CWE-200 · Information Disclosure (page 77)
Page 77 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-2251 | High | 7.5 | 2017-06-08 | The DeviceManager in Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to obtain sensitive information via a cra… |
CVE-2017-1125 | Low | 3.3 | 2017-06-07 | IBM Cognos Analytics 10.1 and 10.2 could allow a local user to craft a URL which could confirm the existence of and expose postial contents of a file. IBM X-Fo… |
CVE-2016-9710 | Medium | 5.3 | 2017-06-07 | IBM Predictive Solutions Foundation (formerly PMQ) could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted U… |
CVE-2016-8939 | Medium | 5.5 | 2017-06-07 | IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) clients/agents store password information in the Windows Registry in a manner which can be compro… |
CVE-2016-5960 | Medium | 5.5 | 2017-06-07 | IBM Security Privileged Identity Manager 2.0.2 and 2.1.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 1161… |
CVE-2016-5959 | Medium | 5.3 | 2017-06-07 | IBM Security Privileged Identity Manager 2.0.2 and 2.1.0 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorize… |
CVE-2015-7514 | Medium | 6.5 | 2017-06-07 | OpenStack Ironic 4.2.0 through 4.2.1 does not "clean" the disk after use, which allows remote authenticated users to obtain sensitive information. |
CVE-2017-7313 | High | 7.5 | 2017-06-07 | An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, it is possible to read any customer name, master Cust… |
CVE-2016-3066 | Medium | 6.5 | 2017-06-06 | The spice-gtk widget allows remote authenticated users to obtain information from the host clipboard. |
CVE-2014-9951 | Medium | 5.5 | 2017-06-06 | In TrustZone in all Android releases from CAF using the Linux kernel, an Information Exposure Through Timing Discrepancy vulnerability could potentially exist. |
CVE-2014-9947 | Medium | 5.5 | 2017-06-06 | In TrustZone in all Android releases from CAF using the Linux kernel, an Information Exposure vulnerability could potentially exist. |
CVE-2017-8840 | Medium | 5.3 | 2017-06-05 | Debug information disclosure exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_… |
CVE-2017-8441 | Medium | 4.3 | 2017-06-05 | Elastic X-Pack Security versions prior to 5.4.1 and 5.3.3 did not always correctly apply Document Level Security to index aliases. This bug could allow a user… |
CVE-2016-8230 | High | 7.5 | 2017-06-04 | In Lenovo Service Bridge before version 4, an insecure HTTP connection is used by LSB to send system serial number, machine type and model and product name to… |
CVE-2017-2309 | Medium | 5.9 | 2017-05-30 | On Juniper Networks Junos Space versions prior to 16.1R1 when certificate based authentication is enabled for the Junos Space cluster, some restricted web serv… |
CVE-2017-2304 | High | 7.5 | 2017-05-30 | Juniper Networks QFX3500, QFX3600, QFX5100, QFX5200, EX4300 and EX4600 devices running Junos OS 14.1X53 prior to 14.1X53-D40, 15.1X53 prior to 15.1X53-D40, 15… |
CVE-2017-7338 | High | 7.5 | 2017-05-27 | A password management vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to carry out information disclosure via the FortiAnalyz… |
CVE-2017-1292 | Medium | 5.3 | 2017-05-26 | IBM Maximo Asset Management 7.5 and 7.6 generates error messages that could reveal sensitive information that could be used in further attacks against the syst… |
CVE-2017-7439 | High | 7.5 | 2017-05-26 | NetApp OnCommand Unified Manager Core Package 5.x before 5.2.2P1 might allow remote attackers to obtain sensitive information via vectors involving error messa… |
CVE-2016-7977 | Medium | 5.5 | 2017-05-23 | Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently read arbitrary files via the use of the .li… |
CVE-2016-10073 | High | 7.5 | 2017-05-23 | The from method in library/core/class.email.php in Vanilla Forums before 2.3.1 allows remote attackers to spoof the email domain in sent messages and potential… |
CVE-2015-6586 | High | 7.5 | 2017-05-23 | The mDNS module in Huawei WLAN AC6005, AC6605, and ACU2 devices with software before V200R006C00SPC100 allows remote attackers to obtain sensitive information… |
CVE-2015-5383 | High | 7.5 | 2017-05-23 | Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs director… |
CVE-2015-5382 | Medium | 6.5 | 2017-05-23 | program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the… |
CVE-2017-9150 | Medium | 5.5 | 2017-05-22 | The do_check function in kernel/bpf/verifier.c in the Linux kernel before 4.11.1 does not make the allow_ptr_leaks value available for restricting the output o… |
