CWE-200 · Information Disclosure (page 80)
Page 80 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-0252 | Medium | 5.1 | 2016-07-08 | IBM Control Center 6.x before 6.0.0.1 iFix06 and Sterling Control Center 5.4.x before 5.4.2.1 iFix09 allow local users to decrypt the master key via unspecifie… |
CVE-2016-2923 | High | 7.5 | 2016-07-07 | IBM WebSphere Application Server (WAS) 8.5 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 does not include the HTTPOnly flag in a Set-Cookie header f… |
CVE-2016-0389 | Medium | 5.3 | 2016-07-07 | Admin Center in IBM WebSphere Application Server (WAS) 8.5.5.2 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 allows remote attackers to obtain sensi… |
CVE-2016-5097 | Medium | 5.3 | 2016-07-05 | phpMyAdmin before 4.6.2 places tokens in query strings and does not arrange for them to be stripped before external navigation, which allows remote attackers t… |
CVE-2016-5849 | Low | 2.5 | 2016-07-04 | Siemens SICAM PAS through 8.07 allows local users to obtain sensitive configuration information by leveraging database stoppage. |
CVE-2016-5848 | Medium | 6.7 | 2016-07-04 | Siemens SICAM PAS before 8.07 does not properly restrict password data in the database, which makes it easier for local users to calculate passwords by leverag… |
CVE-2016-0899 | Medium | 6.3 | 2016-07-04 | EMC RSA Archer GRC 5.5.x before 5.5.3.4 allows remote authenticated users to read the web.config.bak file, and obtain sensitive credential information, by modi… |
CVE-2016-2894 | Low | 2.5 | 2016-07-03 | IBM Spectrum Protect (formerly Tivoli Storage Manager) 5.5 through 6.3 before 6.3.2.6, 6.4 before 6.4.3.3, and 7.1 before 7.1.6 allows local users to obtain se… |
CVE-2016-1337 | High | 8.1 | 2016-07-03 | Cisco EPC3928 devices allow remote attackers to obtain sensitive configuration and credential information by making requests during the early part of the boot… |
CVE-2016-5739 | High | 7.5 | 2016-07-03 | The Transformation implementation in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not use the no-referrer Content Secu… |
CVE-2016-5730 | Medium | 5.3 | 2016-07-03 | phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving… |
CVE-2016-2079 | Medium | 5.9 | 2016-07-03 | VMware NSX Edge 6.1 before 6.1.7 and 6.2 before 6.2.3 and vCNS Edge 5.5 before 5.5.4.3, when the SSL-VPN feature is configured, allow remote attackers to obtai… |
CVE-2016-3956 | High | 7.5 | 2016-07-02 | The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes b… |
CVE-2016-2961 | Medium | 5.3 | 2016-07-02 | The integration server in IBM Integration Bus 9 before 9.0.0.6 and 10 before 10.0.0.5 and WebSphere Message Broker 8 before 8.0.0.8 allows remote attackers to… |
CVE-2016-2882 | Medium | 4.3 | 2016-07-02 | IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.4, and 3.5 before 3.5.0.2 allows remote authenticated users to obtain sensitive informati… |
CVE-2016-2861 | Low | 3.7 | 2016-07-02 | IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3, 7.1.1 before 7.1.1.1, 8.5 before 8.5.0.3, and 8.6 before 8.6.0.8 does not properly encrypt data, which makes… |
CVE-2016-0365 | Medium | 5.9 | 2016-07-01 | IBM UrbanCode Deploy 6.0.x before 6.0.1.13, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1, when agent-relay Codestation artifact caching is enabled, allows re… |
CVE-2016-0364 | Medium | 4.3 | 2016-07-01 | IBM UrbanCode Deploy 6.0.x before 6.0.1.13, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1 does not properly implement a logging-obfuscation feature for secure… |
CVE-2016-5306 | Medium | 5.3 | 2016-06-30 | Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 does not properly implement the HSTS protection mechanism, which makes it easier for remote att… |
