CWE-200 · Information Disclosure (page 88)
Page 88 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-8399 | Medium | 4.3 | 2016-04-11 | Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName parameter to (1) spaces/viewdefaultdecor… |
CVE-2015-7528 | Medium | 5.3 | 2016-04-11 | Kubernetes before 1.2.0-alpha.5 allows remote attackers to read arbitrary pod logs via a container name. |
CVE-2015-7502 | Medium | 5.1 | 2016-04-11 | Red Hat CloudForms 3.2 Management Engine (CFME) 5.4.4 and CloudForms 4.0 Management Engine (CFME) 5.5.0 do not properly encrypt data in the backend PostgreSQL… |
CVE-2014-9759 | Medium | 5.3 | 2016-04-11 | Incomplete blacklist vulnerability in the config_is_private function in config_api.php in MantisBT 1.3.x before 1.3.0 allows remote attackers to obtain sensiti… |
CVE-2016-2164 | High | 7.5 | 2016-04-11 | The (1) FileService.importFileByInternalUserId and (2) FileService.importFile SOAP API methods in Apache OpenMeetings before 3.1.1 improperly use the Java URL… |
CVE-2016-0783 | High | 7.5 | 2016-04-11 | The sendHashByUser function in Apache OpenMeetings before 3.1.1 generates predictable password reset tokens, which makes it easier for remote attackers to rese… |
CVE-2016-2513 | Low | 3.1 | 2016-04-08 | The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack in… |
CVE-2015-5969 | Medium | 6.2 | 2016-04-08 | The mysql-systemd-helper script in the mysql-community-server package before 5.6.28-2.17.1 in openSUSE 13.2 and before 5.6.28-13.1 in openSUSE Leap 42.1 and th… |
CVE-2016-0791 | Critical | 9.8 | 2016-04-07 | Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify CSRF tokens, which makes it easier for remote attackers to bypass a… |
CVE-2016-0790 | Medium | 5.3 | 2016-04-07 | Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify API tokens, which makes it easier for remote attackers to determine… |
CVE-2015-2774 | Medium | 5.9 | 2016-04-07 | Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obt… |
CVE-2016-3973 | Medium | 5.3 | 2016-04-07 | The chat feature in the Real-Time Collaboration (RTC) services 7.3 and 7.4 in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to obtain sensitive… |
CVE-2016-1563 | Medium | 6.8 | 2016-04-07 | NetApp Clustered Data ONTAP 8.3.1 does not properly verify X.509 certificates from TLS servers, which allows man-in-the-middle attackers to spoof servers and o… |
CVE-2016-0871 | High | 7.5 | 2016-04-06 | Eaton Lighting EG2 Web Control 4.04P and earlier allows remote attackers to read the configuration file, and consequently discover credentials, via a direct re… |
CVE-2016-0793 | High | 7.5 | 2016-04-01 | Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before 10.0.0.Final on Windows al… |
CVE-2016-1787 | Medium | 5.3 | 2016-03-24 | Wiki Server in Apple OS X Server before 5.1 allows remote attackers to obtain sensitive information from Wiki pages via unspecified vectors. |
CVE-2016-1786 | Medium | 5.4 | 2016-03-24 | The Page Loading implementation in WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles HTTP responses with a 3xx (aka redirection) status code, whi… |
CVE-2016-1785 | Medium | 6.5 | 2016-03-24 | The Page Loading implementation in WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles character encoding during access to cached data, which allow… |
CVE-2016-1780 | Medium | 4.3 | 2016-03-24 | WebKit in Apple iOS before 9.3 does not prevent hidden web views from reading orientation and motion data, which allows remote attackers to obtain sensitive in… |
CVE-2016-1779 | Medium | 6.5 | 2016-03-24 | WebKit in Apple iOS before 9.3 and Safari before 9.1 allows remote attackers to bypass the Same Origin Policy and obtain physical-location data via a crafted g… |
