CWE-200 · Information Disclosure (page 73)
Page 73 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-0823 | High | 7.5 | 2017-10-04 | An information disclosure vulnerability in the Android system (rild). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android I… |
CVE-2017-0817 | High | 7.5 | 2017-10-04 | An information disclosure vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1… |
CVE-2017-0816 | Medium | 5.5 | 2017-10-04 | An information disclosure vulnerability in the Android media framework (libeffects). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7… |
CVE-2017-0815 | Medium | 5.5 | 2017-10-04 | An information disclosure vulnerability in the Android media framework (libeffects). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7… |
CVE-2017-0814 | High | 7.5 | 2017-10-04 | An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62800140. |
CVE-2017-0808 | High | 7.5 | 2017-10-04 | An information disclosure vulnerability in the Android framework (file system). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62301183. |
CVE-2017-9797 | Medium | 6.5 | 2017-10-03 | When an Apache Geode cluster before v1.2.1 is operating in secure mode, an unauthenticated client can enter multi-user authentication mode and send metadata me… |
CVE-2017-14772 | Low | 3.3 | 2017-10-03 | Skybox Manager Client Application is prone to information disclosure via a username enumeration attack. A local unauthenticated attacker could exploit the flaw… |
CVE-2017-14770 | Medium | 5.5 | 2017-10-03 | Skybox Manager Client Application prior to 8.5.501 is prone to an information disclosure vulnerability of user password hashes. A local authenticated attacker… |
CVE-2017-14494 | Medium | 5.9 | 2017-10-03 | dnsmasq before 2.78, when configured as a relay, allows remote attackers to obtain sensitive memory information via vectors involving handling DHCPv6 forwarded… |
CVE-2014-0043 | Medium | 5.3 | 2017-10-03 | In Apache Wicket 1.5.10 or 6.13.0, by issuing requests to special urls handled by Wicket, it is possible to check for the existence of particular classes in th… |
CVE-2017-14955 | Medium | 5.9 | 2017-10-02 | Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain se… |
CVE-2017-14954 | Medium | 5.5 | 2017-10-02 | The waitid implementation in kernel/exit.c in the Linux kernel through 4.13.4 accesses rusage data structures in unintended cases, which allows local users to… |
CVE-2017-14941 | Medium | 6.5 | 2017-10-02 | Jaspersoft JasperReports 4.7 suffers from a saved credential disclosure vulnerability, which allows a remote authenticated user to retrieve stored Data Source… |
CVE-2017-9794 | Medium | 4.3 | 2017-09-30 | When a cluster is operating in secure mode, a user with read privileges for specific data regions can use the gfsh command line utility to execute queries. In… |
CVE-2017-13991 | Medium | 5.3 | 2017-09-30 | An information leakage vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows disclosure of… |
CVE-2017-13990 | Medium | 5.3 | 2017-09-30 | An information leakage vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows disclosure of… |
CVE-2015-1027 | Medium | 5.9 | 2017-09-29 | The version checking subroutine in percona-toolkit before 2.2.13 and xtrabackup before 2.2.9 was vulnerable to silent HTTP downgrade attacks and Man In The Mid… |
CVE-2014-2029 | High | 8.1 | 2017-09-29 | The automatic version check functionality in the tools in Percona Toolkit 2.1 allows man-in-the-middle attackers to obtain sensitive information or execute arb… |
CVE-2017-14775 | Medium | 5.9 | 2017-09-28 | Laravel before 5.5.10 mishandles the remember_me token verification process because DatabaseUserProvider does not have constant-time token comparison. |
CVE-2015-5070 | Low | 3.1 | 2017-09-26 | The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.4 and… |
CVE-2015-5069 | Medium | 4.3 | 2017-09-26 | The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.3 and… |
CVE-2017-9960 | Medium | 5.3 | 2017-09-26 | An information disclosure vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the system response to error… |
CVE-2015-8707 | Critical | 9.8 | 2017-09-26 | Password reset tokens in Magento CE before 1.9.2.2, and Magento EE before 1.14.2.2 are passed via a GET request and not canceled after use, which allows remote… |
