CWE-200 · Information Disclosure (page 89)
Page 89 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-1939 | Medium | 5.3 | 2016-01-31 | Mozilla Firefox before 44.0 stores cookies with names containing vertical tab characters, which allows remote attackers to obtain sensitive information by read… |
CVE-2016-0867 | High | 7.5 | 2016-01-30 | CAREL PlantVisorEnhanced allows remote attackers to bypass intended access restrictions via a direct file request. |
CVE-2015-8792 | Medium | 5.3 | 2016-01-29 | The KaxInternalBlock::ReadData function in libMatroska before 1.4.4 allows context-dependent attackers to obtain sensitive information from process heap memory… |
CVE-2015-8791 | Medium | 4.3 | 2016-01-29 | The EbmlElement::ReadCodedSizeValue function in libEBML before 1.3.3 allows context-dependent attackers to obtain sensitive information from process heap memor… |
CVE-2015-8790 | Medium | 4.3 | 2016-01-29 | The EbmlUnicodeString::UpdateFromUTF8 function in libEBML before 1.3.3 allows context-dependent attackers to obtain sensitive information from process heap mem… |
CVE-2015-8618 | High | 7.5 | 2016-01-27 | The Int.Exp Montgomery code in the math/big library in Go 1.5.x before 1.5.3 mishandles carry propagation and produces incorrect output, which makes it easier… |
CVE-2015-7488 | Medium | 5.9 | 2016-01-27 | IBM Spectrum Scale 4.1.1.x before 4.1.1.4 and 4.2.x before 4.2.0.1, in certain LDAP File protocol configurations, allows remote attackers to discover an LDAP p… |
CVE-2015-7487 | Medium | 4.1 | 2016-01-27 | IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.9 IFIX002, and 7.6.0 before 7.6.0.3 IFIX001; Maximo Asset Management 7.5.0 before 7.5.0.9… |
CVE-2016-1490 | Medium | 4.1 | 2016-01-26 | The Wifi hotspot in Lenovo SHAREit before 3.2.0 for Windows allows remote attackers to obtain sensitive file names via a crafted file request to /list. |
CVE-2016-1489 | High | 8.0 | 2016-01-26 | Lenovo SHAREit before 3.2.0 for Windows and SHAREit before 3.5.48_ww for Android transfer files in cleartext, which allows remote attackers to (1) obtain sensi… |
CVE-2016-1618 | Medium | 6.5 | 2016-01-25 | Blink, as used in Google Chrome before 48.0.2564.82, does not ensure that a proper cryptographicallyRandomValues random number generator is used, which makes i… |
CVE-2016-1617 | Medium | 4.3 | 2016-01-25 | The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy (CSP) implementation in Blink, as used in Go… |
CVE-2016-1614 | Medium | 4.3 | 2016-01-25 | The UnacceleratedImageBufferSurface class in WebKit/Source/platform/graphics/UnacceleratedImageBufferSurface.cpp in Blink, as used in Google Chrome before 48.0… |
CVE-2016-1903 | Critical | 9.1 | 2016-01-19 | The gdImageRotateInterpolated function in ext/gd/libgd/gd_interpolation.c in PHP before 5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2 allows remote attacke… |
CVE-2016-0201 | Medium | 5.9 | 2016-01-18 | GSKit in IBM Security Network Protection 5.3.1 before 5.3.1.7 and 5.3.2 allows remote attackers to discover credentials by triggering an MD5 collision. |
CVE-2015-7886 | Low | 3.7 | 2016-01-18 | NetApp Data ONTAP before 8.2.4P1, when 7-Mode and HTTP access are enabled, allows remote attackers to obtain sensitive volume information via unspecified vecto… |
CVE-2015-7470 | High | 7.5 | 2016-01-17 | Report Builder in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 allows man-in-the-middle att… |
CVE-2015-4958 | Low | 3.3 | 2016-01-17 | IBM InfoSphere Master Data Management - Collaborative Edition 9.1, 10.1, 11.0 before 11.0.0.0 IF11, 11.3 before 11.3.0.0 IF7, and 11.4 before 11.4.0.4 IF1 does… |
CVE-2016-1295 | Medium | 5.3 | 2016-01-16 | Cisco Adaptive Security Appliance (ASA) Software 8.4 allows remote attackers to obtain sensitive information via an AnyConnect authentication attempt, aka Bug… |
