CWE-200 · Information Disclosure (page 79)
Page 79 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-6838 | High | 7.5 | 2016-09-07 | Huawei X6800 and XH620 V3 servers with software before V100R003C00SPC606, RH1288 V3 servers with software before V100R003C00SPC613, RH2288 V3 servers with soft… |
CVE-2016-6670 | Medium | 5.3 | 2016-09-07 | Huawei S7700, S9300, S9700, and S12700 devices with software before V200R008C00SPC500 use random numbers with insufficient entropy to generate self-signed cert… |
CVE-2016-1242 | Medium | 4.4 | 2016-09-07 | file_open in Tryton before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allows remote authenticated users with ce… |
CVE-2016-1241 | Medium | 5.3 | 2016-09-07 | Tryton 3.x before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allow remote authenticated users to discover user… |
CVE-2016-6345 | Medium | 6.5 | 2016-09-07 | RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs. |
CVE-2016-6344 | Medium | 5.3 | 2016-09-07 | Red Hat JBoss BPM Suite 6.3.x does not include the HTTPOnly flag in a Set-Cookie header for session cookies, which makes it easier for remote attackers to obta… |
CVE-2016-7153 | Medium | 5.3 | 2016-09-06 | The HTTP/2 protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote att… |
CVE-2016-7152 | Medium | 5.3 | 2016-09-06 | The HTTPS protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote atta… |
CVE-2016-5430 | Medium | 5.3 | 2016-09-03 | The RSA 1.5 algorithm implementation in the JOSE_JWE class in JWE.php in jose-php before 2.2.1 lacks the Random Filling protection mechanism, which makes it ea… |
CVE-2016-5429 | Low | 3.7 | 2016-09-03 | jose-php before 2.2.1 does not use constant-time operations for HMAC comparison, which makes it easier for remote attackers to obtain sensitive information via… |
CVE-2016-1473 | Critical | 9.8 | 2016-09-02 | Cisco Small Business 220 devices with firmware before 1.0.1.1 have a hardcoded SNMP community, which allows remote attackers to read or modify SNMP objects by… |
CVE-2016-6298 | Medium | 5.3 | 2016-09-01 | The _Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism, which makes it easie… |
CVE-2016-0385 | Low | 3.1 | 2016-09-01 | Buffer overflow in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.10, 9.0 before 9.0.0.1, and Liberty before… |
CVE-2016-3064 | Medium | 6.5 | 2016-09-01 | NetApp Clustered Data ONTAP before 8.2.4P4 and 8.3.x before 8.3.2P2 allows remote authenticated users to obtain sensitive cluster and tenant information via un… |
CVE-2016-2183 | High | 7.5 | 2016-09-01 | The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four bill… |
CVE-2016-5677 | High | 7.5 | 2016-08-31 | NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 have a hardcoded qwe23622260 passwo… |
CVE-2016-0397 | Medium | 5.9 | 2016-08-30 | WebReports in IBM BigFix Platform (formerly Tivoli Endpoint Manager) 9.x before 9.5.2 allows remote attackers to obtain sensitive information by sniffing the n… |
CVE-2016-0292 | Medium | 5.5 | 2016-08-30 | WebReports in IBM BigFix Platform (formerly Tivoli Endpoint Manager) 9.x before 9.5.2 allows local users to discover the cleartext system password by reading a… |
CVE-2016-4378 | High | 7.5 | 2016-08-26 | The (1) Device Manager, (2) Tiered Storage Manager, (3) Replication Manager, (4) Replication Monitor, and (5) Hitachi Automation Director (HAD) components in H… |
CVE-2016-1497 | Medium | 4.9 | 2016-08-26 | The Configuration utility in F5 BIG-IP systems 11.0.x, 11.1.x, 11.2.x before 11.2.1 HF16, 11.3.x, 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4 HF2, 1.6.x be… |
CVE-2016-6231 | Medium | 5.9 | 2016-08-25 | Kaspersky Safe Browser iOS before 1.7.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to obtain sensitive infor… |
