerability in the Siebel CRM Desktop component of Oracle Siebel CRM (subcomponent: Siebel Business Service Issues). Supported versions that are affected are… |
CVE-2017-10299 | Medium | 4.3 | 2017-10-19 | Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Security). Supported versions that are affected are 9.3.5… |
CVE-2017-10287 | Medium | 4.3 | 2017-10-19 | Vulnerability in the PeopleSoft Enterprise FSCM component of Oracle PeopleSoft Products (subcomponent: Strategic Sourcing). The supported version that is affec… |
CVE-2017-10280 | Medium | 6.5 | 2017-10-19 | Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Test Framework). Supported versions that are affe… |
CVE-2017-10261 | Medium | 6.5 | 2017-10-19 | Vulnerability in the XML Database component of Oracle Database Server. Supported versions that are affected are 11.2.0.4 and 12.1.0.2. Easily exploitable vulne… |
CVE-2017-10259 | High | 7.5 | 2017-10-19 | Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). The supported version that is affected is 1… |
CVE-2017-10197 | Medium | 4.6 | 2017-10-19 | Vulnerability in the Oracle Hospitality OPERA 5 Property Services component of Oracle Hospitality Applications (subcomponent: Folios). The supported version th… |
CVE-2017-10194 | Low | 2.7 | 2017-10-19 | Vulnerability in the Oracle Integrated Lights Out Manager (ILOM) component of Oracle Sun Systems Products Suite (subcomponent: System Management). The supporte… |
CVE-2017-10164 | Medium | 4.3 | 2017-10-19 | Vulnerability in the PeopleSoft Enterprise FSCM component of Oracle PeopleSoft Products (subcomponent: Staffing Front Office). The supported version that is af… |
CVE-2017-10154 | Medium | 5.3 | 2017-10-19 | Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). The supported version that is affected is 1… |
CVE-2017-10152 | Medium | 6.5 | 2017-10-19 | Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Container). Supported versions that are affected are 10.3… |
CVE-2017-10037 | High | 7.5 | 2017-10-19 | Vulnerability in the Oracle BI Publisher component of Oracle Fusion Middleware (subcomponent: Web Service API). Supported versions that are affected are 11.1.1… |
CVE-2017-15610 | Medium | 6.5 | 2017-10-19 | An issue was discovered in Octopus before 3.17.7. When the special Guest user account is granted the CertificateExportPrivateKey permission, and Guest Access i… |
CVE-2017-12289 | Medium | 4.4 | 2017-10-19 | A vulnerability in conditional, verbose debug logging for the IPsec feature of Cisco IOS XE Software could allow an authenticated, local attacker to display se… |
CVE-2017-12284 | Medium | 5.5 | 2017-10-19 | A vulnerability in the web interface of Cisco Jabber for Windows Client could allow an authenticated, local attacker to retrieve user profile information, whic… |
CVE-2015-3400 | Medium | 4.3 | 2017-10-18 | sharenfs 0.6.4, when built with commits bcdd594 and 7d08880 from the zfs repository, provides world readable access to the shared zfs file system, which might… |
CVE-2014-8491 | Medium | 5.3 | 2017-10-18 | The Grand Flagallery plugin before 4.25 for WordPress allows remote attackers to obtain the installation path via a request to (1) flagallery-skins/banner_widg… |
CVE-2017-15589 | Medium | 6.5 | 2017-10-18 | An issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to obtain sensitive information from the host OS (or an arbitrary guest OS) becaus… |
CVE-2017-15583 | Medium | 6.5 | 2017-10-18 | The embedded web server on ABB Fox515T 1.0 devices is vulnerable to Local File Inclusion. It accepts a parameter that specifies a file for display or for use a… |
CVE-2017-15577 | High | 7.5 | 2017-10-18 | Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles the rendering of wiki links, which allows remote attackers to obtain sensitive information. |
CVE-2017-15576 | High | 7.5 | 2017-10-18 | Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles Time Entry rendering in activity views, which allows remote attackers to obtain sensitive information. |
