CWE-200 · Information Disclosure (page 75)
Page 75 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-10213 | Medium | 5.9 | 2017-02-08 | A10 AX1030 and possibly other devices with software before 2.7.2-P8 uses random GCM nonce generations, which makes it easier for remote attackers to obtain the… |
CVE-2016-10212 | Medium | 5.9 | 2017-02-08 | Radware devices use the same value for the first two GCM nonces, which allows remote attackers to obtain the authentication key and spoof data via a "forbidden… |
CVE-2016-0270 | Medium | 5.9 | 2017-02-08 | IBM Domino 9.0.1 Fix Pack 3 Interim Fix 2 through 9.0.1 Fix Pack 5 Interim Fix 1, when using TLS and AES GCM, uses random nonce generation, which makes it easi… |
CVE-2017-0451 | Medium | 4.7 | 2017-02-08 | An information disclosure vulnerability in the Qualcomm sound driver could enable a local malicious application to access data outside of its permission levels… |
CVE-2017-0448 | Medium | 5.5 | 2017-02-08 | An information disclosure vulnerability in the NVIDIA video driver could enable a local malicious application to access data outside of its permission levels… |
CVE-2017-0426 | Medium | 5.5 | 2017-02-08 | An information disclosure vulnerability in the Filesystem could enable a local malicious application to access data outside of its permission levels. This issu… |
CVE-2017-0425 | Medium | 5.5 | 2017-02-08 | An information disclosure vulnerability in Audioserver could enable a local malicious application to access data outside of its permission levels. This issue i… |
CVE-2017-0424 | Medium | 5.5 | 2017-02-08 | An information disclosure vulnerability in AOSP Messaging could enable a remote attacker using a special crafted file to access data outside of its permission… |
CVE-2017-0421 | Medium | 5.5 | 2017-02-08 | An information disclosure vulnerability in the Framework APIs could enable a local malicious application to bypass operating system protections that isolate ap… |
CVE-2017-0420 | Medium | 5.5 | 2017-02-08 | An information disclosure vulnerability in AOSP Mail could enable a local malicious application to bypass operating system protections that isolate application… |
CVE-2017-0414 | Medium | 5.5 | 2017-02-08 | An information disclosure vulnerability in AOSP Messaging could enable a local malicious application to bypass operating system protections that isolate applic… |
CVE-2017-0413 | Medium | 5.5 | 2017-02-08 | An information disclosure vulnerability in AOSP Messaging could enable a local malicious application to bypass operating system protections that isolate applic… |
CVE-2016-8414 | Medium | 4.7 | 2017-02-08 | An information disclosure vulnerability in the Qualcomm Secure Execution Environment Communicator could enable a local malicious application to access data out… |
CVE-2016-6495 | Medium | 5.9 | 2017-02-07 | NetApp Data ONTAP before 8.2.4P5, when operating in 7-Mode, allows remote attackers to obtain information about the volumes configured for HTTP access. |
CVE-2016-4341 | High | 7.5 | 2017-02-07 | NetApp Clustered Data ONTAP before 8.3.2P7 allows remote attackers to obtain SMB share information via unspecified vectors. |
CVE-2016-3124 | Medium | 5.3 | 2017-02-07 | The sanitycheck module in SimpleSAMLphp before 1.14.1 allows remote attackers to learn the PHP version on the system via unspecified vectors. |
CVE-2015-8544 | High | 7.5 | 2017-02-07 | NetApp SnapDrive for Windows before 7.0.2P4, 7.0.3, and 7.1 before 7.1.3P1 allows remote attackers to obtain sensitive information via unspecified vectors. |
CVE-2016-6097 | Medium | 4.0 | 2017-02-07 | IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 allows web pages to be stored locally which can be read by another user on the system. |
CVE-2016-6094 | Medium | 4.3 | 2017-02-07 | IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 generates an error message that includes sensitive information about its environment, users, or associated… |
CVE-2016-6092 | Medium | 6.2 | 2017-02-07 | IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 stores user credentials in plain in clear text which can be read by a local user. |
CVE-2015-5677 | Medium | 5.5 | 2017-02-07 | bsnmpd, as used in FreeBSD 9.3, 10.1, and 10.2, uses world-readable permissions on the snmpd.config file, which allows local users to obtain the secret key for… |
CVE-2017-5595 | Medium | 5.5 | 2017-02-06 | A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to r… |
