CWE-200 · Information Disclosure (page 72)
Page 72 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-2317 | High | 8.6 | 2017-04-24 | A denial of service vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an unauthenticated, unpr… |
CVE-2014-9680 | Low | 3.3 | 2017-04-24 | sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows local users to open arbitrary files for re… |
CVE-2016-3702 | Medium | 5.3 | 2017-04-21 | Padding oracle flaw in CloudForms Management Engine (aka CFME) 5 allows remote attackers to obtain sensitive cleartext information. |
CVE-2016-1561 | High | 7.5 | 2017-04-21 | ExaGrid appliances with firmware before 4.8 P26 have a default SSH public key in the authorized_keys file for root, which allows remote attackers to obtain SSH… |
CVE-2016-1187 | Medium | 6.8 | 2017-04-21 | Cybozu KUNAI for iPhone 2.0.3 through 3.1.5 and for Android 2.1.2 through 3.0.4 does not verify SSL certificates. |
CVE-2016-1559 | High | 8.1 | 2017-04-21 | D-Link DAP-1353 H/W vers. B1 3.15 and earlier, D-Link DAP-2553 H/W ver. A1 1.31 and earlier, and D-Link DAP-3520 H/W ver. A1 1.16 and earlier reveal wireless p… |
CVE-2016-1557 | Critical | 9.8 | 2017-04-21 | Netgear WNAP320, WNDAP350, and WNDAP360 before 3.5.5.0 reveal wireless passwords and administrative usernames and passwords over SNMP. |
CVE-2016-1556 | High | 7.5 | 2017-04-21 | Information disclosure in Netgear WN604 before 3.3.3; WNAP210, WNAP320, WNDAP350, and WNDAP360 before 3.5.5.0; and WND930 before 2.0.11 allows remote attackers… |
CVE-2017-6614 | Medium | 6.5 | 2017-04-20 | A vulnerability in the file-download feature of the web user interface for Cisco FindIT Network Probe Software 1.0.0 could allow an authenticated, remote attac… |
CVE-2016-9978 | Medium | 4.3 | 2017-04-20 | IBM Curam Social Program Management 5.2, 6.0, and 7.0 could allow an authenticated attacker to disclose sensitive information. IBM X-Force ID: 120254. |
CVE-2016-8923 | Medium | 4.3 | 2017-04-20 | IBM Curam Social Program Management 5.2, 6.0, and 7.0 contains a vulnerability that would allow an authorized user to obtain sensitive information from the pro… |
CVE-2016-3732 | Medium | 4.3 | 2017-04-20 | The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote a… |
CVE-2016-3731 | Medium | 5.3 | 2017-04-20 | Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, and 2.8 through 2.8.11 allows remote attackers to obtain the names of hidden forums and forum discussions. |
CVE-2017-5158 | Critical | 9.8 | 2017-04-20 | An Information Exposure issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. Credentials may be exposed to… |
CVE-2016-4844 | Medium | 4.3 | 2017-04-20 | Cybozu Mailwise before 5.4.0 allows remote attackers to conduct clickjacking attacks. |
CVE-2016-4843 | Medium | 6.5 | 2017-04-20 | Cybozu Mailwise before 5.4.0 allows remote attackers to obtain sensitive cookie information. |
CVE-2016-4842 | Medium | 4.3 | 2017-04-20 | Cybozu Mailwise before 5.4.0 allows remote attackers to obtain information on when an email is read. |
CVE-2016-6341 | Medium | 5.5 | 2017-04-20 | oVirt Engine before 4.0.3 does not include DWH_DB_PASSWORD in the list of keys to hide in log files, which allows local users to obtain sensitive password info… |
CVE-2016-6335 | High | 7.5 | 2017-04-20 | MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 does not generate head items in the context of a given title, which allows remote atta… |
CVE-2016-6332 | High | 7.5 | 2017-04-20 | MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1, when $wgBlockDisablesLogin is true, might allow remote attackers to obtain sensitive… |
CVE-2016-5409 | High | 7.5 | 2017-04-20 | Red Hat OpenShift Enterprise 2 does not include the HTTPOnly flag in a Set-Cookie header for the GEARID cookie, which makes it easier for remote attackers to o… |