CVE-2016-5812 | Low | 3.3 | 2016-08-24 | Moxa OnCell G3100V2 devices before 2.8 and G3111, G3151, G3211, and G3251 devices before 1.7 use cleartext password storage, which makes it easier for local us… |
CVE-2016-6364 | High | 7.5 | 2016-08-23 | The User Data Services (UDS) API implementation in Cisco Unified Communications Manager 11.5 allows remote attackers to bypass intended access restrictions and… |
CVE-2016-1484 | High | 7.5 | 2016-08-23 | Cisco WebEx Meetings Server 2.6 allows remote attackers to bypass intended access restrictions and obtain sensitive application information via unspecified vec… |
CVE-2016-1477 | Medium | 6.5 | 2016-08-23 | Cisco Connected Streaming Analytics 1.1.1 allows remote authenticated users to discover a notification service password by reading administrative pages, aka Bu… |
CVE-2016-5390 | Medium | 5.3 | 2016-08-19 | Foreman before 1.11.4 and 1.12.x before 1.12.1 allow remote authenticated users with the view_hosts permission containing a filter to obtain sensitive network… |
CVE-2016-4995 | Medium | 5.3 | 2016-08-19 | Foreman before 1.11.4 and 1.12.x before 1.12.1 does not properly restrict access to preview provisioning templates, which allows remote authenticated users wit… |
CVE-2013-7458 | Low | 3.3 | 2016-08-10 | linenoise, as used in Redis before 3.2.3, uses world-readable permissions for .rediscli_history, which allows local users to obtain sensitive information by re… |
CVE-2016-3329 | Medium | 5.3 | 2016-08-09 | Microsoft Internet Explorer 9 through 11 and Edge allow remote attackers to determine the existence of files via a crafted webpage, aka "Internet Explorer Info… |
CVE-2016-3327 | Medium | 5.3 | 2016-08-09 | Microsoft Internet Explorer 9 through 11 and Edge allow remote attackers to obtain sensitive information via a crafted web page, aka "Microsoft Browser Informa… |
CVE-2016-3326 | Medium | 5.3 | 2016-08-09 | Microsoft Internet Explorer 9 through 11 and Edge allow remote attackers to obtain sensitive information via a crafted web page, aka "Microsoft Browser Informa… |
CVE-2016-3321 | Low | 2.5 | 2016-08-09 | Microsoft Internet Explorer 10 and 11 load different files for attempts to open a file:// URL depending on whether the file exists, which allows local users to… |
CVE-2016-3315 | Medium | 5.5 | 2016-08-09 | Microsoft OneNote 2007 SP3, 2010 SP2, 2013 SP1, 2013 RT SP1, 2016, and 2016 for Mac allow remote attackers to obtain sensitive information via a crafted OneNot… |
CVE-2016-3312 | Critical | 9.1 | 2016-08-09 | ActiveSyncProvider in Microsoft Windows 10 Gold and 1511 allows attackers to discover credentials by leveraging failure of Universal Outlook to obtain a secure… |
CVE-2016-4253 | Medium | 5.3 | 2016-08-09 | The Backup functionality in Adobe Experience Manager 5.6.1, 6.0, 6.1, and 6.2 allows attackers to obtain sensitive information via unspecified vectors. |
CVE-2016-4169 | Medium | 5.3 | 2016-08-09 | Adobe Experience Manager 6.0, 6.1, and 6.2 allow attackers to obtain sensitive audit log event information via unspecified vectors. |
CVE-2016-3059 | Medium | 6.2 | 2016-08-08 | IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server (aka IBM Spectrum Protect for Databases) 6.3 before 6.3.1.7 and 6.4 before 6… |
CVE-2016-5696 | Medium | 4.8 | 2016-08-06 | net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not properly determine the rate of challenge ACK segments, which makes it easier for remote attackers… |
CVE-2015-8944 | Medium | 5.5 | 2016-08-06 | The ioresources_init function in kernel/resource.c in the Linux kernel through 4.7, as used in Android before 2016-08-05 on Nexus 6 and 7 (2013) devices, uses… |
CVE-2014-9900 | Medium | 5.5 | 2016-08-06 | The ethtool_get_wol function in net/core/ethtool.c in the Linux kernel through 4.7, as used in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices, does… |
