CWE-200
11,564 CVEs • Abstraction: Class • Likelihood of Exploit: High
Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVEs (11,564)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
monitor/index.php in op5 Monitor and op5 Appliance before 5.5.1 allows remote authenticated users to obtain sensitive information such as database and user credentials via error messages that are triggered by (1) a malfo...Show more |
1Cisco 1Unified Communications Manager Apr 29, 2026 Dec 21, 2013 N/A· v4 N/A· v3 4.0 MEDIUM· v2 The disaster recovery system (DRS) component in Cisco Unified Communications Manager (UCM) 9.1(1) and earlier allows remote authenticated users to obtain sensitive device information by reading "extraneous information" i...Show more |
1Ibm 1Spss Collaboration And Deployment Services Apr 29, 2026 Dec 21, 2013 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The Portal application in IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote attackers to discover an internal password via unspecified vectors. |
1Ibm 1Spss Collaboration And Deployment Services Apr 29, 2026 Dec 21, 2013 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The Portal application in IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction w...Show more |
1Ibm 1Spss Collaboration And Deployment Services Apr 29, 2026 Dec 21, 2013 N/A· v4 N/A· v3 4.0 MEDIUM· v2 IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote authenticated users to read application log files via a direct HTTP request. |
1Ibm 1Filenet Business Process Framework Apr 29, 2026 Dec 19, 2013 N/A· v4 N/A· v3 3.5 LOW· v2 IBM FileNet Business Process Framework 4.1.0 allows remote authenticated users to read arbitrary files or send TCP requests to intranet servers via XML data containing an external entity declaration in conjunction with a...Show more |
The Web Client in IBM Rational ClearQuest 7.1 through 7.1.2.12, 8.0.0.x before 8.0.0.9, and 8.0.1.x before 8.0.1.2, when a multi-database dataset exists, allows remote attackers to read database names via unspecified vec...Show more |
1Dlink 15Dsr 1000 Dsr 1000 FirmwareDsr 1000n+12 moreApr 29, 2026 Dec 19, 2013 N/A· v4 N/A· v3 4.9 MEDIUM· v2 D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1.08B44; and DSR-500, DSR-500N, DSR-1000, and DSR-1000N with firmware before 1.08B77 stores ac...Show more |
1Netgear 11Prosafe Firmware Prosafe Gs510tpProsafe Gs724t+8 moreApr 29, 2026 Dec 19, 2013 N/A· v4 N/A· v3 7.8 HIGH· v2 NETGEAR ProSafe GS724Tv3 and GS716Tv2 with firmware 5.4.1.13 and earlier; GS748Tv4 with firmware 5.4.1.14; GS510TP with firmware 5.4.0.6; GS752TPS, GS728TPS, GS728TS, and GS725TS with firmware 5.3.0.17; and GS752TXS and...Show more |
IBM InfoSphere Information Server 8.0, 8.1, 8.5, 8.7, and 9.1 allows local users to obtain sensitive information in opportunistic circumstances by leveraging the presence of file content after a failed installation. |
Cisco WebEx Training Center allows remote attackers to discover registration IDs via a crafted URL, aka Bug ID CSCul57121. |
Cisco WebEx Training Center allows remote attackers to discover session numbers, and bypass host approval for audio-conference attendance, by reading HTML source code, aka Bug ID CSCul57126. |
Cisco WebEx Meeting Center allows remote attackers to obtain sensitive information by reading verbose error messages within server responses, aka Bug ID CSCul35928. |
Cisco WebEx Training Center provides different error messages for registration attempts depending on whether the e-mail address exists, which allows remote attackers to enumerate attendees via a series of requests, aka B...Show more |
The registration component in Cisco WebEx Training Center provides the training-session URL before payment is completed, which allows remote attackers to bypass intended access restrictions and join an audio conference b...Show more |
The CleanChanges extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3, when "Group changes by page in recent changes and watchlist" is enabled, allows remote attackers to obtain sensitive...Show more |
OpenJPEG 1.3 and earlier allows remote attackers to obtain sensitive information via unspecified vectors that trigger a heap-based out-of-bounds read. |
6Canonical FedoraprojectMozilla+3 more9Fedora FirefoxLinux Enterprise Desktop+6 moreApr 29, 2026 Dec 11, 2013 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Mozilla Firefox before 26.0 and SeaMonkey before 2.23 on Linux allow user-assisted remote attackers to read clipboard data by leveraging certain middle-click paste operations. |
Microsoft Office 2013 and 2013 RT allows remote attackers to discover authentication tokens via a crafted response to a file-open request for an Office file on a web site, as exploited in the wild in 2013, aka "Token Hij...Show more |
1Islonline 2Isl Desktop Plugin Isl LightApr 29, 2026 Dec 10, 2013 N/A· v4 N/A· v3 3.5 LOW· v2 The ISL Desktop plugin for Windows before 1.4.7 for ISL Light 3.5.4 and earlier allows remote authenticated users to obtain sensitive information by pasting the clipboard contents that have been copied by another user in...Show more |