CWE-200 · Information Disclosure (page 73)
Page 73 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-1154 | Medium | 6.5 | 2017-03-31 | IBM Algorithmics One-Algo Risk Application 4.9.1, 5.0, and 5.1.0 could allow a user to gain access to files in the local environment which should not be viewed… |
CVE-2017-5184 | Medium | 5.3 | 2017-03-30 | A vulnerability was discovered in NetIQ Sentinel Server 8.0 before 8.0.1 that may allow leakage of information (account enumeration). |
CVE-2016-7542 | Medium | 4.9 | 2017-03-30 | A read-only administrator on Fortinet devices with FortiOS 5.2.x before 5.2.10 GA and 5.4.x before 5.4.2 GA may have access to read-write administrators passwo… |
CVE-2017-4977 | High | 7.0 | 2017-03-29 | EMC RSA Archer Security Operations Management with RSA Unified Collector Framework versions prior to 1.3.1.52 contain a sensitive information disclosure vulner… |
CVE-2016-6349 | Low | 3.3 | 2017-03-29 | The machinectl command in oci-register-machine allows local users to list running containers and possibly obtain sensitive information by running that command. |
CVE-2016-4976 | Medium | 5.5 | 2017-03-29 | Apache Ambari 2.x before 2.4.0 includes KDC administrator passwords on the kadmin command line, which allows local users to obtain sensitive information via a… |
CVE-2017-2686 | Medium | 6.5 | 2017-03-29 | Siemens RUGGEDCOM ROX I (all versions) contain a vulnerability that could allow an authenticated user to read arbitrary files through the web interface at port… |
CVE-2017-0882 | Medium | 6.3 | 2017-03-28 | Multiple versions of GitLab expose sensitive user credentials when assigning a user to an issue or merge request. A fix was included in versions 8.15.8, 8.16.7… |
CVE-2017-0881 | Medium | 4.3 | 2017-03-28 | An error in the implementation of an autosubscribe feature in the check_stream_exists route of the Zulip group chat application server before 1.4.3 allowed an… |
CVE-2016-9129 | Medium | 5.3 | 2017-03-28 | Revive Adserver before 3.2.3 suffers from Information Exposure Through Discrepancy. It is possible to check whether or not an email address was associated to o… |
CVE-2017-1143 | Medium | 5.3 | 2017-03-27 | IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Stri… |
CVE-2017-1142 | Medium | 6.5 | 2017-03-27 | IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for t… |
CVE-2016-6102 | Low | 3.7 | 2017-03-27 | IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties ha… |
CVE-2016-7474 | Medium | 5.5 | 2017-03-27 | In some cases the MCPD binary cache in F5 BIG-IP devices may allow a user with Advanced Shell access, or privileges to generate a qkview, to temporarily obtain… |
CVE-2017-2643 | Medium | 5.3 | 2017-03-26 | In Moodle 3.2.x, global search displays user names for unauthenticated users. |
CVE-2015-8628 | Medium | 5.3 | 2017-03-23 | The (1) Special:MyPage, (2) Special:MyTalk, (3) Special:MyContributions, (4) Special:MyUploads, and (5) Special:AllMyUploads pages in MediaWiki before 1.23.12… |
CVE-2015-8625 | High | 7.5 | 2017-03-23 | MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when calling the cURL librar… |
CVE-2015-5729 | Critical | 9.8 | 2017-03-23 | The Soft Access Point (AP) feature in Samsung Smart TVs X10P, X12, X14H, X14J, and NT14U and Xpress M288OFW printers generate weak WPA2 PSK keys, which makes i… |
CVE-2015-4078 | Low | 3.1 | 2017-03-23 | Cloudera Navigator 2.2.x before 2.2.4 and 2.3.x before 2.3.3 include support for SSLv3 when configured to use SSL/TLS, which makes it easier for man-in-the-mid… |
CVE-2017-5227 | High | 7.5 | 2017-03-23 | QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by reading data in an XOR format within t… |
CVE-2016-5757 | Critical | 9.8 | 2017-03-23 | iManager Admin Console in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerable to iFrame manipulation attacks, which could allow… |
CVE-2016-5754 | High | 7.5 | 2017-03-23 | Presence of a .htaccess file could leak information in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before SP2. |