CVE-2017-5190 | Low | 3.1 | 2017-04-20 | NetIQ Access Manager 4.2 before SP3 HF1 and 4.3 before SP1 HF1, when configured as a SAML 2.0 Identity Server with Virtual Attributes, has a concurrency issue… |
CVE-2017-7282 | Medium | 5.5 | 2017-04-20 | An issue was discovered in Unitrends Enterprise Backup before 9.1.1. The function downloadFile in api/includes/restore.php blindly accepts any filename passed… |
CVE-2017-7978 | High | 7.5 | 2017-04-19 | Samsung Android devices with L(5.0/5.1), M(6.0), and N(7.x) software allow attackers to obtain sensitive information by reading a world-readable log file after… |
CVE-2016-3037 | Medium | 5.7 | 2017-04-17 | IBM Cognos TM1 10.1 and 10.2 provides a service to return the victim's password with a valid session key. An authenticated attacker with user interaction could… |
CVE-2017-5647 | High | 7.5 | 2017-04-17 | A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0… |
CVE-2016-4872 | Medium | 4.3 | 2017-04-17 | Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to bypass access restrictions to view the names of unauthorized projects via a breadcrumb t… |
CVE-2016-4869 | Medium | 6.5 | 2017-04-17 | Cybozu Office 9.0.0 to 10.4.0 allow remote attackers to obtain session information via a page where CGI environment variables are displayed. |
CVE-2016-4867 | Medium | 4.3 | 2017-04-17 | Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to bypass access restriction to view unauthorized project information via the Project funct… |
CVE-2016-7060 | Medium | 4.6 | 2017-04-14 | The web interface in Red Hat QuickStart Cloud Installer (QCI) 1.0 does not mask passwords fields, which allows physically proximate attackers to obtain sensiti… |
CVE-2016-8926 | Medium | 4.3 | 2017-04-14 | IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 could allow a remote attacker to read system files or data that is restricted to authorized u… |
CVE-2016-8925 | Medium | 6.5 | 2017-04-14 | IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 could allow a remote attacker to include arbitrary files which could allow the attacker to re… |
CVE-2017-7455 | High | 7.5 | 2017-04-14 | Moxa MXView 2.8 allows remote attackers to read web server's private key file, no access control. |
CVE-2016-8727 | High | 7.5 | 2017-04-13 | An exploitable information disclosure vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point. Retrieving a series of… |
CVE-2016-8725 | Medium | 5.3 | 2017-04-13 | An exploitable information disclosure vulnerability exists in the Web Application functionality of the Moxa AWK-3131A wireless access point running firmware 1… |
CVE-2016-8724 | Medium | 5.3 | 2017-04-13 | An exploitable information disclosure vulnerability exists in the serviceAgent functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. A sp… |
CVE-2016-8722 | Medium | 5.3 | 2017-04-13 | An exploitable Information Disclosure vulnerability exists in the Web Application functionality of Moxa AWK-3131A Series Industrial IEEE 802.11a/b/g/n wireless… |
CVE-2016-7834 | High | 8.8 | 2017-04-13 | SONY SNC-CH115, SNC-CH120, SNC-CH160, SNC-CH220, SNC-CH260, SNC-DH120, SNC-DH120T, SNC-DH160, SNC-DH220, SNC-DH220T, SNC-DH260, SNC-EB520, SNC-EM520, SNC-EM521… |
CVE-2016-2565 | Low | 3.3 | 2017-04-13 | Samsung SecEmailSync on SM-G920F build G920FXXU2COH2 (Galaxy S6) devices allows attackers to read sent e-mail messages, aka SVE-2015-5081. |
CVE-2017-3043 | Medium | 5.5 | 2017-04-12 | Adobe Acrobat Reader versions 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier have a memory address leak vulnerability in the collabora… |
