CWE-200 · Information Disclosure (page 83)
Page 83 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-6464 | High | 7.5 | 2016-12-14 | A vulnerability in the web management interface of the Cisco Unified Communications Manager IM and Presence Service could allow an unauthenticated, remote atta… |
CVE-2016-6313 | Medium | 5.3 | 2016-12-13 | The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easie… |
CVE-2016-6722 | Medium | 5.5 | 2016-12-13 | An information disclosure vulnerability in libstagefright in Mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-1… |
CVE-2016-6720 | Medium | 5.5 | 2016-12-13 | An information disclosure vulnerability in libstagefright in Mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-1… |
CVE-2015-5073 | Critical | 9.1 | 2016-12-13 | Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a denial of service (crash)… |
CVE-2016-9855 | Medium | 5.3 | 2016-12-11 | An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to displa… |
CVE-2016-9854 | Medium | 5.3 | 2016-12-11 | An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to displa… |
CVE-2016-9853 | Medium | 5.3 | 2016-12-11 | An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to displa… |
CVE-2016-9852 | Medium | 5.3 | 2016-12-11 | An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to displa… |
CVE-2016-9848 | Medium | 5.3 | 2016-12-11 | An issue was discovered in phpMyAdmin. phpinfo (phpinfo.php) shows PHP information including values of HttpOnly cookies. All 4.6.x versions (prior to 4.6.5), 4… |
CVE-2016-6627 | Medium | 5.3 | 2016-12-11 | An issue was discovered in phpMyAdmin. An attacker can determine the phpMyAdmin host location through the file url.php. All 4.6.x versions (prior to 4.6.4), 4… |
CVE-2016-6625 | Medium | 4.3 | 2016-12-11 | An issue was discovered in phpMyAdmin. An attacker can determine whether a user is logged in to phpMyAdmin. The user's session, username, and password are not… |
CVE-2016-6613 | Medium | 5.3 | 2016-12-11 | An issue was discovered in phpMyAdmin. A user can specially craft a symlink on disk, to a file which phpMyAdmin is permitted to read but the user is not, which… |
CVE-2016-6612 | Medium | 6.5 | 2016-12-11 | An issue was discovered in phpMyAdmin. A user can exploit the LOAD LOCAL INFILE functionality to expose files on the server to the database system. All 4.6.x v… |
CVE-2016-6610 | Medium | 4.3 | 2016-12-11 | A full path disclosure vulnerability was discovered in phpMyAdmin where a user can trigger a particular error in the export mechanism to discover the full path… |
CVE-2016-6606 | High | 8.1 | 2016-12-11 | An issue was discovered in cookie encryption in phpMyAdmin. The decryption of the username/password is vulnerable to a padding oracle attack. This can allow an… |
CVE-2016-9103 | Medium | 6.0 | 2016-12-09 | The v9fs_xattrcreate function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to obtain sensitive host heap memory informatio… |
CVE-2016-9839 | High | 7.5 | 2016-12-08 | In MapServer before 7.0.3, OGR driver error messages are too verbose and may leak sensitive information if data connection fails. |
CVE-2016-3012 | High | 7.5 | 2016-12-01 | IBM API Connect (aka APIConnect) before 5.0.3.0 with NPM before 2.2.8 includes certain internal server credentials in the software package, which might allow r… |
CVE-2016-2887 | High | 8.1 | 2016-11-30 | IBM IMS Enterprise Suite Data Provider before 3.2.0.1 for Microsoft .NET allows remote authenticated users to obtain sensitive information or modify data via u… |
CVE-2016-3002 | Low | 2.1 | 2016-11-30 | IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows physically proximate attackers to obtain sensitive information by reading cached da… |
