CWE-200 · Information Disclosure (page 86)
Page 86 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-5797 | Medium | 5.3 | 2016-07-15 | Tollgrade LightHouse SMS before 5.1 patch 3 provides different error messages for failed authentication attempts depending on whether the username exists, whic… |
CVE-2016-1452 | Medium | 6.5 | 2016-07-15 | Cisco ASR 5000 devices with software 18.3 through 20.0.0 allow remote attackers to make configuration changes over SNMP by leveraging knowledge of the read-wri… |
CVE-2016-3100 | High | 8.4 | 2016-07-13 | kinit in KDE Frameworks before 5.23.0 uses weak permissions (644) for /tmp/xauth-xxx-_y, which allows local users to obtain X11 cookies of other users and cons… |
CVE-2016-3277 | Medium | 5.3 | 2016-07-13 | Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser… |
CVE-2016-3273 | Medium | 5.3 | 2016-07-13 | The XSS Filter in Microsoft Internet Explorer 9 through 11 and Microsoft Edge does not properly restrict JavaScript code, which allows remote attackers to obta… |
CVE-2016-3272 | Low | 2.8 | 2016-07-13 | The kernel in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mishandles page-fault system calls, which al… |
CVE-2016-3271 | Medium | 6.5 | 2016-07-13 | The VBScript engine in Microsoft Edge allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Scripting Engine… |
CVE-2016-3261 | Medium | 5.3 | 2016-07-13 | Microsoft Internet Explorer 11 allows remote attackers to obtain sensitive information via a crafted web site, aka "Internet Explorer Information Disclosure Vu… |
CVE-2016-3256 | Medium | 5.0 | 2016-07-13 | Microsoft Windows 10 Gold and 1511 allows local users to bypass the Secure Kernel Mode protection mechanism and obtain sensitive information via a crafted appl… |
CVE-2016-3255 | High | 7.5 | 2016-07-13 | Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 allows remote attackers to read arbitrary files via XML data containing an external entity… |
CVE-2016-3251 | Low | 2.8 | 2016-07-13 | The GDI component in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 201… |
CVE-2016-4985 | High | 7.5 | 2016-07-12 | The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a… |
CVE-2016-3816 | Medium | 5.5 | 2016-07-11 | The MediaTek display driver in Android before 2016-07-05 on Android One devices allows attackers to obtain sensitive information via a crafted application, aka… |
CVE-2016-3815 | Medium | 5.5 | 2016-07-11 | The NVIDIA camera driver in Android before 2016-07-05 on Nexus 9 devices allows attackers to obtain sensitive information via a crafted application, aka Androi… |
CVE-2016-3814 | Medium | 5.5 | 2016-07-11 | The NVIDIA camera driver in Android before 2016-07-05 on Nexus 9 devices allows attackers to obtain sensitive information via a crafted application, aka Androi… |
CVE-2016-3813 | Medium | 5.5 | 2016-07-11 | The Qualcomm USB driver in Android before 2016-07-05 on Nexus 5, 5X, 6, and 6P devices allows attackers to obtain sensitive information via a crafted applicati… |
CVE-2016-3812 | Medium | 5.5 | 2016-07-11 | The MediaTek video codec driver in Android before 2016-07-05 on Android One devices allows attackers to obtain sensitive information via a crafted application… |
CVE-2016-3810 | Medium | 5.5 | 2016-07-11 | The MediaTek Wi-Fi driver in Android before 2016-07-05 on Android One devices allows attackers to obtain sensitive information via a crafted application, aka A… |
CVE-2016-3809 | Medium | 5.5 | 2016-07-11 | The networking component in Android before 2016-07-05 on Android One, Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 7 (2013), Nexus 9, Nexus Player, and Pixel C… |
CVE-2016-3765 | High | 7.7 | 2016-07-11 | decoder/impeg2d_bitstream.c in mediaserver in Android 6.x before 2016-07-01 allows attackers to obtain sensitive information from process memory or cause a den… |