CVE-2016-1772 | Medium | 4.3 | 2016-03-24 | The Top Sites feature in Apple Safari before 9.1 mishandles cookie storage, which makes it easier for remote web servers to track users via unspecified vectors. |
CVE-2016-1764 | Medium | 4.3 | 2016-03-24 | The Content Security Policy (CSP) implementation in Messages in Apple OS X before 10.11.4 allows remote attackers to obtain sensitive information via a javascr… |
CVE-2016-1758 | Low | 3.3 | 2016-03-24 | The kernel in Apple iOS before 9.3 and OS X before 10.11.4 allows attackers to obtain sensitive memory-layout information or cause a denial of service (out-of-… |
CVE-2016-1748 | Low | 3.3 | 2016-03-24 | IOHIDFamily in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows attackers to obtain sensitive kernel memory-layout inf… |
CVE-2015-2286 | Medium | 6.5 | 2016-03-19 | lms/templates/footer-edx-new.html in Open edX edx-platform before 2015-01-29 does not properly restrict links on the password-reset page, which allows user-ass… |
CVE-2016-3155 | Low | 3.4 | 2016-03-18 | Siemens APOGEE Insight uses weak permissions for the application folder, which allows local users to obtain sensitive information or modify data via unspecifie… |
CVE-2016-1994 | Medium | 6.5 | 2016-03-18 | HPE System Management Homepage before 7.5.4 allows remote authenticated users to obtain sensitive information via unspecified vectors. |
CVE-2016-1992 | Medium | 6.5 | 2016-03-17 | HPE ArcSight ESM before 6.8c, and ArcSight ESM Express before 6.9.1, allows remote authenticated users to obtain sensitive information via unspecified vectors. |
CVE-2016-1967 | Medium | 6.5 | 2016-03-13 | Mozilla Firefox before 45.0 does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to bypass the Same O… |
CVE-2016-1955 | Medium | 4.3 | 2016-03-13 | Mozilla Firefox before 45.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by reading a Content Security Policy (CSP… |
CVE-2016-0831 | Medium | 5.5 | 2016-03-12 | The getDeviceIdForPhone function in internal/telephony/PhoneSubInfoController.java in Telephony in Android 5.x before 5.1.1 LMY49H and 6.x before 2016-03-01 do… |
CVE-2016-0829 | High | 7.5 | 2016-03-12 | The BnGraphicBufferProducer::onTransact function in libs/gui/IGraphicBufferConsumer.cpp in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, an… |
CVE-2016-0828 | High | 7.5 | 2016-03-12 | The BnGraphicBufferConsumer::onTransact function in libs/gui/IGraphicBufferConsumer.cpp in mediaserver in Android 5.x before 5.1.1 LMY49H and 6.x before 2016-0… |
CVE-2016-0825 | Medium | 5.3 | 2016-03-12 | The Widevine Trusted Application in Android 6.0.1 before 2016-03-01 allows attackers to obtain sensitive TrustZone secure-storage information by leveraging ker… |
CVE-2016-0824 | Medium | 5.3 | 2016-03-12 | libmpeg2 in libstagefright in Android 6.x before 2016-03-01 allows attackers to obtain sensitive information, and consequently bypass an unspecified protection… |
CVE-2016-0823 | Medium | 4.0 | 2016-03-12 | The pagemap_open function in fs/proc/task_mmu.c in the Linux kernel before 3.19.3, as used in Android 6.0.1 before 2016-03-01, allows local users to obtain sen… |
CVE-2016-1562 | Medium | 4.3 | 2016-03-12 | The REST API in the DTE Energy Insight application before 1.7.8 for Android allows remote authenticated users to obtain unspecified customer information via a… |
CVE-2016-1360 | High | 7.1 | 2016-03-12 | Cisco Prime LAN Management Solution (LMS) through 4.2.5 uses the same database decryption key across different customers' installations, which allows local use… |
CVE-2015-6485 | Medium | 5.3 | 2016-03-12 | Schneider Electric Telvent Sage 2300 RTUs with firmware before C3413-500-S01, and LANDAC II-2, Sage 1410, Sage 1430, Sage 1450, Sage 2400, and Sage 3030M RTUs… |