CVE-2017-0208 | Medium | 4.3 | 2017-04-12 | An information disclosure vulnerability exists in Microsoft Edge when the Chakra scripting engine does not properly handle objects in memory. An attacker who s… |
CVE-2017-0194 | Medium | 5.5 | 2017-04-12 | Microsoft Excel 2007 SP3, Microsoft Excel 2010 SP2, and Office Compatibility Pack SP2 allow remote attackers to obtain sensitive information from process memor… |
CVE-2017-0192 | Medium | 4.3 | 2017-04-12 | The Adobe Type Manager Font Driver (ATMFD.dll) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2… |
CVE-2017-0188 | Low | 3.3 | 2017-04-12 | A Win32k information disclosure vulnerability exists in Windows 8.1, Windows RT 8.1, Windows Server 2012, Windows Server 2012 R2, Windows 10, and Windows Serve… |
CVE-2017-0168 | Medium | 5.8 | 2017-04-12 | An information disclosure vulnerability exists when the Windows Hyper-V Network Switch running on a Windows 8.1, Windows Server 2008, Windows Server 2008 R2, W… |
CVE-2017-0167 | Medium | 5.5 | 2017-04-12 | An information disclosure vulnerability exists in Windows 8.1, Windows RT 8.1, Windows Server 2012 R2, Windows 10, and Windows Server 2016 when the Windows ker… |
CVE-2017-0058 | Medium | 4.7 | 2017-04-12 | A Win32k information disclosure vulnerability exists in Microsoft Windows when the win32k component improperly provides kernel information. An attacker who suc… |
CVE-2017-5672 | Medium | 6.5 | 2017-04-11 | Kony Enterprise Mobile Management (EMM) before 4.2.5.2 has the vulnerability of disclosing the private key in clear-text when changing the parameters of the re… |
CVE-2017-7646 | Medium | 6.5 | 2017-04-10 | SolarWinds Log & Event Manager (LEM) before 6.3.1 Hotfix 4 allows an authenticated user to browse the server's filesystem and read the contents of arbitrary fi… |
CVE-2017-7345 | Medium | 5.3 | 2017-04-10 | NetApp OnCommand Performance Manager and OnCommand Unified Manager for Clustered Data ONTAP before 7.1P1 improperly bind the Java Management Extension Remote M… |
CVE-2017-5607 | Low | 3.5 | 2017-04-10 | Splunk Enterprise 5.0.x before 5.0.18, 6.0.x before 6.0.14, 6.1.x before 6.1.13, 6.2.x before 6.2.13.1, 6.3.x before 6.3.10, 6.4.x before 6.4.6, and 6.5.x befo… |
CVE-2015-7824 | High | 7.5 | 2017-04-10 | botan 1.11.x before 1.11.22 makes it easier for remote attackers to decrypt TLS ciphertext data via a padding-oracle attack against TLS CBC ciphersuites. |
CVE-2015-8378 | High | 7.5 | 2017-04-10 | In KeePassX before 0.4.4, a cleartext copy of password data is created upon a cancel of an XML export action. This allows context-dependent attackers to obtain… |
CVE-2016-5076 | High | 7.5 | 2017-04-10 | CloudView NMS before 2.10a allows remote attackers to obtain sensitive information via a direct request for admin/auto.def. |
CVE-2016-5059 | Medium | 6.5 | 2017-04-10 | OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 allows attackers to obtain sensitive information by reading screenshots under /private/var/mobile/Container… |
CVE-2016-5051 | High | 7.5 | 2017-04-10 | OSRAM SYLVANIA Osram Lightify Home before 2016-07-26 stores a PSK in cleartext under /private/var/mobile/Containers/Data/Application. |
CVE-2015-8276 | Medium | 5.5 | 2017-04-10 | LVRTC eParakstitajs 3.0 (1.3.0) and edoc-libraries-2.5.4_01 allow attackers to read arbitrary files via crafted EDOC files. |
CVE-2015-2886 | High | 7.5 | 2017-04-10 | iBaby M6 allows remote attackers to obtain sensitive information, related to the ibabycloud.com service. |
CVE-2015-2884 | High | 7.5 | 2017-04-10 | Philips In.Sight B120/37 allows remote attackers to obtain sensitive information via a direct request, related to yoics.net URLs, stream.m3u8 URIs, and cam_ser… |