CVE-2016-3651 | High | 8.0 | 2016-06-30 | Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to discover the PHP JSESSIONID value via unspecified vectors. |
CVE-2016-3650 | High | 8.8 | 2016-06-30 | Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to discover credentials via a brute-force attack. |
CVE-2016-3649 | Medium | 4.3 | 2016-06-30 | Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated administrators to enumerate administrator accounts via modified GET… |
CVE-2016-3648 | High | 8.8 | 2016-06-30 | Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to bypass the Authentication Lock protection mechanism, and c… |
CVE-2016-4474 | High | 8.8 | 2016-06-30 | The image build process for the overcloud images in Red Hat OpenStack Platform 8.0 (Liberty) director and Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo… |
CVE-2016-5835 | High | 7.5 | 2016-06-29 | WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/i… |
CVE-2016-0298 | Medium | 6.5 | 2016-06-29 | Directory traversal vulnerability in IBM Security Guardium Database Activity Monitor 10 before 10.0p100 allows remote authenticated users to read arbitrary fil… |
CVE-2016-0267 | High | 7.7 | 2016-06-29 | IBM UrbanCode Deploy 6.0.x before 6.0.1.13, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1 allows remote authenticated users to obtain sensitive cleartext secu… |
CVE-2016-5244 | High | 7.5 | 2016-06-27 | The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel through 4.6.3 does not initialize a certain structure member, which allows remote attacker… |
CVE-2016-5243 | Medium | 5.5 | 2016-06-27 | The tipc_nl_compat_link_dump function in net/tipc/netlink_compat.c in the Linux kernel through 4.6.3 does not properly copy a certain string, which allows loca… |
CVE-2014-9903 | Medium | 5.5 | 2016-06-27 | The sched_read_attr function in kernel/sched/core.c in the Linux kernel 3.14-rc before 3.14-rc4 uses an incorrect size, which allows local users to obtain sens… |
CVE-2016-0259 | Low | 2.5 | 2016-06-26 | runmqsc in IBM WebSphere MQ 8.x before 8.0.0.5 allows local users to bypass an intended +dsp authority requirement and obtain sensitive information via unspeci… |
CVE-2016-1193 | High | 7.5 | 2016-06-25 | Cybozu Garoon 3.7 through 4.2 allows remote attackers to obtain sensitive email-reading information via unspecified vectors. |
CVE-2016-5722 | High | 7.3 | 2016-06-24 | Huawei OceanStor 5300 V3, 5500 V3, 5600 V3, 5800 V3, 6800 V3, 18800 V3, and 18500 V3 before V300R003C10 sends the plaintext session token in the HTTP header, w… |
CVE-2016-5709 | Medium | 4.7 | 2016-06-24 | SolarWinds Virtualization Manager 6.3.1 and earlier uses weak encryption to store passwords in /etc/shadow, which allows local users with superuser privileges… |
CVE-2016-5021 | Medium | 4.9 | 2016-06-24 | The iControl REST service in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.5.x before 11.5.4, 11.6.x before 11.6.1, and 12.x before… |
CVE-2015-8289 | High | 7.5 | 2016-06-20 | The password-recovery feature on NETGEAR D3600 devices with firmware 1.0.0.49 and D6000 devices with firmware 1.0.0.49 and earlier allows remote attackers to d… |
CVE-2016-1864 | Medium | 4.3 | 2016-06-19 | The XSS auditor in WebKit, as used in Apple iOS before 9.3 and Safari before 9.1, does not properly handle redirects in block mode, which allows remote attacke… |
CVE-2016-1862 | Low | 3.3 | 2016-06-19 | Intel Graphics Driver in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app, a different vulnera… |
CVE-2016-1860 | Low | 3.3 | 2016-06-19 | Intel Graphics Driver in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app, a different vulnera… |
CVE-2016-1196 | Medium | 4.3 | 2016-06-19 | Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote authenticated users to bypass intended access restrictions and obtain sensitive Address Book information v… |
