CWE-200 · Information Disclosure (page 84)
Page 84 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-5500 | High | 7.5 | 2016-10-25 | Unspecified vulnerability in the Oracle Discoverer component in Oracle Fusion Middleware 11.1.1.7.0 allows remote attackers to affect confidentiality via vecto… |
CVE-2016-5498 | Low | 3.3 | 2016-10-25 | Unspecified vulnerability in the RDBMS Security component in Oracle Database Server 11.2.0.4 and 12.1.0.2 allows local users to affect confidentiality via unkn… |
CVE-2016-5495 | High | 7.5 | 2016-10-25 | Unspecified vulnerability in the Oracle Discoverer component in Oracle Fusion Middleware 11.1.1.7.0 allows remote attackers to affect confidentiality via vecto… |
CVE-2016-5481 | Low | 3.7 | 2016-10-25 | Unspecified vulnerability in the Sun ZFS Storage Appliance Kit (AK) component in Oracle Sun Systems Products Suite AK 2013 allows remote attackers to affect co… |
CVE-2016-5479 | Medium | 4.3 | 2016-10-25 | Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Applications 11.3.0, 11.4.0, and 12.0.1 allows remote… |
CVE-2016-3562 | Low | 2.4 | 2016-10-25 | Unspecified vulnerability in the RDBMS Security and SQL*Plus components in Oracle Database Server 11.2.0.4 and 12.1.0.2 allows remote administrators to affect… |
CVE-2016-3473 | High | 7.7 | 2016-10-25 | Unspecified vulnerability in the BI Publisher (formerly XML Publisher) component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, and 12.2.1.0.0 allows remo… |
CVE-2016-1000214 | Medium | 5.3 | 2016-10-25 | Ruckus Wireless H500 web management interface authentication bypass |
CVE-2016-0377 | Medium | 4.3 | 2016-10-22 | The Administrative Console in IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.x before 8.0.0.13, and 8.5.x before 8.5.5.10 mishandles CSRFtoken… |
CVE-2016-0247 | High | 7.8 | 2016-10-22 | IBM Security Guardium 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 allows local users to obtain sensitive cleartext informat… |
CVE-2016-0242 | Medium | 4.3 | 2016-10-22 | IBM Security Guardium 10.x through 10.1 before p100 allows remote authenticated users to obtain sensitive information by reading an Application Error message. |
CVE-2016-3391 | Medium | 5.3 | 2016-10-14 | Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow context-dependent attackers to discover credentials by leveraging access to a memory dump, aka "… |
CVE-2016-3267 | Medium | 5.3 | 2016-10-14 | Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to determine the existence of unspecified files via a crafted web site, aka… |
CVE-2016-3263 | Medium | 5.5 | 2016-10-14 | Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012… |
CVE-2016-3262 | Medium | 5.5 | 2016-10-14 | Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012… |
CVE-2016-3209 | Medium | 5.5 | 2016-10-14 | Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012… |
CVE-2016-0079 | Medium | 5.0 | 2016-10-14 | The kernel in Microsoft Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted application that makes an API call to access sensit… |
CVE-2016-0075 | Medium | 5.5 | 2016-10-14 | The kernel in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges… |
CVE-2016-0073 | Medium | 5.0 | 2016-10-14 | The kernel in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges… |
CVE-2016-0070 | Medium | 5.5 | 2016-10-14 | The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and… |
CVE-2016-3946 | High | 7.8 | 2016-10-13 | SAP Console (aka SAPConsole) 7.30 allows local users to discover SAP Server login credentials by reading the Windows registry, aka SAP Security Note 2121461. |
CVE-2016-7960 | Low | 2.5 | 2016-10-13 | Siemens SIMATIC STEP 7 (TIA Portal) before 14 uses an improper format for managing TIA project files during version updates, which makes it easier for local us… |