CVE-2015-0238 | Low | 3.3 | 2017-09-26 | selinux-policy as packaged in Red Hat OpenShift 2 allows attackers to obtain process listing information via a privilege escalation attack. |
CVE-2014-8889 | Medium | 5.3 | 2017-09-26 | Dropbox SDK for Android before 1.6.2 might allow remote attackers to obtain sensitive information via crafted malware or via a drive-by download attack. |
CVE-2015-8251 | Medium | 5.9 | 2017-09-25 | OpenStage 60 and OpenScape Desk Phone IP 55G SIP V3, OpenStage 15, 20E, 20 and 40 and OpenScape Desk Phone IP 35G SIP V3, OpenScape Desk Phone IP 35G Eco SIP V… |
CVE-2015-7846 | Medium | 4.6 | 2017-09-25 | Huawei S7700, S9700, S9300 before V200R07C00SPC500, and AR200, AR1200, AR2200, AR3200 before V200R005C20SPC200 allows attackers with physical access to the CF… |
CVE-2017-1346 | Low | 2.5 | 2017-09-25 | IBM Business Process Manager 7.5, 8.0, and 8.5 temporarily stores files in a temporary folder during offline installs which could be read by a local user withi… |
CVE-2017-9393 | Critical | 9.8 | 2017-09-22 | CA Identity Manager r12.6 to r12.6 SP8, 14.0, and 14.1 allows remote attackers to potentially identify passwords of locked accounts through an exhaustive searc… |
CVE-2017-14653 | Medium | 6.5 | 2017-09-22 | member/Orderinfo.asp in ASP4CMS AspCMS 2.7.2 allows remote authenticated users to read arbitrary order information via a modified OrderNo parameter. |
CVE-2017-14680 | High | 7.5 | 2017-09-21 | ZKTeco ZKTime Web 2.0.1.12280 allows remote attackers to obtain sensitive employee metadata via a direct request for a PDF document. |
CVE-2017-9676 | Medium | 4.7 | 2017-09-21 | In all Qualcomm products with Android releases from CAF using the Linux kernel, potential use after free scenarios and race conditions can occur when accessing… |
CVE-2017-8281 | Medium | 4.7 | 2017-09-21 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a race condition can allow access to already freed memory while querying event… |
CVE-2017-11040 | Medium | 5.5 | 2017-09-21 | In all Qualcomm products with Android releases from CAF using the Linux kernel, when reading from sysfs nodes, one can read more information than it is allowed… |
CVE-2017-11001 | Medium | 5.5 | 2017-09-21 | In all Qualcomm products with Android releases from CAF using the Linux kernel, the length of the MAC address is not checked which may cause out of bounds read. |
CVE-2017-10996 | Medium | 5.5 | 2017-09-21 | In all Qualcomm products with Android releases from CAF using the Linux kernel, out of bounds access is possible in c_show(), due to compat_hwcap_str[] not bei… |
CVE-2015-8559 | High | 7.5 | 2017-09-21 | The knife bootstrap command in chef Infra client before version 15.4.45 leaks the validator.pem private RSA key to /var/log/messages. |
CVE-2015-5284 | Critical | 9.8 | 2017-09-21 | ipa-kra-install in FreeIPA before 4.2.2 puts the CA agent certificate and private key in /etc/httpd/alias/kra-agent.pem, which is world readable. |
CVE-2015-9231 | High | 7.5 | 2017-09-20 | iTerm2 3.x before 3.1.1 allows remote attackers to discover passwords by reading DNS queries. A new (default) feature was added to iTerm2 version 3.0.0 (and un… |
CVE-2015-2826 | Medium | 5.3 | 2017-09-20 | WordPress Simple Ads Manager plugin 2.5.94 and 2.5.96 allows remote attackers to obtain sensitive information. |
CVE-2015-8224 | Low | 3.7 | 2017-09-20 | Huawei P8 before GRA-CL00C92B210, before GRA-L09C432B200, before GRA-TL00C01B210, and before GRA-UL00C00B210 allows remote attackers to obtain user equipment (… |
CVE-2017-8770 | High | 7.5 | 2017-09-20 | There is LFD (local file disclosure) on BE126 WIFI repeater 1.0 devices that allows attackers to read the entire filesystem on the device via a crafted getpage… |
CVE-2015-4682 | Medium | 6.5 | 2017-09-19 | Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows remote authenticated users to obtain the installation path via an HTTP POST request to PlcmR… |
CVE-2015-1849 | Medium | 5.9 | 2017-09-19 | AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.1 allows attackers to obtain sensitive information via vectors involv… |
CVE-2014-9616 | High | 7.5 | 2017-09-19 | Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to obtain sensitive information by making a request that redirects… |