CVE-2016-1910 | Medium | 5.3 | 2016-01-15 | The User Management Engine (UME) in SAP NetWeaver 7.4 allows attackers to decrypt unspecified data via unknown vectors, aka SAP Security Note 2191290. |
CVE-2015-8749 | Medium | 5.9 | 2016-01-15 | The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info… |
CVE-2016-1898 | Medium | 5.5 | 2016-01-15 | FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming (HLS) M3U8… |
CVE-2016-1897 | Medium | 5.5 | 2016-01-15 | FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming (HLS) M3U8 f… |
CVE-2016-0853 | High | 7.5 | 2016-01-15 | Advantech WebAccess before 8.1 allows remote attackers to obtain sensitive information via crafted input. |
CVE-2015-8280 | High | 7.5 | 2016-01-15 | Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to discover credentials by reading detailed error messages. |
CVE-2015-3943 | Medium | 5.3 | 2016-01-15 | Advantech WebAccess before 8.1 allows remote attackers to read sensitive cleartext information about e-mail project accounts via unspecified vectors. |
CVE-2016-0777 | Medium | 6.5 | 2016-01-14 | The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensitive information fro… |
CVE-2016-0012 | Medium | 4.3 | 2016-01-13 | Microsoft Office 2007 SP3, Excel 2007 SP3, PowerPoint 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Visio 2010… |
CVE-2016-0008 | Medium | 4.3 | 2016-01-13 | The graphics device interface in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Go… |
CVE-2015-7548 | Low | 3.5 | 2016-01-12 | OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty), when using libvirt to spawn instances and use_cow_images is set to false, a… |
CVE-2015-8335 | Medium | 6.5 | 2016-01-11 | Huawei VCN500 with software before V100R002C00SPC201 logs passwords in cleartext, which allows remote authenticated users to obtain sensitive information by tr… |
CVE-2015-7399 | Medium | 5.3 | 2016-01-11 | IBM WebSphere Message Broker 7 before 7.0.0.8 and 8 before 8.0.0.6 and IBM Integration Bus 9 before 9.0.0.3 and 10 before 10.0.0.0 allow remote attackers to ob… |
CVE-2016-1501 | Medium | 4.3 | 2016-01-08 | ownCloud Server before 8.0.9 and 8.1.x before 8.1.4 allow remote authenticated users to obtain sensitive information via unspecified vectors, which reveals the… |
CVE-2016-1500 | Low | 3.1 | 2016-01-08 | ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2, when the "file_versions" application is enabled, does not prope… |
CVE-2016-1499 | High | 8.5 | 2016-01-08 | ownCloud Server before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allow remote authenticated users to obtain sensitive information from a directory lis… |
CVE-2015-8481 | Low | 3.1 | 2016-01-08 | Atlassian JIRA Software 7.0.3, JIRA Core 7.0.3, and the bundled JIRA Service Desk 3.0.3 installer attaches the wrong image to e-mail notifications when a user… |
CVE-2015-8303 | Medium | 4.0 | 2016-01-08 | Huawei Document Security Management (DSM) with software before V100R002C05SPC661 does not clear the clipboard when closing a secure file, which allows local us… |
CVE-2015-7328 | Medium | 4.7 | 2016-01-08 | Puppet Server in Puppet Enterprise before 3.8.x before 3.8.3 and 2015.2.x before 2015.2.3 uses world-readable permissions for the private key of the Certificat… |
CVE-2015-6862 | High | 8.4 | 2016-01-08 | HPE UCMDB Browser before 4.02 allows remote attackers to obtain sensitive information or bypass intended access restrictions via unspecified vectors. |
CVE-2015-6644 | Low | 3.3 | 2016-01-06 | Bouncy Castle in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to obtain sensitive information via a crafted application, aka internal… |
CVE-2015-6641 | Low | 3.1 | 2016-01-06 | Bluetooth in Android 6.0 before 2016-01-01 allows remote attackers to obtain sensitive Contacts information by leveraging pairing, aka internal bug 23607427. |