CVE-2017-14009 | Medium | 6.5 | 2017-10-17 | An Information Exposure issue was discovered in ProMinent MultiFLEX M10a Controller web interface. When an authenticated user uses the Change Password feature… |
CVE-2017-15537 | Medium | 5.5 | 2017-10-17 | The x86/fpu (Floating Point Unit) subsystem in the Linux kernel before 4.13.5, when a processor supports the xsave feature but not the xsaves feature, does not… |
CVE-2017-9368 | High | 7.5 | 2017-10-16 | An information disclosure vulnerability in the BlackBerry Workspaces Server could result in an attacker gaining access to source code for server-side applicati… |
CVE-2014-9147 | High | 7.5 | 2017-10-16 | Fiyo CMS 2.0.1.8 allows remote attackers to obtain sensitive information via a direct request to the database backup file in .backup/. |
CVE-2016-1265 | Critical | 9.8 | 2017-10-13 | A remote unauthenticated network based attacker with access to Junos Space may execute arbitrary code on Junos Space or gain access to devices managed by Junos… |
CVE-2017-8693 | Medium | 5.5 | 2017-10-13 | The Microsoft Graphics Component on Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an information disclosure vulnerability in… |
CVE-2017-11817 | Medium | 4.7 | 2017-10-13 | The Microsoft Windows Kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT… |
CVE-2017-11816 | Medium | 5.5 | 2017-10-13 | The Microsoft Windows Graphics Device Interface (GDI) on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and… |
CVE-2017-11815 | Medium | 5.3 | 2017-10-13 | The Microsoft Server Block Message (SMB) on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows… |
CVE-2017-11814 | Medium | 5.5 | 2017-10-13 | The Microsoft Windows Kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT… |
CVE-2017-11801 | High | 7.5 | 2017-10-13 | ChakraCore allows an attacker to execute arbitrary code in the context of the current user, due to how the ChakraCore scripting engine handles objects in memor… |
CVE-2017-11797 | High | 7.5 | 2017-10-13 | ChakraCore allows an attacker to execute arbitrary code in the context of the current user, due to how the ChakraCore scripting engine handles objects in memor… |
CVE-2017-11794 | Medium | 4.3 | 2017-10-13 | Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to obtain information to further compromise the user's system, due to how Microsoft Edge handles… |
CVE-2017-11790 | Medium | 4.3 | 2017-10-13 | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold… |
CVE-2017-11785 | Medium | 5.5 | 2017-10-13 | The Microsoft Windows Kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT… |
CVE-2017-11784 | Medium | 5.5 | 2017-10-13 | The Microsoft Windows Kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT… |
CVE-2017-11776 | High | 7.5 | 2017-10-13 | Microsoft Outlook 2016 allows an attacker to obtain the email content of a user, due to how Outlook 2016 discloses user email content, aka "Microsoft Outlook I… |
CVE-2017-11772 | High | 7.5 | 2017-10-13 | The Microsoft Windows Search component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT… |
CVE-2017-11765 | Medium | 5.5 | 2017-10-13 | The Microsoft Windows Kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT… |
CVE-2017-12849 | Medium | 5.3 | 2017-10-12 | Response discrepancy in the login and password reset forms in SilverStripe CMS before 3.5.5 and 3.6.x before 3.6.1 allows remote attackers to enumerate users v… |
CVE-2017-15277 | Medium | 6.5 | 2017-10-12 | ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when processing a GIF file that has neither a gl… |
CVE-2017-15236 | High | 7.5 | 2017-10-11 | Tiandy IP cameras 5.56.17.120 do not properly restrict a certain proprietary protocol, which allows remote attackers to read settings via a crafted request to… |
CVE-2017-15212 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can at least see the names of tags of a private project of another user. |
CVE-2017-15210 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can see thumbnails of pictures from a private project of another user. |