CVE-2014-9899 | Medium | 5.5 | 2016-08-06 | drivers/usb/host/ehci-msm2.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5 devices omits certain minimum calculations before copying data… |
CVE-2014-9898 | Medium | 5.5 | 2016-08-06 | arch/arm/mach-msm/qdsp6v2/ultrasound/usf.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices does not properly validate i… |
CVE-2014-9897 | Medium | 5.5 | 2016-08-06 | sound/soc/msm/qdsp6v2/msm-lsm-client.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5 devices does not validate certain user-space data, wh… |
CVE-2014-9896 | Medium | 5.5 | 2016-08-06 | drivers/char/adsprpc.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices does not properly validate parameters and return… |
CVE-2014-9895 | Medium | 5.5 | 2016-08-06 | drivers/media/media-device.c in the Linux kernel before 3.11, as used in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices, does not properly initializ… |
CVE-2014-9894 | Medium | 5.5 | 2016-08-06 | drivers/misc/qseecom.c in the Qualcomm components in Android before 2016-08-05 on Nexus 7 (2013) devices does not ensure that certain name strings end in a '\0… |
CVE-2014-9893 | Medium | 5.5 | 2016-08-06 | drivers/video/msm/mdss/mdss_mdp_pp.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5 devices does not properly determine the size of Gamut L… |
CVE-2014-9892 | Medium | 5.5 | 2016-08-06 | The snd_compr_tstamp function in sound/core/compress_offload.c in the Linux kernel through 4.7, as used in Android before 2016-08-05 on Nexus 5 and 7 (2013) de… |
CVE-2016-3852 | Medium | 5.5 | 2016-08-05 | The MediaTek Wi-Fi driver in Android before 2016-08-05 on Android One devices allows attackers to obtain sensitive information via a crafted application, aka A… |
CVE-2016-3837 | Medium | 5.5 | 2016-08-05 | service/jni/com_android_server_wifi_WifiNative.cpp in Wi-Fi in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 allows attackers to ob… |
CVE-2016-3836 | Medium | 5.5 | 2016-08-05 | The SurfaceFlinger service in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 allows attackers to obtain sensitive information via a… |
CVE-2016-3835 | Medium | 5.5 | 2016-08-05 | The secure-session feature in the mm-video-v4l2 venc component in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x befo… |
CVE-2016-3834 | Medium | 5.5 | 2016-08-05 | The camera APIs in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 allow attackers to bypass intended access restri… |
CVE-2016-5392 | Medium | 6.5 | 2016-08-05 | The API server in Kubernetes, as used in Red Hat OpenShift Enterprise 3.2, in a multi tenant environment allows remote authenticated users with knowledge of ot… |
CVE-2016-6149 | Medium | 5.5 | 2016-08-05 | SAP HANA SPS09 1.00.091.00.14186593 allows local users to obtain sensitive information by leveraging the EXPORT statement to export files, aka SAP Security Not… |
CVE-2016-6145 | Medium | 5.3 | 2016-08-05 | The SQL interface in SAP HANA DB 1.00.091.00.1418659308 provides different error messages for failed login attempts depending on whether the username exists an… |
CVE-2016-3640 | Medium | 5.5 | 2016-08-05 | The Extended Application Services (aka XS or XS Engine) in SAP HANA DB 1.00.091.00.1418659308 allows local users to obtain sensitive password information via v… |
CVE-2016-5265 | Medium | 5.5 | 2016-08-05 | Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow user-assisted remote attackers to bypass the Same Origin Policy, and conduct Universal XSS (… |
CVE-2016-5260 | Medium | 6.5 | 2016-08-05 | Mozilla Firefox before 48.0 mishandles changes from 'INPUT type="password"' to 'INPUT type="text"' within a single Session Manager session, which might allow a… |
CVE-2016-5250 | Medium | 4.3 | 2016-08-05 | Mozilla Firefox before 48.0, Firefox ESR < 45.4 and Thunderbird < 45.4 allow remote attackers to obtain sensitive information about the previously retrieved pa… |