CVE-2016-0886 | Medium | 4.3 | 2016-03-09 | EMC Documentum xCP 2.1 before patch 24 and 2.2 before patch 12 allows remote authenticated users to obtain sensitive user-account metadata via a members/xcp_me… |
CVE-2016-1325 | High | 7.5 | 2016-03-09 | The administration interface on Cisco DPC3939B and DPC3941 devices allows remote attackers to obtain sensitive information via a crafted HTTP request, aka Bug… |
CVE-2016-0125 | Low | 3.1 | 2016-03-09 | Microsoft Edge mishandles the Referer policy, which allows remote attackers to obtain sensitive browser-history and request information via a crafted HTTPS web… |
CVE-2016-2845 | Medium | 5.3 | 2016-03-06 | The Content Security Policy (CSP) implementation in Blink, as used in Google Chrome before 49.0.2623.75, does not ignore a URL's path component in the case of… |
CVE-2016-1637 | Medium | 6.5 | 2016-03-06 | The SkATan2_255 function in effects/gradients/SkSweepGradient.cpp in Skia, as used in Google Chrome before 49.0.2623.75, mishandles arctangent calculations, wh… |
CVE-2016-2244 | Medium | 5.9 | 2016-03-04 | HP LaserJet printers and MFPs and OfficeJet Enterprise printers with firmware before 3.7.01 allow remote attackers to obtain sensitive information via unspecif… |
CVE-2016-1357 | Medium | 5.3 | 2016-03-03 | The password-management administration component in Cisco Policy Suite (CPS) 7.0.1.3, 7.0.2, 7.0.2-att, 7.0.3-att, 7.0.4-att, and 7.5.0 allows remote attackers… |
CVE-2016-0702 | Medium | 5.1 | 2016-03-03 | The MOD_EXP_CTIME_COPY_FROM_PREBUF function in crypto/bn/bn_exp.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not properly consider cache-bank… |
CVE-2016-0704 | Medium | 5.9 | 2016-03-02 | An oracle protection mechanism in the get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1… |
CVE-2016-0703 | Medium | 5.9 | 2016-03-02 | The get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 befo… |
CVE-2016-0800 | Medium | 5.9 | 2016-03-01 | The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establ… |
CVE-2016-0225 | Medium | 4.9 | 2016-02-29 | IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x through 7.0.0.9 allows remote authenticated Commerce Accelerator administrators to obtain sensitive informa… |
CVE-2016-1342 | Medium | 5.3 | 2016-02-26 | The device login page in Cisco FirePOWER Management Center 5.3 through 6.0.0.1 allows remote attackers to obtain potentially sensitive software-version informa… |
CVE-2016-0706 | Medium | 4.3 | 2016-02-25 | Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet… |
CVE-2016-0724 | Medium | 4.3 | 2016-02-22 | The (1) core_enrol_get_course_enrolment_methods and (2) enrol_self_get_instance_info web services in Moodle through 2.6.11, 2.7.x before 2.7.12, 2.8.x before 2… |
CVE-2015-5341 | Medium | 4.3 | 2016-02-22 | mod_scorm in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 mishandles availability dates, which allows remote authenti… |
CVE-2015-5340 | Medium | 4.3 | 2016-02-22 | Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not consider the moodle/badges:viewbadges capability, which allows… |
CVE-2015-5339 | Medium | 4.3 | 2016-02-22 | The core_enrol_get_enrolled_users web service in enrol/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9… |
CVE-2015-5335 | Medium | 4.3 | 2016-02-22 | Cross-site request forgery (CSRF) vulnerability in admin/registration/register.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x… |
CVE-2015-5268 | Medium | 4.3 | 2016-02-22 | The rating component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 mishandles group-based authorization checks, whi… |
CVE-2015-5267 | High | 7.5 | 2016-02-22 | lib/moodlelib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 relies on the PHP mt_rand function to implement the… |