CVE-2016-8100 | Medium | 5.5 | 2016-10-10 | Intel Integrated Performance Primitives (aka IPP) Cryptography before 9.0.4 makes it easier for local users to discover RSA private keys via a side-channel att… |
CVE-2016-6689 | Medium | 5.5 | 2016-10-10 | Binder in the kernel in Android before 2016-10-05 on Nexus devices allows attackers to obtain sensitive information via a crafted application, aka internal bug… |
CVE-2016-6688 | Medium | 5.5 | 2016-10-10 | The NVIDIA profiler in Android before 2016-10-05 on Nexus 9 devices allows attackers to obtain sensitive information via a crafted application, aka internal bu… |
CVE-2016-6687 | Medium | 5.5 | 2016-10-10 | The NVIDIA profiler in Android before 2016-10-05 on Nexus 9 devices allows attackers to obtain sensitive information via a crafted application, aka internal bu… |
CVE-2016-6686 | Medium | 5.5 | 2016-10-10 | The NVIDIA profiler in Android before 2016-10-05 on Nexus 9 devices allows attackers to obtain sensitive information via a crafted application, aka internal bu… |
CVE-2016-6685 | Medium | 5.5 | 2016-10-10 | The kernel in Android before 2016-10-05 on Nexus 6P devices allows attackers to obtain sensitive information via a crafted application, aka internal bug 304026… |
CVE-2016-6684 | Medium | 5.5 | 2016-10-10 | The kernel in Android before 2016-10-05 on Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, and Android One devices allows attackers to obtain sens… |
CVE-2016-6683 | Medium | 5.5 | 2016-10-10 | The kernel in Android before 2016-10-05 on Nexus devices allows attackers to obtain sensitive information via a crafted application, aka internal bug 30143283. |
CVE-2016-6682 | Medium | 5.5 | 2016-10-10 | drivers/misc/qcom/qdsp6v2/audio_utils.c in a Qualcomm QDSP6v2 driver in Android before 2016-10-05 on Nexus 5X, Nexus 6P, and Android One devices does not initi… |
CVE-2016-6681 | Medium | 5.5 | 2016-10-10 | drivers/misc/qcom/qdsp6v2/audio_utils.c in a Qualcomm QDSP6v2 driver in Android before 2016-10-05 on Nexus 5X, Nexus 6P, and Android One devices does not initi… |
CVE-2016-6680 | High | 7.8 | 2016-10-10 | CORE/HDD/src/wlan_hdd_wext.c in the Qualcomm Wi-Fi driver in Android before 2016-10-05 on Nexus 5X and Android One devices allows attackers to obtain sensitive… |
CVE-2016-6679 | Medium | 5.5 | 2016-10-10 | CORE/HDD/src/wlan_hdd_hostapd.c in the Qualcomm Wi-Fi driver in Android before 2016-10-05 on Nexus 5X and Android One devices allows attackers to obtain sensit… |
CVE-2016-6678 | Medium | 5.5 | 2016-10-10 | The Motorola USBNet driver in Android before 2016-10-05 on Nexus 6 devices allows attackers to obtain sensitive information via a crafted application, aka inte… |
CVE-2016-6677 | Medium | 5.5 | 2016-10-10 | The NVIDIA GPU driver in Android before 2016-10-05 on Nexus 9 devices allows attackers to obtain sensitive information via a crafted application, aka internal… |
CVE-2016-3924 | Medium | 5.5 | 2016-10-10 | services/audioflinger/Effects.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 201… |
CVE-2016-3918 | Medium | 5.5 | 2016-10-10 | email/provider/AttachmentProvider.java in AOSP Mail in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before… |
CVE-2016-3902 | Medium | 5.5 | 2016-10-10 | drivers/platform/msm/ipa/ipa_qmi_service.c in the Qualcomm IPA driver in Android before 2016-10-05 on Nexus 5X and 6P devices allows attackers to obtain sensit… |
CVE-2016-3860 | Medium | 5.5 | 2016-10-10 | sound/soc/msm/qdsp6v2/audio_calibration.c in the Qualcomm sound driver in Android before 2016-10-05 on Nexus 5X, Nexus 6P, and Android One devices allows attac… |
CVE-2015-8950 | Medium | 5.5 | 2016-10-10 | arch/arm64/mm/dma-mapping.c in the Linux kernel before 4.0.3, as used in the ION subsystem in Android and other products, does not initialize certain data stru… |