CVE-2016-9772 | Medium | 5.3 | 2017-02-06 | OpenAFS 1.6.19 and earlier allows remote attackers to obtain sensitive directory information via vectors involving the (1) client cache partition, (2) fileserv… |
CVE-2017-5550 | Medium | 5.5 | 2017-02-06 | Off-by-one error in the pipe_advance function in lib/iov_iter.c in the Linux kernel before 4.9.5 allows local users to obtain sensitive information from uninit… |
CVE-2016-8217 | Low | 3.7 | 2017-02-03 | EMC RSA BSAFE Crypto-J versions prior to 6.2.2 has a PKCS#12 Timing Attack Vulnerability. A possible timing attack could be carried out by modifying a PKCS#12… |
CVE-2016-0890 | Medium | 6.4 | 2017-02-03 | EMC PowerPath Virtual (Management) Appliance 2.0, EMC PowerPath Virtual (Management) Appliance 2.0 SP1 is affected by a sensitive information disclosure vulner… |
CVE-2016-6116 | Medium | 5.9 | 2017-02-02 | IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Stric… |
CVE-2016-6099 | Medium | 5.3 | 2017-02-02 | IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the… |
CVE-2016-5935 | Medium | 5.9 | 2017-02-02 | IBM Jazz for Service Management could allow a remote attacker to obtain sensitive information, caused by the failure to properly validate the SSL certificate… |
CVE-2016-8982 | Medium | 5.3 | 2017-02-01 | IBM InfoSphere Information Server stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access t… |
CVE-2016-8977 | Medium | 5.3 | 2017-02-01 | IBM BigFix Inventory v9 could disclose sensitive information to an unauthorized user using HTTP GET requests. This information could be used to mount further a… |
CVE-2016-8963 | Medium | 5.5 | 2017-02-01 | IBM BigFix Inventory v9 stores potentially sensitive information in log files that could be read by a local user. |
CVE-2016-6068 | High | 7.5 | 2017-02-01 | IBM UrbanCode Deploy could allow an authenticated user with access to the REST endpoints to access API and CLI getResource secured role properties. |
CVE-2016-5953 | Low | 3.7 | 2017-02-01 | IBM Sterling Order Management transmits the session identifier within the URL. When a user is unable to view a certain view due to not being allowed permission… |
CVE-2016-5938 | Low | 3.3 | 2017-02-01 | IBM Kenexa LMS on Cloud allows web pages to be stored locally which can be read by another user on the system. |
CVE-2016-2941 | Medium | 5.5 | 2017-02-01 | IBM UrbanCode Deploy creates temporary files during step execution that could contain sensitive information including passwords that could be read by a local u… |
CVE-2016-6117 | Medium | 5.3 | 2017-02-01 | IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 can be deployed with active debugging code that can disclose sensitive information. |
CVE-2016-8981 | Medium | 5.5 | 2017-02-01 | IBM BigFix Inventory v9 allows web pages to be stored locally which can be read by another user on the system. |
CVE-2016-8966 | Medium | 5.9 | 2017-02-01 | IBM BigFix Inventory v9 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security… |
CVE-2016-6122 | Medium | 4.3 | 2017-02-01 | IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 discloses answers to security questions in a response to authenticated users. |
CVE-2016-6080 | Medium | 5.3 | 2017-02-01 | The WebAdmin context for WebSphere Message Broker allows directory listings which could disclose sensitive information to the attacker. |
CVE-2016-6034 | Medium | 6.8 | 2017-02-01 | IBM Tivoli Storage Manager for Virtual Environments (VMware) could disclose the Windows domain credentials to a user with a high level of privileges. |
CVE-2016-5994 | Medium | 6.5 | 2017-02-01 | IBM InfoSphere Information Server contains a vulnerability that would allow an authenticated user to browse any file on the engine tier, and examine its conten… |
CVE-2016-5988 | Medium | 6.5 | 2017-02-01 | IBM Security Privileged Identity Manager Virtual Appliance could disclose sensitive information in generated error messages that would be available to an authe… |
CVE-2016-5966 | Medium | 5.9 | 2017-02-01 | IBM Security Privileged Identity Manager Virtual Appliance could allow a remote attacker to obtain sensitive information, caused by the failure to properly ena… |
CVE-2016-5958 | High | 7.5 | 2017-02-01 | IBM Security Privileged Identity Manager could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the se… |
CVE-2016-5896 | Medium | 5.3 | 2017-02-01 | IBM Maximo Asset Management could disclose sensitive information from a stack trace after submitting incorrect login onto Cognos browser. |
