CWE-200 · Information Disclosure (page 74)
Page 74 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-3250 | High | 7.5 | 2017-09-07 | Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors. |
CVE-2015-6250 | Medium | 5.3 | 2017-09-06 | simple-php-captcha before commit 9d65a945029c7be7bb6bc893759e74c5636be694 allows remote attackers to automatically generate the captcha response by running the… |
CVE-2015-5959 | Critical | 9.8 | 2017-09-06 | Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/sql-error.log. |
CVE-2015-3454 | High | 7.5 | 2017-09-06 | TelescopeJS before 0.15 leaks user bcrypt password hashes in websocket messages, which might allow remote attackers to obtain password hashes via a cross-site… |
CVE-2017-14156 | Medium | 5.5 | 2017-09-05 | The atyfb_ioctl function in drivers/video/fbdev/aty/atyfb_base.c in the Linux kernel through 4.12.10 does not initialize a certain data structure, which allows… |
CVE-2016-3086 | Critical | 9.8 | 2017-09-05 | The YARN NodeManager in Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the password for credential store provider used by the NodeManager to… |
CVE-2017-14140 | Medium | 5.5 | 2017-09-05 | The move_pages system call in mm/migrate.c in the Linux kernel before 4.12.9 doesn't check the effective uid of the target process, enabling a local attacker t… |
CVE-2017-10793 | High | 8.1 | 2017-09-03 | The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589, NVG599, and unspecified other devices, when IP Passthrough mode is not used, configures an sbdc.ha W… |
CVE-2017-14114 | Medium | 6.5 | 2017-09-02 | RTPproxy through 2.2.alpha.20160822 has a NAT feature that results in not properly determining the IP address and port number of the legitimate recipient of RT… |
CVE-2017-14099 | High | 7.5 | 2017-09-02 | In res/res_rtp_asterisk.c in Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cert17 and 13.x… |
CVE-2017-14053 | High | 7.5 | 2017-09-01 | NetApp OnCommand Unified Manager for Clustered Data ONTAP before 7.2P1 does not set the secure flag for an unspecified cookie in an HTTPS session, which makes… |
CVE-2017-12872 | Medium | 5.9 | 2017-09-01 | The (1) Htpasswd authentication source in the authcrypt module and (2) SimpleSAML_Session class in SimpleSAMLphp 1.14.11 and earlier allow remote attackers to… |
CVE-2017-12870 | Medium | 5.9 | 2017-09-01 | SimpleSAMLphp 1.14.12 and earlier make it easier for man-in-the-middle attackers to obtain sensitive information by leveraging use of the aesEncrypt and aesDec… |
CVE-2014-8675 | High | 7.5 | 2017-08-31 | Soplanning 1.32 and earlier generates static links for sharing ICAL calendars with embedded login information, which allows remote attackers to obtain a calend… |
CVE-2017-12734 | High | 7.5 | 2017-08-30 | A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V1.81.2). An attacker with network access to the integrated web serve… |
CVE-2016-5001 | Medium | 5.5 | 2017-08-30 | This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of HDFS. A local user o… |
CVE-2017-13774 | High | 7.8 | 2017-08-30 | Hikvision iVMS-4200 devices before v2.6.2.7 allow local users to generate password-recovery codes via unspecified vectors. |
CVE-2017-0379 | High | 7.5 | 2017-08-29 | Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret key, related to cip… |
CVE-2016-2978 | Low | 3.3 | 2017-08-29 | IBM Sametime 8.5.2 and 9.0 could store potentially sensitive information from the browser cache locally that could be available to a local user. IBM X-Force ID… |
CVE-2016-2976 | Medium | 4.3 | 2017-08-29 | IBM Sametime Meeting Server 8.5.2 and 9.0 could allow a meeting invitee to obtain previously cleared sensitive information by viewing the meeting report histor… |
CVE-2016-2974 | Low | 3.3 | 2017-08-29 | IBM Sametime Connect 8.5.2 and 9.0, after uninstalling the Sametime Rich Client, could disclose potentially sensitive information related to the Sametime envir… |
CVE-2016-2966 | Medium | 4.3 | 2017-08-29 | IBM Sametime 8.5.1 and 9.0 could allow an authenticated user to enumerate meeting rooms by guessing the meeting room id. IBM X-Force ID: 113847. |
CVE-2016-2964 | Medium | 5.3 | 2017-08-29 | IBM Sametime 8.5.2 and 9.0 under certain conditions provides an error message to a user that is too detailed and may reveal details about the application. IBM… |
CVE-2016-0358 | Medium | 4.3 | 2017-08-29 | IBM Sametime 8.5.2 and 9.0 could allow an unauthorized authenticated user to enumerate group chat ID numbers and join meetings that he was not invited to. IBM… |
