CWE-200 · Information Disclosure (page 81)
Page 81 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-9349 | High | 7.5 | 2017-02-13 | An issue was discovered in Advantech SUISAccess Server Version 3.0 and prior. An attacker could traverse the file system and extract files that can result in i… |
CVE-2016-5813 | Medium | 5.3 | 2017-02-13 | An issue was discovered in Visonic PowerLink2, all versions prior to October 2016 firmware release. When a specific URL to an image is accessed, the downloaded… |
CVE-2016-5786 | High | 7.5 | 2017-02-13 | An issue was discovered in OmniMetrix OmniView, Version 1.2. The OmniView web application transmits credentials with the HTTP protocol, which could be sniffed… |
CVE-2016-3995 | High | 7.5 | 2017-02-13 | The timing attack protection in Rijndael::Enc::ProcessAndXorBlock and Rijndael::Dec::ProcessAndXorBlock in Crypto++ (aka cryptopp) before 5.6.4 may be optimize… |
CVE-2016-6210 | Medium | 5.9 | 2017-02-13 | sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exi… |
CVE-2016-8495 | High | 7.4 | 2017-02-13 | An improper certificate validation vulnerability in Fortinet FortiManager 5.0.6 through 5.2.7 and 5.4.0 through 5.4.1 allows remote attacker to spoof a trusted… |
CVE-2016-9244 | High | 7.5 | 2017-02-09 | A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized m… |
CVE-2016-5918 | Medium | 4.7 | 2017-02-08 | IBM Tivoli Storage Manager HSM for Windows displays the encrypted Tivoli Storage Manager password in application trace output if the password access option is… |
CVE-2016-5900 | Medium | 5.9 | 2017-02-08 | IBM Tealeaf Customer Experience on Cloud Network Capture Add-On could allow a remote attacker to obtain sensitive information, caused by the failure to properl… |
CVE-2016-0307 | Medium | 4.3 | 2017-02-08 | IBM Connections 5.5 and earlier allows remote attackers to obtain sensitive information by reading stack traces in returned responses. |
CVE-2016-0210 | Medium | 5.3 | 2017-02-08 | IBM Sterling B2B Integrator Standard Edition could allow a remote attacker to obtain sensitive information. By allowing HTTP OPTIONS method, a remote attacker… |
CVE-2016-0203 | Medium | 5.5 | 2017-02-08 | A vulnerability has been identified in the IBM Cloud Orchestrator task API. The task API might allow an authenticated user to view background information assoc… |
CVE-2016-0202 | Low | 3.3 | 2017-02-08 | A vulnerability has been identified in tasks, backend object generated for handling any action performed by the application in IBM Cloud Orchestrator. It is po… |
CVE-2015-7493 | Medium | 4.7 | 2017-02-08 | IBM InfoSphere Information Server could allow a local user under special circumstances to execute commands during installation processes that could expose sens… |
CVE-2015-7418 | Medium | 4.4 | 2017-02-08 | IBM WebSphere eXtreme Scale and the WebSphere DataPower XC10 Appliance allow some sensitive data to linger in memory instead of being overwritten which could a… |
CVE-2016-9748 | Medium | 4.3 | 2017-02-08 | IBM Rational DOORS Next Generation 5.0 and 6.0 discloses sensitive information in error response messages that could be used for further attacks against the sy… |
CVE-2016-2866 | Medium | 4.3 | 2017-02-08 | An unspecified vulnerability in IBM Jazz Team Server may disclose some deployment information to an authenticated user. |
CVE-2017-5933 | Medium | 5.9 | 2017-02-08 | Citrix NetScaler ADC and NetScaler Gateway 10.5 before Build 65.11, 11.0 before Build 69.12/69.123, and 11.1 before Build 51.21 randomly generates GCM nonces… |
CVE-2016-8492 | Medium | 5.9 | 2017-02-08 | The implementation of an ANSI X9.31 RNG in Fortinet FortiGate allows attackers to gain unauthorized read access to data handled by the device via IPSec/TLS dec… |
CVE-2016-10213 | Medium | 5.9 | 2017-02-08 | A10 AX1030 and possibly other devices with software before 2.7.2-P8 uses random GCM nonce generations, which makes it easier for remote attackers to obtain the… |
CVE-2016-10212 | Medium | 5.9 | 2017-02-08 | Radware devices use the same value for the first two GCM nonces, which allows remote attackers to obtain the authentication key and spoof data via a "forbidden… |
CVE-2016-0270 | Medium | 5.9 | 2017-02-08 | IBM Domino 9.0.1 Fix Pack 3 Interim Fix 2 through 9.0.1 Fix Pack 5 Interim Fix 1, when using TLS and AES GCM, uses random nonce generation, which makes it easi… |
CVE-2017-0451 | Medium | 4.7 | 2017-02-08 | An information disclosure vulnerability in the Qualcomm sound driver could enable a local malicious application to access data outside of its permission levels… |