CVE-2015-5310 | Medium | 4.3 | 2016-01-06 | The WNM Sleep Mode code in wpa_supplicant 2.x before 2.6 does not properly ignore key data in response frames when management frame protection (MFP) was not ne… |
CVE-2015-6858 | Low | 3.7 | 2016-01-05 | HP Insight Control server provisioning before 7.5.0 RabbitMQ allows remote attackers to obtain sensitive information via unspecified vectors. |
CVE-2015-8509 | Low | 3.5 | 2016-01-03 | Template.pm in Bugzilla 2.x, 3.x, and 4.x before 4.2.16, 4.3.x and 4.4.x before 4.4.11, and 4.5.x and 5.0.x before 5.0.2 does not properly construct CSV files… |
CVE-2015-4962 | Low | 3.5 | 2016-01-03 | Jazz Team Server in Jazz Foundation in IBM Rational Collaborative Lifecycle Management (CLM) 3.x and 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF9, and 6.x before… |
CVE-2015-7452 | Medium | 4.3 | 2016-01-02 | IBM Maximo Asset Management 7.5 before 7.5.0.9 FP9 and 7.6 before 7.6.0.3 FP3 and Maximo Asset Management 7.5 before 7.5.0.9 FP9, 7.5.1, and 7.6 before 7.6.0.3… |
CVE-2015-7438 | Medium | 4.7 | 2016-01-02 | IBM Sterling B2B Integrator 5.2 allows local users to obtain sensitive cleartext web-services information by leveraging database access. |
CVE-2015-7437 | Medium | 5.5 | 2016-01-02 | Queue Watcher in IBM Sterling B2B Integrator 5.2 allows local users to obtain sensitive information via unspecified vectors. |
CVE-2015-7429 | High | 8.5 | 2016-01-02 | The Data Protection extension in the VMware GUI in IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware (aka Spectrum Protect for Vi… |
CVE-2015-4996 | Medium | 5.1 | 2016-01-02 | IBM Rational ClearQuest 7.1.x and 8.0.0.x before 8.0.0.17 and 8.0.1.x before 8.0.1.10 allows local users to spoof database servers and discover credentials via… |
CVE-2015-4990 | Medium | 4.0 | 2016-01-02 | The portal in IBM Tealeaf Customer Experience before 8.7.1.8818, 8.8 before 8.8.0.9026, 9.0.0, 9.0.0A, 9.0.1 before 9.0.1.1083, 9.0.1A before 9.0.1.5073, 9.0.2… |
CVE-2015-4989 | Low | 3.7 | 2016-01-02 | The portal in IBM Tealeaf Customer Experience before 8.7.1.8814, 8.8 before 8.8.0.9026, 9.0.0, 9.0.0A, 9.0.1 before 9.0.1.1083, 9.0.1A before 9.0.1.5073, 9.0.2… |
CVE-2015-7456 | Medium | 6.5 | 2016-01-01 | IBM Spectrum Scale 4.1.1 before 4.1.1.4, and 4.2.0.0, allows remote authenticated users to discover object-storage admin passwords via unspecified vectors. |
CVE-2015-7445 | Medium | 4.3 | 2016-01-01 | IBM Multi-Enterprise Integration Gateway 1.0 through 1.0.0.1 and B2B Advanced Communications 1.x before 1.0.0.4, when guest access is configured, allow remote… |
CVE-2015-7421 | Low | 3.7 | 2016-01-01 | Unspecified vulnerability in GSKit on IBM MQ M2000 appliances before 8.0.0.4 allows remote attackers to obtain sensitive information via unknown vectors, a dif… |
CVE-2015-7420 | Low | 3.7 | 2016-01-01 | Unspecified vulnerability in GSKit on IBM MQ M2000 appliances before 8.0.0.4 allows remote attackers to obtain sensitive information via unknown vectors, a dif… |
CVE-2015-7447 | Medium | 5.3 | 2015-12-31 | IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF20, and 8.5.0 before CF09 allow… |
CVE-2015-2913 | Medium | 5.9 | 2015-12-31 | server/network/protocol/http/OHttpSessionManager.java in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 imprope… |
CVE-2015-2896 | Medium | 5.3 | 2015-12-31 | The up.time client in Idera Uptime Infrastructure Monitor through 7.6 allows remote attackers to obtain potentially sensitive version, OS, process, and event-l… |
CVE-2014-4876 | Low | 3.7 | 2015-12-31 | Toshiba 4690 Operating System 6 Release 3, when the ADXSITCF logical name is not properly restricted, allows remote attackers to read potentially sensitive sys… |
CVE-2015-8703 | Medium | 6.5 | 2015-12-30 | ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE and ZXV10 W300 devices W300V1.0.0f_ER1_PE allow remote authenticated users to bypass intended acces… |