CVE-2014-2960 | High | 7.5 | 2017-04-10 | Vision Critical before 2014-05-30 allows attackers to read arbitrary files via unspecified vectors, as demonstrated by image files and configuration files. |
CVE-2017-7589 | Medium | 6.5 | 2017-04-09 | In OpenIDM through 4.0.0 before 4.5.0, the info endpoint may leak sensitive information upon a request by the "anonymous" user, as demonstrated by responses wi… |
CVE-2017-0586 | Medium | 4.7 | 2017-04-07 | An information disclosure vulnerability in the Qualcomm sound driver could enable a local malicious application to access data outside of its permission levels… |
CVE-2017-0585 | Medium | 4.7 | 2017-04-07 | An information disclosure vulnerability in the Broadcom Wi-Fi driver could enable a local malicious application to access data outside of its permission levels… |
CVE-2017-0584 | Medium | 4.7 | 2017-04-07 | An information disclosure vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to access data outside of its permission levels… |
CVE-2017-0560 | Medium | 5.5 | 2017-04-07 | An information disclosure vulnerability in the factory reset process could enable a local malicious attacker to access data from the previous owner. This issue… |
CVE-2017-0559 | Medium | 5.5 | 2017-04-07 | An information disclosure vulnerability in libskia could enable a local malicious application to access data outside of its permission levels. This issue is ra… |
CVE-2017-0558 | Medium | 5.5 | 2017-04-07 | An information disclosure vulnerability in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue i… |
CVE-2017-0557 | Medium | 5.5 | 2017-04-07 | An information disclosure vulnerability in libmpeg2 in Mediaserver could enable a local malicious application to access data outside of its permission levels… |
CVE-2017-0556 | Medium | 5.5 | 2017-04-07 | An information disclosure vulnerability in libmpeg2 in Mediaserver could enable a local malicious application to access data outside of its permission levels… |
CVE-2017-0555 | Medium | 5.5 | 2017-04-07 | An information disclosure vulnerability in libavc in Mediaserver could enable a local malicious application to access data outside of its permission levels. Th… |
CVE-2017-0547 | Medium | 5.5 | 2017-04-07 | An information disclosure vulnerability in libmedia in Mediaserver could enable a local malicious application to access data outside of its permission levels… |
CVE-2017-3884 | Medium | 6.5 | 2017-04-07 | A vulnerability in the web interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote at… |
CVE-2017-7575 | Critical | 9.8 | 2017-04-06 | Schneider Electric Modicon TM221CE16R 1.3.3.3 devices allow remote attackers to discover the application-protection password via a \x00\x01\x00\x00\x00\x05\x01… |
CVE-2016-5349 | Medium | 5.5 | 2017-04-06 | The high level operating systems (HLOS) was not providing sufficient memory address information to ensure that secure applications inside Qualcomm Secure Execu… |
CVE-2017-0885 | Medium | 4.3 | 2017-04-05 | Nextcloud Server before 9.0.55 and 10.0.2 suffers from a error message disclosing existence of file in write-only share. Due to an error in the application log… |
CVE-2017-0330 | Medium | 4.7 | 2017-04-05 | An information disclosure vulnerability in the NVIDIA crypto driver could enable a local malicious application to access data outside of its permission levels… |
CVE-2017-0328 | Medium | 4.7 | 2017-04-05 | An information disclosure vulnerability in the NVIDIA crypto driver could enable a local malicious application to access data outside of its permission levels… |
CVE-2017-5649 | High | 7.5 | 2017-04-04 | Apache Geode before 1.1.1, when a cluster has enabled security by setting the security-manager property, allows remote authenticated users with CLUSTER:READ bu… |