CVE-2017-0448 | Medium | 5.5 | 2017-02-08 | An information disclosure vulnerability in the NVIDIA video driver could enable a local malicious application to access data outside of its permission levels… |
CVE-2017-0426 | Medium | 5.5 | 2017-02-08 | An information disclosure vulnerability in the Filesystem could enable a local malicious application to access data outside of its permission levels. This issu… |
CVE-2017-0425 | Medium | 5.5 | 2017-02-08 | An information disclosure vulnerability in Audioserver could enable a local malicious application to access data outside of its permission levels. This issue i… |
CVE-2017-0424 | Medium | 5.5 | 2017-02-08 | An information disclosure vulnerability in AOSP Messaging could enable a remote attacker using a special crafted file to access data outside of its permission… |
CVE-2017-0421 | Medium | 5.5 | 2017-02-08 | An information disclosure vulnerability in the Framework APIs could enable a local malicious application to bypass operating system protections that isolate ap… |
CVE-2017-0420 | Medium | 5.5 | 2017-02-08 | An information disclosure vulnerability in AOSP Mail could enable a local malicious application to bypass operating system protections that isolate application… |
CVE-2017-0414 | Medium | 5.5 | 2017-02-08 | An information disclosure vulnerability in AOSP Messaging could enable a local malicious application to bypass operating system protections that isolate applic… |
CVE-2017-0413 | Medium | 5.5 | 2017-02-08 | An information disclosure vulnerability in AOSP Messaging could enable a local malicious application to bypass operating system protections that isolate applic… |
CVE-2016-8414 | Medium | 4.7 | 2017-02-08 | An information disclosure vulnerability in the Qualcomm Secure Execution Environment Communicator could enable a local malicious application to access data out… |
CVE-2016-6495 | Medium | 5.9 | 2017-02-07 | NetApp Data ONTAP before 8.2.4P5, when operating in 7-Mode, allows remote attackers to obtain information about the volumes configured for HTTP access. |
CVE-2016-4341 | High | 7.5 | 2017-02-07 | NetApp Clustered Data ONTAP before 8.3.2P7 allows remote attackers to obtain SMB share information via unspecified vectors. |
CVE-2016-3124 | Medium | 5.3 | 2017-02-07 | The sanitycheck module in SimpleSAMLphp before 1.14.1 allows remote attackers to learn the PHP version on the system via unspecified vectors. |
CVE-2015-8544 | High | 7.5 | 2017-02-07 | NetApp SnapDrive for Windows before 7.0.2P4, 7.0.3, and 7.1 before 7.1.3P1 allows remote attackers to obtain sensitive information via unspecified vectors. |
CVE-2016-6097 | Medium | 4.0 | 2017-02-07 | IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 allows web pages to be stored locally which can be read by another user on the system. |
CVE-2016-6094 | Medium | 4.3 | 2017-02-07 | IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 generates an error message that includes sensitive information about its environment, users, or associated… |
CVE-2016-6092 | Medium | 6.2 | 2017-02-07 | IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 stores user credentials in plain in clear text which can be read by a local user. |
CVE-2015-5677 | Medium | 5.5 | 2017-02-07 | bsnmpd, as used in FreeBSD 9.3, 10.1, and 10.2, uses world-readable permissions on the snmpd.config file, which allows local users to obtain the secret key for… |
CVE-2017-5595 | Medium | 5.5 | 2017-02-06 | A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to r… |
CVE-2016-9772 | Medium | 5.3 | 2017-02-06 | OpenAFS 1.6.19 and earlier allows remote attackers to obtain sensitive directory information via vectors involving the (1) client cache partition, (2) fileserv… |
CVE-2017-5550 | Medium | 5.5 | 2017-02-06 | Off-by-one error in the pipe_advance function in lib/iov_iter.c in the Linux kernel before 4.9.5 allows local users to obtain sensitive information from uninit… |
CVE-2016-8217 | Low | 3.7 | 2017-02-03 | EMC RSA BSAFE Crypto-J versions prior to 6.2.2 has a PKCS#12 Timing Attack Vulnerability. A possible timing attack could be carried out by modifying a PKCS#12… |
CVE-2016-0890 | Medium | 6.4 | 2017-02-03 | EMC PowerPath Virtual (Management) Appliance 2.0, EMC PowerPath Virtual (Management) Appliance 2.0 SP1 is affected by a sensitive information disclosure vulner… |
CVE-2016-6116 | Medium | 5.9 | 2017-02-02 | IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Stric… |
CVE-2016-6099 | Medium | 5.3 | 2017-02-02 | IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the… |