CVE-2017-9149 | High | 7.5 | 2017-05-22 | Metadata Anonymisation Toolkit (MAT) 0.6 and 0.6.1 silently fails to perform "Clean metadata" actions upon invocation from the Nautilus contextual menu, which… |
CVE-2017-6987 | Medium | 5.5 | 2017-05-22 | An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS bef… |
CVE-2017-2507 | Medium | 5.5 | 2017-05-22 | An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS bef… |
CVE-2017-6647 | Medium | 5.3 | 2017-05-22 | A vulnerability in the web interface of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to access sensitive Tempora… |
CVE-2017-6646 | Medium | 5.3 | 2017-05-22 | A vulnerability in the web interface of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to access sensitive Order i… |
CVE-2017-6645 | Medium | 5.3 | 2017-05-22 | A vulnerability in the web interface of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to access sensitive Virtual… |
CVE-2017-6644 | Medium | 5.3 | 2017-05-22 | A vulnerability in the web interface of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to access sensitive informa… |
CVE-2017-6643 | Medium | 5.3 | 2017-05-22 | A vulnerability in the web interface of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to access sensitive Virtual… |
CVE-2017-6642 | Medium | 5.3 | 2017-05-22 | A vulnerability in the web interface of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to access sensitive informa… |
CVE-2017-9134 | High | 7.5 | 2017-05-21 | An information-leakage issue was discovered on Mimosa Client Radios before 2.2.3 and Mimosa Backhaul Radios before 2.2.3. There is a page in the web interface… |
CVE-2014-9970 | High | 7.5 | 2017-05-21 | jasypt before 1.9.2 allows a timing attack against the password hash comparison. |
CVE-2017-6621 | High | 7.5 | 2017-05-18 | A vulnerability in the web interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to access sensitive data. The at… |
CVE-2017-4017 | Medium | 5.3 | 2017-05-17 | User Name Disclosure in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to view user information via the appliance web i… |
CVE-2017-4016 | Medium | 5.3 | 2017-05-17 | Web Server method disclosure in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to exploit and find another hole via HTT… |
CVE-2017-4013 | Medium | 5.3 | 2017-05-17 | Banner Disclosure in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to obtain product information via HTTP response hea… |
CVE-2017-7488 | Medium | 4.3 | 2017-05-16 | Authconfig version 6.2.8 is vulnerable to an Information exposure while using SSSD to authenticate against remote server resulting in the leak of information a… |
CVE-2017-6651 | High | 7.5 | 2017-05-16 | A vulnerability in Cisco WebEx Meetings Server could allow unauthenticated, remote attackers to gain information that could allow them to access scheduled cust… |
CVE-2015-9001 | Medium | 5.5 | 2017-05-16 | In TrustZone an information exposure vulnerability can potentially occur in all Android releases from CAF using the Linux kernel. |
CVE-2016-9735 | Medium | 4.3 | 2017-05-15 | IBM Jazz Foundation could allow an authenticated user to obtain sensitive information from stack traces. IBM X-Force ID: 119781, |
CVE-2017-7495 | Medium | 5.5 | 2017-05-15 | fs/ext4/inode.c in the Linux kernel before 4.6.2, when ext4 data=ordered mode is used, mishandles a needs-flushing-before-commit list, which allows local users… |
CVE-2017-5655 | Medium | 6.5 | 2017-05-15 | In Ambari 2.2.2 through 2.4.2 and Ambari 2.5.0, sensitive data may be stored on disk in temporary files on the Ambari Server host. The temporary files are read… |
CVE-2016-8741 | High | 7.5 | 2017-05-15 | The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication. Among the choices are the S… |
CVE-2017-7486 | High | 7.5 | 2017-05-12 | PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign server passwords to any user having USAGE pri… |
CVE-2017-7484 | High | 7.5 | 2017-05-12 | It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x be… |
CVE-2016-4839 | Medium | 5.5 | 2017-05-12 | The Android Apps Money Forward (prior to v7.18.0), Money Forward for The Gunma Bank (prior to v1.2.0), Money Forward for SHIGA BANK (prior to v1.2.0), Money Fo… |
CVE-2017-0634 | Medium | 4.7 | 2017-05-12 | An information disclosure vulnerability in the Synaptics touchscreen driver could enable a local malicious application to access data outside of its permission… |