CVE-2016-1192 | Medium | 4.3 | 2016-06-19 | Directory traversal vulnerability in the logging implementation in Cybozu Garoon 3.7 through 4.2 allows remote authenticated users to read a log file via unspe… |
CVE-2015-7776 | Medium | 4.3 | 2016-06-19 | Cybozu Garoon 3.x and 4.x before 4.2.0 does not properly restrict loading of IMG elements, which makes it easier for remote attackers to track users via a craf… |
CVE-2015-7462 | Medium | 4.4 | 2016-06-19 | IBM WebSphere MQ 8.0.0.4 on IBM i platforms allows local users to discover cleartext certificate-keystore passwords within MQ trace output by leveraging admini… |
CVE-2016-1225 | Medium | 6.5 | 2016-06-19 | Trend Micro Internet Security 8 and 10 allows remote attackers to read arbitrary files via unspecified vectors. |
CVE-2016-4816 | Medium | 6.5 | 2016-06-19 | BUFFALO WZR-600DHP3 devices with firmware 2.16 and earlier and WZR-S600DHP devices allow remote attackers to discover credentials and other sensitive informati… |
CVE-2016-1427 | High | 7.5 | 2016-06-18 | The System Configuration Protocol (SCP) core messaging interface in Cisco Prime Network Registrar 8.2 before 8.2.3.1 and 8.3 before 8.3.2 allows remote attacke… |
CVE-2016-3234 | Medium | 5.5 | 2016-06-16 | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2, Wo… |
CVE-2016-3232 | Medium | 5.0 | 2016-06-16 | The Virtual PCI (VPCI) virtual service provider in Microsoft Windows Server 2012 Gold and R2 allows local users to obtain sensitive information from uninitiali… |
CVE-2016-3216 | Medium | 4.3 | 2016-06-16 | GDI32.dll in the Graphics component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold an… |
CVE-2016-3215 | Medium | 5.5 | 2016-06-16 | Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 1511, and Microsoft Edge allow remote attackers to obtain sensitive information from process… |
CVE-2016-3201 | Medium | 6.5 | 2016-06-16 | Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 Gold and 1511, and Microsoft Edge allow remote attackers to obtain sensitive information fro… |
CVE-2016-0028 | Medium | 5.5 | 2016-06-16 | Outlook Web Access (OWA) in Microsoft Exchange Server 2013 SP1, Cumulative Update 11, and Cumulative Update 12 and 2016 Gold and Cumulative Update 1 does not p… |
CVE-2016-5367 | High | 7.5 | 2016-06-14 | Huawei Honor WS851 routers with software 1.1.21.1 and earlier allow remote attackers to obtain sensitive information via unspecified vectors, aka HWPSIRT-2016-… |
CVE-2015-8869 | Critical | 9.1 | 2016-06-13 | OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sensitive information… |
CVE-2016-2832 | Medium | 4.3 | 2016-06-13 | Mozilla Firefox before 47.0 allows remote attackers to discover the list of disabled plugins via a fingerprinting attack involving Cascading Style Sheets (CSS)… |
CVE-2016-2500 | Medium | 5.5 | 2016-06-13 | Activity Manager in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 does not properly terminate process groups, which allows attacker… |
CVE-2016-2499 | Medium | 5.5 | 2016-06-13 | AudioSource.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 does not initia… |
CVE-2016-2498 | Medium | 5.5 | 2016-06-13 | The Qualcomm Wi-Fi driver in Android before 2016-06-01 on Nexus 7 (2013) devices allows attackers to bypass intended data-access restrictions via a crafted app… |
CVE-2016-5233 | Low | 3.7 | 2016-06-10 | Huawei Mate 8 smartphones with software NXT-AL10 before NXT-AL10C00B182, NXT-CL00 before NXT-CL00C92B182, NXT-DL00 before NXT-DL00C17B182, and NXT-TL00 before… |
CVE-2016-4516 | Low | 3.3 | 2016-06-10 | ABB PCM600 before 2.7 improperly stores the main application password after a password change, which allows local users to obtain sensitive information via uns… |
