CWE-200 · Information Disclosure (page 76)
Page 76 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-6083 | Medium | 5.3 | 2017-06-27 | IBM Tivoli Monitoring V6 could allow an unauthenticated user to access SOAP queries that could contain sensitive information. IBM X-Force ID: 117696. |
CVE-2017-7520 | High | 7.4 | 2017-06-27 | OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service and/or possibly sensitive memory leak triggered by man-in-the-middle attack… |
CVE-2015-3142 | Medium | 4.7 | 2017-06-26 | The kernel-invoked coredump processor in Automatic Bug Reporting Tool (ABRT) does not properly check the ownership of files before writing core dumps to them… |
CVE-2015-1870 | Medium | 5.5 | 2017-06-26 | The event scripts in Automatic Bug Reporting Tool (ABRT) uses world-readable permission on a copy of sosreport file in problem directories, which allows local… |
CVE-2017-9868 | Medium | 5.5 | 2017-06-25 | In Mosquitto through 1.4.12, mosquitto.db (aka the persistence file) is world readable, which allows local users to obtain sensitive MQTT topic information. |
CVE-2017-1349 | Medium | 5.5 | 2017-06-23 | IBM Sterling B2B Integrator Standard Edition 5.2 stores potentially sensitive information from HTTP sessions that could be read by a local user. IBM X-Force ID… |
CVE-2017-1302 | Medium | 5.5 | 2017-06-23 | IBM Sterling B2B Integrator Standard Edition 5.2 could allow a local user view sensitive information due to improper access controls. IBM X-Force ID: 125456. |
CVE-2017-1193 | Medium | 6.5 | 2017-06-23 | IBM Sterling B2B Integrator Standard Edition 5.2 could allow user to obtain sensitive information using an HTTP GET request. IBM X-Force ID: 123667. |
CVE-2017-1131 | Medium | 6.5 | 2017-06-23 | IBM Sterling B2B Integrator Standard Edition 5.2 could allow an authenticated user to obtain sensitive information by using unsupported, specially crafted HTTP… |
CVE-2016-5893 | Medium | 5.5 | 2017-06-23 | IBM Sterling B2B Integrator Standard Edition 5.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 115336. |
CVE-2016-9983 | Medium | 5.3 | 2017-06-22 | IBM Sterling B2B Integrator Standard Edition 5.2 could allow an authenticated user with special privileges to view files that they should not have access to. I… |
CVE-2016-9982 | Medium | 6.5 | 2017-06-22 | IBM Sterling B2B Integrator Standard Edition 5.2 could allow an authenticated user to obtain sensitive information such as account lists due to improper access… |
CVE-2017-6045 | High | 7.5 | 2017-06-21 | An Information Exposure issue was discovered in Trihedral VTScada Versions prior to 11.2.26. Some files are exposed within the web server application to unauth… |
CVE-2017-3087 | High | 7.5 | 2017-06-20 | Adobe Captivate versions 9 and earlier have an information disclosure vulnerability resulting from abuse of the quiz reporting feature in Captivate. |
CVE-2017-3743 | High | 7.5 | 2017-06-20 | If multiple users are concurrently logged into a single system where one user is sending a command via the Lenovo ToolsCenter Advanced Settings Utility (ASU)… |
CVE-2017-1000380 | Medium | 5.5 | 2017-06-17 | sound/core/timer.c in the Linux kernel before 4.11.5 is vulnerable to a data race in the ALSA /dev/snd/timer driver resulting in local users being able to read… |
CVE-2017-8450 | High | 7.5 | 2017-06-16 | X-Pack 5.1.1 did not properly apply document and field level security to multi-search and multi-get requests so users without access to a document and/or field… |
CVE-2017-8449 | Medium | 5.9 | 2017-06-16 | X-Pack Security 5.2.x would allow access to more fields than the user should have seen if the field level security rules used a mix of grant and exclude rules… |
CVE-2016-10362 | Medium | 6.5 | 2017-06-16 | Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating connections after sniffing, would log to file HTTP basic auth credentials. |
CVE-2016-1000221 | High | 7.5 | 2017-06-16 | Logstash prior to version 2.3.4, Elasticsearch Output plugin would log to file HTTP authorization headers which could contain sensitive information. |