CVE-2017-3154 | High | 7.5 | 2017-08-29 | Error responses from Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating included stack trace, exposing excessive information. |
CVE-2013-7431 | Medium | 5.3 | 2017-08-29 | Full path disclosure in the Googlemaps plugin before 3.1 for Joomla!. |
CVE-2016-2971 | Medium | 5.3 | 2017-08-29 | IBM Sametime Media Services 8.5.2 and 9.0 can disclose sensitive information in stack trace error logs that could aid an attacker in future attacks. IBM X-Forc… |
CVE-2016-2969 | Medium | 4.3 | 2017-08-29 | IBM Sametime Meeting Server 8.5.2 and 9.0 may send replies that contain emails of people that should not be in these messages. IBM X-Force ID: 113850. |
CVE-2015-7255 | High | 7.5 | 2017-08-29 | ZTE OX-330P, ZXHN H108N, W300V1.0.0S_ZRD_TR1_D68, HG110, GAN9.8T101A-B, MF28G, ZXHN H108N use non-unique X.509 certificates and SSH host keys, which might allo… |
CVE-2017-1110 | Medium | 6.5 | 2017-08-29 | IBM Curam Social Program Management 6.0, 6.1, 6.2, and 7.0 contains an unspecified vulnerability that could allow an authenticated user to view the incidents o… |
CVE-2016-2970 | Medium | 4.3 | 2017-08-29 | IBM Sametime 8.5 and 9.0 meetings server may provide detailed information in an error message that may provide details about the application to possible attack… |
CVE-2017-9978 | Medium | 5.3 | 2017-08-28 | On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, a flaw was found with the error message sent as a response for users that don't exist on the syste… |
CVE-2015-1600 | High | 7.5 | 2017-08-28 | Information disclosure vulnerability in Netatmo Indoor Module firmware 100 and earlier. |
CVE-2014-9483 | High | 7.5 | 2017-08-28 | Emacs 24.4 allows remote attackers to bypass security restrictions. |
CVE-2017-12857 | High | 8.8 | 2017-08-25 | Polycom SoundStation IP, VVX, and RealPresence Trio that are running software older than UCS 4.0.12, 5.4.5 rev AG, 5.4.7, 5.5.2, or 5.6.0 are affected by a vul… |
CVE-2014-7860 | Medium | 5.3 | 2017-08-25 | The web/web_file/fb_publish.php script in D-Link DNS-320L before 1.04b12 and DNS-327L before 1.03b04 Build0119 does not authenticate requests, which allows rem… |
CVE-2017-13695 | Medium | 5.5 | 2017-08-25 | The acpi_ns_evaluate() function in drivers/acpi/acpica/nseval.c in the Linux kernel through 4.12.9 does not flush the operand cache and causes a kernel stack d… |
CVE-2017-13694 | Medium | 5.5 | 2017-08-25 | The acpi_ps_complete_final_op() function in drivers/acpi/acpica/psobject.c in the Linux kernel through 4.12.9 does not flush the node and node_ext caches and c… |
CVE-2017-13693 | Medium | 5.5 | 2017-08-25 | The acpi_ds_create_operands() function in drivers/acpi/acpica/dsutils.c in the Linux kernel through 4.12.9 does not flush the operand cache and causes a kernel… |
CVE-2015-1800 | High | 7.5 | 2017-08-24 | The samsung_extdisp driver in the Samsung S4 (GT-I9500) I9500XXUEMK8 kernel 3.4 and earlier allows attackers to potentially obtain sensitive information. |
CVE-2017-9512 | High | 7.5 | 2017-08-24 | The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sensitive information… |
CVE-2017-13143 | High | 7.5 | 2017-08-23 | In ImageMagick before 6.9.7-6 and 7.x before 7.0.4-6, the ReadMATImage function in coders/mat.c uses uninitialized data, which might allow remote attackers to… |
CVE-2017-1422 | Low | 3.3 | 2017-08-22 | IBM MaaS360 DTM all versions up to 3.81 does not perform proper verification for user rights of certain applications which could disclose sensitive information… |
CVE-2016-6311 | Medium | 5.3 | 2017-08-22 | Get requests in JBoss Enterprise Application Platform (EAP) 7 disclose internal IP addresses to remote attackers. |
CVE-2016-6310 | Medium | 5.5 | 2017-08-22 | oVirt Engine discloses the ENGINE_HTTPS_PKI_TRUST_STORE_PASSWORD in /var/log/ovirt-engine/engine.log file in RHEV before 4.0. |
CVE-2017-8037 | High | 7.5 | 2017-08-21 | In Cloud Foundry Foundation CAPI-release versions after v1.6.0 and prior to v1.38.0 and cf-release versions after v244 and prior to v270, there is an incomplet… |
CVE-2017-9682 | Medium | 4.7 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a race condition in two KGSL driver functions can lead to a Use After Free cond… |
CVE-2017-9680 | High | 7.5 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, if a pointer argument coming from userspace is invalid, a driver may use an uni… |
CVE-2017-9679 | High | 7.5 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, if a userspace string is not NULL-terminated, kernel memory contents can leak t… |