CVE-2015-8268 | High | 7.5 | 2016-06-10 | The up.time agent in Idera Uptime Infrastructure Monitor 7.5 and 7.6 on Linux allows remote attackers to read arbitrary files via unspecified vectors. |
CVE-2016-1582 | Medium | 5.5 | 2016-06-09 | LXD before 2.0.2 does not properly set permissions when switching an unprivileged container into privileged mode, which allows local users to access arbitrary… |
CVE-2016-3711 | Low | 3.3 | 2016-06-08 | HAproxy in Red Hat OpenShift Enterprise 3.2 and OpenShift Origin allows local users to obtain the internal IP address of a pod by reading the "OPENSHIFT_[names… |
CVE-2016-2149 | Medium | 6.5 | 2016-06-08 | Red Hat OpenShift Enterprise 3.2 allows remote authenticated users to read log files from another namespace by using the same name as a previously deleted name… |
CVE-2016-2142 | Medium | 5.5 | 2016-06-08 | Red Hat OpenShift Enterprise 3.1 uses world-readable permissions on the /etc/origin/master/master-config.yaml configuration file, which allows local users to o… |
CVE-2016-4367 | High | 7.5 | 2016-06-08 | The Universal Discovery component in HPE Universal CMDB 10.0, 10.01, 10.10, 10.11, 10.20, and 10.21 allows remote attackers to obtain sensitive information via… |
CVE-2016-2027 | High | 7.5 | 2016-06-08 | HPE Matrix Operating Environment before 7.5.1 allows remote attackers to obtain sensitive information via unspecified vectors, a different vulnerability than C… |
CVE-2016-2026 | High | 7.5 | 2016-06-08 | HPE Matrix Operating Environment before 7.5.1 allows remote attackers to obtain sensitive information via unspecified vectors, a different vulnerability than C… |
CVE-2015-5231 | Medium | 5.5 | 2016-06-07 | The service daemon in CRIU does not properly restrict access to non-dumpable processes, which allows local users to obtain sensitive information via (1) proces… |
CVE-2015-5041 | Critical | 9.1 | 2016-06-06 | The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to… |
CVE-2016-1698 | Medium | 6.5 | 2016-06-05 | The createCustomType function in extensions/renderer/resources/binding.js in the extension bindings in Google Chrome before 51.0.2704.79 does not validate modu… |
CVE-2016-1687 | Medium | 6.5 | 2016-06-05 | The renderer implementation in Google Chrome before 51.0.2704.63 does not properly restrict public exposure of classes, which allows remote attackers to obtain… |
CVE-2016-1677 | Medium | 6.5 | 2016-06-05 | uri.js in Google V8 before 5.1.281.26, as used in Google Chrome before 51.0.2704.63, uses an incorrect array type, which allows remote attackers to obtain sens… |
CVE-2016-4785 | Medium | 5.3 | 2016-05-31 | A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100… |
CVE-2016-4784 | Medium | 5.3 | 2016-05-31 | A vulnerability has been identified in firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100… |
CVE-2016-4521 | Critical | 9.8 | 2016-05-31 | Sixnet BT-5xxx and BT-6xxx M2M devices before 3.8.21 and 3.9.x before 3.9.8 have hardcoded credentials, which allows remote attackers to obtain access via unsp… |
CVE-2016-2295 | High | 7.5 | 2016-05-31 | Moxa MiiNePort_E1_4641 devices with firmware 1.1.10 Build 09120714, MiiNePort_E1_7080 devices with firmware 1.1.10 Build 09120714, MiiNePort_E2_1242 devices wi… |
CVE-2016-2311 | Medium | 6.5 | 2016-05-30 | Black Box AlertWerks ServSensor with firmware before SP473, AlertWerks ServSensor Junior with firmware before SP473, AlertWerks ServSensor Junior with PoE with… |
CVE-2016-2025 | High | 7.5 | 2016-05-30 | HPE Service Manager 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, and 9.41 allows remote attackers to obtain sensitive information via unspecified vectors, related… |