CVE-2017-9731 | High | 7.5 | 2017-06-16 | In meta/classes/package_ipk.bbclass in Poky in poky-pyro 17.0.0 for Yocto Project through YP Core - Pyro 2.3, attackers can obtain sensitive information by rea… |
CVE-2015-7732 | High | 7.5 | 2017-06-15 | The Avira Mobile Security app before 1.5.11 for iOS sends sensitive login information in cleartext. |
CVE-2017-1379 | High | 7.5 | 2017-06-15 | IBM API Connect 5.0.0.0 could allow a remote attacker to obtain sensitive information, caused by improper handling of requests to the Developer Portal. IBM X-F… |
CVE-2017-8553 | Medium | 4.7 | 2017-06-15 | An information disclosure vulnerability exists in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, a… |
CVE-2017-8544 | Medium | 5.5 | 2017-06-15 | Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703… |
CVE-2017-8534 | Medium | 6.5 | 2017-06-15 | Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, Wind… |
CVE-2017-8533 | Medium | 6.5 | 2017-06-15 | Graphics in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703… |
CVE-2017-8532 | Medium | 6.5 | 2017-06-15 | Graphics in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703… |
CVE-2017-8531 | Medium | 6.5 | 2017-06-15 | Graphics in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703… |
CVE-2017-8504 | Medium | 4.3 | 2017-06-15 | Microsoft Edge in Windows 10 1607 and 1703, and Windows Server 2016 allows an attacker to read the URL of a cross-origin request when the Microsoft Edge Fetch… |
CVE-2017-8498 | Medium | 4.3 | 2017-06-15 | Microsoft Edge in Windows 10 1607 and 1703, and Windows Server 2016 allows an attacker to read data not intended to be disclosed when Edge allows JavaScript XM… |
CVE-2017-8492 | Medium | 5.0 | 2017-06-15 | The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511… |
CVE-2017-8491 | Medium | 5.0 | 2017-06-15 | The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511… |
CVE-2017-8490 | Medium | 5.0 | 2017-06-15 | The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511… |
CVE-2017-8489 | Medium | 5.0 | 2017-06-15 | The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511… |
CVE-2017-8488 | Medium | 5.0 | 2017-06-15 | The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511… |
CVE-2017-8485 | Medium | 5.0 | 2017-06-15 | The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511… |
CVE-2017-8484 | Medium | 5.0 | 2017-06-15 | Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703… |
CVE-2017-8483 | Medium | 5.0 | 2017-06-15 | The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511… |
CVE-2017-8482 | Medium | 5.0 | 2017-06-15 | The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511… |
CVE-2017-8481 | Medium | 5.0 | 2017-06-15 | The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511… |
CVE-2017-8480 | Medium | 5.0 | 2017-06-15 | The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511… |
CVE-2017-8479 | Medium | 5.0 | 2017-06-15 | The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511… |
CVE-2017-8478 | Medium | 5.0 | 2017-06-15 | The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511… |
CVE-2017-8477 | Medium | 5.0 | 2017-06-15 | Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703… |
CVE-2017-8476 | Medium | 5.0 | 2017-06-15 | The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511… |
CVE-2017-8475 | Medium | 5.0 | 2017-06-15 | Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow a… |
CVE-2017-8474 | Medium | 5.0 | 2017-06-15 | The kernel in Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1… |
CVE-2017-8473 | Medium | 5.0 | 2017-06-15 | Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and Windows Server 2016 allow an authenti… |
CVE-2017-8472 | Medium | 5.0 | 2017-06-15 | Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 allow an authenticated attacker to run a specially crafted application whe… |
CVE-2017-8471 | Medium | 5.0 | 2017-06-15 | Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703… |
