CWE-200 · Information Disclosure (page 75)
Page 75 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-9858 | High | 7.5 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. By sending crafted packets to an inverter and observing the response, active and inactive user accoun… |
CVE-2017-12419 | Medium | 4.9 | 2017-08-05 | If, after successful installation of MantisBT through 2.5.2 on MySQL/MariaDB, the administrator does not remove the 'admin' directory (as recommended in the "P… |
CVE-2017-11387 | High | 7.5 | 2017-08-02 | Authentication Bypass in Trend Micro Control Manager 6.0 causes Information Disclosure when authentication validation is not done for functionality that can ch… |
CVE-2017-7890 | Medium | 6.5 | 2017-08-02 | The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7, doe… |
CVE-2017-11356 | Medium | 6.5 | 2017-08-02 | The application distribution export functionality in PEGA Platform 7.2 ML0 and earlier allows remote authenticated users with certain privileges to obtain sens… |
CVE-2015-3642 | Medium | 5.9 | 2017-08-02 | The TLS and DTLS processing functionality in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway devices with firmware 9.x before 9.3… |
CVE-2017-8572 | Medium | 5.5 | 2017-08-01 | Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Microsoft Office allows an information dis… |
CVE-2017-4923 | Critical | 9.8 | 2017-08-01 | VMware vCenter Server (6.5 prior to 6.5 U1) contains an information disclosure vulnerability. This issue may allow plaintext credentials to be obtained when us… |
CVE-2017-4922 | Medium | 6.5 | 2017-08-01 | VMware vCenter Server (6.5 prior to 6.5 U1) contains an information disclosure issue due to the service startup script using world writable directories as temp… |
CVE-2015-5059 | Medium | 5.3 | 2017-08-01 | The "Project Documentation" feature in MantisBT 1.2.19 and earlier, when the threshold to access files ($g_view_proj_doc_threshold) is set to ANYBODY, allows r… |
CVE-2017-9495 | Medium | 4.6 | 2017-07-31 | The Comcast firmware on Motorola MX011ANM (firmware version MX011AN_2.9p6s1_PROD_sey) devices allows physically proximate attackers to read arbitrary files by… |
CVE-2017-9492 | High | 7.5 | 2017-07-31 | The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST); Cisco DPC3939 (firmware version dpc3939-P20-18-v303r204217… |
CVE-2017-9491 | Medium | 5.3 | 2017-07-31 | The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST); Cisco DPC3939 (firmware version dpc3939-P20-18-v303r204217… |
CVE-2017-9487 | Medium | 5.9 | 2017-07-31 | The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST) and DPC3941T (firmware version DPC3941_2.5s3_PROD_sey) devi… |
CVE-2017-9486 | High | 7.5 | 2017-07-31 | The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST) devices allows remote attackers to compute password-of-the-… |
CVE-2017-9484 | High | 7.5 | 2017-07-31 | The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST) and DPC3939 (firmware version dpc3939-P20-18-v303r20421746-… |
CVE-2017-9480 | Medium | 5.5 | 2017-07-31 | The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST) devices allows local users (e.g., users who have command ac… |
CVE-2017-9478 | High | 7.5 | 2017-07-31 | The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST) and DPC3939 (firmware version dpc3939-P20-18-v303r20421746-… |
CVE-2017-9477 | Medium | 6.5 | 2017-07-31 | The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST) and DPC3939 (firmware version dpc3939-P20-18-v303r20421746-… |
CVE-2017-9476 | Medium | 6.5 | 2017-07-31 | The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST); Cisco DPC3939 (firmware version dpc3939-P20-18-v303r204217… |
CVE-2017-11706 | High | 7.5 | 2017-07-28 | The Boozt Fashion application before 2.3.4 for Android allows remote attackers to read login credentials by sniffing the network and leveraging the lack of SSL… |
CVE-2015-5187 | Medium | 6.5 | 2017-07-25 | Candlepin allows remote attackers to obtain sensitive information by obtaining Java exception statements as a result of excessive web traffic. |
CVE-2015-3171 | Medium | 5.5 | 2017-07-25 | sosreport 3.2 uses weak permissions for generated sosreport archives, which allows local users with access to /var/tmp/ to obtain sensitive information by read… |
CVE-2017-8035 | High | 7.5 | 2017-07-25 | An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions after v1.6.0 and prior to v1.35.0 and cf-release versions… |
CVE-2017-9554 | Medium | 5.3 | 2017-07-24 | An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to enumerate valid… |
