CWE-200 · Information Disclosure (page 78)
Page 78 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-6689 | Medium | 5.5 | 2016-10-10 | Binder in the kernel in Android before 2016-10-05 on Nexus devices allows attackers to obtain sensitive information via a crafted application, aka internal bug… |
CVE-2016-6688 | Medium | 5.5 | 2016-10-10 | The NVIDIA profiler in Android before 2016-10-05 on Nexus 9 devices allows attackers to obtain sensitive information via a crafted application, aka internal bu… |
CVE-2016-6687 | Medium | 5.5 | 2016-10-10 | The NVIDIA profiler in Android before 2016-10-05 on Nexus 9 devices allows attackers to obtain sensitive information via a crafted application, aka internal bu… |
CVE-2016-6686 | Medium | 5.5 | 2016-10-10 | The NVIDIA profiler in Android before 2016-10-05 on Nexus 9 devices allows attackers to obtain sensitive information via a crafted application, aka internal bu… |
CVE-2016-6685 | Medium | 5.5 | 2016-10-10 | The kernel in Android before 2016-10-05 on Nexus 6P devices allows attackers to obtain sensitive information via a crafted application, aka internal bug 304026… |
CVE-2016-6684 | Medium | 5.5 | 2016-10-10 | The kernel in Android before 2016-10-05 on Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, and Android One devices allows attackers to obtain sens… |
CVE-2016-6683 | Medium | 5.5 | 2016-10-10 | The kernel in Android before 2016-10-05 on Nexus devices allows attackers to obtain sensitive information via a crafted application, aka internal bug 30143283. |
CVE-2016-6682 | Medium | 5.5 | 2016-10-10 | drivers/misc/qcom/qdsp6v2/audio_utils.c in a Qualcomm QDSP6v2 driver in Android before 2016-10-05 on Nexus 5X, Nexus 6P, and Android One devices does not initi… |
CVE-2016-6681 | Medium | 5.5 | 2016-10-10 | drivers/misc/qcom/qdsp6v2/audio_utils.c in a Qualcomm QDSP6v2 driver in Android before 2016-10-05 on Nexus 5X, Nexus 6P, and Android One devices does not initi… |
CVE-2016-6680 | High | 7.8 | 2016-10-10 | CORE/HDD/src/wlan_hdd_wext.c in the Qualcomm Wi-Fi driver in Android before 2016-10-05 on Nexus 5X and Android One devices allows attackers to obtain sensitive… |
CVE-2016-6679 | Medium | 5.5 | 2016-10-10 | CORE/HDD/src/wlan_hdd_hostapd.c in the Qualcomm Wi-Fi driver in Android before 2016-10-05 on Nexus 5X and Android One devices allows attackers to obtain sensit… |
CVE-2016-6678 | Medium | 5.5 | 2016-10-10 | The Motorola USBNet driver in Android before 2016-10-05 on Nexus 6 devices allows attackers to obtain sensitive information via a crafted application, aka inte… |
CVE-2016-6677 | Medium | 5.5 | 2016-10-10 | The NVIDIA GPU driver in Android before 2016-10-05 on Nexus 9 devices allows attackers to obtain sensitive information via a crafted application, aka internal… |
CVE-2016-3924 | Medium | 5.5 | 2016-10-10 | services/audioflinger/Effects.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 201… |
CVE-2016-3918 | Medium | 5.5 | 2016-10-10 | email/provider/AttachmentProvider.java in AOSP Mail in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before… |
CVE-2016-3902 | Medium | 5.5 | 2016-10-10 | drivers/platform/msm/ipa/ipa_qmi_service.c in the Qualcomm IPA driver in Android before 2016-10-05 on Nexus 5X and 6P devices allows attackers to obtain sensit… |
CVE-2016-3860 | Medium | 5.5 | 2016-10-10 | sound/soc/msm/qdsp6v2/audio_calibration.c in the Qualcomm sound driver in Android before 2016-10-05 on Nexus 5X, Nexus 6P, and Android One devices allows attac… |
CVE-2015-8950 | Medium | 5.5 | 2016-10-10 | arch/arm64/mm/dma-mapping.c in the Linux kernel before 4.0.3, as used in the ION subsystem in Android and other products, does not initialize certain data stru… |
CVE-2015-2080 | High | 7.5 | 2016-10-07 | The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal cha… |
CVE-2015-1000012 | High | 7.5 | 2016-10-06 | Local File Inclusion Vulnerability in mypixs v0.3 wordpress plugin |