CVE-2016-3045 | Low | 3.7 | 2017-02-01 | IBM Security Access Manager for Web stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access… |
CVE-2016-3043 | Medium | 5.9 | 2017-02-01 | IBM Security Access Manager for Web could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transpo… |
CVE-2016-3035 | Medium | 5.3 | 2017-02-01 | IBM AppScan Source could reveal some sensitive information through the browsing of testlinks on the server. |
CVE-2016-3024 | Medium | 4.0 | 2017-02-01 | IBM Security Access Manager for Web allows web pages to be stored locally which can be read by another user on the system. |
CVE-2016-3023 | Medium | 5.3 | 2017-02-01 | IBM Security Access Manager for Web could allow an unauthenticated user to gain access to sensitive information by entering invalid file names. |
CVE-2016-3021 | Low | 2.7 | 2017-02-01 | IBM Security Access Manager for Web could allow an authenticated attacker to obtain sensitive information from error message using a specially crafted HTTP req… |
CVE-2016-2987 | Medium | 4.3 | 2017-02-01 | An undisclosed vulnerability in CLM applications may result in some administrative deployment parameters being shown to an attacker. |
CVE-2016-0297 | Low | 3.7 | 2017-02-01 | IBM Tivoli Endpoint Manager - Mobile Device Management (MDM) could allow a remote attacker to obtain sensitive information due to a missing HTTP Strict-Transpo… |
CVE-2016-9418 | High | 7.5 | 2017-01-31 | MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows might allow remote attackers to obtain sensitive information f… |
CVE-2016-9414 | High | 7.5 | 2017-01-31 | MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow remote attackers to obtain sensitive information by leveraging missing directo… |
CVE-2016-9411 | Medium | 5.3 | 2017-01-31 | The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to obtain the installation path v… |
CVE-2016-9410 | High | 7.5 | 2017-01-31 | MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to obtain sensitive database information via vectors in… |
CVE-2016-6329 | Medium | 5.9 | 2017-01-31 | OpenVPN, when using a 64-bit block cipher, makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypte… |
CVE-2015-8034 | Low | 3.3 | 2017-01-30 | The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive information by reading the… |
CVE-2017-5610 | Medium | 5.3 | 2017-01-30 | wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility of a taxonomy-assignment user interface… |
CVE-2016-10181 | High | 7.5 | 2017-01-30 | An issue was discovered on the D-Link DWR-932B router. qmiweb provides sensitive information for CfgType=get_homeCfg requests. |
CVE-2016-10175 | Critical | 9.8 | 2017-01-30 | The NETGEAR WNR2000v5 router leaks its serial number when performing a request to the /BRS_netgear_success.html URI. This serial number allows a user to obtain… |
CVE-2017-3319 | Low | 3.1 | 2017-01-27 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: X Plugin). Supported versions that are affected are 5.7.16 and earlier. Diff… |
CVE-2017-3315 | Medium | 4.3 | 2017-01-27 | Vulnerability in the PeopleSoft Enterprise HCM ePerformance component of Oracle PeopleSoft Products (subcomponent: Security). The supported version that is aff… |
CVE-2017-3296 | Medium | 4.3 | 2017-01-27 | Vulnerability in the Oracle Commerce Platform component of Oracle Commerce (subcomponent: Dynamo Application Framework). Supported versions that are affected a… |
CVE-2017-3292 | Medium | 5.7 | 2017-01-27 | Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integration Broker). Supported versions that are… |
CVE-2017-3277 | Medium | 4.9 | 2017-01-27 | Vulnerability in the Oracle Applications Manager component of Oracle E-Business Suite (subcomponent: OAM Client). Supported versions that are affected are 12.1… |
CVE-2017-3255 | Medium | 5.8 | 2017-01-27 | Vulnerability in the Oracle JDeveloper component of Oracle Fusion Middleware (subcomponent: ADF Faces). Supported versions that are affected are 11.1.1.7.0, 11… |
CVE-2017-3250 | High | 7.3 | 2017-01-27 | Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Security). Supported versions that are affected are 2.1.1, 3… |
CVE-2017-3245 | Medium | 4.7 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Direct Banking component of Oracle Financial Services Applications (subcomponent: Pre-Login). Supported versions that are… |
CVE-2017-3240 | Low | 3.3 | 2017-01-27 | Vulnerability in the RDBMS Security component of Oracle Database Server. The supported version that is affected is 12.1.0.2. Easily exploitable vulnerability a… |