CVE-2017-8254 | Medium | 5.5 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, an audio client pointer is dereferenced before being checked if it is valid. |
CVE-2015-4071 | Medium | 5.3 | 2017-08-18 | The Helpdesk Pro Plugin before 1.4.0 for Joomla! allows remote attackers to read the support tickets of arbitrary users via obtaining the target ticketId, and… |
CVE-2015-7945 | High | 7.5 | 2017-08-18 | The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before… |
CVE-2017-1501 | Medium | 5.9 | 2017-08-18 | IBM WebSphere Application Server 8.0, 8.5, and 9.0 could provide weaker than expected security after using the Admin Console to update the web services securit… |
CVE-2017-6786 | Medium | 6.3 | 2017-08-17 | A vulnerability in Cisco Elastic Services Controller could allow an authenticated, local, unprivileged attacker to access sensitive information, including cred… |
CVE-2017-6784 | Medium | 5.3 | 2017-08-17 | A vulnerability in the web interface of the Cisco RV340, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an unauthenticated, remote attacker to acce… |
CVE-2017-6783 | Medium | 4.3 | 2017-08-17 | A vulnerability in SNMP polling for the Cisco Web Security Appliance (WSA), Email Security Appliance (ESA), and Content Security Management Appliance (SMA) cou… |
CVE-2017-6778 | Medium | 6.5 | 2017-08-17 | A vulnerability in the Elastic Services Controller (ESC) web interface of the Cisco Ultra Services Platform could allow an authenticated, remote attacker to ac… |
CVE-2017-6777 | Medium | 4.9 | 2017-08-17 | A vulnerability in the ConfD server of the Cisco Elastic Services Controller (ESC) could allow an authenticated, remote attacker to acquire sensitive system in… |
CVE-2017-6772 | Medium | 4.3 | 2017-08-17 | A vulnerability in Cisco Elastic Services Controller (ESC) could allow an authenticated, remote attacker to view sensitive information. The vulnerability is du… |
CVE-2017-6771 | High | 7.5 | 2017-08-17 | A vulnerability in the AutoVNF automation tool of the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to acquire sensitive infor… |
CVE-2016-5858 | Medium | 4.7 | 2017-08-16 | In an ioctl handler in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, if a user supplies a value too large, then an out-of-bou… |
CVE-2016-5855 | Medium | 4.7 | 2017-08-16 | In a driver in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, a user-supplied buffer is casted to a structure without checking… |
CVE-2016-5854 | Medium | 4.7 | 2017-08-16 | In a driver in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, kernel heap memory can be exposed to userspace. |
CVE-2016-5347 | Medium | 4.7 | 2017-08-16 | In all Qualcomm products with Android releases from CAF using the Linux kernel, kernel stack data can be leaked to userspace by an audio driver. |
CVE-2017-12855 | Medium | 6.5 | 2017-08-15 | Xen maintains the _GTF_{read,writ}ing bits as appropriate, to inform the guest that a grant is in use. A guest is expected not to modify the grant details whil… |
CVE-2016-6029 | Medium | 5.9 | 2017-08-14 | IBM Emptoris Strategic Supply Management Platform 10.0 and 10.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properl… |
CVE-2015-3614 | High | 7.5 | 2017-08-11 | Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote attackers to obtain arbitrary files via vectors involving another unspecified vulne… |
CVE-2017-3118 | Medium | 6.5 | 2017-08-11 | Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has a security bypass vulnerab… |
CVE-2017-3115 | Medium | 6.5 | 2017-08-11 | Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an information disclosure… |
CVE-2017-3110 | High | 7.5 | 2017-08-11 | Adobe Experience Manager 6.1 and earlier has a sensitive data exposure vulnerability. |
CVE-2017-3107 | High | 7.5 | 2017-08-11 | Adobe Experience Manager 6.3 and earlier has a misconfiguration vulnerability. |
CVE-2017-11272 | High | 7.5 | 2017-08-11 | Adobe Digital Editions 4.5.4 and earlier has a security bypass vulnerability. |
CVE-2017-11232 | Medium | 6.5 | 2017-08-11 | Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable use after f… |
CVE-2017-8269 | Medium | 5.5 | 2017-08-11 | Userspace-controlled non null terminated parameter for IPA WAN ioctl in all Qualcomm products with Android releases from CAF using the Linux kernel can lead to… |
CVE-2017-8258 | Medium | 5.5 | 2017-08-11 | An array out-of-bounds access in all Qualcomm products with Android releases from CAF using the Linux kernel can potentially occur in a camera driver. |