CVE-2016-2958 | Medium | 4.3 | 2016-11-30 | IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated users to obtain sensitive information by reading an "archaic"… |
CVE-2016-2957 | Medium | 4.3 | 2016-11-30 | IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated users to obtain sensitive information by reading a stack trace… |
CVE-2016-2952 | Low | 3.7 | 2016-11-30 | IBM BigFix Remote Control before 9.1.3 does not enable the HSTS protection mechanism, which makes it easier for remote attackers to obtain sensitive informatio… |
CVE-2016-2949 | Low | 3.3 | 2016-11-30 | IBM BigFix Remote Control before 9.1.3 allows local users to obtain sensitive information by reading cached web pages from a different user's session. |
CVE-2016-2940 | Medium | 5.3 | 2016-11-30 | Multiple unspecified vulnerabilities in IBM BigFix Remote Control before 9.1.3 allow remote attackers to obtain sensitive information via unknown vectors. |
CVE-2016-2937 | Medium | 6.5 | 2016-11-30 | IBM BigFix Remote Control before 9.1.3 allows remote attackers to obtain sensitive information or spoof e-mail transmission via a crafted POST request, related… |
CVE-2016-2931 | Medium | 5.3 | 2016-11-30 | IBM BigFix Remote Control before 9.1.3 allows remote attackers to obtain sensitive cleartext information by sniffing the network. |
CVE-2016-5765 | Medium | 6.5 | 2016-11-29 | Administrative Server in Micro Focus Host Access Management and Security Server (MSS) and Reflection for the Web (RWeb) and Reflection Security Gateway (RSG) a… |
CVE-2016-9178 | Medium | 5.5 | 2016-11-28 | The __get_user_asm_ex macro in arch/x86/include/asm/uaccess.h in the Linux kernel before 4.7.5 does not initialize a certain integer variable, which allows loc… |
CVE-2016-2927 | Medium | 5.9 | 2016-11-25 | IBM BigFix Remote Control before 9.1.3 does not properly restrict the set of available encryption algorithms, which makes it easier for remote attackers to def… |
CVE-2016-9449 | Medium | 4.3 | 2016-11-25 | The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms… |
CVE-2016-6753 | Medium | 5.5 | 2016-11-25 | An information disclosure vulnerability in kernel components, including the process-grouping subsystem and the networking subsystem, in Android before 2016-11-… |
CVE-2016-6752 | Medium | 5.5 | 2016-11-25 | An information disclosure vulnerability in Qualcomm components including the GPU driver, power driver, SMSM Point-to-Point driver, and sound driver in Android… |
CVE-2016-6751 | Medium | 5.5 | 2016-11-25 | An information disclosure vulnerability in Qualcomm components including the GPU driver, power driver, SMSM Point-to-Point driver, and sound driver in Android… |
CVE-2016-6750 | Medium | 5.5 | 2016-11-25 | An information disclosure vulnerability in Qualcomm components including the GPU driver, power driver, SMSM Point-to-Point driver, and sound driver in Android… |
CVE-2016-6749 | Medium | 5.5 | 2016-11-25 | An information disclosure vulnerability in Qualcomm components including the GPU driver, power driver, SMSM Point-to-Point driver, and sound driver in Android… |
CVE-2016-6748 | Medium | 5.5 | 2016-11-25 | An information disclosure vulnerability in Qualcomm components including the GPU driver, power driver, SMSM Point-to-Point driver, and sound driver in Android… |
CVE-2016-6746 | Medium | 5.5 | 2016-11-25 | An information disclosure vulnerability in the NVIDIA GPU driver in Android before 2016-11-05 could enable a local malicious application to access data outside… |
CVE-2016-6721 | Medium | 5.5 | 2016-11-25 | An information disclosure vulnerability in Mediaserver in Android 6.x before 2016-11-01 and 7.0 before 2016-11-01 could enable a local malicious application to… |