CVE-2014-8174 | Critical | 9.8 | 2017-09-19 | eDeploy makes it easier for remote attackers to execute arbitrary code by leveraging use of HTTP to download files. |
CVE-2017-12616 | High | 7.5 | 2017-09-19 | When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resour… |
CVE-2017-12157 | Medium | 4.3 | 2017-09-18 | In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access. |
CVE-2017-0785 | Medium | 6.5 | 2017-09-14 | A information disclosure vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0… |
CVE-2017-0783 | Medium | 6.5 | 2017-09-14 | A information disclosure vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0… |
CVE-2017-13761 | Medium | 6.5 | 2017-09-14 | The Fastly CDN module before 1.2.26 for Magento2, when used with a third-party authentication plugin, might allow remote authenticated users to obtain sensitiv… |
CVE-2017-1490 | Medium | 5.3 | 2017-09-14 | An unspecified vulnerability in the Lifecycle Query Engine of Jazz Reporting Service 6.0 through 6.0.4 could disclose highly sensitive information. |
CVE-2017-1002100 | Medium | 6.5 | 2017-09-14 | Default access permissions for Persistent Volumes (PVs) created by the Kubernetes Azure cloud provider in versions 1.6.0 to 1.6.5 are set to "container" which… |
CVE-2015-7880 | Medium | 4.3 | 2017-09-13 | The Entity Registration module 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to obtain sensitive event registration information by leveraging the "… |
CVE-2017-14404 | High | 7.5 | 2017-09-13 | The EyesOfNetwork web interface (aka eonweb) 5.1-0 allows local file inclusion via the tool_list parameter (aka the url_tool variable) to module/tool_all/selec… |
CVE-2017-8739 | Medium | 4.3 | 2017-09-13 | Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to obtain information to further compromise the user's system, due to the way that the Microsoft… |
CVE-2017-8736 | Medium | 4.3 | 2017-09-13 | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, and Microsoft Edge and Intern… |
CVE-2017-8719 | Medium | 4.7 | 2017-09-13 | The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Wind… |
CVE-2017-8713 | Medium | 5.3 | 2017-09-13 | The Windows Hyper-V component on Microsoft Windows Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016… |
CVE-2017-8712 | Medium | 5.3 | 2017-09-13 | The Windows Hyper-V component on Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an information disclosure vulnerability when it fails to prope… |
CVE-2017-8711 | Medium | 5.3 | 2017-09-13 | The Windows Hyper-V component on Microsoft Windows 10 1607 and Windows Server 2016 allows an information disclosure vulnerability when it fails to properly val… |
CVE-2017-8709 | Medium | 4.7 | 2017-09-13 | The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Wind… |
CVE-2017-8708 | Medium | 4.7 | 2017-09-13 | The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Wind… |
CVE-2017-8707 | Medium | 5.3 | 2017-09-13 | The Windows Hyper-V component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 Gold, 1511, 1607, and 1… |
CVE-2017-8706 | Medium | 5.3 | 2017-09-13 | The Windows Hyper-V component on Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an information disclosure vulnerability when i… |
CVE-2017-8695 | Medium | 5.3 | 2017-09-13 | Windows Uniscribe in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold… |
CVE-2017-8688 | Medium | 5.5 | 2017-09-13 | Windows GDI+ on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 151… |
CVE-2017-8687 | Medium | 5.5 | 2017-09-13 | The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Wind… |
CVE-2017-8685 | Medium | 5.5 | 2017-09-13 | Windows GDI+ on Microsoft Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows information disclosure by the way it discloses kernel memory addresses… |
CVE-2017-8684 | Medium | 5.5 | 2017-09-13 | Windows GDI+ on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT 8.1, allows informati… |
CVE-2017-8683 | Medium | 5.5 | 2017-09-13 | Windows graphics on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold… |
CVE-2017-8681 | Medium | 5.5 | 2017-09-13 | The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Wind… |
CVE-2017-8680 | Medium | 5.5 | 2017-09-13 | The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT 8.1 a… |
CVE-2017-8679 | Medium | 5.5 | 2017-09-13 | The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Wind… |