CVE-2016-5935 | Medium | 5.9 | 2017-02-02 | IBM Jazz for Service Management could allow a remote attacker to obtain sensitive information, caused by the failure to properly validate the SSL certificate… |
CVE-2016-8982 | Medium | 5.3 | 2017-02-01 | IBM InfoSphere Information Server stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access t… |
CVE-2016-8977 | Medium | 5.3 | 2017-02-01 | IBM BigFix Inventory v9 could disclose sensitive information to an unauthorized user using HTTP GET requests. This information could be used to mount further a… |
CVE-2016-8963 | Medium | 5.5 | 2017-02-01 | IBM BigFix Inventory v9 stores potentially sensitive information in log files that could be read by a local user. |
CVE-2016-6068 | High | 7.5 | 2017-02-01 | IBM UrbanCode Deploy could allow an authenticated user with access to the REST endpoints to access API and CLI getResource secured role properties. |
CVE-2016-5953 | Low | 3.7 | 2017-02-01 | IBM Sterling Order Management transmits the session identifier within the URL. When a user is unable to view a certain view due to not being allowed permission… |
CVE-2016-5938 | Low | 3.3 | 2017-02-01 | IBM Kenexa LMS on Cloud allows web pages to be stored locally which can be read by another user on the system. |
CVE-2016-2941 | Medium | 5.5 | 2017-02-01 | IBM UrbanCode Deploy creates temporary files during step execution that could contain sensitive information including passwords that could be read by a local u… |
CVE-2016-6117 | Medium | 5.3 | 2017-02-01 | IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 can be deployed with active debugging code that can disclose sensitive information. |
CVE-2016-8981 | Medium | 5.5 | 2017-02-01 | IBM BigFix Inventory v9 allows web pages to be stored locally which can be read by another user on the system. |
CVE-2016-8966 | Medium | 5.9 | 2017-02-01 | IBM BigFix Inventory v9 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security… |
CVE-2016-6122 | Medium | 4.3 | 2017-02-01 | IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 discloses answers to security questions in a response to authenticated users. |
CVE-2016-6080 | Medium | 5.3 | 2017-02-01 | The WebAdmin context for WebSphere Message Broker allows directory listings which could disclose sensitive information to the attacker. |
CVE-2016-6034 | Medium | 6.8 | 2017-02-01 | IBM Tivoli Storage Manager for Virtual Environments (VMware) could disclose the Windows domain credentials to a user with a high level of privileges. |
CVE-2016-5994 | Medium | 6.5 | 2017-02-01 | IBM InfoSphere Information Server contains a vulnerability that would allow an authenticated user to browse any file on the engine tier, and examine its conten… |
CVE-2016-5988 | Medium | 6.5 | 2017-02-01 | IBM Security Privileged Identity Manager Virtual Appliance could disclose sensitive information in generated error messages that would be available to an authe… |
CVE-2016-5966 | Medium | 5.9 | 2017-02-01 | IBM Security Privileged Identity Manager Virtual Appliance could allow a remote attacker to obtain sensitive information, caused by the failure to properly ena… |
CVE-2016-5958 | High | 7.5 | 2017-02-01 | IBM Security Privileged Identity Manager could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the se… |
CVE-2016-5896 | Medium | 5.3 | 2017-02-01 | IBM Maximo Asset Management could disclose sensitive information from a stack trace after submitting incorrect login onto Cognos browser. |
CVE-2016-3045 | Low | 3.7 | 2017-02-01 | IBM Security Access Manager for Web stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access… |
CVE-2016-3043 | Medium | 5.9 | 2017-02-01 | IBM Security Access Manager for Web could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transpo… |
CVE-2016-3035 | Medium | 5.3 | 2017-02-01 | IBM AppScan Source could reveal some sensitive information through the browsing of testlinks on the server. |
CVE-2016-3024 | Medium | 4.0 | 2017-02-01 | IBM Security Access Manager for Web allows web pages to be stored locally which can be read by another user on the system. |
CVE-2016-3023 | Medium | 5.3 | 2017-02-01 | IBM Security Access Manager for Web could allow an unauthenticated user to gain access to sensitive information by entering invalid file names. |
CVE-2016-3021 | Low | 2.7 | 2017-02-01 | IBM Security Access Manager for Web could allow an authenticated attacker to obtain sensitive information from error message using a specially crafted HTTP req… |