CVE-2017-11327 | Medium | 6.5 | 2017-07-24 | An issue was discovered in Tilde CMS 1.0.1. It is possible to retrieve sensitive data by using direct references. A low-privileged user can load PHP resources… |
CVE-2017-11325 | High | 7.5 | 2017-07-24 | An issue was discovered in Tilde CMS 1.0.1. Arbitrary files can be read via a file=../ attack on actionphp/download.File.php. |
CVE-2017-1381 | Low | 3.3 | 2017-07-21 | IBM WebSphere Application Server Proxy Server or On-demand-router (ODR) 7.0, 8.0, 8.5, 9.0 and could allow a local attacker to obtain sensitive information, ca… |
CVE-2017-1374 | Medium | 6.5 | 2017-07-21 | Sensitive data can be exposed in the IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 that can lead to an attacker gaining unauthorized access to the system… |
CVE-2015-3198 | High | 7.5 | 2017-07-21 | The Undertow module of WildFly 9.x before 9.0.0.CR2 and 10.x before 10.0.0.Alpha1 allows remote attackers to obtain the source code of a JSP page via a "/" at… |
CVE-2015-1323 | Medium | 5.5 | 2017-07-21 | The simulate dbus method in aptdaemon before 1.1.1+bzr982-0ubuntu3.1 as packaged in Ubuntu 15.04, before 1.1.1+bzr980-0ubuntu1.1 as packaged in Ubuntu 14.10, b… |
CVE-2017-11502 | Critical | 9.8 | 2017-07-20 | Technicolor DPC3928AD DOCSIS devices allow remote attackers to read arbitrary files via a request starting with "GET /../" on TCP port 4321. |
CVE-2017-7058 | Low | 2.4 | 2017-07-20 | An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. The issue involves the "Notifications" component. It allows physically proxim… |
CVE-2017-7029 | Medium | 5.5 | 2017-07-20 | An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. macOS before 10.12.6 is affected. tvOS before 10.2.2 is affected. watchOS bef… |
CVE-2017-7028 | Medium | 5.5 | 2017-07-20 | An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. macOS before 10.12.6 is affected. tvOS before 10.2.2 is affected. watchOS bef… |
CVE-2016-6018 | Medium | 4.3 | 2017-07-19 | IBM Emptoris Contract Management 10.0 and 10.1 reveals detailed error messages in certain features that could cause an attacker to gain additional information… |
CVE-2017-11448 | Medium | 6.5 | 2017-07-19 | The ReadJPEGImage function in coders/jpeg.c in ImageMagick before 7.0.6-1 allows remote attackers to obtain sensitive information from uninitialized memory loc… |
CVE-2017-11435 | Critical | 9.8 | 2017-07-19 | The Humax Wi-Fi Router model HG100R-* 2.0.6 is prone to an authentication bypass vulnerability via specially crafted requests to the management console. The bu… |
CVE-2017-9245 | High | 7.5 | 2017-07-19 | The Google News and Weather application before 3.3.1 for Android allows remote attackers to read OAuth tokens by sniffing the network and leveraging the lack o… |
CVE-2017-9933 | High | 7.5 | 2017-07-17 | Improper cache invalidation in Joomla! CMS 1.7.3 through 3.7.2 leads to disclosure of form contents. |
CVE-2017-9812 | High | 7.5 | 2017-07-17 | The reportId parameter of the getReportStatus action method can be abused in the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance… |
CVE-2017-7947 | Medium | 6.5 | 2017-07-17 | NetApp Clustered Data ONTAP before 8.3.2P11, 9.0 before P4, and 9.1 before P5 allow attackers to obtain sensitive password information by leveraging logging of… |
CVE-2017-3742 | Medium | 4.8 | 2017-07-17 | In Lenovo Connect2 versions earlier than 4.2.5.4885 for Windows and 4.2.5.3071 for Android, when an ad-hoc connection is made between two systems for the purpo… |
CVE-2017-7531 | Medium | 4.3 | 2017-07-17 | In Moodle 3.3, the course overview block reveals activities in hidden courses. |
CVE-2017-2642 | Medium | 6.5 | 2017-07-17 | Moodle 3.x has user fullname disclosure on the user preferences page. |
CVE-2017-7683 | High | 7.5 | 2017-07-17 | Apache OpenMeetings 1.0.0 displays Tomcat version and detailed error stack trace, which is not secure. |
CVE-2017-1000362 | Critical | 9.8 | 2017-07-17 | The re-key admin monitor was introduced in Jenkins 1.498 and re-encrypted all secrets in JENKINS_HOME with a new key. It also created a backup directory with a… |
CVE-2017-1000029 | High | 7.5 | 2017-07-17 | Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to Local File Inclusion vulnerability, that makes it possible to include arbitrary… |
CVE-2017-1000025 | High | 7.5 | 2017-07-17 | GNOME Web (Epiphany) 3.23 before 3.23.5, 3.22 before 3.22.6, 3.20 before 3.20.7, 3.18 before 3.18.11, and prior versions, is vulnerable to a password manager s… |