CVE-2016-2023 | Medium | 5.5 | 2016-05-30 | HPE RESTful Interface Tool 1.40 allows local users to obtain sensitive information via unspecified vectors. |
CVE-2016-1404 | High | 7.5 | 2016-05-29 | Cisco UCS Invicta 4.3, 4.5, and 5.0.1 on Invicta appliances and Invicta Scaling System uses the same hardcoded GnuPG encryption key across different customers'… |
CVE-2016-1410 | High | 7.5 | 2016-05-28 | Cisco WebEx Meeting Center Original Release Base allows remote attackers to obtain sensitive information about username validity by (1) attending or (2) hostin… |
CVE-2016-3664 | High | 7.4 | 2016-05-23 | Trend Micro Mobile Security for iOS before 3.2.1188 does not verify the X.509 certificate of the mobile application login server, which allows man-in-the-middl… |
CVE-2016-4913 | High | 7.8 | 2016-05-23 | The get_rock_ridge_filename function in fs/isofs/rock.c in the Linux kernel before 4.5.5 mishandles NM (aka alternate name) entries containing \0 characters, w… |
CVE-2016-4580 | High | 7.5 | 2016-05-23 | The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel before 4.5.5 does not properly initialize a certain data structure, which… |
CVE-2016-4578 | Medium | 5.5 | 2016-05-23 | sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which allows local users to obtain sensitive information fro… |
CVE-2016-4569 | Medium | 5.5 | 2016-05-23 | The snd_timer_user_params function in sound/core/timer.c in the Linux kernel through 4.6 does not initialize a certain data structure, which allows local users… |
CVE-2016-4486 | Low | 3.3 | 2016-05-23 | The rtnl_fill_link_ifmap function in net/core/rtnetlink.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows local use… |
CVE-2016-4485 | High | 7.5 | 2016-05-23 | The llc_cmsg_rcv function in net/llc/af_llc.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows attackers to obtain s… |
CVE-2016-4482 | Medium | 6.2 | 2016-05-23 | The proc_connectinfo function in drivers/usb/core/devio.c in the Linux kernel through 4.6 does not initialize a certain data structure, which allows local user… |
CVE-2016-2158 | Medium | 4.3 | 2016-05-22 | lib/ajax/getnavbranch.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3, when the forcelogin f… |
CVE-2016-2156 | Medium | 4.3 | 2016-05-22 | calendar/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 provides calendar-event… |
CVE-2016-2154 | Medium | 4.3 | 2016-05-22 | admin/tool/monitor/lib.php in Event Monitor in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moodle/course:viewh… |
CVE-2016-2151 | Medium | 4.3 | 2016-05-22 | user/index.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 grants excessive authorization on… |
CVE-2016-3693 | High | 8.1 | 2016-05-20 | The Safemode gem before 1.2.4 for Ruby, when initialized with a delegate object that is a Rails controller, allows context-dependent attackers to obtain sensit… |
CVE-2016-1858 | Medium | 6.5 | 2016-05-20 | WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, improperly tracks taint attributes, which allows remote attackers to obt… |
CVE-2016-1853 | High | 7.5 | 2016-05-20 | Tcl in Apple OS X before 10.11.5 allows remote attackers to obtain sensitive information by leveraging SSLv2 support. |
CVE-2016-1852 | Low | 2.4 | 2016-05-20 | Siri in Apple iOS before 9.3.2 does not block data detectors within results in the lock-screen state, which allows physically proximate attackers to obtain sen… |
CVE-2016-1849 | Low | 3.3 | 2016-05-20 | The "Clear History and Website Data" feature in Apple Safari before 9.1.1, as used in iOS before 9.3.2 and other products, mishandles the deletion of browsing… |
CVE-2016-1802 | Medium | 5.5 | 2016-05-20 | CCCrypt in CommonCrypto in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 mishandles return values during key-length… |