CVE-2017-15205 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can download attachments from a private project of another user. |
CVE-2017-15198 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can edit a category of a private project of another user. |
CVE-2017-1538 | Medium | 6.5 | 2017-10-10 | IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.2 could allow an authenticated user to obtain sensitive information from an undocumen… |
CVE-2017-11051 | High | 7.5 | 2017-10-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, information disclosure is possible in function… |
CVE-2015-6918 | Medium | 6.3 | 2017-10-10 | salt before 2015.5.5 leaks git usernames and passwords to the log. |
CVE-2017-14943 | High | 7.5 | 2017-10-10 | Trapeze TransitMaster is vulnerable to information disclosure (emails / hashed passwords) via a modified userID field in JSON data to ManageSubscriber.aspx/Get… |
CVE-2017-14603 | High | 7.5 | 2017-10-10 | In Asterisk 11.x before 11.25.3, 13.x before 13.17.2, and 14.x before 14.6.2 and Certified Asterisk 11.x before 11.6-cert18 and 13.x before 13.13-cert6, insuff… |
CVE-2017-14971 | Medium | 5.5 | 2017-10-09 | Infocus Mondopad 2.2.08 is vulnerable to a Hashed Credential Disclosure vulnerability. The attacker provides a crafted Microsoft Office document containing a l… |
CVE-2015-1828 | Medium | 5.9 | 2017-10-06 | The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-th… |
CVE-2017-14085 | Medium | 5.3 | 2017-10-06 | Information disclosure vulnerabilities in Trend Micro OfficeScan 11.0 and XG may allow unauthenticated users who can access the OfficeScan server to query the… |
CVE-2017-9628 | Medium | 5.3 | 2017-10-05 | An Information Exposure issue was discovered in Saia Burgess Controls PCD Controllers with PCD firmware versions prior to 1.28.16 or 1.24.69. In certain circum… |
CVE-2017-1000114 | Low | 3.1 | 2017-10-05 | The Datadog Plugin stores an API key to access the Datadog service in the global Jenkins configuration. While the API key is stored encrypted on disk, it was t… |
CVE-2017-1000113 | Medium | 5.5 | 2017-10-05 | The Deploy to container Plugin stored passwords unencrypted as part of its configuration. This allowed users with Jenkins master local file system access, or u… |
CVE-2017-1000108 | High | 7.5 | 2017-10-05 | The Pipeline: Input Step Plugin by default allowed users with Item/Read access to a pipeline to interact with the step to provide input. This has been changed… |
CVE-2017-1000100 | Medium | 6.5 | 2017-10-05 | When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit… |
CVE-2017-1000099 | Medium | 6.5 | 2017-10-05 | When asking to get a file from a file:// URL, libcurl provides a feature that outputs meta-data about the file using HTTP-like headers. The code doing this wou… |
CVE-2017-1000094 | Medium | 6.5 | 2017-10-05 | Docker Commons Plugin provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use to authenticate with a… |
CVE-2017-1000087 | Medium | 4.3 | 2017-10-05 | GitHub Branch Source provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use. This functionality did… |
CVE-2017-14991 | Medium | 5.5 | 2017-10-04 | The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel before 4.13.4 allows local users to obtain sensitive information from uninitialized kernel heap-… |
CVE-2017-1126 | Medium | 5.3 | 2017-10-04 | IBM WebSphere Message Broker (IBM Integration Bus 9.0 and 10.0) could allow an unauthorized user to obtain sensitive information about software versions that c… |
CVE-2017-11122 | High | 7.5 | 2017-10-04 | On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56, an attacker can trigger an information leak due to insufficient length validation, related to ICMPv6 route… |
CVE-2017-0825 | High | 7.5 | 2017-10-04 | An information disclosure vulnerability in the Broadcom wifi driver. Product: Android. Versions: Android kernel. Android ID: A-37305633. References: B-V2017063… |