CVE-2017-0633 | Medium | 4.7 | 2017-05-12 | An information disclosure vulnerability in the Broadcom Wi-Fi driver could enable a local malicious component to access data outside of its permission levels… |
CVE-2017-0632 | Medium | 4.7 | 2017-05-12 | An information disclosure vulnerability in the Qualcomm sound codec driver could enable a local malicious application to access data outside of its permission… |
CVE-2017-0631 | Medium | 4.7 | 2017-05-12 | An information disclosure vulnerability in the Qualcomm camera driver could enable a local malicious application to access data outside of its permission level… |
CVE-2017-0630 | Medium | 4.7 | 2017-05-12 | An information disclosure vulnerability in the kernel trace subsystem could enable a local malicious application to access data outside of its permission level… |
CVE-2017-0629 | Medium | 4.7 | 2017-05-12 | An information disclosure vulnerability in the Qualcomm camera driver could enable a local malicious application to access data outside of its permission level… |
CVE-2017-0628 | Medium | 4.7 | 2017-05-12 | An information disclosure vulnerability in the Qualcomm camera driver could enable a local malicious application to access data outside of its permission level… |
CVE-2017-0627 | Medium | 4.7 | 2017-05-12 | An information disclosure vulnerability in the kernel UVC driver could enable a local malicious application to access data outside of its permission levels. Th… |
CVE-2017-0626 | Medium | 5.5 | 2017-05-12 | An information disclosure vulnerability in the Qualcomm crypto engine driver could enable a local malicious application to access data outside of its permissio… |
CVE-2017-0625 | Medium | 5.5 | 2017-05-12 | An information disclosure vulnerability in the MediaTek command queue driver could enable a local malicious application to access data outside of its permissio… |
CVE-2017-0624 | Medium | 5.5 | 2017-05-12 | An information disclosure vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to access data outside of its permission levels… |
CVE-2017-0602 | Medium | 5.5 | 2017-05-12 | An information disclosure vulnerability in Bluetooth could allow a local malicious application to bypass operating system protections that isolate application… |
CVE-2017-0598 | Medium | 5.5 | 2017-05-12 | An information disclosure vulnerability in the Framework APIs could enable a local malicious application to bypass operating system protections that isolate ap… |
CVE-2016-10296 | Medium | 4.7 | 2017-05-12 | An information disclosure vulnerability in the Qualcomm shared memory driver could enable a local malicious application to access data outside of its permissio… |
CVE-2016-10295 | Medium | 4.7 | 2017-05-12 | An information disclosure vulnerability in the Qualcomm LED driver could enable a local malicious application to access data outside of its permission levels… |
CVE-2016-10294 | Medium | 4.7 | 2017-05-12 | An information disclosure vulnerability in the Qualcomm power driver could enable a local malicious application to access data outside of its permission levels… |
CVE-2016-10293 | Medium | 4.7 | 2017-05-12 | An information disclosure vulnerability in the Qualcomm video driver could enable a local malicious application to access data outside of its permission levels… |
CVE-2017-0276 | Medium | 5.9 | 2017-05-12 | Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1, Windows… |
CVE-2017-0275 | Medium | 5.9 | 2017-05-12 | Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1, Windows… |
CVE-2017-0274 | Medium | 5.9 | 2017-05-12 | Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1, Windows… |
CVE-2017-0271 | Medium | 5.9 | 2017-05-12 | Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1, Windows… |
CVE-2017-0270 | Medium | 5.9 | 2017-05-12 | Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1, Windows… |
CVE-2017-0268 | Medium | 5.9 | 2017-05-12 | Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1, Windows… |
CVE-2017-0267 | Medium | 5.9 | 2017-05-12 | Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1, Windows… |
CVE-2017-0259 | Medium | 4.7 | 2017-05-12 | The Windows kernel in Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows authenti… |
CVE-2017-0258 | Medium | 4.7 | 2017-05-12 | The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gol… |
CVE-2017-0245 | Medium | 4.7 | 2017-05-12 | The kernel-mode drivers in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1 and Windows Server 2012 Gold allow a local authenticated attacker to execute a spe… |