CVE-2017-3239 | Low | 3.3 | 2017-01-27 | Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Administration). Supported versions that are affected are 3.0… |
CVE-2017-3231 | Medium | 4.3 | 2017-01-27 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u131… |
CVE-2016-8322 | Medium | 4.3 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Core Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are affecte… |
CVE-2016-8313 | Medium | 4.1 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Product / Instrument Search). Supported… |
CVE-2016-8305 | Low | 2.1 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are af… |
CVE-2016-8302 | Medium | 4.3 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are af… |
CVE-2016-5614 | Medium | 4.3 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Product / Instrument Search). Supported… |
CVE-2016-3996 | Medium | 5.5 | 2017-01-27 | ClipboardDataMgr in Samsung KNOX 1.0.0 and 2.3.0 does not properly check the caller, which allows local users to read KNOX clipboard data via a crafted applica… |
CVE-2016-1919 | Medium | 4.7 | 2017-01-27 | Samsung KNOX 1.0 uses a weak eCryptFS Key generation algorithm, which makes it easier for local users to obtain sensitive information by leveraging knowledge o… |
CVE-2016-10002 | High | 7.5 | 2017-01-27 | Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 th… |
CVE-2016-9932 | Low | 3.3 | 2017-01-26 | CMPXCHG8B emulation in Xen 3.3.x through 4.7.x on x86 systems allows local HVM guest OS users to obtain sensitive information from host stack memory via a "sup… |
CVE-2017-3805 | Medium | 5.3 | 2017-01-26 | A vulnerability in the web-based management interface of Cisco IOS and Cisco IOx Software could allow an unauthenticated, remote attacker to view confidential… |
CVE-2017-3797 | Medium | 5.3 | 2017-01-26 | A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to view the fully qualified domain name of the Cisco WebEx admin… |
CVE-2017-5372 | High | 7.5 | 2017-01-23 | The function msp (aka MSPRuntimeInterface) in the P4 SERVERCORE component in SAP AS JAVA allows remote attackers to obtain sensitive system information by leve… |
CVE-2016-6668 | High | 7.5 | 2017-01-23 | The Atlassian Hipchat Integration Plugin for Bitbucket Server 6.26.0 before 6.27.5, 6.28.0 before 7.3.7, and 7.4.0 before 7.8.17; Confluence HipChat plugin 6.2… |
CVE-2017-5182 | High | 7.5 | 2017-01-23 | Remote Manager in Open Enterprise Server (OES) allows unauthenticated remote attackers to read any arbitrary file, via a specially crafted URL, that allows com… |
CVE-2016-5014 | Medium | 5.4 | 2017-01-20 | In Moodle 2.x and 3.x, an unenrolled user still receives event monitor notifications even though they can no longer access the course. |
CVE-2016-5012 | Medium | 5.3 | 2017-01-20 | In Moodle 3.x, glossary search displays entries without checking user permissions to view them. |
CVE-2016-10143 | High | 7.5 | 2017-01-20 | A vulnerability in Tiki Wiki CMS 15.2 could allow a remote attacker to read arbitrary files on a targeted system via a crafted pathname in a banner URL field. |
CVE-2016-5220 | Medium | 6.5 | 2017-01-19 | PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled navigation within PDFs, which allowe… |
CVE-2016-5212 | Medium | 6.5 | 2017-01-19 | Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android insufficiently sanitized DevTools URLs, which allowed a remote att… |
CVE-2016-5201 | Medium | 6.5 | 2017-01-19 | A leak of privateClass in the extensions API in Google Chrome prior to 54.0.2840.100 for Linux, and 54.0.2840.99 for Windows, and 54.0.2840.98 for Mac allowed… |
CVE-2016-9680 | High | 7.5 | 2017-01-18 | Citrix Provisioning Services before 7.12 allows attackers to obtain sensitive information from kernel memory via unspecified vectors. |
CVE-2016-9677 | Medium | 5.3 | 2017-01-18 | Citrix Provisioning Services before 7.12 allows attackers to obtain sensitive kernel address information via unspecified vectors. |
CVE-2017-5223 | Medium | 5.5 | 2017-01-16 | An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to an HTML document to make it usable as an email messag… |
CVE-2017-5487 | Medium | 5.3 | 2017-01-15 | wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listi… |
CVE-2017-2584 | High | 7.1 | 2017-01-15 | arch/x86/kvm/emulate.c in the Linux kernel through 4.9.3 allows local users to obtain sensitive information from kernel memory or cause a denial of service (us… |