Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CVEs (10,330)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2008-1288 1Ibm 1Rational Clearquest Apr 23, 2026 Mar 11, 2008 N/A· v4 N/A· v3 5.0 MEDIUM· v2 IBM Rational ClearQuest 7.0.1.1 and 7.0.0.2 might allow local or remote attackers to obtain sensitive information about users by reading user cookies.
CVE-2008-1270 1Lighttpd 1Lighttpd Apr 23, 2026 Mar 10, 2008 N/A· v4 N/A· v3 5.0 MEDIUM· v2 mod_userdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME, which might allow remote attackers to read arbitrary files, as demonstrated by accessing the ~nobody directory.
CVE-2008-1252 1Deutsche Telekom 1Speedport W500 Dsl Router Apr 23, 2026 Mar 10, 2008 N/A· v4 N/A· v3 10.0 HIGH· v2 b_banner.stm (aka the login page) on the Deutsche Telekom Speedport W500 DSL router allows remote attackers to obtain the logon password by reading the pwd field in the HTML source.
CVE-2008-1181 1Juniper 1Secure Access 2000 Apr 23, 2026 Mar 6, 2008 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Juniper Networks Secure Access 2000 5.5 R1 (build 11711) allows remote attackers to obtain sensitive information via a direct request for remediate.cgi without certain parameters, which reveals the path in an "Execute fa...Show more Juniper Networks Secure Access 2000 5.5 R1 (build 11711) allows remote attackers to obtain sensitive information via a direct request for remediate.cgi without certain parameters, which reveals the path in an "Execute failed" error message.Show less
CVE-2008-1166 1Flyspray 1Flyspray Apr 23, 2026 Mar 5, 2008 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Flyspray 0.9.9.4 generates different error messages depending on whether the username is valid or invalid, which allows remote attackers to enumerate usernames.
CVE-2008-1111 1Lighttpd 1Lighttpd Apr 23, 2026 Mar 4, 2008 N/A· v4 N/A· v3 5.0 MEDIUM· v2 mod_cgi in lighttpd 1.4.18 sends the source code of CGI scripts instead of a 500 error when a fork failure occurs, which might allow remote attackers to obtain sensitive information.
CVE-2008-1135 1Omegasoft 1Interneserviceslosungen Apr 23, 2026 Mar 4, 2008 N/A· v4 N/A· v3 5.0 MEDIUM· v2 OMEGA (aka Omegasoft) INterneSErvicesLosungen (INSEL) 7 generates different responses depending on whether or not a username is valid in a failed login attempt, which allows remote attackers to enumerate valid usernames.
CVE-2007-6702 1Goahead Software 2Fs4104 Aw Device Goahead Webserver Apr 23, 2026 Mar 4, 2008 N/A· v4 N/A· v3 5.0 MEDIUM· v2 goform/QuickStart_c0 on the GoAhead Web Server on the FS4104-AW (aka rooter) VDSL device contains a password in the typepassword field, which allows remote attackers to obtain this password by reading the HTML source, a...Show more goform/QuickStart_c0 on the GoAhead Web Server on the FS4104-AW (aka rooter) VDSL device contains a password in the typepassword field, which allows remote attackers to obtain this password by reading the HTML source, a different vulnerability than CVE-2002-1603.Show less
CVE-2008-1113 1Vocera Communications 1Vocera Communications Badge Apr 23, 2026 Mar 3, 2008 N/A· v4 N/A· v3 7.8 HIGH· v2 Cisco Unified Wireless IP Phone 7921, when using Protected Extensible Authentication Protocol (PEAP), does not validate server certificates, which allows remote wireless access points to steal hashed passwords and conduc...Show more Cisco Unified Wireless IP Phone 7921, when using Protected Extensible Authentication Protocol (PEAP), does not validate server certificates, which allows remote wireless access points to steal hashed passwords and conduct man-in-the-middle (MITM) attacks.Show less
CVE-2008-0978 1Double Take Software 1Double Take Apr 23, 2026 Feb 25, 2008 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Double-Take 5.0.0.2865 and earlier, distributed under the HP StorageWorks Storage Mirroring name and other names, allows remote attackers to obtain sensitive information via a packet of type (1) 0x2728, which provides op...Show more Double-Take 5.0.0.2865 and earlier, distributed under the HP StorageWorks Storage Mirroring name and other names, allows remote attackers to obtain sensitive information via a packet of type (1) 0x2728, which provides operating system and path information; (2) 0x274e, which lists Ethernet adapters; (3) 0x2726, which provides filesystem information; (4) 0x274f, which specifies the printer driver; or (5) 0x2757, which provides recent log entries.Show less
CVE-2008-0938 1Sun 1Solaris Apr 23, 2026 Feb 25, 2008 N/A· v4 N/A· v3 4.7 MEDIUM· v2 Unspecified vulnerability in the dynamic tracing framework (DTrace) in Sun Solaris 10 allows local users with PRIV_DTRACE_USER or PRIV_DTRACE_PROC privileges to obtain sensitive kernel information via unspecified vectors...Show more Unspecified vulnerability in the dynamic tracing framework (DTrace) in Sun Solaris 10 allows local users with PRIV_DTRACE_USER or PRIV_DTRACE_PROC privileges to obtain sensitive kernel information via unspecified vectors, a different vulnerability than CVE-2007-4126.Show less
CVE-2008-0904 1Bea Systems 2Aqualogic Interaction Plumtree Collaboration Apr 23, 2026 Feb 22, 2008 N/A· v4 N/A· v3 7.8 HIGH· v2 Unspecified vulnerability in the download servlet in BEA Plumtree Collaboration 4.1 through SP2 and AquaLogic Interaction 4.2 through MP1 allows remote attackers to read arbitrary files via a crafted URL.