CVE-2016-5752 | High | 7.5 | 2017-03-23 | The SAML2 implementation in Identity Server in NetIQ Access Manager 4.1 before 4.1.2 HF1 and 4.2 before 4.2.2 was handling unsigned SAML requests incorrectly… |
CVE-2016-1603 | Medium | 6.5 | 2017-03-23 | An information leak in the NetIQ IDM ServiceNow Driver before 1.0.0.1 could expose cryptographic attributes to logged-in users. |
CVE-2016-6650 | High | 7.5 | 2017-03-21 | EMC RecoverPoint versions prior to 5.0 and EMC RecoverPoint for Virtual Machines versions prior to 5.0 have an SSL Stripping Vulnerability that may potentially… |
CVE-2017-6318 | High | 7.5 | 2017-03-20 | saned in sane-backends 1.0.25 allows remote attackers to obtain sensitive memory information via a crafted SANE_NET_CONTROL_OPTION packet. |
CVE-2017-1155 | Medium | 4.3 | 2017-03-20 | IBM Algorithmics One-Algo Risk Application 4.9.1, 5.0, and 5.1.0 could allow a user to gain access to another user's reports using a specially crafted HTTP req… |
CVE-2016-9697 | Low | 3.1 | 2017-03-20 | An unspecified vulnerability in IBM Rhapsody DM 4.0, 5.0, and 6.0 could allow an attacker to perform a JSON Hijacking Attack. A JSON Hijacking Attack may expos… |
CVE-2016-9165 | High | 7.5 | 2017-03-20 | The get_sessions servlet in CA Unified Infrastructure Management (formerly CA Nimsoft Monitor) before 8.5 and CA Unified Infrastructure Management Snap (former… |
CVE-2016-2981 | Medium | 6.8 | 2017-03-20 | An undisclosed vulnerability in the CLM applications in IBM Jazz Team Server may allow unauthorized access to user credentials. IBM Reference #: 1999965. |
CVE-2017-3871 | Medium | 4.3 | 2017-03-17 | A RADIUS Secret Disclosure vulnerability in the web network management interface of Cisco Prime Optical for Service Providers could allow an authenticated, rem… |
CVE-2015-3882 | Medium | 5.3 | 2017-03-17 | qdPM 8.3 allows remote attackers to obtain sensitive information via invalid ID value to index.php/users/info/id/[ID], which reveals the installation path in a… |
CVE-2015-3881 | High | 7.5 | 2017-03-17 | Information disclosure issue in qdPM 8.3 allows remote attackers to obtain sensitive information via a direct request to (1) core/config/databases.yml, (2) cor… |
CVE-2014-8723 | Medium | 5.3 | 2017-03-17 | GetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to (1) plugins/anonymous_data.php or (2) plugins/InnovationPlu… |
CVE-2014-8722 | High | 7.5 | 2017-03-17 | GetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to (1) data/users/<username>.xml, (2) backups/users/<username>… |
CVE-2014-8706 | Medium | 5.3 | 2017-03-17 | Pluck CMS 4.7.2 allows remote attackers to obtain sensitive information by (1) changing "PHPSESSID" to an array; (2) adding non-alphanumeric chars to "PHPSESSI… |
CVE-2014-8702 | Medium | 5.3 | 2017-03-17 | Wonder CMS 2014 allows remote attackers to obtain sensitive information by logging into the application with an array for the password, which reveals the insta… |
CVE-2014-8701 | High | 7.5 | 2017-03-17 | Wonder CMS 2014 allows remote attackers to obtain sensitive information by viewing /files/password, which reveals the unsalted MD5 hashed password. |
CVE-2017-0128 | Medium | 4.3 | 2017-03-17 | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from pr… |
CVE-2017-0127 | Medium | 4.3 | 2017-03-17 | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from pr… |
CVE-2017-0126 | Medium | 4.3 | 2017-03-17 | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from pr… |
CVE-2017-0125 | Medium | 4.3 | 2017-03-17 | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from pr… |
CVE-2017-0124 | Medium | 4.3 | 2017-03-17 | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from pr… |
CVE-2017-0123 | Medium | 4.3 | 2017-03-17 | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from pr… |
CVE-2017-0122 | Medium | 4.3 | 2017-03-17 | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from pr… |
CVE-2017-0121 | Medium | 4.3 | 2017-03-17 | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Wind… |
CVE-2017-0120 | Medium | 4.3 | 2017-03-17 | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from pr… |
CVE-2017-0119 | Medium | 4.3 | 2017-03-17 | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from pr… |