CVE-2016-6718 | Medium | 5.5 | 2016-11-25 | An elevation of privilege vulnerability in the Account Manager Service in Android 7.0 before 2016-11-01 could enable a local malicious application to retrieve… |
CVE-2016-6710 | Medium | 5.5 | 2016-11-25 | An information disclosure vulnerability in the download manager in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-11-01, and 7.0 before 2016-1… |
CVE-2016-6709 | Medium | 5.9 | 2016-11-25 | An information disclosure vulnerability in Conscrypt and BoringSSL in Android 6.x before 2016-11-01 and 7.0 before 2016-11-01 could enable a man-in-the-middle… |
CVE-2016-6698 | Medium | 5.5 | 2016-11-25 | An information disclosure vulnerability in Qualcomm components including the GPU driver, power driver, SMSM Point-to-Point driver, and sound driver in Android… |
CVE-2016-3907 | Medium | 5.5 | 2016-11-25 | An information disclosure vulnerability in Qualcomm components including the GPU driver, power driver, SMSM Point-to-Point driver, and sound driver in Android… |
CVE-2016-3906 | Medium | 5.5 | 2016-11-25 | An information disclosure vulnerability in Qualcomm components including the GPU driver, power driver, SMSM Point-to-Point driver, and sound driver in Android… |
CVE-2016-2947 | Low | 2.7 | 2016-11-25 | IBM Rational Collaborative Lifecycle Management 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Quality Manager 4.0 befo… |
CVE-2016-0378 | Low | 3.7 | 2016-11-24 | IBM WebSphere Application Server (WAS) Liberty before 16.0.0.3, when the installation lacks a default error page, allows remote attackers to obtain sensitive i… |
CVE-2016-0372 | Low | 3.7 | 2016-11-24 | IBM Rational Collaborative Lifecycle Management 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Qu… |
CVE-2016-0353 | Low | 3.7 | 2016-11-24 | IBM Security Privileged Identity Manager 2.0 before 2.0.2 FP8, when Virtual Appliance is used, does not set the secure flag for the session cookie in an https… |
CVE-2015-4961 | Low | 2.6 | 2016-11-24 | IBM Tealeaf Customer Experience 8.x before 8.7.1.8847 FP10, 8.8.x before 8.8.0.9049 FP9, 9.0.0 and 9.0.1 before 9.0.1.1117 FP5, 9.0.1A before 9.0.1.5108 FP5, 9… |
CVE-2016-9567 | Medium | 5.5 | 2016-11-23 | The mDNIe system service on Samsung Mobile S7 devices with M(6.0) software does not properly restrict setmDNIeScreenCurtain API calls, enabling attackers to co… |
CVE-2016-8672 | Medium | 5.3 | 2016-11-23 | A vulnerability has been identified in SIMATIC CP 343-1 Advanced (incl. SIPLUS NET variant) (All versions < V3.0.53), SIMATIC CP 443-1 Advanced (incl. SIPLUS N… |
CVE-2016-7917 | Medium | 5.0 | 2016-11-16 | The nfnetlink_rcv_batch function in net/netfilter/nfnetlink.c in the Linux kernel before 4.5 does not check whether a batch message's length field is large eno… |
CVE-2015-8964 | Medium | 5.5 | 2016-11-16 | The tty_set_termios_ldisc function in drivers/tty/tty_ldisc.c in the Linux kernel before 4.5 allows local users to obtain sensitive information from kernel mem… |
CVE-2016-9286 | Medium | 5.3 | 2016-11-11 | framework/modules/users/controllers/usersController.php in Exponent CMS v2.4.0patch1 does not properly restrict access to user records, which allows remote att… |
CVE-2016-9285 | Medium | 5.3 | 2016-11-11 | framework/modules/addressbook/controllers/addressController.php in Exponent CMS v2.4.0 allows remote attackers to read user information via a modified id numbe… |
CVE-2016-9284 | Medium | 5.3 | 2016-11-11 | getUsersByJSON in framework/modules/users/controllers/usersController.php in Exponent CMS v2.4.0 allows remote attackers to read user information via users/get… |