CVE-2016-2830 | Medium | 4.3 | 2016-08-05 | Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 preserve the network connection used for favicon resource retrieval after the associated browser w… |
CVE-2015-5738 | High | 7.5 | 2016-07-26 | The RSA-CRT implementation in the Cavium Software Development Kit (SDK) 2.x, when used on OCTEON II CN6xxx Hardware on Linux to support TLS with Perfect Forwar… |
CVE-2016-5137 | Medium | 4.3 | 2016-07-23 | The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy (CSP) implementation in Blink, as used in Go… |
CVE-2016-5134 | High | 8.8 | 2016-07-23 | net/proxy/proxy_service.cc in the Proxy Auto-Config (PAC) feature in Google Chrome before 52.0.2743.82 does not ensure that URL information is restricted to a… |
CVE-2016-5744 | High | 7.5 | 2016-07-22 | Siemens SIMATIC WinCC 7.0 through SP3 and 7.2 allows remote attackers to read arbitrary WinCC station files via crafted packets. |
CVE-2016-4648 | Medium | 5.5 | 2016-07-22 | Audio in Apple OS X before 10.11.6 allows local users to obtain sensitive kernel memory-layout information or cause a denial of service (out-of-bounds read) vi… |
CVE-2016-4646 | Medium | 6.5 | 2016-07-22 | Audio in Apple OS X before 10.11.6 mishandles a size value, which allows remote attackers to obtain sensitive information or cause a denial of service (out-of-… |
CVE-2016-4645 | Low | 3.3 | 2016-07-22 | CFNetwork in Apple OS X before 10.11.6 uses weak permissions for web-browser cookies, which allows local users to obtain sensitive information via unspecified… |
CVE-2016-4635 | Medium | 5.3 | 2016-07-22 | FaceTime in Apple iOS before 9.3.3 and OS X before 10.11.6 allows man-in-the-middle attackers to spoof relayed-call termination, and obtain sensitive audio inf… |
CVE-2016-4628 | Medium | 5.5 | 2016-07-22 | IOAcceleratorFamily in Apple iOS before 9.3.3 and watchOS before 2.2.2 allows local users to obtain sensitive information from kernel memory or cause a denial… |
CVE-2016-4595 | Medium | 4.6 | 2016-07-22 | Safari Login AutoFill in Apple OS X before 10.11.6 allows physically proximate attackers to discover passwords by reading the screen during the login procedure. |
CVE-2016-4593 | Low | 2.4 | 2016-07-22 | The Siri Contacts component in Apple iOS before 9.3.3 allows physically proximate attackers to read arbitrary Contact card information via unspecified vectors. |
CVE-2016-0393 | Medium | 5.3 | 2016-07-17 | IBM Maximo Asset Management 7.5 before 7.5.0.10-TIV-MBS-IFIX002 and 7.6 before 7.6.0.5-TIV-MAMMT-FP001 allows remote attackers to obtain sensitive URL informat… |
CVE-2016-0321 | Medium | 6.2 | 2016-07-17 | IBM Personal Communications (aka PCOMM) 6.x before 6.0.17 and 12.x before 12.0.0.1 does not properly restrict credential extraction, which allows local users t… |
CVE-2016-2865 | Medium | 6.5 | 2016-07-15 | The GIT Integration component in IBM Rational Team Concert (RTC) 5.x before 5.0.2 iFix14 and 6.x before 6.0.1 iFix5 and Rational Collaborative Lifecycle Manage… |
CVE-2016-0338 | Medium | 6.2 | 2016-07-15 | IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 allows local users to discover cleartext passwords b… |
CVE-2015-1977 | High | 7.5 | 2016-07-15 | Directory traversal vulnerability in the Web Administration tool in IBM Tivoli Directory Server (ITDS) before 6.1.0.74-ISS-ISDS-IF0074, 6.2.x before 6.2.0.50-I… |
CVE-2016-5797 | Medium | 5.3 | 2016-07-15 | Tollgrade LightHouse SMS before 5.1 patch 3 provides different error messages for failed authentication attempts depending on whether the username exists, whic… |
CVE-2016-1452 | Medium | 6.5 | 2016-07-15 | Cisco ASR 5000 devices with software 18.3 through 20.0.0 allow remote attackers to make configuration changes over SNMP by leveraging knowledge of the read-wri… |