CVE-2017-5670 | Medium | 4.6 | 2017-04-04 | Riverbed RiOS through 9.6.0 deletes the secure vault with the rm program (not shred or srm), which makes it easier for physically proximate attackers to obtain… |
CVE-2014-1677 | High | 7.5 | 2017-04-03 | Technicolor TC7200 with firmware STD6.01.12 could allow remote attackers to obtain sensitive information. |
CVE-2016-10314 | High | 8.8 | 2017-04-03 | Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. 3), Air:Link 5000AC (AL5000AC) version 1.13, and Air:Link 59300 (AL59300) version 1.04 (Rev. 4)… |
CVE-2016-8757 | Low | 3.3 | 2017-04-02 | ION memory management module in Huawei P9 phones with software EVA-AL10C00B192 and earlier versions, EVA-DL10C00B192 and earlier versions, EVA-TL10C00B192 and… |
CVE-2016-8272 | Medium | 5.3 | 2017-04-02 | Huawei PC client software HiSuite 4.0.5.300_OVE has an information leak vulnerability; an attacker who can log in to the system can copy out the user's proxy p… |
CVE-2016-8271 | Medium | 5.3 | 2017-04-02 | Huawei eSpace IAD V300R002C01SPC100 and earlier versions have an information leak vulnerability; an attacker can check and download the fault information by ac… |
CVE-2015-2246 | Low | 3.3 | 2017-04-02 | The MeWidget module on Huawei P7 smartphones with software P7-L10 V100R001C00B136 and earlier versions could lead to the disclosure of contact information. |
CVE-2014-9692 | High | 7.5 | 2017-04-02 | Huawei Tecal RH1288 V2 V100R002C00SPC107 and earlier versions, Tecal RH2265 V2 V100R002C00, Tecal RH2285 V2 V100R002C00SPC115 and earlier versions, Tecal RH226… |
CVE-2014-9691 | Medium | 6.5 | 2017-04-02 | Huawei Tecal RH1288 V2 V100R002C00SPC107 and earlier versions, Tecal RH2265 V2 V100R002C00, Tecal RH2285 V2 V100R002C00SPC115 and earlier versions, Tecal RH226… |
CVE-2014-8570 | Medium | 5.3 | 2017-04-02 | Huawei S9300, S9303, S9306, S9312 with software V100R002; S7700, S7703, S7706, S7712 with software V100R003, V100R006, V200R001, V200R002, V200R003, V200R005… |
CVE-2017-2489 | Medium | 5.5 | 2017-04-02 | An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "Intel Graphics Driver" component. It allows attack… |
CVE-2017-2480 | Medium | 6.5 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. iCloud before 6.2 on Windows is affected. iTune… |
CVE-2017-2452 | Medium | 4.6 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "Siri" component. It allows physically proximate attacke… |
CVE-2017-2448 | Medium | 5.9 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. The issue invol… |
CVE-2017-2426 | Low | 3.3 | 2017-04-02 | An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "iBooks" component. It allows remote attackers to o… |
CVE-2017-2424 | Medium | 6.5 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves mishandling of OpenGL shader… |
CVE-2017-2418 | Medium | 6.5 | 2017-04-02 | An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "Hypervisor" component. It allows guest OS users to… |
CVE-2017-2400 | Medium | 5.3 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "SafariViewController" component. It allows attackers to… |
CVE-2017-2397 | Low | 2.4 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "Accounts" component. It allows physically proximate att… |
CVE-2017-2385 | Medium | 5.5 | 2017-04-02 | An issue was discovered in certain Apple products. Safari before 10.1 is affected. The issue involves the "Safari Login AutoFill" component. It allows local us… |
CVE-2017-2384 | Low | 3.3 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves mishandling of deletion within the SQLite subsystem of the "… |
CVE-2017-2382 | High | 7.5 | 2017-04-02 | An issue was discovered in certain Apple products. macOS Server before 5.3 is affected. The issue involves the "Wiki Server" component. It allows remote attack… |