CVE-2016-3761 | Medium | 4.0 | 2016-07-11 | NfcService.java in NFC in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows attackers to obtain sensitive fore… |
CVE-2016-3759 | Low | 3.3 | 2016-07-11 | The Framework APIs in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allow attackers to read backup data via a crafted application t… |
CVE-2016-3753 | High | 7.5 | 2016-07-11 | mediaserver in Android 4.x before 4.4.4 allows remote attackers to obtain sensitive information via unspecified vectors, aka internal bug 27210135. |
CVE-2016-0287 | High | 7.8 | 2016-07-08 | IBM i Access 7.1 on Windows allows local users to discover registry passwords via unspecified vectors. |
CVE-2016-0252 | Medium | 5.1 | 2016-07-08 | IBM Control Center 6.x before 6.0.0.1 iFix06 and Sterling Control Center 5.4.x before 5.4.2.1 iFix09 allow local users to decrypt the master key via unspecifie… |
CVE-2016-2923 | High | 7.5 | 2016-07-07 | IBM WebSphere Application Server (WAS) 8.5 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 does not include the HTTPOnly flag in a Set-Cookie header f… |
CVE-2016-0389 | Medium | 5.3 | 2016-07-07 | Admin Center in IBM WebSphere Application Server (WAS) 8.5.5.2 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 allows remote attackers to obtain sensi… |
CVE-2016-5097 | Medium | 5.3 | 2016-07-05 | phpMyAdmin before 4.6.2 places tokens in query strings and does not arrange for them to be stripped before external navigation, which allows remote attackers t… |
CVE-2016-5849 | Low | 2.5 | 2016-07-04 | Siemens SICAM PAS through 8.07 allows local users to obtain sensitive configuration information by leveraging database stoppage. |
CVE-2016-5848 | Medium | 6.7 | 2016-07-04 | Siemens SICAM PAS before 8.07 does not properly restrict password data in the database, which makes it easier for local users to calculate passwords by leverag… |
CVE-2016-0899 | Medium | 6.3 | 2016-07-04 | EMC RSA Archer GRC 5.5.x before 5.5.3.4 allows remote authenticated users to read the web.config.bak file, and obtain sensitive credential information, by modi… |
CVE-2016-2894 | Low | 2.5 | 2016-07-03 | IBM Spectrum Protect (formerly Tivoli Storage Manager) 5.5 through 6.3 before 6.3.2.6, 6.4 before 6.4.3.3, and 7.1 before 7.1.6 allows local users to obtain se… |
CVE-2016-1337 | High | 8.1 | 2016-07-03 | Cisco EPC3928 devices allow remote attackers to obtain sensitive configuration and credential information by making requests during the early part of the boot… |
CVE-2016-5739 | High | 7.5 | 2016-07-03 | The Transformation implementation in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not use the no-referrer Content Secu… |
CVE-2016-5730 | Medium | 5.3 | 2016-07-03 | phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving… |
CVE-2016-2079 | Medium | 5.9 | 2016-07-03 | VMware NSX Edge 6.1 before 6.1.7 and 6.2 before 6.2.3 and vCNS Edge 5.5 before 5.5.4.3, when the SSL-VPN feature is configured, allow remote attackers to obtai… |
CVE-2016-3956 | High | 7.5 | 2016-07-02 | The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes b… |
CVE-2016-2961 | Medium | 5.3 | 2016-07-02 | The integration server in IBM Integration Bus 9 before 9.0.0.6 and 10 before 10.0.0.5 and WebSphere Message Broker 8 before 8.0.0.8 allows remote attackers to… |
CVE-2016-2882 | Medium | 4.3 | 2016-07-02 | IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.4, and 3.5 before 3.5.0.2 allows remote authenticated users to obtain sensitive informati… |
CVE-2016-2861 | Low | 3.7 | 2016-07-02 | IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3, 7.1.1 before 7.1.1.1, 8.5 before 8.5.0.3, and 8.6 before 8.6.0.8 does not properly encrypt data, which makes… |