CVE-2015-7787 | Medium | 4.3 | 2015-12-30 | ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allow remote attackers to discover the WPA2-PSK passphrase via unspecified vectors. |
CVE-2015-7248 | High | 7.5 | 2015-12-30 | ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allow remote attackers to discover usernames and password hashes by reading the cgi-bin/webproc HTM… |
CVE-2015-5330 | High | 7.5 | 2015-12-29 | ldb before 1.1.24, as used in the AD LDAP server in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, mishandles string lengths, which allow… |
CVE-2015-5299 | Medium | 5.3 | 2015-12-29 | The shadow_copy2_get_shadow_copy_data function in modules/vfs_shadow_copy2.c in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 doe… |
CVE-2015-6852 | Medium | 4.3 | 2015-12-28 | Directory traversal vulnerability in the API in EMC Secure Remote Services Virtual Edition 3.x before 3.10 allows remote authenticated users to read log files… |
CVE-2015-8569 | Low | 2.3 | 2015-12-28 | The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp.c in the Linux kernel through 4.3.3 do not verify an address length, which allows loca… |
CVE-2015-8374 | Medium | 4.0 | 2015-12-28 | fs/btrfs/inode.c in the Linux kernel before 4.3.3 mishandles compressed inline extents, which allows local users to obtain sensitive pre-truncation information… |
CVE-2015-7885 | Low | 2.3 | 2015-12-28 | The dgnc_mgmt_ioctl function in drivers/staging/dgnc/dgnc_mgmt.c in the Linux kernel through 4.3.3 does not initialize a certain structure member, which allows… |
CVE-2015-7884 | Low | 2.3 | 2015-12-28 | The vivid_fb_ioctl function in drivers/media/platform/vivid/vivid-osd.c in the Linux kernel through 4.3.3 does not initialize a certain structure member, which… |
CVE-2015-7665 | Medium | 5.3 | 2015-12-27 | Tails before 1.7 includes the wget program but does not prevent automatic fallback from passive FTP to active FTP, which allows remote FTP servers to discover… |
CVE-2015-8253 | Low | 3.7 | 2015-12-27 | The Frontel protocol before 3 on RSI Video Technologies Videofied devices sets up AES encryption but sends all traffic in cleartext, which allows remote attack… |
CVE-2015-8252 | Medium | 5.9 | 2015-12-27 | The Frontel protocol before 3 on RSI Video Technologies Videofied devices sends a cleartext serial number, which allows remote attackers to determine a hardcod… |
CVE-2015-8669 | Medium | 5.3 | 2015-12-26 | libraries/config/messages.inc.php in phpMyAdmin 4.0.x before 4.0.10.12, 4.4.x before 4.4.15.2, and 4.5.x before 4.5.3.1 allows remote attackers to obtain sensi… |
CVE-2015-6409 | Medium | 5.9 | 2015-12-26 | Cisco Jabber 10.6.x, 11.0.x, and 11.1.x on Windows allows man-in-the-middle attackers to conduct STARTTLS downgrade attacks and trigger cleartext XMPP sessions… |
CVE-2015-7934 | High | 8.6 | 2015-12-24 | The Java client in Adcon Telemetry A840 Telemetry Gateway Base Station allows remote attackers to discover log-file pathnames via unspecified vectors. |
CVE-2015-7932 | High | 8.6 | 2015-12-24 | Adcon Telemetry A840 Telemetry Gateway Base Station allows remote attackers to obtain sensitive information by sniffing the network. |
CVE-2015-7931 | High | 8.7 | 2015-12-24 | The Java client in Adcon Telemetry A840 Telemetry Gateway Base Station does not authenticate the station device, which allows man-in-the-middle attackers to sp… |
CVE-2015-7929 | Medium | 4.3 | 2015-12-23 | eWON devices with firmware through 10.1s0 support unspecified GET requests, which might allow remote attackers to obtain sensitive information by reading (1) w… |
CVE-2015-7928 | High | 8.5 | 2015-12-23 | eWON devices with firmware before 10.1s0 do not have an off autocomplete attribute for a password field, which makes it easier for remote attackers to obtain a… |