CVE-2017-8678 | Medium | 5.5 | 2017-09-13 | The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Wind… |
CVE-2017-8677 | Medium | 5.5 | 2017-09-13 | The Windows GDI+ component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Window… |
CVE-2017-8676 | Low | 3.3 | 2017-09-13 | The Windows Graphics Device Interface (GDI) in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windo… |
CVE-2017-8648 | Medium | 4.3 | 2017-09-13 | Microsoft Edge in Microsoft Windows Version 1703 allows an attacker to obtain information to further compromise the user's system, due to the way that Microsof… |
CVE-2017-8643 | Medium | 4.3 | 2017-09-13 | Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to leave a malicious website open during user clipboa… |
CVE-2017-8597 | Medium | 4.3 | 2017-09-13 | Microsoft Edge in Microsoft Windows 10 Version 1703 allows an attacker to obtain information to further compromise the user's system, due to the way that Micro… |
CVE-2017-11761 | Medium | 5.3 | 2017-09-13 | Microsoft Exchange Server 2013 and Microsoft Exchange Server 2016 allow an input sanitization issue with Microsoft Exchange that could potentially result in un… |
CVE-2017-1434 | Medium | 4.7 | 2017-09-12 | IBM DB2 for Linux, UNIX and Windows 11.1 (includes DB2 Connect Server) under unusual circumstances, could expose highly sensitive information in the error log… |
CVE-2017-1162 | High | 7.5 | 2017-09-12 | IBM QRadar 7.2 and 7.3 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force I… |
CVE-2017-1000250 | Medium | 6.5 | 2017-09-12 | All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sens… |
CVE-2015-4688 | Medium | 5.3 | 2017-09-11 | Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allow remote attackers to enumerate user accounts via a series of requests. |
CVE-2017-14269 | Critical | 9.8 | 2017-09-11 | EE 4GEE WiFi MBB (before EE60_00_05.00_31) devices allow remote attackers to obtain sensitive information via a JSONP endpoint, as demonstrated by passwords an… |
CVE-2017-14240 | High | 7.5 | 2017-09-11 | There is a sensitive information disclosure vulnerability in document.php in Dolibarr ERP/CRM version 6.0.0 via the file parameter. |
CVE-2017-0793 | Medium | 5.5 | 2017-09-08 | A information disclosure vulnerability in the N/A memory subsystem. Product: Android. Versions: Android kernel. Android ID: A-35764946. |
CVE-2017-0792 | Medium | 6.5 | 2017-09-08 | A information disclosure vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: Android kernel. Android ID: A-37305578. References: B-V2017052… |
CVE-2017-0779 | Medium | 5.5 | 2017-09-08 | A information disclosure vulnerability in the Android media framework (audioflinger). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1… |
CVE-2017-0778 | High | 7.1 | 2017-09-08 | A information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-62133227. |
CVE-2017-0777 | Medium | 5.5 | 2017-09-08 | A information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-38342499. |
CVE-2017-0776 | Medium | 5.5 | 2017-09-08 | A information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-38496660. |
CVE-2011-3177 | High | 7.8 | 2017-09-08 | The YaST2 network created files with world readable permissions which could have allowed local users to read sensitive material out of network configuration fi… |
CVE-2017-2550 | High | 7.5 | 2017-09-08 | Vulnerability in Easy Joomla Backup v3.2.4. The software creates a copy of the backup in the web root with an easily guessable filename. |
CVE-2017-6793 | Medium | 6.5 | 2017-09-07 | A vulnerability in the Inventory Management feature of Cisco Prime Collaboration Provisioning Tool could allow an authenticated, remote attacker to view sensit… |
CVE-2017-12224 | Medium | 6.5 | 2017-09-07 | A vulnerability in the ability for guest users to join meetings via a hyperlink with Cisco Meeting Server could allow an authenticated, remote attacker to ente… |
CVE-2017-12216 | High | 8.8 | 2017-09-07 | A vulnerability in the web-based user interface of Cisco SocialMiner could allow an unauthenticated, remote attacker to have read and write access to informati… |
CVE-2015-8079 | Medium | 5.3 | 2017-09-07 | qt5-qtwebkit before 5.4 records private browsing URLs to its favicon database, WebpageIcons.db. |