CVE-2015-1000008 | Medium | 5.3 | 2016-10-06 | Path Disclosure Vulnerability in wordpress plugin MP3-jPlayer v2.3.2 |
CVE-2015-1000007 | High | 7.5 | 2016-10-06 | Remote file download vulnerability in wptf-image-gallery v1.03 |
CVE-2016-6653 | High | 7.5 | 2016-10-06 | The MariaDB audit_plugin component in Pivotal Cloud Foundry (PCF) cf-mysql-release 27 and 28 allows remote attackers to obtain sensitive information by reading… |
CVE-2016-6435 | Medium | 6.5 | 2016-10-06 | The web console in Cisco Firepower Management Center 6.0.1 allows remote authenticated users to read arbitrary files via crafted parameters, aka Bug ID CSCva30… |
CVE-2016-6026 | Medium | 5.3 | 2016-10-06 | The Configuration Manager in IBM Sterling Secure Proxy (SSP) 3.4.2 before 3.4.2.0 iFix 8 and 3.4.3 before 3.4.3.0 iFix 1 allows man-in-the-middle attackers to… |
CVE-2016-1455 | High | 7.5 | 2016-10-05 | Cisco NX-OS before 7.0(3)I2(2e) and 7.0(3)I4 before 7.0(3)I4(1) has an incorrect iptables local-interface configuration, which allows remote attackers to obtai… |
CVE-2016-7561 | High | 7.2 | 2016-10-05 | Fortinet FortiWLC 6.1-2-29 and earlier, 7.0-9-1, 7.0-10-0, 8.0-5-0, 8.1-2-0, and 8.2-4-0 allow administrators to obtain sensitive user credentials by reading t… |
CVE-2016-6420 | Medium | 6.5 | 2016-10-05 | Cisco FireSIGHT System Software 4.10.3 through 5.4.0 in Firepower Management Center allows remote authenticated users to bypass authorization checks and gain p… |
CVE-2016-2307 | High | 7.5 | 2016-10-05 | American Auto-Matrix Aspect-Nexus Building Automation Front-End Solutions application before 3.0.0 and Aspect-Matrix Building Automation Front-End Solutions ap… |
CVE-2016-7031 | High | 7.5 | 2016-10-03 | The RGW code in Ceph before 10.0.1, when authenticated-read ACL is applied to a bucket, allows remote attackers to list the bucket contents via a URL. |
CVE-2016-6494 | Medium | 5.5 | 2016-10-03 | The client in MongoDB uses world-readable permissions on .dbshell history files, which might allow local users to obtain sensitive information by reading these… |
CVE-2016-7442 | Medium | 4.4 | 2016-10-03 | The Frontend component in Sophos UTM with firmware 9.405-5 and earlier allows local administrators to obtain sensitive password information by reading the "val… |
CVE-2016-7397 | Medium | 4.4 | 2016-10-03 | The Frontend component in Sophos UTM with firmware 9.405-5 and earlier allows local administrators to obtain sensitive password information by reading the "val… |
CVE-2016-5986 | High | 7.5 | 2016-10-01 | IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.x before 8.0.0.13, 8.5.x before 8.5.5.11, 9.0.x before 9.0.0.2, and Liberty before 16.0.0.3 mis… |
CVE-2016-7090 | Medium | 4.0 | 2016-09-29 | The integrated web server on Siemens SCALANCE M-800 and S615 modules with firmware before 4.02 does not set the secure flag for the session cookie in an https… |
CVE-2016-6146 | Medium | 5.3 | 2016-09-27 | The NameServer in SAP TREX 7.10 Revision 63 allows remote attackers to obtain sensitive TNS information via an unspecified query, aka SAP Security Note 2234226. |
CVE-2016-6827 | Medium | 6.5 | 2016-09-26 | Huawei FusionCompute before V100R005C10CP7002 stores cleartext AES keys in a file, which allows remote authenticated users to obtain sensitive information via… |
CVE-2016-3639 | Medium | 4.3 | 2016-09-26 | SAP HANA DB 1.00.091.00.1418659308 allows remote attackers to obtain sensitive topology information via an unspecified HTTP request, aka SAP Security Note 2176… |
CVE-2016-5976 | Medium | 4.9 | 2016-09-26 | The web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10, 8.8 before 8.8.0.9049 FP9, 9.0.0 and 9.0.1 before 9.0.1.1117 FP5, 9.0.1A before 9.0.1… |
CVE-2016-5972 | Medium | 6.8 | 2016-09-26 | IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 uses weak permissions for unspecified resources, which allows remote au… |