CVE-2016-7252 | Medium | 6.5 | 2016-11-10 | Microsoft SQL Server 2016 mishandles the FILESTREAM path, which allows remote authenticated users to gain privileges via unspecified vectors, aka "SQL Analysis… |
CVE-2016-7239 | Low | 3.1 | 2016-11-10 | The RegEx class in the XSS filter in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allows remote attackers to conduct cross-site scripting (XSS)… |
CVE-2016-7233 | Medium | 6.5 | 2016-11-10 | Microsoft Word 2007, Office 2010 SP2, Word 2010 SP2, Word for Mac 2011, Excel for Mac 2011, Word Viewer, Office Compatibility Pack SP3, Word Automation Service… |
CVE-2016-7227 | Low | 3.1 | 2016-11-10 | The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to determine the existence of local files via unspe… |
CVE-2016-7220 | Low | 3.3 | 2016-11-10 | Virtual Secure Mode in Microsoft Windows 10 allows local users to obtain sensitive information via a crafted application, aka "Virtual Secure Mode Information… |
CVE-2016-7218 | Medium | 4.7 | 2016-11-10 | Bowser.sys in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold… |
CVE-2016-7216 | Medium | 5.5 | 2016-11-10 | The kernel API in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 mishandles permissions, which allows local users to gain p… |
CVE-2016-7214 | Low | 3.3 | 2016-11-10 | The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Window… |
CVE-2016-7210 | Medium | 6.5 | 2016-11-10 | atmfd.dll in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Wind… |
CVE-2016-7204 | Low | 3.1 | 2016-11-10 | Microsoft Edge allows remote attackers to access arbitrary "My Documents" files via a crafted web site, aka "Microsoft Edge Information Disclosure Vulnerabilit… |
CVE-2016-7199 | Low | 3.1 | 2016-11-10 | Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to bypass the Same Origin Policy and obtain sensitive window-state informati… |
CVE-2016-7386 | Medium | 5.5 | 2016-11-08 | For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 375.63 contains a vulnerability in the k… |
CVE-2016-9185 | Medium | 4.3 | 2016-11-04 | In OpenStack Heat, by launching a new Heat stack with a local URL an authenticated user may conduct network discovery revealing internal network configuration… |
CVE-2016-9184 | High | 7.5 | 2016-11-04 | In /framework/modules/core/controllers/expHTMLEditorController.php of Exponent CMS 2.4.0, untrusted input is used to construct a table name, and in the selectO… |
CVE-2016-9183 | High | 7.5 | 2016-11-04 | In /framework/modules/ecommerce/controllers/orderController.php of Exponent CMS 2.4.0, untrusted input is passed into selectObjectsBySql. The method selectObje… |
CVE-2016-9135 | High | 7.5 | 2016-11-03 | Exponent CMS 2.3.9 suffers from a SQL injection vulnerability in "/framework/modules/help/controllers/helpController.php" affecting the version parameter. Impa… |
CVE-2016-9134 | High | 7.5 | 2016-11-03 | Exponent CMS 2.3.9 suffers from a SQL injection vulnerability in "/expPaginator.php" affecting the order parameter. Impact is Information Disclosure. |
CVE-2016-9086 | Medium | 6.5 | 2016-11-03 | GitLab versions 8.9.x and above contain a critical security flaw in the "import/export project" feature of GitLab. Added in GitLab 8.9, this feature allows a u… |
CVE-2016-9017 | High | 7.5 | 2016-10-28 | Artifex Software, Inc. MuJS before a5c747f1d40e8d6659a37a8d25f13fb5acf8e767 allows context-dependent attackers to obtain sensitive information by using the "op… |
CVE-2016-8889 | Medium | 6.2 | 2016-10-28 | In Bitcoin Knots v0.11.0.ljr20150711 through v0.13.0.knots20160814 (fixed in v0.13.1.knots20161027), the debug console stores sensitive information including p… |