CVE-2016-2044 | Medium | 5.3 | 2016-02-20 | libraries/sql-parser/autoload.php in the SQL parser in phpMyAdmin 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted requ… |
CVE-2016-2042 | Medium | 5.3 | 2016-02-20 | phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request to (1) libraries/phpsecli… |
CVE-2016-2039 | Medium | 5.3 | 2016-02-20 | libraries/session.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not properly generate CSRF token values, whi… |
CVE-2016-2038 | Medium | 5.3 | 2016-02-20 | phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request… |
CVE-2016-2509 | Medium | 5.3 | 2016-02-18 | The password-sync feature on Belden Hirschmann Classic Platform switches L2B before 05.3.07 and L2E, L2P, L3E, and L3P before 09.0.06 sets an SNMP community to… |
CVE-2015-8148 | High | 7.5 | 2016-02-18 | The LDAP service in Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows remote attackers to obtain sensitive information about administrator… |
CVE-2015-8488 | Medium | 4.3 | 2016-02-17 | Cybozu Office 10.3.0 allows remote attackers to read image files via a crafted e-mail message, a different vulnerability than CVE-2015-8487. |
CVE-2015-8487 | Medium | 4.3 | 2016-02-17 | Cybozu Office 9.0.0 through 10.3 allows remote attackers to discover CSRF tokens via unspecified vectors, a different vulnerability than CVE-2015-8488. |
CVE-2016-2388 | Medium | 5.3 | 2016-02-16 | The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka… |
CVE-2016-1321 | Medium | 5.8 | 2016-02-15 | Cisco Universal Small Cell devices with firmware R2.12 through R3.5 contain an image-decryption key in flash memory, which allows remote attackers to bypass a… |
CVE-2016-0232 | Medium | 4.3 | 2016-02-15 | IBM Financial Transaction Manager (FTM) for ACH Services, Check Services and Corporate Payment Services (CPS) 3.0.0 before FP12 allows remote authenticated use… |
CVE-2016-0231 | Medium | 4.3 | 2016-02-15 | IBM Financial Transaction Manager (FTM) for ACH Services, Check Services and Corporate Payment Services (CPS) 3.0.0 before FP12 allows remote authenticated use… |
CVE-2016-0701 | Low | 3.7 | 2016-02-15 | The DH_check_pub_key function in crypto/dh/dh_check.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriate for Diffie-Hellman (DH)… |
CVE-2015-7444 | Medium | 5.3 | 2016-02-15 | The Update Installer in IBM WebSphere Commerce Enterprise 7.0.0.8 and 7.0.0.9 does not properly replicate the search index, which allows attackers to obtain se… |
CVE-2015-4991 | Medium | 4.0 | 2016-02-15 | IBM SPSS Modeler 14.2 through FP3 IF027, 15 through FP3 IF015, 16 through FP2 IF012, 17 through FP1 IF018, and 17.1 through IF008 includes unspecified cleartex… |
CVE-2015-3197 | Medium | 5.9 | 2016-02-15 | ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle atta… |
CVE-2015-2005 | Medium | 5.3 | 2016-02-15 | IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 and 7.2.x before 7.2.5 Patch 6 does not properly expire sessions, which allows remote attackers to obtai… |
CVE-2016-1526 | High | 8.1 | 2016-02-13 | The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, i… |
CVE-2016-0864 | Medium | 5.3 | 2016-02-13 | Tollgrade SmartGrid LightHouse Sensor Management System (SMS) Software EMS before 5.1, and 4.1.0 Build 16, allows remote attackers to obtain sensitive report a… |
CVE-2016-1323 | Medium | 4.3 | 2016-02-12 | The REST interface in Cisco Spark 2015-06 allows remote authenticated users to obtain sensitive information via a request for an unspecified file, aka Bug ID C… |
CVE-2016-0958 | High | 7.5 | 2016-02-10 | Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 might allow remote attackers to have an unspecified impact via a crafted serialized Java object. |