CVE-2016-5971 | High | 7.1 | 2016-09-26 | IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 allows remote authenticated users to read arbitrary files or cause a de… |
CVE-2016-5970 | Medium | 6.5 | 2016-09-26 | Directory traversal vulnerability in IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 allows remote authenticated users… |
CVE-2016-5946 | Medium | 6.5 | 2016-09-26 | Directory traversal vulnerability in IBM Spectrum Control (formerly Tivoli Storage Productivity Center) 5.2.x before 5.2.11 allows remote authenticated users t… |
CVE-2016-2999 | Medium | 6.5 | 2016-09-26 | IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to obtain sensitive information via an unspecified br… |
CVE-2016-0248 | Low | 3.7 | 2016-09-26 | IBM Security Guardium 9.0 before p700 and 10.0 before p100 allows man-in-the-middle attackers to obtain sensitive query-string information from SSL sessions vi… |
CVE-2016-5172 | Medium | 6.5 | 2016-09-25 | The parser in Google V8, as used in Google Chrome before 53.0.2785.113, mishandles scopes, which allows remote attackers to obtain sensitive information from a… |
CVE-2016-4771 | Medium | 5.5 | 2016-09-25 | The kernel in Apple iOS before 10 and OS X before 10.12 allows local users to bypass intended file-access restrictions via a crafted directory pathname. |
CVE-2016-4758 | Medium | 6.5 | 2016-09-25 | WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly restrict access to the location variable, which allows r… |
CVE-2016-4755 | Medium | 5.5 | 2016-09-25 | Terminal in Apple OS X before 10.12 uses weak permissions for the .bash_history and .bash_session files, which allows local users to obtain sensitive informati… |
CVE-2016-4752 | Medium | 5.5 | 2016-09-25 | The SecKeyDeriveFromPassword function in Apple OS X before 10.12 does not use the CF_RETURNS_RETAINED keyword, which allows attackers to obtain sensitive infor… |
CVE-2016-4745 | Medium | 5.3 | 2016-09-25 | The Kerberos 5 (aka krb5) PAM module in Apple OS X before 10.12 does not use constant-time operations for determining username validity, which makes it easier… |
CVE-2016-4742 | Medium | 5.5 | 2016-09-25 | NSSecureTextField in Apple OS X before 10.12 does not enable Secure Input, which allows attackers to discover credentials via a crafted app. |
CVE-2016-4739 | Low | 3.7 | 2016-09-25 | mDNSResponder in Apple OS X before 10.12, when VMnet.framework is used, arranges for a DNS proxy to listen on all interfaces, which allows remote attackers to… |
CVE-2016-4715 | Low | 3.3 | 2016-09-25 | The Date & Time Pref Pane component in Apple OS X before 10.12 mishandles the .GlobalPreferences file, which allows attackers to discover a user's location via… |
CVE-2016-4713 | Medium | 5.3 | 2016-09-25 | CoreDisplay in Apple OS X before 10.12 allows attackers to view arbitrary users' screens by leveraging screen-sharing access. |
CVE-2016-4711 | High | 7.5 | 2016-09-25 | CCrypt in corecrypto in CommonCrypto in Apple iOS before 10 and OS X before 10.12 allows attackers to discover cleartext information by leveraging a function c… |
CVE-2016-4708 | Medium | 6.5 | 2016-09-25 | CFNetwork in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 misparses the Set-Cookie header, which allows remote attackers to obt… |
CVE-2016-4707 | Medium | 4.0 | 2016-09-25 | CFNetwork in Apple iOS before 10 and OS X before 10.12 mishandles Local Storage deletion, which allows local users to discover the visited web sites of arbitra… |
CVE-2016-0918 | Medium | 4.3 | 2016-09-24 | EMC RSA Identity Management and Governance before 6.8.1 P25 and 6.9.x before 6.9.1 P15 and RSA Via Lifecycle and Governance before 7.0.0 P04 allow remote authe… |
CVE-2016-5282 | Medium | 6.5 | 2016-09-22 | Mozilla Firefox before 49.0 does not properly restrict the scheme in favicon requests, which might allow remote attackers to obtain sensitive information via u… |