CVE-2016-0365 | Medium | 5.9 | 2016-07-01 | IBM UrbanCode Deploy 6.0.x before 6.0.1.13, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1, when agent-relay Codestation artifact caching is enabled, allows re… |
CVE-2016-0364 | Medium | 4.3 | 2016-07-01 | IBM UrbanCode Deploy 6.0.x before 6.0.1.13, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1 does not properly implement a logging-obfuscation feature for secure… |
CVE-2016-5306 | Medium | 5.3 | 2016-06-30 | Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 does not properly implement the HSTS protection mechanism, which makes it easier for remote att… |
CVE-2016-3651 | High | 8.0 | 2016-06-30 | Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to discover the PHP JSESSIONID value via unspecified vectors. |
CVE-2016-3650 | High | 8.8 | 2016-06-30 | Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to discover credentials via a brute-force attack. |
CVE-2016-3649 | Medium | 4.3 | 2016-06-30 | Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated administrators to enumerate administrator accounts via modified GET… |
CVE-2016-3648 | High | 8.8 | 2016-06-30 | Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to bypass the Authentication Lock protection mechanism, and c… |
CVE-2016-4474 | High | 8.8 | 2016-06-30 | The image build process for the overcloud images in Red Hat OpenStack Platform 8.0 (Liberty) director and Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo… |
CVE-2016-5835 | High | 7.5 | 2016-06-29 | WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/i… |
CVE-2016-0298 | Medium | 6.5 | 2016-06-29 | Directory traversal vulnerability in IBM Security Guardium Database Activity Monitor 10 before 10.0p100 allows remote authenticated users to read arbitrary fil… |
CVE-2016-0267 | High | 7.7 | 2016-06-29 | IBM UrbanCode Deploy 6.0.x before 6.0.1.13, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1 allows remote authenticated users to obtain sensitive cleartext secu… |
CVE-2016-5244 | High | 7.5 | 2016-06-27 | The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel through 4.6.3 does not initialize a certain structure member, which allows remote attacker… |
CVE-2016-5243 | Medium | 5.5 | 2016-06-27 | The tipc_nl_compat_link_dump function in net/tipc/netlink_compat.c in the Linux kernel through 4.6.3 does not properly copy a certain string, which allows loca… |
CVE-2014-9903 | Medium | 5.5 | 2016-06-27 | The sched_read_attr function in kernel/sched/core.c in the Linux kernel 3.14-rc before 3.14-rc4 uses an incorrect size, which allows local users to obtain sens… |
CVE-2016-0259 | Low | 2.5 | 2016-06-26 | runmqsc in IBM WebSphere MQ 8.x before 8.0.0.5 allows local users to bypass an intended +dsp authority requirement and obtain sensitive information via unspeci… |
CVE-2016-1193 | High | 7.5 | 2016-06-25 | Cybozu Garoon 3.7 through 4.2 allows remote attackers to obtain sensitive email-reading information via unspecified vectors. |
CVE-2016-5722 | High | 7.3 | 2016-06-24 | Huawei OceanStor 5300 V3, 5500 V3, 5600 V3, 5800 V3, 6800 V3, 18800 V3, and 18500 V3 before V300R003C10 sends the plaintext session token in the HTTP header, w… |
CVE-2016-5709 | Medium | 4.7 | 2016-06-24 | SolarWinds Virtualization Manager 6.3.1 and earlier uses weak encryption to store passwords in /etc/shadow, which allows local users with superuser privileges… |
CVE-2016-5021 | Medium | 4.9 | 2016-06-24 | The iControl REST service in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.5.x before 11.5.4, 11.6.x before 11.6.1, and 12.x before… |
CVE-2015-8289 | High | 7.5 | 2016-06-20 | The password-recovery feature on NETGEAR D3600 devices with firmware 1.0.0.49 and D6000 devices with firmware 1.0.0.49 and earlier allows remote attackers to d… |