CVE-2015-2080 | High | 7.5 | 2016-10-07 | The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal cha… |
CVE-2015-1000012 | High | 7.5 | 2016-10-06 | Local File Inclusion Vulnerability in mypixs v0.3 wordpress plugin |
CVE-2015-1000008 | Medium | 5.3 | 2016-10-06 | Path Disclosure Vulnerability in wordpress plugin MP3-jPlayer v2.3.2 |
CVE-2015-1000007 | High | 7.5 | 2016-10-06 | Remote file download vulnerability in wptf-image-gallery v1.03 |
CVE-2016-6653 | High | 7.5 | 2016-10-06 | The MariaDB audit_plugin component in Pivotal Cloud Foundry (PCF) cf-mysql-release 27 and 28 allows remote attackers to obtain sensitive information by reading… |
CVE-2016-6435 | Medium | 6.5 | 2016-10-06 | The web console in Cisco Firepower Management Center 6.0.1 allows remote authenticated users to read arbitrary files via crafted parameters, aka Bug ID CSCva30… |
CVE-2016-6026 | Medium | 5.3 | 2016-10-06 | The Configuration Manager in IBM Sterling Secure Proxy (SSP) 3.4.2 before 3.4.2.0 iFix 8 and 3.4.3 before 3.4.3.0 iFix 1 allows man-in-the-middle attackers to… |
CVE-2016-1455 | High | 7.5 | 2016-10-05 | Cisco NX-OS before 7.0(3)I2(2e) and 7.0(3)I4 before 7.0(3)I4(1) has an incorrect iptables local-interface configuration, which allows remote attackers to obtai… |
CVE-2016-7561 | High | 7.2 | 2016-10-05 | Fortinet FortiWLC 6.1-2-29 and earlier, 7.0-9-1, 7.0-10-0, 8.0-5-0, 8.1-2-0, and 8.2-4-0 allow administrators to obtain sensitive user credentials by reading t… |
CVE-2016-6420 | Medium | 6.5 | 2016-10-05 | Cisco FireSIGHT System Software 4.10.3 through 5.4.0 in Firepower Management Center allows remote authenticated users to bypass authorization checks and gain p… |
CVE-2016-2307 | High | 7.5 | 2016-10-05 | American Auto-Matrix Aspect-Nexus Building Automation Front-End Solutions application before 3.0.0 and Aspect-Matrix Building Automation Front-End Solutions ap… |
CVE-2016-7031 | High | 7.5 | 2016-10-03 | The RGW code in Ceph before 10.0.1, when authenticated-read ACL is applied to a bucket, allows remote attackers to list the bucket contents via a URL. |
CVE-2016-6494 | Medium | 5.5 | 2016-10-03 | The client in MongoDB uses world-readable permissions on .dbshell history files, which might allow local users to obtain sensitive information by reading these… |
CVE-2016-7442 | Medium | 4.4 | 2016-10-03 | The Frontend component in Sophos UTM with firmware 9.405-5 and earlier allows local administrators to obtain sensitive password information by reading the "val… |
CVE-2016-7397 | Medium | 4.4 | 2016-10-03 | The Frontend component in Sophos UTM with firmware 9.405-5 and earlier allows local administrators to obtain sensitive password information by reading the "val… |
CVE-2016-5986 | High | 7.5 | 2016-10-01 | IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.x before 8.0.0.13, 8.5.x before 8.5.5.11, 9.0.x before 9.0.0.2, and Liberty before 16.0.0.3 mis… |
CVE-2016-7090 | Medium | 4.0 | 2016-09-29 | The integrated web server on Siemens SCALANCE M-800 and S615 modules with firmware before 4.02 does not set the secure flag for the session cookie in an https… |
CVE-2016-6146 | Medium | 5.3 | 2016-09-27 | The NameServer in SAP TREX 7.10 Revision 63 allows remote attackers to obtain sensitive TNS information via an unspecified query, aka SAP Security Note 2234226. |
CVE-2016-6827 | Medium | 6.5 | 2016-09-26 | Huawei FusionCompute before V100R005C10CP7002 stores cleartext AES keys in a file, which allows remote authenticated users to obtain sensitive information via… |
CVE-2016-3639 | Medium | 4.3 | 2016-09-26 | SAP HANA DB 1.00.091.00.1418659308 allows remote attackers to obtain sensitive topology information via an unspecified HTTP request, aka SAP Security Note 2176… |