CVE-2016-5279 | Medium | 4.3 | 2016-09-22 | Mozilla Firefox before 49.0 allows user-assisted remote attackers to obtain sensitive full-pathname information during a local-file drag-and-drop operation via… |
CVE-2016-4968 | Medium | 6.5 | 2016-09-21 | The linkreport/tmp/admin_global page in Fortinet FortiWan (formerly AscernLink) before 4.2.5 allows remote authenticated users to discover administrator cookie… |
CVE-2016-4967 | Medium | 6.5 | 2016-09-21 | Fortinet FortiWan (formerly AscernLink) before 4.2.5 allows remote authenticated users to obtain sensitive information from (1) a backup of the device configur… |
CVE-2016-0904 | High | 8.6 | 2016-09-21 | Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before 7.3.0-233 use the same encryption key across different customers' installa… |
CVE-2016-0903 | Critical | 9.1 | 2016-09-21 | Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before 7.3.0-233 rely on client-side authentication, which allows remote attacker… |
CVE-2016-6537 | High | 7.5 | 2016-09-19 | AVer Information EH6108H+ devices with firmware X9.03.24.00.07l store passwords in a cleartext base64 format and require cleartext credentials in HTTP Cookie h… |
CVE-2016-6415 | High | 7.5 | 2016-09-19 | The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX befor… |
CVE-2016-0870 | Medium | 5.3 | 2016-09-19 | The web server in Trane Tracer SC 4.2.1134 and earlier allows remote attackers to read sensitive configuration files via a direct request. |
CVE-2016-4749 | Low | 3.3 | 2016-09-18 | Printing UIKit in Apple iOS before 10 mishandles environment variables, which allows local users to discover cleartext AirPrint preview content by reading a te… |
CVE-2016-4747 | Low | 3.7 | 2016-09-18 | Mail in Apple iOS before 10 mishandles certificates, which makes it easier for man-in-the-middle attackers to discover mail credentials via unspecified vectors. |
CVE-2016-4746 | Medium | 5.3 | 2016-09-18 | The Keyboards component in Apple iOS before 10 does not properly use a cache for auto-correct suggestions, which allows remote attackers to obtain sensitive in… |
CVE-2016-4740 | Low | 2.9 | 2016-09-18 | Apple iOS before 10, when Handoff for Messages is used, does not ensure that a Messages signin has occurred before displaying messages, which might allow attac… |
CVE-2016-4719 | Medium | 5.5 | 2016-09-18 | The GeoServices component in Apple iOS before 10 and watchOS before 3 does not properly restrict access to PlaceData information, which allows attackers to dis… |
CVE-2016-4620 | Low | 3.3 | 2016-09-18 | The Sandbox Profiles component in Apple iOS before 10 does not properly restrict access to directory metadata for SMS draft directories, which allows attackers… |
CVE-2016-0929 | High | 7.5 | 2016-09-18 | The metrics-collection component in RabbitMQ for Pivotal Cloud Foundry (PCF) 1.6.x before 1.6.4 logs command lines of failed commands, which might allow contex… |
CVE-2016-6644 | Medium | 5.3 | 2016-09-17 | EMC Documentum D2 4.5 before patch 15 and 4.6 before patch 03 allows remote attackers to read arbitrary Docbase documents by leveraging knowledge of an r_objec… |
CVE-2016-7420 | Medium | 5.9 | 2016-09-16 | Crypto++ (aka cryptopp) through 5.6.4 does not document the requirement for a compile-time NDEBUG definition disabling the many assert calls that are unintende… |
CVE-2016-6936 | High | 7.5 | 2016-09-16 | Adobe AIR SDK & Compiler before 23.0.0.257 on Windows does not support Android runtime-analytics transport security, which might allow remote attackers to obta… |
CVE-2016-3374 | Medium | 6.5 | 2016-09-14 | The PDF library in Microsoft Edge, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows remote attackers to… |
CVE-2016-3371 | Medium | 5.5 | 2016-09-14 | The kernel API in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1… |
