← Back
CWE-200

11,535 CVEs • Abstraction: Class • Likelihood of Exploit: High

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

JSON object

Loading...

CVEs (11,535)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2012-0959
1Remote Login Service Hackers
1Remote Login Service
Apr 29, 2026
Nov 24, 2012
N/A· v4
N/A· v3
2.1 LOW· v2
Remote Login Service (RLS) 1.0.0 does not properly clear account information when switching users, which might allow physically proximate users to obtain login credentials.
CVE-2012-4411
1Xen
1Xen
Apr 29, 2026
Nov 23, 2012
N/A· v4
N/A· v3
4.6 MEDIUM· v2
The graphical console in Xen 4.0, 4.1 and 4.2 allows local OS guest administrators to obtain sensitive host resource information via the qemu monitor. NOTE: this might be a duplicate of CVE-2007-0998.
CVE-2012-0818
1Redhat
1Resteasy
Apr 29, 2026
Nov 23, 2012
N/A· v4
N/A· v3
5.0 MEDIUM· v2
RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity (XXE) injection attack.
CVE-2011-5245
1Redhat
1Resteasy
Apr 29, 2026
Nov 23, 2012
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, a...Show more
The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.Show less
CVE-2012-5473
1Moodle
1Moodle
Apr 29, 2026
Nov 21, 2012
N/A· v4
N/A· v3
4.0 MEDIUM· v2
The Database activity module in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and 2.3.x before 2.3.3 allows remote authenticated users to read activity entries of a different group's users via an advanced search.
CVE-2012-4208
4Canonical
MozillaOpensuse+1 more
8Firefox
Linux Enterprise DesktopLinux Enterprise Server+5 more
Apr 29, 2026
Nov 21, 2012
N/A· v4
N/A· v3
4.3 MEDIUM· v2
The XrayWrapper implementation in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 does not consider the compartment during property filtering, which allows remote attackers to bypass inten...Show more
The XrayWrapper implementation in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 does not consider the compartment during property filtering, which allows remote attackers to bypass intended chrome-only restrictions on reading DOM object properties via a crafted web site.Show less
CVE-2012-3354
2Dokuwiki
Fedoraproject
2Dokuwiki
Fedora
Apr 29, 2026
Nov 20, 2012
N/A· v4
N/A· v3
4.3 MEDIUM· v2
doku.php in DokuWiki, as used in Fedora 16, 17, and 18, when certain PHP error levels are set, allows remote attackers to obtain sensitive information via the prefix parameter, which reveals the installation path in an e...Show more
doku.php in DokuWiki, as used in Fedora 16, 17, and 18, when certain PHP error levels are set, allows remote attackers to obtain sensitive information via the prefix parameter, which reveals the installation path in an error message.Show less
CVE-2012-5916
1Neocrome
1Seditio
Apr 29, 2026
Nov 17, 2012
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Neocrome Seditio build 161 allows remote attackers to obtain sensitive information via a direct request to (1) docs/new/seditio-createnew-160.sql, (2) docs/upgrade/sedito_convert_to_utf8.optional.sql, or (3) system/insta...Show more
Neocrome Seditio build 161 allows remote attackers to obtain sensitive information via a direct request to (1) docs/new/seditio-createnew-160.sql, (2) docs/upgrade/sedito_convert_to_utf8.optional.sql, or (3) system/install/install.parser.sql.Show less
CVE-2012-5915
1Neocrome
1Seditio
Apr 29, 2026
Nov 17, 2012
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Neocrome Seditio build 161 and earlier allows remote attackers to obtain sensitive information via direct request to (1) view.php, (2) plugins/contact/lang/contact.en.lang.php, (3) system/lang/en/main.lang.php, (4) syste...Show more
Neocrome Seditio build 161 and earlier allows remote attackers to obtain sensitive information via direct request to (1) view.php, (2) plugins/contact/lang/contact.en.lang.php, (3) system/lang/en/main.lang.php, (4) system/lang/en/message.lang.php, or (5) system/core/view/view.inc.php, which reveals the installation path in an error message.Show less
CVE-2012-5890
1Stanislas Rolland
1Sr Feuser Register
Apr 29, 2026
Nov 17, 2012
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The Front End User Registration (sr_feuser_register) extension before 2.6.2 for TYPO3 allows remote attackers to obtain user names and passwords via the (1) edit perspective or (2) autologin feature.
CVE-2012-5172
1Asial
1Monaca Debugger
Apr 29, 2026
Nov 16, 2012
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The Asial Monaca Debugger application before 1.4.2 for Android allows remote attackers to obtain sensitive (1) account or (2) session ID information in a system log file via a crafted application.
CVE-2012-5884
1Mozilla
1Bugzilla
Apr 29, 2026
Nov 16, 2012