CVE-2016-5976 | Medium | 4.9 | 2016-09-26 | The web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10, 8.8 before 8.8.0.9049 FP9, 9.0.0 and 9.0.1 before 9.0.1.1117 FP5, 9.0.1A before 9.0.1… |
CVE-2016-5972 | Medium | 6.8 | 2016-09-26 | IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 uses weak permissions for unspecified resources, which allows remote au… |
CVE-2016-5971 | High | 7.1 | 2016-09-26 | IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 allows remote authenticated users to read arbitrary files or cause a de… |
CVE-2016-5970 | Medium | 6.5 | 2016-09-26 | Directory traversal vulnerability in IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 allows remote authenticated users… |
CVE-2016-5946 | Medium | 6.5 | 2016-09-26 | Directory traversal vulnerability in IBM Spectrum Control (formerly Tivoli Storage Productivity Center) 5.2.x before 5.2.11 allows remote authenticated users t… |
CVE-2016-2999 | Medium | 6.5 | 2016-09-26 | IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to obtain sensitive information via an unspecified br… |
CVE-2016-0248 | Low | 3.7 | 2016-09-26 | IBM Security Guardium 9.0 before p700 and 10.0 before p100 allows man-in-the-middle attackers to obtain sensitive query-string information from SSL sessions vi… |
CVE-2016-5172 | Medium | 6.5 | 2016-09-25 | The parser in Google V8, as used in Google Chrome before 53.0.2785.113, mishandles scopes, which allows remote attackers to obtain sensitive information from a… |
CVE-2016-4771 | Medium | 5.5 | 2016-09-25 | The kernel in Apple iOS before 10 and OS X before 10.12 allows local users to bypass intended file-access restrictions via a crafted directory pathname. |
CVE-2016-4758 | Medium | 6.5 | 2016-09-25 | WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly restrict access to the location variable, which allows r… |
CVE-2016-4755 | Medium | 5.5 | 2016-09-25 | Terminal in Apple OS X before 10.12 uses weak permissions for the .bash_history and .bash_session files, which allows local users to obtain sensitive informati… |
CVE-2016-4752 | Medium | 5.5 | 2016-09-25 | The SecKeyDeriveFromPassword function in Apple OS X before 10.12 does not use the CF_RETURNS_RETAINED keyword, which allows attackers to obtain sensitive infor… |
CVE-2016-4745 | Medium | 5.3 | 2016-09-25 | The Kerberos 5 (aka krb5) PAM module in Apple OS X before 10.12 does not use constant-time operations for determining username validity, which makes it easier… |
CVE-2016-4742 | Medium | 5.5 | 2016-09-25 | NSSecureTextField in Apple OS X before 10.12 does not enable Secure Input, which allows attackers to discover credentials via a crafted app. |
CVE-2016-4739 | Low | 3.7 | 2016-09-25 | mDNSResponder in Apple OS X before 10.12, when VMnet.framework is used, arranges for a DNS proxy to listen on all interfaces, which allows remote attackers to… |
CVE-2016-4715 | Low | 3.3 | 2016-09-25 | The Date & Time Pref Pane component in Apple OS X before 10.12 mishandles the .GlobalPreferences file, which allows attackers to discover a user's location via… |
CVE-2016-4713 | Medium | 5.3 | 2016-09-25 | CoreDisplay in Apple OS X before 10.12 allows attackers to view arbitrary users' screens by leveraging screen-sharing access. |
CVE-2016-4711 | High | 7.5 | 2016-09-25 | CCrypt in corecrypto in CommonCrypto in Apple iOS before 10 and OS X before 10.12 allows attackers to discover cleartext information by leveraging a function c… |
CVE-2016-4708 | Medium | 6.5 | 2016-09-25 | CFNetwork in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 misparses the Set-Cookie header, which allows remote attackers to obt… |
CVE-2016-4707 | Medium | 4.0 | 2016-09-25 | CFNetwork in Apple iOS before 10 and OS X before 10.12 mishandles Local Storage deletion, which allows local users to discover the visited web sites of arbitra… |