CVE-2017-8470 | Medium | 5.0 | 2017-06-15 | Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703… |
CVE-2017-8469 | Medium | 5.5 | 2017-06-15 | The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511… |
CVE-2017-8462 | Medium | 5.0 | 2017-06-15 | The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511… |
CVE-2017-8460 | High | 7.3 | 2017-06-15 | Windows PDF in Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows information disc… |
CVE-2017-0300 | Medium | 5.0 | 2017-06-15 | The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511… |
CVE-2017-0299 | Medium | 5.0 | 2017-06-15 | The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511… |
CVE-2017-0297 | Medium | 5.0 | 2017-06-15 | The kernel in Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1… |
CVE-2017-0289 | Medium | 5.0 | 2017-06-15 | Graphics in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703… |
CVE-2017-0288 | Medium | 5.0 | 2017-06-15 | Graphics in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703… |
CVE-2017-0287 | Medium | 5.0 | 2017-06-15 | Graphics in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703… |
CVE-2017-0286 | Medium | 5.0 | 2017-06-15 | Graphics in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703… |
CVE-2017-0285 | Medium | 5.0 | 2017-06-15 | Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703… |
CVE-2017-0284 | Medium | 5.0 | 2017-06-15 | Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703… |
CVE-2017-0282 | Medium | 5.0 | 2017-06-15 | Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703… |
CVE-2017-4986 | Medium | 5.3 | 2017-06-14 | EMC ESRS VE 3.18 or earlier contains Authentication Bypass that could potentially be exploited by malicious users to compromise the affected system. |
CVE-2017-0651 | Medium | 4.7 | 2017-06-14 | An information disclosure vulnerability in the kernel ION subsystem could enable a local malicious application to access data outside of its permission levels… |
CVE-2017-0650 | Medium | 4.7 | 2017-06-14 | An information disclosure vulnerability in the Synaptics touchscreen driver could enable a local malicious application to access data outside of its permission… |
CVE-2017-0647 | Medium | 5.5 | 2017-06-14 | An information disclosure vulnerability in libziparchive could enable a local malicious application to access data outside of its permission levels. This issue… |
CVE-2017-0646 | Medium | 5.5 | 2017-06-14 | An information disclosure vulnerability in Bluetooth component could enable a local malicious application to access data outside of its permission levels. This… |
CVE-2017-0645 | Medium | 5.5 | 2017-06-14 | An elevation of privilege vulnerability in Bluetooth could enable a local malicious application to access data outside of its permission levels. This issue is… |
CVE-2017-0639 | Medium | 5.5 | 2017-06-14 | An information disclosure vulnerability in Bluetooth component could enable a local malicious application to access data outside of its permission levels. This… |
CVE-2017-8239 | Medium | 5.5 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, userspace-controlled parameters for flash initialization are not sanitized potentially leading to expo… |
CVE-2016-10339 | High | 7.1 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, HLOS can overwite secure memory or read contents of the keystore. |
CVE-2015-9032 | Low | 3.3 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, a DRM key was exposed to QTEE applications. |
CVE-2015-9031 | Low | 3.3 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, a TZ memory address is exposed to HLOS by HDCP. |
CVE-2017-9605 | Medium | 5.5 | 2017-06-13 | The vmw_gb_surface_define_ioctl function (accessible via DRM_IOCTL_VMW_GB_SURFACE_CREATE) in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel throug… |
CVE-2017-1099 | Medium | 4.3 | 2017-06-13 | IBM Jazz Foundation could expose potentially sensitive information to authenticated users through stack trace error conditions. IBM X-Force ID: 120659. |
