Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CVEs (11,534)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2012-1579 1Mediawiki 1Mediawiki Apr 29, 2026 Sep 9, 2012 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The resource loader in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 includes private data such as CSRF tokens in a JavaScript file, which allows remote attackers to obtain sensitive information.
CVE-2012-4012 1Cybozu 1Kunai Apr 29, 2026 Sep 8, 2012 N/A· v4 N/A· v3 4.3 MEDIUM· v2 The WebView class in the Cybozu KUNAI application before 2.0.6 for Android allows remote attackers to execute arbitrary JavaScript code, and obtain sensitive information, via a crafted application that places this code i...Show more The WebView class in the Cybozu KUNAI application before 2.0.6 for Android allows remote attackers to execute arbitrary JavaScript code, and obtain sensitive information, via a crafted application that places this code into a local file associated with a file: URL.Show less
CVE-2012-0837 1Joomla 1Joomla Apr 29, 2026 Sep 6, 2012 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Joomla! 1.7.x before 1.7.5 and 2.5.x before 2.5.1 allows attackers to obtain the installation path via unspecified vectors related to "administrator."
CVE-2012-4390 1Owncloud 2Owncloud Owncloud Server Apr 29, 2026 Sep 5, 2012 N/A· v4 N/A· v3 4.0 MEDIUM· v2 (1) apps/calendar/appinfo/remote.php and (2) apps/contacts/appinfo/remote.php in ownCloud before 4.0.7 allows remote authenticated users to enumerate the registered users via unspecified vectors.
CVE-2012-3529 1Typo3 1Typo3 Apr 29, 2026 Sep 5, 2012 N/A· v4 N/A· v3 3.5 LOW· v2 The configuration module in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to obtain the encryption key via unspecified vectors.
CVE-2012-1614 1Coppermine Gallery 1Coppermine Photo Gallery Apr 29, 2026 Sep 4, 2012 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Coppermine Photo Gallery before 1.5.20 allows remote attackers to obtain sensitive information via (1) a direct request to plugins/visiblehookpoints/index.php, an invalid (2) page or (3) cat parameter to thumbnails.php,...Show more Coppermine Photo Gallery before 1.5.20 allows remote attackers to obtain sensitive information via (1) a direct request to plugins/visiblehookpoints/index.php, an invalid (2) page or (3) cat parameter to thumbnails.php, an invalid (4) page parameter to usermgr.php, or an invalid (5) newer_than or (6) older_than parameter to search.inc.php, which reveals the installation path in an error message.Show less
CVE-2012-1607 1Typo3 1Typo3 Apr 29, 2026 Sep 4, 2012 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The Command Line Interface (CLI) script in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to obtain the database name via a direct request.
CVE-2012-3976 5Canonical MozillaOpensuse+2 more 12Enterprise Linux Desktop Enterprise Linux EusEnterprise Linux Server+9 more Apr 29, 2026 Aug 29, 2012 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, and SeaMonkey before 2.12 do not properly handle onLocationChange events during navigation between different https sites, which allows remote attackers to spoo...Show more Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, and SeaMonkey before 2.12 do not properly handle onLocationChange events during navigation between different https sites, which allows remote attackers to spoof the X.509 certificate information in the address bar via a crafted web page.Show less
CVE-2012-3975 1Mozilla 3Firefox SeamonkeyThunderbird Apr 29, 2026 Aug 29, 2012 N/A· v4 N/A· v3 4.3 MEDIUM· v2 The DOMParser component in Mozilla Firefox before 15.0, Thunderbird before 15.0, and SeaMonkey before 2.12 loads subresources during parsing of text/html data within an extension, which allows remote attackers to obtain...Show more The DOMParser component in Mozilla Firefox before 15.0, Thunderbird before 15.0, and SeaMonkey before 2.12 loads subresources during parsing of text/html data within an extension, which allows remote attackers to obtain sensitive information by providing crafted data to privileged extension code.Show less
CVE-2012-3972 6Canonical DebianMozilla+3 more 15Debian Linux Enterprise Linux DesktopEnterprise Linux Eus+12 more Apr 29, 2026 Aug 29, 2012 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The format-number functionality in the XSLT implementation in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows rem...Show more The format-number functionality in the XSLT implementation in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to obtain sensitive information via unspecified vectors that trigger a heap-based buffer over-read.Show less
CVE-2012-3581 1Symantec 1Messaging Gateway Apr 29, 2026 Aug 29, 2012 N/A· v4 N/A· v3 3.3 LOW· v2 Symantec Messaging Gateway (SMG) before 10.0 allows remote attackers to obtain potentially sensitive information about component versions via unspecified vectors.