CVE-2016-0918 | Medium | 4.3 | 2016-09-24 | EMC RSA Identity Management and Governance before 6.8.1 P25 and 6.9.x before 6.9.1 P15 and RSA Via Lifecycle and Governance before 7.0.0 P04 allow remote authe… |
CVE-2016-5282 | Medium | 6.5 | 2016-09-22 | Mozilla Firefox before 49.0 does not properly restrict the scheme in favicon requests, which might allow remote attackers to obtain sensitive information via u… |
CVE-2016-5279 | Medium | 4.3 | 2016-09-22 | Mozilla Firefox before 49.0 allows user-assisted remote attackers to obtain sensitive full-pathname information during a local-file drag-and-drop operation via… |
CVE-2016-4968 | Medium | 6.5 | 2016-09-21 | The linkreport/tmp/admin_global page in Fortinet FortiWan (formerly AscernLink) before 4.2.5 allows remote authenticated users to discover administrator cookie… |
CVE-2016-4967 | Medium | 6.5 | 2016-09-21 | Fortinet FortiWan (formerly AscernLink) before 4.2.5 allows remote authenticated users to obtain sensitive information from (1) a backup of the device configur… |
CVE-2016-0904 | High | 8.6 | 2016-09-21 | Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before 7.3.0-233 use the same encryption key across different customers' installa… |
CVE-2016-0903 | Critical | 9.1 | 2016-09-21 | Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before 7.3.0-233 rely on client-side authentication, which allows remote attacker… |
CVE-2016-6537 | High | 7.5 | 2016-09-19 | AVer Information EH6108H+ devices with firmware X9.03.24.00.07l store passwords in a cleartext base64 format and require cleartext credentials in HTTP Cookie h… |
CVE-2016-6415 | High | 7.5 | 2016-09-19 | The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX befor… |
CVE-2016-0870 | Medium | 5.3 | 2016-09-19 | The web server in Trane Tracer SC 4.2.1134 and earlier allows remote attackers to read sensitive configuration files via a direct request. |
CVE-2016-4749 | Low | 3.3 | 2016-09-18 | Printing UIKit in Apple iOS before 10 mishandles environment variables, which allows local users to discover cleartext AirPrint preview content by reading a te… |
CVE-2016-4747 | Low | 3.7 | 2016-09-18 | Mail in Apple iOS before 10 mishandles certificates, which makes it easier for man-in-the-middle attackers to discover mail credentials via unspecified vectors. |
CVE-2016-4746 | Medium | 5.3 | 2016-09-18 | The Keyboards component in Apple iOS before 10 does not properly use a cache for auto-correct suggestions, which allows remote attackers to obtain sensitive in… |
CVE-2016-4740 | Low | 2.9 | 2016-09-18 | Apple iOS before 10, when Handoff for Messages is used, does not ensure that a Messages signin has occurred before displaying messages, which might allow attac… |
CVE-2016-4719 | Medium | 5.5 | 2016-09-18 | The GeoServices component in Apple iOS before 10 and watchOS before 3 does not properly restrict access to PlaceData information, which allows attackers to dis… |
CVE-2016-4620 | Low | 3.3 | 2016-09-18 | The Sandbox Profiles component in Apple iOS before 10 does not properly restrict access to directory metadata for SMS draft directories, which allows attackers… |
CVE-2016-0929 | High | 7.5 | 2016-09-18 | The metrics-collection component in RabbitMQ for Pivotal Cloud Foundry (PCF) 1.6.x before 1.6.4 logs command lines of failed commands, which might allow contex… |
CVE-2016-6644 | Medium | 5.3 | 2016-09-17 | EMC Documentum D2 4.5 before patch 15 and 4.6 before patch 03 allows remote attackers to read arbitrary Docbase documents by leveraging knowledge of an r_objec… |
CVE-2016-7420 | Medium | 5.9 | 2016-09-16 | Crypto++ (aka cryptopp) through 5.6.4 does not document the requirement for a compile-time NDEBUG definition disabling the many assert calls that are unintende… |