CVE-2016-8871 | Medium | 6.2 | 2016-10-28 | In Botan 1.11.29 through 1.11.32, RSA decryption with certain padding options had a detectable timing channel which could given sufficient queries be used to r… |
CVE-2016-7919 | High | 7.5 | 2016-10-28 | Moodle 3.1.2 allows remote attackers to obtain sensitive information via unspecified vectors, related to a "SQL Injection" issue affecting the Administration p… |
CVE-2016-6446 | High | 7.5 | 2016-10-27 | A vulnerability in Web Bridge for Cisco Meeting Server could allow an unauthenticated, remote attacker to retrieve memory from a connected server. More Informa… |
CVE-2016-8295 | Medium | 4.3 | 2016-10-25 | Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidential… |
CVE-2016-8294 | Medium | 4.3 | 2016-10-25 | Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote authenticated users to a… |
CVE-2016-8286 | Low | 3.1 | 2016-10-25 | Unspecified vulnerability in Oracle MySQL 5.7.14 and earlier allows remote authenticated users to affect confidentiality via vectors related to Server: Securit… |
CVE-2016-5621 | Medium | 4.3 | 2016-10-25 | Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Applications 11.3.0, 11.4.0, 12.0.1 and 12.0.3, 12.1… |
CVE-2016-5618 | Low | 3.1 | 2016-10-25 | Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, 12.1.2.0.0, 12.1.3.0.0, 12.2.1.0.0, and 1… |
CVE-2016-5611 | Medium | 4.3 | 2016-10-25 | Unspecified vulnerability in the Oracle VM VirtualBox component before 5.0.28 and 5.1.x before 5.1.8 in Oracle Virtualization allows local users to affect conf… |
CVE-2016-5603 | Medium | 4.3 | 2016-10-25 | Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Applications 11.3.0, 11.4.0, 12.0.1 through 12.0.3, 1… |
CVE-2016-5602 | Medium | 5.7 | 2016-10-25 | Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, 12.1.3.0.0, 12.2.1.0.0, and 12.2.1.1.0 al… |
CVE-2016-5597 | Medium | 5.9 | 2016-10-25 | Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect confidentiality via vectors relat… |
CVE-2016-5596 | Medium | 4.3 | 2016-10-25 | Unspecified vulnerability in the Oracle CRM Technical Foundation component in Oracle E-Business Suite 12.1.1 through 12.1.3 and 12.2.3 through 12.2.6 allows re… |
CVE-2016-5575 | Medium | 5.3 | 2016-10-25 | Unspecified vulnerability in the Oracle Common Applications Calendar component in Oracle E-Business Suite 12.1.1 through 12.1.3 and 12.2.3 through 12.2.6 allow… |
CVE-2016-5565 | High | 7.7 | 2016-10-25 | Unspecified vulnerability in the Oracle Hospitality OPERA 5 Property Services component in Oracle Hospitality Applications 5.4.0.0 through 5.4.3.0, 5.5.0.0, an… |
CVE-2016-5524 | Medium | 5.3 | 2016-10-25 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote attackers to affect confidentia… |
CVE-2016-5522 | Medium | 4.3 | 2016-10-25 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote authenticated users to affect c… |
CVE-2016-5513 | Medium | 4.3 | 2016-10-25 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote authenticated users to affect c… |
CVE-2016-5510 | Medium | 5.3 | 2016-10-25 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote attackers to affect confidentia… |
CVE-2016-5508 | Low | 3.3 | 2016-10-25 | Unspecified vulnerability in the Solaris Cluster component in Oracle Sun Systems Products Suite 4.3 allows local users to affect confidentiality via vectors re… |
CVE-2016-5505 | Medium | 5.5 | 2016-10-25 | Unspecified vulnerability in the RDBMS Programmable Interface component in Oracle Database Server 11.2.0.4 and 12.1.0.2 allows local users to affect confidenti… |
CVE-2016-5504 | Medium | 4.1 | 2016-10-25 | Unspecified vulnerability in the Oracle Agile Product Lifecycle Management for Process component in Oracle Supply Chain Products Suite 6.1.0.4, 6.1.1.6, and 6… |