CVE-2012-1645 1Wimleers 1Cdn Apr 29, 2026 Aug 28, 2012 N/A· v4 N/A· v3 2.6 LOW· v2 The CDN module 6.x-2.2 and 7.x-2.2 for Drupal, when running in Origin Pull mode with the "Far Future expiration" option enabled, allows remote attackers to read arbitrary PHP files via unspecified vectors, as demonstrate...Show more The CDN module 6.x-2.2 and 7.x-2.2 for Drupal, when running in Origin Pull mode with the "Far Future expiration" option enabled, allows remote attackers to read arbitrary PHP files via unspecified vectors, as demonstrated by reading settings.php.Show less
CVE-2012-3419 1Sgi 1Performance Co Pilot Apr 29, 2026 Aug 27, 2012 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Performance Co-Pilot (PCP) before 3.6.5 exports some of the /proc file system, which allows attackers to obtain sensitive information such as proc/pid/maps and command line arguments.
CVE-2012-1586 1Debian 1Cifs Utils Apr 29, 2026 Aug 27, 2012 N/A· v4 N/A· v3 2.1 LOW· v2 mount.cifs in cifs-utils 2.6 allows local users to determine the existence of arbitrary files or directories via the file path in the second argument, which reveals their existence in an error message.
CVE-2011-5126 1Bluecoat 1Sgos Apr 29, 2026 Aug 26, 2012 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Blue Coat ProxySG 6.1 before SGOS 6.1.5.1 and 6.2 before SGOS 6.2.2.1 writes the secure heap to core images, which allows context-dependent attackers to obtain sensitive authentication information by leveraging read acce...Show more Blue Coat ProxySG 6.1 before SGOS 6.1.5.1 and 6.2 before SGOS 6.2.2.1 writes the secure heap to core images, which allows context-dependent attackers to obtain sensitive authentication information by leveraging read access to a downloaded core file.Show less
CVE-2012-4674 1Pluxml 1Pluxml Apr 29, 2026 Aug 26, 2012 N/A· v4 N/A· v3 5.0 MEDIUM· v2 PluXml before 5.1.6 allows remote attackers to obtain the installation path via the PHPSESSID.
CVE-2010-5188 1Silverstripe 1Silverstripe Apr 29, 2026 Aug 26, 2012 N/A· v4 N/A· v3 5.0 MEDIUM· v2 SilverStripe 2.3.x before 2.3.6 allows remote attackers to obtain sensitive information via the (1) debug_memory parameter to core/control/Director.php or (2) debug_profile parameter to main.php.
CVE-2010-5187 1Silverstripe 1Silverstripe Apr 29, 2026 Aug 26, 2012 N/A· v4 N/A· v3 4.3 MEDIUM· v2 SilverStripe 2.3.x before 2.3.8 and 2.4.x before 2.4.1, when running on servers with certain configurations, allows remote attackers to obtain sensitive information via a direct request to PHP files in the (1) sapphire,...Show more SilverStripe 2.3.x before 2.3.8 and 2.4.x before 2.4.1, when running on servers with certain configurations, allows remote attackers to obtain sensitive information via a direct request to PHP files in the (1) sapphire, (2) cms, or (3) mysite folders, which reveals the installation path in an error message.Show less
CVE-2012-3519 1Tor 1Tor Apr 29, 2026 Aug 26, 2012 N/A· v4 N/A· v3 5.0 MEDIUM· v2 routerlist.c in Tor before 0.2.2.38 uses a different amount of time for relay-list iteration depending on which relay is chosen, which might allow remote attackers to obtain sensitive information about relay selection vi...Show more routerlist.c in Tor before 0.2.2.38 uses a different amount of time for relay-list iteration depending on which relay is chosen, which might allow remote attackers to obtain sensitive information about relay selection via a timing side-channel attack.Show less
CVE-2012-4605 1Websense 1Websense Email Security Apr 29, 2026 Aug 23, 2012 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The default configuration of the SMTP component in Websense Email Security 6.1 through 7.3 enables weak SSL ciphers in the "SurfControl plc\SuperScout Email Filter\SMTP" registry key, which makes it easier for remote att...Show more The default configuration of the SMTP component in Websense Email Security 6.1 through 7.3 enables weak SSL ciphers in the "SurfControl plc\SuperScout Email Filter\SMTP" registry key, which makes it easier for remote attackers to obtain sensitive information by sniffing the network and then conducting a brute-force attack against encrypted session data.Show less

Previous 1...518519520...577 Next