CVE-2016-1864 | Medium | 4.3 | 2016-06-19 | The XSS auditor in WebKit, as used in Apple iOS before 9.3 and Safari before 9.1, does not properly handle redirects in block mode, which allows remote attacke… |
CVE-2016-1862 | Low | 3.3 | 2016-06-19 | Intel Graphics Driver in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app, a different vulnera… |
CVE-2016-1860 | Low | 3.3 | 2016-06-19 | Intel Graphics Driver in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app, a different vulnera… |
CVE-2016-1196 | Medium | 4.3 | 2016-06-19 | Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote authenticated users to bypass intended access restrictions and obtain sensitive Address Book information v… |
CVE-2016-1192 | Medium | 4.3 | 2016-06-19 | Directory traversal vulnerability in the logging implementation in Cybozu Garoon 3.7 through 4.2 allows remote authenticated users to read a log file via unspe… |
CVE-2015-7776 | Medium | 4.3 | 2016-06-19 | Cybozu Garoon 3.x and 4.x before 4.2.0 does not properly restrict loading of IMG elements, which makes it easier for remote attackers to track users via a craf… |
CVE-2015-7462 | Medium | 4.4 | 2016-06-19 | IBM WebSphere MQ 8.0.0.4 on IBM i platforms allows local users to discover cleartext certificate-keystore passwords within MQ trace output by leveraging admini… |
CVE-2016-1225 | Medium | 6.5 | 2016-06-19 | Trend Micro Internet Security 8 and 10 allows remote attackers to read arbitrary files via unspecified vectors. |
CVE-2016-4816 | Medium | 6.5 | 2016-06-19 | BUFFALO WZR-600DHP3 devices with firmware 2.16 and earlier and WZR-S600DHP devices allow remote attackers to discover credentials and other sensitive informati… |
CVE-2016-1427 | High | 7.5 | 2016-06-18 | The System Configuration Protocol (SCP) core messaging interface in Cisco Prime Network Registrar 8.2 before 8.2.3.1 and 8.3 before 8.3.2 allows remote attacke… |
CVE-2016-3234 | Medium | 5.5 | 2016-06-16 | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2, Wo… |
CVE-2016-3232 | Medium | 5.0 | 2016-06-16 | The Virtual PCI (VPCI) virtual service provider in Microsoft Windows Server 2012 Gold and R2 allows local users to obtain sensitive information from uninitiali… |
CVE-2016-3216 | Medium | 4.3 | 2016-06-16 | GDI32.dll in the Graphics component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold an… |
CVE-2016-3215 | Medium | 5.5 | 2016-06-16 | Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 1511, and Microsoft Edge allow remote attackers to obtain sensitive information from process… |
CVE-2016-3201 | Medium | 6.5 | 2016-06-16 | Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 Gold and 1511, and Microsoft Edge allow remote attackers to obtain sensitive information fro… |
CVE-2016-0028 | Medium | 5.5 | 2016-06-16 | Outlook Web Access (OWA) in Microsoft Exchange Server 2013 SP1, Cumulative Update 11, and Cumulative Update 12 and 2016 Gold and Cumulative Update 1 does not p… |
CVE-2016-5367 | High | 7.5 | 2016-06-14 | Huawei Honor WS851 routers with software 1.1.21.1 and earlier allow remote attackers to obtain sensitive information via unspecified vectors, aka HWPSIRT-2016-… |
CVE-2015-8869 | Critical | 9.1 | 2016-06-13 | OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sensitive information… |
CVE-2016-2832 | Medium | 4.3 | 2016-06-13 | Mozilla Firefox before 47.0 allows remote attackers to discover the list of disabled plugins via a fingerprinting attack involving Cascading Style Sheets (CSS)… |
CVE-2016-2500 | Medium | 5.5 | 2016-06-13 | Activity Manager in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 does not properly terminate process groups, which allows attacker… |