CVE-2016-2987 | Medium | 4.3 | 2017-02-01 | An undisclosed vulnerability in CLM applications may result in some administrative deployment parameters being shown to an attacker. |
CVE-2016-0297 | Low | 3.7 | 2017-02-01 | IBM Tivoli Endpoint Manager - Mobile Device Management (MDM) could allow a remote attacker to obtain sensitive information due to a missing HTTP Strict-Transpo… |
CVE-2016-9418 | High | 7.5 | 2017-01-31 | MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows might allow remote attackers to obtain sensitive information f… |
CVE-2016-9414 | High | 7.5 | 2017-01-31 | MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow remote attackers to obtain sensitive information by leveraging missing directo… |
CVE-2016-9411 | Medium | 5.3 | 2017-01-31 | The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to obtain the installation path v… |
CVE-2016-9410 | High | 7.5 | 2017-01-31 | MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to obtain sensitive database information via vectors in… |
CVE-2016-6329 | Medium | 5.9 | 2017-01-31 | OpenVPN, when using a 64-bit block cipher, makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypte… |
CVE-2015-8034 | Low | 3.3 | 2017-01-30 | The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive information by reading the… |
CVE-2017-5610 | Medium | 5.3 | 2017-01-30 | wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility of a taxonomy-assignment user interface… |
CVE-2016-10181 | High | 7.5 | 2017-01-30 | An issue was discovered on the D-Link DWR-932B router. qmiweb provides sensitive information for CfgType=get_homeCfg requests. |
CVE-2016-10175 | Critical | 9.8 | 2017-01-30 | The NETGEAR WNR2000v5 router leaks its serial number when performing a request to the /BRS_netgear_success.html URI. This serial number allows a user to obtain… |
CVE-2017-3319 | Low | 3.1 | 2017-01-27 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: X Plugin). Supported versions that are affected are 5.7.16 and earlier. Diff… |
CVE-2017-3315 | Medium | 4.3 | 2017-01-27 | Vulnerability in the PeopleSoft Enterprise HCM ePerformance component of Oracle PeopleSoft Products (subcomponent: Security). The supported version that is aff… |
CVE-2017-3296 | Medium | 4.3 | 2017-01-27 | Vulnerability in the Oracle Commerce Platform component of Oracle Commerce (subcomponent: Dynamo Application Framework). Supported versions that are affected a… |
CVE-2017-3292 | Medium | 5.7 | 2017-01-27 | Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integration Broker). Supported versions that are… |
CVE-2017-3277 | Medium | 4.9 | 2017-01-27 | Vulnerability in the Oracle Applications Manager component of Oracle E-Business Suite (subcomponent: OAM Client). Supported versions that are affected are 12.1… |
CVE-2017-3255 | Medium | 5.8 | 2017-01-27 | Vulnerability in the Oracle JDeveloper component of Oracle Fusion Middleware (subcomponent: ADF Faces). Supported versions that are affected are 11.1.1.7.0, 11… |
CVE-2017-3250 | High | 7.3 | 2017-01-27 | Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Security). Supported versions that are affected are 2.1.1, 3… |
CVE-2017-3245 | Medium | 4.7 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Direct Banking component of Oracle Financial Services Applications (subcomponent: Pre-Login). Supported versions that are… |
CVE-2017-3240 | Low | 3.3 | 2017-01-27 | Vulnerability in the RDBMS Security component of Oracle Database Server. The supported version that is affected is 12.1.0.2. Easily exploitable vulnerability a… |
CVE-2017-3239 | Low | 3.3 | 2017-01-27 | Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Administration). Supported versions that are affected are 3.0… |
CVE-2017-3231 | Medium | 4.3 | 2017-01-27 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u131… |
CVE-2016-8322 | Medium | 4.3 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Core Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are affecte… |
CVE-2016-8313 | Medium | 4.1 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Product / Instrument Search). Supported… |
CVE-2016-8305 | Low | 2.1 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are af… |
CVE-2016-8302 | Medium | 4.3 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are af… |
CVE-2016-5614 | Medium | 4.3 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Product / Instrument Search). Supported… |
CVE-2016-3996 | Medium | 5.5 | 2017-01-27 | ClipboardDataMgr in Samsung KNOX 1.0.0 and 2.3.0 does not properly check the caller, which allows local users to read KNOX clipboard data via a crafted applica… |