CVE-2017-1000007 | Medium | 5.9 | 2017-07-17 | txAWS (all current versions) fail to perform complete certificate verification resulting in vulnerability to MitM attacks and information disclosure. |
CVE-2017-0196 | Medium | 6.5 | 2017-07-17 | An information disclosure vulnerability in Microsoft scripting engine allows remote attackers to obtain sensitive information from process memory via a crafted… |
CVE-2015-5152 | High | 8.1 | 2017-07-17 | Foreman after 1.1 and before 1.9.0-RC1 does not redirect HTTP requests to HTTPS when the require_ssl setting is set to true, which allows remote attackers to o… |
CVE-2017-9788 | Critical | 9.1 | 2017-07-13 | In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset bef… |
CVE-2016-8964 | Critical | 9.8 | 2017-07-13 | IBM BigFix Inventory v9 9.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 1… |
CVE-2017-11165 | Critical | 9.8 | 2017-07-12 | dataTaker DT80 dEX 1.50.012 allows remote attackers to obtain sensitive credential and configuration information via a direct request for the /services/getFile… |
CVE-2017-8592 | Medium | 6.5 | 2017-07-11 | Microsoft browsers on when Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, Windows RT 8.1, and Windows Server 2012 and R2, Windows 10 Gold, 1… |
CVE-2017-8582 | Medium | 5.9 | 2017-07-11 | HTTP.sys in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1… |
CVE-2017-8564 | Medium | 5.5 | 2017-07-11 | Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1… |
CVE-2017-8486 | Medium | 4.7 | 2017-07-11 | Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and… |
CVE-2017-6730 | Medium | 5.3 | 2017-07-10 | A vulnerability in the web-based GUI of Cisco Wide Area Application Services (WAAS) Central Manager could allow an unauthenticated, remote attacker to retrieve… |
CVE-2017-6726 | Medium | 5.5 | 2017-07-10 | A vulnerability in the CLI of the Cisco Prime Network Gateway could allow an authenticated, local attacker to retrieve system process information, which could… |
CVE-2017-1284 | Medium | 4.7 | 2017-07-10 | IBM WebSphere MQ 9.0.1 and 9.0.2 could allow a local user with ability to run or enable trace, to obtain sensitive information from WebSphere Application Serve… |
CVE-2017-11145 | High | 7.5 | 2017-07-10 | In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, an error in the date extension's timelib_meridian parsing code could be used by attackers able… |
CVE-2017-8442 | Medium | 6.5 | 2017-07-07 | Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the Elasticsearch _nodes API leaking sensitive configuration information, su… |
CVE-2017-1000381 | High | 7.5 | 2017-07-07 | The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer… |
CVE-2017-0326 | Medium | 5.5 | 2017-07-07 | An information disclosure vulnerability in the NVIDIA Video Driver due to an out-of-bounds read function in the Tegra Display Controller driver could result in… |
CVE-2017-2239 | Medium | 5.3 | 2017-07-07 | Marp versions v0.0.10 and earlier may allow an attacker to access local resources and files using JavaScript. |
CVE-2017-5001 | Medium | 4.3 | 2017-07-07 | EMC RSA Archer 5.4.1.3, 5.5.3.1, 5.5.2.3, 5.5.2, 5.5.1.3.1, 5.5.1.1 is affected by an information exposure through an error message vulnerability. A remote low… |
CVE-2017-5000 | Medium | 4.3 | 2017-07-07 | EMC RSA Archer 5.4.1.3, 5.5.3.1, 5.5.2.3, 5.5.2, 5.5.1.3.1, 5.5.1.1 is affected by an information exposure through an error message vulnerability. A remote low… |
CVE-2017-4999 | Medium | 6.5 | 2017-07-07 | EMC RSA Archer 5.4.1.3, 5.5.3.1, 5.5.2.3, 5.5.2, 5.5.1.3.1, 5.5.1.1 is affected by an authorization bypass through user-controlled key vulnerability in Discuss… |
CVE-2017-0709 | Low | 3.3 | 2017-07-06 | A information disclosure vulnerability in the HTC sensor hub driver. Product: Android. Versions: Android kernel. Android ID: A-35468048. |
CVE-2017-0708 | Medium | 5.5 | 2017-07-06 | A information disclosure vulnerability in the HTC sound driver. Product: Android. Versions: Android kernel. Android ID: A-35384879. |
CVE-2017-0699 | Medium | 5.5 | 2017-07-06 | A information disclosure vulnerability in the Android media framework. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36490809. |
CVE-2017-0698 | Medium | 5.5 | 2017-07-06 | A information disclosure vulnerability in the Android media framework. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-35467458. |
CVE-2017-0669 | Medium | 5.5 | 2017-07-06 | A information disclosure vulnerability in the Android framework. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34114752. |