CVE-2015-7926 | Critical | 9.9 | 2015-12-23 | eWON devices with firmware before 10.1s0 omit RBAC for I/O server information and status requests, which allows remote attackers to obtain sensitive informatio… |
CVE-2015-7935 | High | 7.5 | 2015-12-23 | Motorola Solutions MOSCAD IP Gateway allows remote attackers to read arbitrary files via unspecified vectors. |
CVE-2015-6471 | Medium | 5.3 | 2015-12-23 | Eaton Cooper Power Systems ProView 4.x and 5.x before 5.1 on Form 6 controls and Idea and IdeaPLUS relays does not properly initialize padding fields in Ethern… |
CVE-2015-7908 | | 2015-12-21 | Honeywell Midas gas detectors before 1.13b3 and Midas Black gas detectors before 2.13b3 allow remote attackers to discover cleartext passwords by sniffing the… | |
CVE-2015-6556 | | 2015-12-18 | EACommunicatorSrv.exe in the Framework Service in the client in Symantec Endpoint Encryption (SEE) before 11.1.0 allows remote authenticated users to discover… | |
CVE-2015-6428 | | 2015-12-18 | Cisco DPQ3925 devices with EDVA r1 Base allow remote attackers to obtain sensitive information via a crafted HTTP request, aka Bug ID CSCuv03958. | |
CVE-2015-8602 | | 2015-12-17 | The Token Insert Entity module 7.x-1.x before 7.x-1.1 for Drupal does not properly check permissions, which allows remote authenticated users with certain perm… | |
CVE-2015-8601 | | 2015-12-17 | The Chat Room module 7.x-2.x before 7.x-2.2 for Drupal does not properly check permissions when setting up a websocket for chat messages, which allows remote a… | |
CVE-2015-7215 | | 2015-12-16 | The importScripts function in the Web Workers API implementation in Mozilla Firefox before 43.0 allows remote attackers to bypass the Same Origin Policy by tri… | |
CVE-2015-7214 | | 2015-12-16 | Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote attackers to bypass the Same Origin Policy via data: and view-source: URIs. | |
CVE-2015-7208 | | 2015-12-16 | Mozilla Firefox before 43.0 stores cookies containing vertical tab characters, which allows remote attackers to obtain sensitive information by reading HTTP Co… | |
CVE-2015-7207 | | 2015-12-16 | Mozilla Firefox before 43.0 does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to bypass the Same O… | |
CVE-2015-6411 | | 2015-12-15 | Cisco FirePOWER Management Center 5.4.1.3, 6.0.0, and 6.0.1 provides verbose responses to requests for help files, which allows remote attackers to obtain pote… | |
CVE-2015-6404 | | 2015-12-15 | Cisco Hosted Collaboration Mediation Fulfillment 10.6(3) does not use RBAC, which allows remote authenticated users to obtain sensitive credential information… | |
CVE-2015-5004 | | 2015-12-15 | The Edge Component Caching Proxy in IBM WebSphere Application Server (WAS) 8.0 before 8.0.0.12 and 8.5 before 8.5.5.8 does not properly encrypt data, which all… | |
CVE-2015-6418 | | 2015-12-13 | The random-number generator on Cisco Small Business RV routers 4.x and SA500 security appliances 2.2.07 does not have sufficient entropy, which makes it easier… | |
CVE-2015-6414 | | 2015-12-13 | Cisco TelePresence Video Communication Server (VCS) X8.6 uses the same encryption key across different customers' installations, which makes it easier for loca… | |
CVE-2015-6419 | | 2015-12-12 | Cisco FireSIGHT Management Center with software 4.10.3, 5.2.0, 5.3.0, 5.3.1, and 5.4.0 allows remote authenticated users to read arbitrary files via a crafted… | |
CVE-2015-7080 | | 2015-12-11 | Siri in Apple iOS before 9.2 allows physically proximate attackers to bypass an intended client-side protection mechanism and obtain sensitive content-notifica… | |
CVE-2015-7058 | | 2015-12-11 | Apple iOS before 9.2, OS X before 10.11.2, and tvOS before 9.1 improperly validate keychain item ACLs, which allows attackers to obtain access to keychain item… |