CVE-2016-3100 | High | 8.4 | 2016-07-13 | kinit in KDE Frameworks before 5.23.0 uses weak permissions (644) for /tmp/xauth-xxx-_y, which allows local users to obtain X11 cookies of other users and cons… |
CVE-2016-3277 | Medium | 5.3 | 2016-07-13 | Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser… |
CVE-2016-3273 | Medium | 5.3 | 2016-07-13 | The XSS Filter in Microsoft Internet Explorer 9 through 11 and Microsoft Edge does not properly restrict JavaScript code, which allows remote attackers to obta… |
CVE-2016-3272 | Low | 2.8 | 2016-07-13 | The kernel in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mishandles page-fault system calls, which al… |
CVE-2016-3271 | Medium | 6.5 | 2016-07-13 | The VBScript engine in Microsoft Edge allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Scripting Engine… |
CVE-2016-3261 | Medium | 5.3 | 2016-07-13 | Microsoft Internet Explorer 11 allows remote attackers to obtain sensitive information via a crafted web site, aka "Internet Explorer Information Disclosure Vu… |
CVE-2016-3256 | Medium | 5.0 | 2016-07-13 | Microsoft Windows 10 Gold and 1511 allows local users to bypass the Secure Kernel Mode protection mechanism and obtain sensitive information via a crafted appl… |
CVE-2016-3255 | High | 7.5 | 2016-07-13 | Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 allows remote attackers to read arbitrary files via XML data containing an external entity… |
CVE-2016-3251 | Low | 2.8 | 2016-07-13 | The GDI component in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 201… |
CVE-2016-4985 | High | 7.5 | 2016-07-12 | The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a… |
CVE-2016-3816 | Medium | 5.5 | 2016-07-11 | The MediaTek display driver in Android before 2016-07-05 on Android One devices allows attackers to obtain sensitive information via a crafted application, aka… |
CVE-2016-3815 | Medium | 5.5 | 2016-07-11 | The NVIDIA camera driver in Android before 2016-07-05 on Nexus 9 devices allows attackers to obtain sensitive information via a crafted application, aka Androi… |
CVE-2016-3814 | Medium | 5.5 | 2016-07-11 | The NVIDIA camera driver in Android before 2016-07-05 on Nexus 9 devices allows attackers to obtain sensitive information via a crafted application, aka Androi… |
CVE-2016-3813 | Medium | 5.5 | 2016-07-11 | The Qualcomm USB driver in Android before 2016-07-05 on Nexus 5, 5X, 6, and 6P devices allows attackers to obtain sensitive information via a crafted applicati… |
CVE-2016-3812 | Medium | 5.5 | 2016-07-11 | The MediaTek video codec driver in Android before 2016-07-05 on Android One devices allows attackers to obtain sensitive information via a crafted application… |
CVE-2016-3810 | Medium | 5.5 | 2016-07-11 | The MediaTek Wi-Fi driver in Android before 2016-07-05 on Android One devices allows attackers to obtain sensitive information via a crafted application, aka A… |
CVE-2016-3809 | Medium | 5.5 | 2016-07-11 | The networking component in Android before 2016-07-05 on Android One, Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 7 (2013), Nexus 9, Nexus Player, and Pixel C… |
CVE-2016-3765 | High | 7.7 | 2016-07-11 | decoder/impeg2d_bitstream.c in mediaserver in Android 6.x before 2016-07-01 allows attackers to obtain sensitive information from process memory or cause a den… |
CVE-2016-3761 | Medium | 4.0 | 2016-07-11 | NfcService.java in NFC in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows attackers to obtain sensitive fore… |
CVE-2016-3759 | Low | 3.3 | 2016-07-11 | The Framework APIs in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allow attackers to read backup data via a crafted application t… |
CVE-2016-3753 | High | 7.5 | 2016-07-11 | mediaserver in Android 4.x before 4.4.4 allows remote attackers to obtain sensitive information via unspecified vectors, aka internal bug 27210135. |