CVE-2017-0118 | Medium | 4.3 | 2017-03-17 | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Wind… |
CVE-2017-0117 | Medium | 4.3 | 2017-03-17 | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from pr… |
CVE-2017-0116 | Medium | 4.3 | 2017-03-17 | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from pr… |
CVE-2017-0115 | Medium | 4.3 | 2017-03-17 | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from pr… |
CVE-2017-0114 | Medium | 4.3 | 2017-03-17 | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from pr… |
CVE-2017-0113 | Medium | 4.3 | 2017-03-17 | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from pr… |
CVE-2017-0112 | Medium | 4.3 | 2017-03-17 | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from pr… |
CVE-2017-0111 | Medium | 4.3 | 2017-03-17 | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from pr… |
CVE-2017-0105 | Medium | 5.5 | 2017-03-17 | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 S… |
CVE-2017-0096 | Low | 2.6 | 2017-03-17 | Hyper-V in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1, Windows Server 2012 Gold and R2; Windows 10 Gold, 1511, and… |
CVE-2017-0092 | Medium | 4.3 | 2017-03-17 | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from pr… |
CVE-2017-0091 | Medium | 4.3 | 2017-03-17 | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from pr… |
CVE-2017-0085 | Medium | 4.3 | 2017-03-17 | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from pr… |
CVE-2017-0073 | Medium | 4.3 | 2017-03-17 | The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold an… |
CVE-2017-0068 | Medium | 4.3 | 2017-03-17 | Browsers in Microsoft Edge allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Microsoft Edge Information D… |
CVE-2017-0065 | Medium | 4.3 | 2017-03-17 | Microsoft Edge allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Microsoft Browser Information Disclosur… |
CVE-2017-0063 | Medium | 6.5 | 2017-03-17 | The Color Management Module (ICM32.dll) memory handling functionality in Windows Vista SP2; Windows Server 2008 SP2 and R2; and Windows 7 SP1; Windows 8.1; Win… |
CVE-2017-0062 | Medium | 4.7 | 2017-03-17 | The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold an… |
CVE-2017-0061 | Medium | 5.3 | 2017-03-17 | The Color Management Module (ICM32.dll) memory handling functionality in Windows Vista SP2, Windows Server 2008 SP2 and R2, and Windows 7 SP1 allows remote att… |
CVE-2017-0060 | Medium | 5.5 | 2017-03-17 | The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold an… |
CVE-2017-0057 | Medium | 4.3 | 2017-03-17 | DNS client in Microsoft Windows 8.1; Windows Server 2012 R2, Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 fails to properly process… |
CVE-2017-0049 | Medium | 4.3 | 2017-03-17 | The VBScript engine in Microsoft Internet Explorer 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "… |
CVE-2017-0043 | Medium | 5.3 | 2017-03-17 | Active Directory Federation Services in Microsoft Windows 10 1607, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 Gold and R2, and Windows Server 2016… |
CVE-2017-0042 | Low | 3.1 | 2017-03-17 | Windows Media Player in Microsoft Windows 8.1; Windows Server 2012 R2; Windows RT 8.1; Windows 7 SP1; Windows 2008 SP2 and R2 SP1, Windows Server 2016; Windows… |
CVE-2017-0027 | Medium | 4.7 | 2017-03-17 | Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Services on SharePoint Server 2013 SP1 allow… |
CVE-2017-0011 | Medium | 4.3 | 2017-03-17 | Microsoft Edge allows remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Edge Information Disclosure Vulnerability." This… |
CVE-2017-0009 | Medium | 4.3 | 2017-03-17 | Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Microsoft Brow… |
CVE-2017-0008 | Medium | 4.3 | 2017-03-17 | Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explo… |
CVE-2017-5537 | Medium | 5.3 | 2017-03-15 | The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which… |
CVE-2017-5496 | Critical | 9.8 | 2017-03-15 | Sawmill Enterprise 8.7.9 allows remote attackers to gain login access by leveraging knowledge of a password hash. |