CVE-2016-3696 | Medium | 5.5 | 2017-06-13 | The pulp-qpid-ssl-cfg script in Pulp before 2.8.5 allows local users to obtain the CA key. |
CVE-2017-6697 | Medium | 6.5 | 2017-06-13 | A vulnerability in the web interface of Cisco Elastic Services Controllers could allow an authenticated, remote attacker to access sensitive system credentials… |
CVE-2017-6696 | Medium | 5.5 | 2017-06-13 | A vulnerability in the file system of Cisco Elastic Services Controllers could allow an authenticated, local attacker to gain access to sensitive user credenti… |
CVE-2017-6695 | Medium | 5.5 | 2017-06-13 | A vulnerability in the ConfD server in Cisco Ultra Services Platform could allow an authenticated, local attacker to view sensitive information. More Informati… |
CVE-2017-6691 | Medium | 6.5 | 2017-06-13 | A vulnerability in the ConfD CLI of Cisco Elastic Services Controllers could allow an authenticated, remote attacker to access sensitive information on an affe… |
CVE-2017-6681 | High | 7.5 | 2017-06-13 | A vulnerability in the AutoVNF VNFStagingView class of Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to execute a relative pat… |
CVE-2017-6673 | Medium | 6.5 | 2017-06-13 | A vulnerability in Cisco Firepower Management Center could allow an authenticated, remote attacker to obtain user information. An attacker could use this infor… |
CVE-2017-4966 | High | 7.8 | 2017-06-13 | An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for P… |
CVE-2017-1214 | Medium | 5.7 | 2017-06-12 | IBM iNotes 8.5 and 9.0 could allow a remote attacker to send a malformed email to a victim, that when opened could cause an information disclosure. IBM X-Force… |
CVE-2017-9526 | Medium | 5.9 | 2017-06-11 | In Libgcrypt before 1.7.7, an attacker who learns the EdDSA session key (from side-channel observation during the signing process) can easily recover the long-… |
CVE-2017-2180 | Medium | 4.3 | 2017-06-09 | Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allow remote attackers to obtain local files via unspecified vectors. |
CVE-2017-2165 | Medium | 6.5 | 2017-06-09 | GroupSession versions 4.6.4 and earlier allows remote authenticated attackers to bypass access restrictions to obtain sensitive information such as emails via… |
CVE-2016-7832 | Medium | 5.3 | 2017-06-09 | Cybozu Dezie 8.0.0 to 8.1.1 allows remote attackers to bypass access restrictions to obtain an arbitrary DBM (Cybozu Dezie proprietary format) file via unspeci… |
CVE-2016-7814 | High | 7.5 | 2017-06-09 | I-O DATA DEVICE TS-WRLP firmware version 1.00.01 and earlier and TS-WRLA firmware version 1.00.01 and earlier allow remote attackers to obtain authentication c… |
CVE-2016-9736 | Medium | 5.3 | 2017-06-08 | IBM WebSphere Application Server using malformed SOAP requests could allow a remote attacker to obtain sensitive information. |
CVE-2016-8987 | Medium | 4.3 | 2017-06-08 | IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow an authenticated user to view incorrect item sets that they should not have access to view. |
CVE-2015-3634 | High | 7.5 | 2017-06-08 | The SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function in the Slideshow plugin 2.2.8 through 2.2.21 for Wordpress allows remote attackers to rea… |
CVE-2016-5416 | High | 7.5 | 2017-06-08 | 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through… |
CVE-2016-4992 | High | 7.5 | 2017-06-08 | 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through… |
CVE-2016-3095 | Medium | 5.5 | 2017-06-08 | server/bin/pulp-gen-ca-certificate in Pulp before 2.8.2 allows local users to read the generated private key. |
CVE-2016-3111 | Medium | 5.5 | 2017-06-08 | pulp.spec in the installation process for Pulp 2.8.3 generates the RSA key pairs used to validate messages between the pulp server and pulp consumers in a dire… |
CVE-2015-2253 | Medium | 5.0 | 2017-06-08 | The XML interface in Huawei OceanStor UDS devices with software before V100R002C01SPC102 allows remote authenticated users to obtain sensitive information via… |