CVE-2016-2499 | Medium | 5.5 | 2016-06-13 | AudioSource.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 does not initia… |
CVE-2016-2498 | Medium | 5.5 | 2016-06-13 | The Qualcomm Wi-Fi driver in Android before 2016-06-01 on Nexus 7 (2013) devices allows attackers to bypass intended data-access restrictions via a crafted app… |
CVE-2016-5233 | Low | 3.7 | 2016-06-10 | Huawei Mate 8 smartphones with software NXT-AL10 before NXT-AL10C00B182, NXT-CL00 before NXT-CL00C92B182, NXT-DL00 before NXT-DL00C17B182, and NXT-TL00 before… |
CVE-2016-4516 | Low | 3.3 | 2016-06-10 | ABB PCM600 before 2.7 improperly stores the main application password after a password change, which allows local users to obtain sensitive information via uns… |
CVE-2015-8268 | High | 7.5 | 2016-06-10 | The up.time agent in Idera Uptime Infrastructure Monitor 7.5 and 7.6 on Linux allows remote attackers to read arbitrary files via unspecified vectors. |
CVE-2016-1582 | Medium | 5.5 | 2016-06-09 | LXD before 2.0.2 does not properly set permissions when switching an unprivileged container into privileged mode, which allows local users to access arbitrary… |
CVE-2016-3711 | Low | 3.3 | 2016-06-08 | HAproxy in Red Hat OpenShift Enterprise 3.2 and OpenShift Origin allows local users to obtain the internal IP address of a pod by reading the "OPENSHIFT_[names… |
CVE-2016-2149 | Medium | 6.5 | 2016-06-08 | Red Hat OpenShift Enterprise 3.2 allows remote authenticated users to read log files from another namespace by using the same name as a previously deleted name… |
CVE-2016-2142 | Medium | 5.5 | 2016-06-08 | Red Hat OpenShift Enterprise 3.1 uses world-readable permissions on the /etc/origin/master/master-config.yaml configuration file, which allows local users to o… |
CVE-2016-4367 | High | 7.5 | 2016-06-08 | The Universal Discovery component in HPE Universal CMDB 10.0, 10.01, 10.10, 10.11, 10.20, and 10.21 allows remote attackers to obtain sensitive information via… |
CVE-2016-2027 | High | 7.5 | 2016-06-08 | HPE Matrix Operating Environment before 7.5.1 allows remote attackers to obtain sensitive information via unspecified vectors, a different vulnerability than C… |
CVE-2016-2026 | High | 7.5 | 2016-06-08 | HPE Matrix Operating Environment before 7.5.1 allows remote attackers to obtain sensitive information via unspecified vectors, a different vulnerability than C… |
CVE-2015-5231 | Medium | 5.5 | 2016-06-07 | The service daemon in CRIU does not properly restrict access to non-dumpable processes, which allows local users to obtain sensitive information via (1) proces… |
CVE-2015-5041 | Critical | 9.1 | 2016-06-06 | The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to… |
CVE-2016-1698 | Medium | 6.5 | 2016-06-05 | The createCustomType function in extensions/renderer/resources/binding.js in the extension bindings in Google Chrome before 51.0.2704.79 does not validate modu… |
CVE-2016-1687 | Medium | 6.5 | 2016-06-05 | The renderer implementation in Google Chrome before 51.0.2704.63 does not properly restrict public exposure of classes, which allows remote attackers to obtain… |
CVE-2016-1677 | Medium | 6.5 | 2016-06-05 | uri.js in Google V8 before 5.1.281.26, as used in Google Chrome before 51.0.2704.63, uses an incorrect array type, which allows remote attackers to obtain sens… |
CVE-2016-4785 | Medium | 5.3 | 2016-05-31 | A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100… |
CVE-2016-4784 | Medium | 5.3 | 2016-05-31 | A vulnerability has been identified in firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100… |
CVE-2016-4521 | Critical | 9.8 | 2016-05-31 | Sixnet BT-5xxx and BT-6xxx M2M devices before 3.8.21 and 3.9.x before 3.9.8 have hardcoded credentials, which allows remote attackers to obtain access via unsp… |