CVE-2017-7737 | Medium | 4.9 | 2017-08-10 | An information disclosure vulnerability in Fortinet FortiWeb 5.8.2 and below versions allows logged-in admin user to view SNMPv3 user password in cleartext in… |
CVE-2017-3130 | High | 7.5 | 2017-08-10 | An information disclosure vulnerability in Fortinet FortiOS 5.6.0, 5.4.4 and below versions allows attacker to get FortiOS version info by inspecting FortiOS I… |
CVE-2017-1377 | Medium | 4.3 | 2017-08-10 | IBM Runbook Automation reveals sensitive information in error messages that could be used in further attacks against the system. IBM X-Force ID: 126874. |
CVE-2017-0739 | Medium | 5.5 | 2017-08-09 | A information disclosure vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Andro… |
CVE-2017-0738 | Medium | 5.5 | 2017-08-09 | A information disclosure vulnerability in the Android media framework (audioserver). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7… |
CVE-2015-3277 | High | 7.5 | 2017-08-09 | The mod_nss module before 1.0.11 in Fedora allows remote attackers to obtain cipher lists due to incorrect parsing of multi-keyword cipherstring. |
CVE-2015-0785 | High | 7.5 | 2017-08-09 | com.novell.zenworks.inventory.rtr.actionclasses.wcreports in Novell ZENworks Configuration Management (ZCM) allows remote attackers to read arbitrary folders v… |
CVE-2015-0784 | High | 7.5 | 2017-08-09 | Rtrlet.class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to obtain Session IDs of logged in users via a value of ShowLogins for t… |
CVE-2015-0783 | Medium | 6.5 | 2017-08-09 | The FileViewer class in Novell ZENworks Configuration Management (ZCM) allows remote authenticated users to read arbitrary files via the filename variable. |
CVE-2017-8668 | Medium | 5.5 | 2017-08-08 | The Volume Manager Extension Driver in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2… |
CVE-2017-8666 | Medium | 5.5 | 2017-08-08 | Microsoft Win32k in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 160… |
CVE-2017-8662 | Medium | 4.3 | 2017-08-08 | Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to disclose information due to how strings are validated in specific scenarios, aka "Microsoft E… |
CVE-2017-8659 | Medium | 4.3 | 2017-08-08 | Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to obtain information to further compromise the user's system due to the Chakra scripting engine… |
CVE-2017-8652 | Medium | 6.5 | 2017-08-08 | Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to disclose information due to the way that Microsoft… |
CVE-2017-8644 | Medium | 4.3 | 2017-08-08 | Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to disclose information due to the way that Microsoft… |
CVE-2017-8516 | High | 7.5 | 2017-08-08 | Microsoft SQL Server Analysis Services in Microsoft SQL Server 2012, Microsoft SQL Server 2014, and Microsoft SQL Server 2016 allows an information disclosure… |
CVE-2011-4343 | High | 7.5 | 2017-08-08 | Information disclosure vulnerability in Apache MyFaces Core 2.0.1 through 2.0.10 and 2.1.0 through 2.1.4 allows remote attackers to inject EL expressions via c… |
CVE-2010-3845 | Critical | 9.8 | 2017-08-08 | libapache-authenhook-perl 2.00-04 stores usernames and passwords in plaintext in the vhost error log. |
CVE-2017-11155 | High | 7.5 | 2017-08-08 | An information exposure vulnerability in index.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to obtain sensitive system… |
CVE-2017-10093 | Medium | 5.3 | 2017-08-08 | Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Security). Supported versions that are affected are 9.3.5… |
CVE-2017-10084 | Medium | 6.5 | 2017-08-08 | Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Report Generator). Supported versions… |
CVE-2016-6220 | High | 7.5 | 2017-08-07 | Information Disclosure vulnerability in the Dashboard and Error Pages in Trend Micro Control Manager SP3 6.0. |
CVE-2014-3462 | High | 7.5 | 2017-08-07 | The ".encfs6.xml" configuration file in encfs before 1.7.5 allows remote attackers to access sensitive data by setting "blockMACBytes" to 0 and adding 8 to "bl… |
CVE-2017-6752 | High | 7.5 | 2017-08-07 | A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) 9.3(3) and 9.6(2) could allow an unauthenticated, remote attacker to determ… |
CVE-2017-9862 | High | 7.5 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. When signed into Sunny Explorer with a wrong password, it is possible to create a debug report, discl… |