CVE-2008-0901 2Bea Bea Systems 2Weblogic Server Weblogic Server Apr 23, 2026 Feb 22, 2008 N/A· v4 N/A· v3 7.1 HIGH· v2 BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed pa...Show more BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not.Show less
CVE-2008-0863 1Bea 1Weblogic Server Apr 23, 2026 Feb 21, 2008 N/A· v4 N/A· v3 5.0 MEDIUM· v2 BEA WebLogic Server and WebLogic Express 9.0 and 9.1 exposes the web service's WSDL and security policies, which allows remote attackers to obtain sensitive information and potentially launch further attacks.
CVE-2008-0784 1Cacti 1Cacti Apr 23, 2026 Feb 14, 2008 N/A· v4 N/A· v3 5.0 MEDIUM· v2 graph.php in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allows remote attackers to obtain the full path via an invalid local_graph_id parameter and other unspecified vectors.
CVE-2008-0736 1Shoppingtree 1Candypress Store Apr 23, 2026 Feb 13, 2008 N/A· v4 N/A· v3 5.0 MEDIUM· v2 admin/SA_shipFedExMeter.asp in CandyPress (CP) 4.1.1.26, and possibly other 4.x and 3.x versions, allows remote attackers to obtain the path via a certain value of the FedExAccount parameter.
CVE-2008-0636 1Level Platforms 1Managed Workplace Service Center Apr 23, 2026 Feb 12, 2008 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Level Platforms, Inc. (LPI) Managed Workplace Service Center 4.x, 5.x and 6.x allows remote attackers to obtain sensitive information via a direct request to About/SC_About.htm, which provides version and patch informati...Show more Level Platforms, Inc. (LPI) Managed Workplace Service Center 4.x, 5.x and 6.x allows remote attackers to obtain sensitive information via a direct request to About/SC_About.htm, which provides version and patch information.Show less
CVE-2008-0041 1Apple 1Mac Os X Apr 23, 2026 Feb 12, 2008 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Parental Controls in Apple Mac OS X 10.5 through 10.5.1 contacts www.apple.com "when a website is unblocked," which allows remote attackers to determine when a system is running Parental Controls.
CVE-2008-0420 1Mozilla 3Firefox SeamonkeyThunderbird Apr 23, 2026 Feb 12, 2008 N/A· v4 N/A· v3 9.3 HIGH· v2 modules/libpr0n/decoders/bmp/nsBMPDecoder.cpp in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 does not properly perform certain calculations related to the mColors table, which...Show more modules/libpr0n/decoders/bmp/nsBMPDecoder.cpp in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 does not properly perform certain calculations related to the mColors table, which allows remote attackers to read portions of memory uninitialized via a crafted 8-bit bitmap (BMP) file that triggers an out-of-bounds read within the heap, as demonstrated using a CANVAS element; or cause a denial of service (application crash) via a crafted 8-bit bitmap file that triggers an out-of-bounds read. NOTE: the initial public reports stated that this affected Firefox in Ubuntu 6.06 through 7.10.Show less
CVE-2007-5333 1Apache 1Tomcat Apr 23, 2026 Feb 12, 2008 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause se...Show more Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks. NOTE: this issue exists because of an incomplete fix for CVE-2007-3385.Show less

Previous 1...504505506...517 Next