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The User.get method in Bugzilla/WebService/User.pm in Bugzilla 4.3.2 allows remote attackers to obtain sensitive information about the saved searches of arbitrary users via an XMLRPC request or a JSONRPC request, a diffe...Show more
The User.get method in Bugzilla/WebService/User.pm in Bugzilla 4.3.2 allows remote attackers to obtain sensitive information about the saved searches of arbitrary users via an XMLRPC request or a JSONRPC request, a different vulnerability than CVE-2012-4198.Show less
CVE-2012-4199
1Mozilla
1Bugzilla
Apr 29, 2026
Nov 16, 2012
N/A· v4
N/A· v3
4.3 MEDIUM· v2
template/en/default/bug/field-events.js.tmpl in Bugzilla 3.x before 3.6.12, 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1 generates JavaScript function calls containing pri...Show more
template/en/default/bug/field-events.js.tmpl in Bugzilla 3.x before 3.6.12, 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1 generates JavaScript function calls containing private product names or private component names in certain circumstances involving custom-field visibility control, which allows remote attackers to obtain sensitive information by reading HTML source code.Show less
CVE-2012-4198
1Mozilla
1Bugzilla
Apr 29, 2026
Nov 16, 2012
N/A· v4
N/A· v3
4.0 MEDIUM· v2
The User.get method in Bugzilla/WebService/User.pm in Bugzilla 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1 has a different outcome for a groups request depending on wheth...Show more
The User.get method in Bugzilla/WebService/User.pm in Bugzilla 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1 has a different outcome for a groups request depending on whether a group exists, which allows remote authenticated users to discover private group names by observing whether a call throws an error.Show less
CVE-2012-4197
1Mozilla
1Bugzilla
Apr 29, 2026
Nov 16, 2012
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Bugzilla/Attachment.pm in attachment.cgi in Bugzilla 2.x and 3.x before 3.6.12, 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1 allows remote attackers to read attachment des...Show more
Bugzilla/Attachment.pm in attachment.cgi in Bugzilla 2.x and 3.x before 3.6.12, 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1 allows remote attackers to read attachment descriptions from private bugs via an obsolete=1 insert action.Show less
CVE-2012-2532
1Microsoft
1Ftp Service
Apr 29, 2026
Nov 14, 2012
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Microsoft FTP Service 7.0 and 7.5 for Internet Information Services (IIS) processes unspecified commands before TLS is enabled for a session, which allows remote attackers to obtain sensitive information by reading the r...Show more
Microsoft FTP Service 7.0 and 7.5 for Internet Information Services (IIS) processes unspecified commands before TLS is enabled for a session, which allows remote attackers to obtain sensitive information by reading the replies to these commands, aka "FTP Command Injection Vulnerability."Show less
CVE-2012-2531
-
-
Apr 29, 2026
Nov 14, 2012
N/A· v4
N/A· v3
2.1 LOW· v2
Microsoft Internet Information Services (IIS) 7.5 uses weak permissions for the Operational log, which allows local users to discover credentials by reading this file, aka "Password Disclosure Vulnerability."
CVE-2012-1896
1Microsoft
1.net Framework
Apr 29, 2026
Nov 14, 2012
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not properly consider trust levels during construction of output data, which allows remote attackers to obtain sensitive information via (1) a crafted XAML browser applicat...Show more
Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not properly consider trust levels during construction of output data, which allows remote attackers to obtain sensitive information via (1) a crafted XAML browser application (aka XBAP) or (2) a crafted .NET Framework application, aka "Code Access Security Info Disclosure Vulnerability."Show less
CVE-2012-1812
1C3 Ilex
1Eoscada
Apr 29, 2026
Nov 13, 2012
N/A· v4
N/A· v3
5.0 MEDIUM· v2
eosfailoverservice.exe in C3-ilex EOScada before 11.0.19.2 allows remote attackers to obtain sensitive cleartext information via a session on TCP port 12000.
CVE-2012-3749
1Apple
1Iphone Os
Apr 29, 2026
Nov 3, 2012
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The extensions APIs in the kernel in Apple iOS before 6.0.1 provide kernel addresses in responses that contain an OSBundleMachOHeaders key, which makes it easier for remote attackers to bypass the ASLR protection mechani...Show more
The extensions APIs in the kernel in Apple iOS before 6.0.1 provide kernel addresses in responses that contain an OSBundleMachOHeaders key, which makes it easier for remote attackers to bypass the ASLR protection mechanism via a crafted app.Show less