CVE-2016-3370 | Medium | 6.5 | 2016-09-14 | The PDF library in Microsoft Edge, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows remote attackers to… |
CVE-2016-3344 | Low | 3.3 | 2016-09-14 | The Secure Kernel Mode feature in Microsoft Windows 10 Gold and 1511 allows local users to obtain sensitive information via a crafted application, aka "Windows… |
CVE-2016-3325 | Low | 3.1 | 2016-09-14 | Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Informa… |
CVE-2016-3291 | Low | 2.4 | 2016-09-14 | Microsoft Internet Explorer 11 and Microsoft Edge mishandle cross-origin requests, which allows remote attackers to obtain sensitive information via a crafted… |
CVE-2016-0141 | Medium | 6.5 | 2016-09-14 | The Visual Basic macros in Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016 export a certificate-store private key during a document-save operation, whi… |
CVE-2016-0138 | Medium | 4.3 | 2016-09-14 | Microsoft Exchange Server 2007 SP3, 2010 SP3, 2013 SP1, 2013 Cumulative Update 12, 2013 Cumulative Update 13, 2016 Cumulative Update 1, and 2016 Cumulative Upd… |
CVE-2016-6398 | Medium | 5.3 | 2016-09-12 | The PPTP server in Cisco IOS 15.5(3)M does not properly initialize packet buffers, which allows remote attackers to obtain sensitive information from earlier n… |
CVE-2016-5927 | Medium | 5.5 | 2016-09-12 | IBM Tivoli Storage Manager for Space Management (aka Spectrum Protect for Space Management) 6.3.x before 6.3.2.6, 6.4.x before 6.4.3.3, and 7.1.x before 7.1.6… |
CVE-2016-7128 | Medium | 5.3 | 2016-09-12 | The exif_process_IFD_in_TIFF function in ext/exif/exif.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles the case of a thumbnail offset that exceeds the… |
CVE-2016-3897 | Medium | 5.5 | 2016-09-11 | The WifiEnterpriseConfig class in net/wifi/WifiEnterpriseConfig.java in Wi-Fi in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x befo… |
CVE-2016-3896 | Medium | 5.5 | 2016-09-11 | AOSP Mail in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-09-01 allows attackers to obtain sensitive EmailAccountCache… |
CVE-2016-3895 | Medium | 5.5 | 2016-09-11 | Integer overflow in the Region::unflatten function in libs/ui/Region.cpp in mediaserver in Android 6.x before 2016-09-01 and 7.0 before 2016-09-01 allows attac… |
CVE-2016-3894 | Medium | 5.5 | 2016-09-11 | The Qualcomm DMA component in Android before 2016-09-05 on Nexus 6 devices allows attackers to obtain sensitive information via a crafted application, aka Andr… |
CVE-2016-3893 | Medium | 5.5 | 2016-09-11 | The wcdcal_hwdep_ioctl_shared function in sound/soc/codecs/wcdcal-hwdep.c in the Qualcomm sound codec in Android before 2016-09-05 on Nexus 6P devices does not… |
CVE-2016-3892 | Medium | 5.5 | 2016-09-11 | The Qualcomm SPMI driver in Android before 2016-09-05 on Nexus 5, 5X, 6, and 6P devices allows attackers to obtain sensitive information via a crafted applicat… |
CVE-2016-5166 | Low | 3.1 | 2016-09-11 | The download implementation in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not properly restrict saving a file… |
CVE-2016-6212 | Medium | 5.3 | 2016-09-09 | The Views module 7.x-3.x before 7.x-3.14 in Drupal 7.x and the Views module in Drupal 8.x before 8.1.3 might allow remote authenticated users to bypass intende… |
CVE-2016-1279 | Critical | 9.8 | 2016-09-09 | J-Web in Juniper Junos OS before 12.1X46-D45, 12.1X46-D50, 12.1X47 before 12.1X47-D35, 12.3 before 12.3R12, 12.3X48 before 12.3X48-D25, 13.3 before 13.3R10, 13… |
CVE-2016-7108 | Medium | 6.5 | 2016-09-07 | Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 SPH206 allows remote authenticated users to obtain the MD5 hashes of arbitrary user passwords v… |
CVE-2016-6899 | High | 7.5 | 2016-09-07 | The Intelligent Baseboard Management Controller (iBMC) in Huawei RH1288 V3 servers with software before V100R003C00SPC613, RH2288 V3 servers with software befo… |