CVE-2017-5583 | Medium | 6.5 | 2017-03-15 | The Management Web Interface in Palo Alto Networks PAN-OS before 6.1.16, 7.0.x before 7.0.13, and 7.1.x before 7.1.8 allows remote authenticated users to read… |
CVE-2016-8016 | Low | 3.4 | 2017-03-14 | Information exposure in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows authenticated remote attackers to obtain the existence of u… |
CVE-2016-8747 | High | 7.5 | 2017-03-14 | An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations. Http11InputBuffer.ja… |
CVE-2014-8688 | High | 7.5 | 2017-03-14 | An issue was discovered in Telegram Messenger 2.6 for iOS and 1.8.2 for Android. Secret chat messages are available in cleartext in process memory and a .db fi… |
CVE-2015-6671 | Medium | 5.9 | 2017-03-13 | Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets, which makes it easier for context-dependent attackers to… |
CVE-2017-5674 | Critical | 9.8 | 2017-03-13 | A vulnerability in a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models allows an attacker to craft a malforme… |
CVE-2016-5894 | Medium | 5.1 | 2017-03-08 | IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 7.0 and 8.0 is vulnerable to information disclosure vulnerability. A local user could v… |
CVE-2017-0537 | Medium | 4.7 | 2017-03-08 | An information disclosure vulnerability in the kernel USB gadget driver could enable a local malicious application to access data outside of its permission lev… |
CVE-2017-0536 | Medium | 4.7 | 2017-03-08 | An information disclosure vulnerability in the Synaptics touchscreen driver could enable a local malicious application to access data outside of its permission… |
CVE-2017-0535 | Medium | 4.7 | 2017-03-08 | An information disclosure vulnerability in the HTC sound codec driver could enable a local malicious application to access data outside of its permission level… |
CVE-2017-0534 | Medium | 4.7 | 2017-03-08 | An information disclosure vulnerability in the Qualcomm video driver could enable a local malicious application to access data outside of its permission levels… |
CVE-2017-0533 | Medium | 4.7 | 2017-03-08 | An information disclosure vulnerability in the Qualcomm video driver could enable a local malicious application to access data outside of its permission levels… |
CVE-2017-0532 | Medium | 4.7 | 2017-03-08 | An information disclosure vulnerability in the MediaTek video codec driver could enable a local malicious application to access data outside of its permission… |
CVE-2017-0531 | Medium | 4.7 | 2017-03-08 | An information disclosure vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to access data outside of its permission levels… |
CVE-2017-0529 | Medium | 5.5 | 2017-03-08 | An information disclosure vulnerability in the MediaTek driver could enable a local malicious application to access data outside of its permission levels. This… |
CVE-2017-0495 | Medium | 5.5 | 2017-03-08 | An information disclosure vulnerability in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue i… |
CVE-2017-0494 | Medium | 5.5 | 2017-03-08 | An information disclosure vulnerability in AOSP Messaging could enable a remote attacker using a special crafted file to access data outside of its permission… |
CVE-2017-0461 | Medium | 4.7 | 2017-03-08 | An information disclosure vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to access data outside of its permission levels… |
CVE-2017-0459 | Medium | 4.7 | 2017-03-08 | An information disclosure vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to access data outside of its permission levels… |
CVE-2017-0455 | High | 7.8 | 2017-03-08 | An information disclosure vulnerability in the Qualcomm bootloader could help to enable a local malicious application to to execute arbitrary code within the c… |
CVE-2017-0452 | Medium | 4.7 | 2017-03-08 | An information disclosure vulnerability in the Qualcomm camera driver could enable a local malicious application to access data outside of its permission level… |
CVE-2017-0336 | Medium | 5.5 | 2017-03-08 | An information disclosure vulnerability in the NVIDIA GPU driver could enable a local malicious application to access data outside of its permission levels. Th… |