CVE-2016-0956 | High | 7.5 | 2016-02-10 | The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to obtain sensitive inf… |
CVE-2015-7680 | Medium | 5.3 | 2016-02-10 | Ipswitch MOVEit DMZ before 8.2 provides different error messages for authentication attempts depending on whether the user account exists, which allows remote… |
CVE-2015-7677 | Medium | 4.3 | 2016-02-10 | The MOVEitISAPI service in Ipswitch MOVEit DMZ before 8.2 provides different error messages depending on whether a FileID exists, which allows remote authentic… |
CVE-2015-7675 | Medium | 6.5 | 2016-02-10 | The "Send as attachment" feature in Ipswitch MOVEit DMZ before 8.2 and MOVEit Mobile before 1.2.2 allow remote authenticated users to bypass authorization and… |
CVE-2016-0080 | Medium | 4.3 | 2016-02-10 | Microsoft Edge mishandles exceptions during window-message dispatch operations, which allows remote attackers to bypass the ASLR protection mechanism via a cra… |
CVE-2016-0059 | Medium | 4.3 | 2016-02-10 | The Hyperlink Object Library in Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from process memory via a craf… |
CVE-2016-0047 | High | 7.5 | 2016-02-10 | WinForms in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 allows remote attackers to obtain sensitive information from process memory via… |
CVE-2016-1319 | Medium | 5.3 | 2016-02-09 | Cisco Unified Communications Manager (aka CallManager) 9.1(2.10000.28), 10.5(2.10000.5), 10.5(2.12901.1), and 11.0(1.10000.10); Unified Communications Manager… |
CVE-2016-1317 | Medium | 4.3 | 2016-02-09 | Cisco Unified Communications Manager 11.5(0.98000.480) allows remote authenticated users to obtain sensitive database table-name and entity-name information vi… |
CVE-2016-1316 | Medium | 5.3 | 2016-02-09 | Cisco TelePresence Video Communication Server (VCS) X8.1 through X8.7, as used in conjunction with Jabber Guest, allows remote attackers to obtain sensitive ca… |
CVE-2015-3251 | Medium | 4.9 | 2016-02-08 | Apache CloudStack before 4.5.2 might allow remote authenticated administrators to obtain sensitive password information for root accounts of virtual machines v… |
CVE-2015-2012 | Medium | 4.0 | 2016-02-08 | The MQXR service in WMQ Telemetry in IBM WebSphere MQ 7.1 before 7.1.0.7, 7.5 through 7.5.0.5, and 8.0 before 8.0.0.4 uses world-readable permissions for a cle… |
CVE-2016-0723 | Medium | 6.8 | 2016-02-08 | Race condition in the tty_ioctl function in drivers/tty/tty_io.c in the Linux kernel through 4.4.1 allows local users to obtain sensitive information from kern… |
CVE-2015-8575 | Medium | 4.0 | 2016-02-08 | The sco_sock_bind function in net/bluetooth/sco.c in the Linux kernel before 4.3.4 does not verify an address length, which allows local users to obtain sensit… |
CVE-2016-0811 | High | 7.5 | 2016-02-07 | Integer overflow in the BnCrypto::onTransact function in media/libmedia/ICrypto.cpp in libmediaplayerservice in Android 6.x before 2016-02-01 allows attackers… |
CVE-2015-7915 | Critical | 9.8 | 2016-02-06 | Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 sends cleartext credentials, which allows remote attackers to obtain sensitive information by sniffing the netw… |
CVE-2016-0862 | Medium | 6.5 | 2016-02-05 | General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authenticated users to obtain sensitive cleartext… |
CVE-2016-1730 | Medium | 5.4 | 2016-02-01 | WebSheet in Apple iOS before 9.2.1 allows remote attackers to read or write to cookies by operating a crafted captive portal. |
CVE-2016-1728 | Medium | 4.3 | 2016-02-01 | The Cascading Style Sheets (CSS) implementation in Apple iOS before 9.2.1 and Safari before 9.0.3 mishandles the "a:visited button" selector during height proc… |