CVE-2017-0668 | Medium | 5.5 | 2017-07-06 | A information disclosure vulnerability in the Android framework. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-… |
CVE-2017-6709 | Critical | 9.8 | 2017-07-06 | A vulnerability in the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to access administrative credentials… |
CVE-2017-6708 | Critical | 9.8 | 2017-07-06 | A vulnerability in the symbolic link (symlink) creation functionality of the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated… |
CVE-2017-1157 | Medium | 4.3 | 2017-07-05 | IBM Jazz Reporting Service (JRS) 5.0 and 6.0 could allow an authenticated attacker to access report data that should be restricted to authorized users. IBM X-F… |
CVE-2016-9700 | Medium | 4.3 | 2017-07-05 | IBM Jazz Foundation could allow an authenticated attacker to obtain sensitive information from error message stack traces. IBM X-Force ID: 119528. |
CVE-2017-1176 | Low | 3.3 | 2017-07-05 | IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a local user to obtain sensitive information due to inappropriate data retention of attachments. IBM… |
CVE-2017-2294 | High | 7.5 | 2017-07-05 | Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 failed to mark MCollective server private keys as sensitive (a feature added in Puppet 4.6), so key… |
CVE-2016-0238 | Low | 3.7 | 2017-07-05 | IBM Security Guardium 9.0, 9.1, 9.5, 10.0, and 10.1 transmits sensitive data in cleartext in the query of the request. This could allow an attacker to obtain s… |
CVE-2017-10916 | High | 7.5 | 2017-07-05 | The vCPU context-switch implementation in Xen through 4.8.x improperly interacts with the Memory Protection Extensions (MPX) and Protection Key (PKU) features… |
CVE-2017-10911 | Medium | 6.5 | 2017-07-05 | The make_response function in drivers/block/xen-blkback/blkback.c in the Linux kernel before 4.11.8 allows guest OS users to obtain sensitive information from… |
CVE-2017-7317 | Critical | 9.8 | 2017-07-04 | An issue was discovered on Humax Digital HG100 2.0.6 devices. The attacker can find the root credentials in the backup file, aka GatewaySettings.bin. |
CVE-2017-6706 | Medium | 5.1 | 2017-07-04 | A vulnerability in the logging subsystem of the Cisco Prime Collaboration Provisioning tool could allow an unauthenticated, local attacker to acquire sensitive… |
CVE-2017-6705 | Medium | 5.5 | 2017-07-04 | A vulnerability in the filesystem of the Cisco Prime Collaboration Provisioning tool could allow an authenticated, local attacker to acquire sensitive informat… |
CVE-2016-5045 | High | 8.1 | 2017-07-03 | NetApp OnCommand System Manager before 9.0 allows remote attackers to obtain sensitive credentials via vectors related to cluster peering setup. |
CVE-2017-0377 | High | 7.5 | 2017-07-02 | Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay (not the exit relay's family), which might allow remote attackers t… |
CVE-2017-8443 | Medium | 6.5 | 2017-06-30 | In Kibana X-Pack security versions prior to 5.4.3 if a Kibana user opens a crafted Kibana URL the result could be a redirect to an improperly initialized Kiban… |
CVE-2017-7899 | Critical | 9.8 | 2017-06-30 | An Information Exposure issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, V… |
CVE-2017-6046 | High | 7.5 | 2017-06-30 | An Insufficiently Protected Credentials issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Raven XT, all versi… |
CVE-2017-6040 | Medium | 5.3 | 2017-06-30 | An Information Exposure issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions. Non-sensitive information can b… |
CVE-2017-10679 | High | 7.5 | 2017-06-29 | Piwigo through 2.9.1 allows remote attackers to obtain sensitive information about the descriptive name of a permalink by examining the redirect URL that is re… |
CVE-2017-5529 | Medium | 4.1 | 2017-06-29 | JasperReports library components contain an information disclosure vulnerability. This vulnerability includes the theoretical disclosure of any accessible info… |
CVE-2017-8575 | Medium | 5.5 | 2017-06-29 | The kernel in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to obtain information via a specially craft… |
CVE-2017-8554 | Medium | 4.7 | 2017-06-29 | The kernel in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1… |
CVE-2017-7686 | High | 7.5 | 2017-06-28 | Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that include additional functionality, bug fixe… |
CVE-2017-9993 | High | 7.5 | 2017-06-28 | FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensio… |