CVE-2017-0242 | Medium | 5.5 | 2017-05-12 | An information disclosure vulnerability exists in the way some ActiveX objects are instantiated, aka "Microsoft ActiveX Information Disclosure Vulnerability." |
CVE-2017-0220 | Medium | 4.7 | 2017-05-12 | The Windows kernel in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Windows Server 2012 Gold allows authenticated attackers to obtain sensitive inform… |
CVE-2017-0190 | Medium | 4.4 | 2017-05-12 | The GDI component in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold… |
CVE-2017-0175 | Medium | 4.7 | 2017-05-12 | The Windows kernel in Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows authenticated attackers to obtain sensitive information via a specially craf… |
CVE-2017-8360 | Medium | 5.5 | 2017-05-12 | Conexant Systems mictray64 task, as used on HP Elite, EliteBook, ProBook, and ZBook systems, leaks sensitive data (keystrokes) to any process. In mictray64.exe… |
CVE-2017-8899 | High | 8.1 | 2017-05-11 | Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has a composite of Stored XSS and Information Disclosure issues in the attachments feature f… |
CVE-2017-8878 | Medium | 6.5 | 2017-05-10 | ASUS RT-AC* and RT-N* devices with firmware before 3.0.0.4.380.7378 allow remote authenticated users to discover the Wi-Fi password via WPS_info.xml. |
CVE-2017-8877 | Medium | 6.5 | 2017-05-10 | ASUS RT-AC* and RT-N* devices with firmware through 3.0.0.4.380.7378 allow JSONP Information Disclosure such as the SSID. |
CVE-2017-5892 | High | 7.5 | 2017-05-10 | ASUS RT-AC* and RT-N* devices with firmware before 3.0.0.4.380.7378 allow JSONP Information Disclosure such as a network map. |
CVE-2017-3067 | High | 7.5 | 2017-05-09 | Adobe Experience Manager Forms versions 6.2, 6.1, 6.0 have an information disclosure vulnerability resulting from abuse of the pre-population service in AEM Fo… |
CVE-2017-0895 | Low | 3.5 | 2017-05-08 | Nextcloud Server before 10.0.4 and 11.0.2 are vulnerable to disclosure of calendar and addressbook names to other logged-in users. Note that no actual content… |
CVE-2017-7923 | High | 8.8 | 2017-05-06 | A Password in Configuration File issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0… |
CVE-2016-8916 | Medium | 5.5 | 2017-05-05 | IBM Tivoli Storage Manager 5.5, 6.1-6.4, and 7.1 stores password information in a log file that could be read by a local user when a set password command is is… |
CVE-2017-3732 | Medium | 5.9 | 2017-05-04 | There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL 1.0.2 before 1.0.2k and 1.1.0 before 1.1.0d. No EC algorithms are affec… |
CVE-2017-6626 | Medium | 5.3 | 2017-05-03 | A vulnerability in the Cisco Finesse Notification Service for Cisco Unified Contact Center Enterprise (UCCE) 11.5(1) and 11.6(1) could allow an unauthenticated… |
CVE-2017-5481 | High | 8.8 | 2017-05-03 | Trend Micro OfficeScan 11.0 before SP1 CP 6325 and XG before CP 1352 allows remote authenticated users to gain privileges by leveraging a leak of an encrypted… |
CVE-2017-7995 | Low | 3.8 | 2017-05-03 | Xen PV guest before Xen 4.3 checked access permissions to MMIO ranges only after accessing them, allowing host PCI device space memory reads, leading to inform… |
CVE-2016-0382 | Medium | 4.0 | 2017-05-03 | The IBM Tealeaf Consumer Experience 8.7, 8.8, and 9.0 portal exposes some of its operational state in a form that may be accidentally captured and exposed by n… |
CVE-2017-7216 | Medium | 6.5 | 2017-05-02 | The Management Web Interface in Palo Alto Networks PAN-OS before 7.1.9 allows remote authenticated users to obtain sensitive information via unspecified reques… |
CVE-2016-5810 | Medium | 4.9 | 2017-05-02 | upAdminPg.asp in Advantech WebAccess before 8.1_20160519 allows remote authenticated administrators to obtain sensitive password information via unspecified ve… |
CVE-2016-5006 | Critical | 9.8 | 2017-05-02 | The Cloud Controller in Cloud Foundry before 239 logs user-provided service objects at creation, which allows attackers to obtain sensitive user credential inf… |
CVE-2016-4442 | Medium | 5.3 | 2017-05-02 | The rack-mini-profiler gem before 0.10.1 for Ruby allows remote attackers to obtain sensitive information about allocated strings and objects by leveraging inc… |
CVE-2016-10351 | Medium | 5.5 | 2017-05-01 | Telegram Desktop 0.10.19 uses 0755 permissions for $HOME/.TelegramDesktop, which allows local users to obtain sensitive authentication information via standard… |