Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CVEs (11,533)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2012-3502 1Apache 1Http Server Apr 29, 2026 Aug 22, 2012 N/A· v4 N/A· v3 4.3 MEDIUM· v2 The proxy functionality in (1) mod_proxy_ajp.c in the mod_proxy_ajp module and (2) mod_proxy_http.c in the mod_proxy_http module in the Apache HTTP Server 2.4.x before 2.4.3 does not properly determine the situations tha...Show more The proxy functionality in (1) mod_proxy_ajp.c in the mod_proxy_ajp module and (2) mod_proxy_http.c in the mod_proxy_http module in the Apache HTTP Server 2.4.x before 2.4.3 does not properly determine the situations that require closing a back-end connection, which allows remote attackers to obtain sensitive information in opportunistic circumstances by reading a response that was intended for a different client.Show less
CVE-2012-4591 1Mcafee 1Enterprise Mobility Manager Apr 29, 2026 Aug 22, 2012 N/A· v4 N/A· v3 5.0 MEDIUM· v2 About.aspx in the Portal in McAfee Enterprise Mobility Manager (EMM) before 10.0 discloses the name of the user account for an IIS worker process, which allows remote attackers to obtain potentially sensitive information...Show more About.aspx in the Portal in McAfee Enterprise Mobility Manager (EMM) before 10.0 discloses the name of the user account for an IIS worker process, which allows remote attackers to obtain potentially sensitive information by visiting this page.Show less
CVE-2012-4583 1Mcafee 2Email And Web Security Email Gateway Apr 29, 2026 Aug 22, 2012 N/A· v4 N/A· v3 4.0 MEDIUM· v2 McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1, allows remote authenticated users to obtain the session tokens of arbitrary users by n...Show more McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1, allows remote authenticated users to obtain the session tokens of arbitrary users by navigating within the Dashboard.Show less
CVE-2009-5117 1Mcafee 1Host Data Loss Prevention Apr 29, 2026 Aug 22, 2012 N/A· v4 N/A· v3 1.9 LOW· v2 The Web Post Protection feature in McAfee Host Data Loss Prevention (DLP) 3.x before 3.0.100.10 and 9.x before 9.0.0.422, when HTTP Capture mode is enabled, allows local users to obtain sensitive information from web tra...Show more The Web Post Protection feature in McAfee Host Data Loss Prevention (DLP) 3.x before 3.0.100.10 and 9.x before 9.0.0.422, when HTTP Capture mode is enabled, allows local users to obtain sensitive information from web traffic by reading unspecified files.Show less
CVE-2012-4168 1Adobe 3Air Air SdkFlash Player Apr 29, 2026 Aug 21, 2012 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Adobe Flash Player before 10.3.183.23 and 11.x before 11.4.402.265 on Windows and Mac OS X, before 10.3.183.23 and 11.x before 11.2.202.238 on Linux, before 11.1.111.16 on Android 2.x and 3.x, and before 11.1.115.17 on A...Show more Adobe Flash Player before 10.3.183.23 and 11.x before 11.4.402.265 on Windows and Mac OS X, before 10.3.183.23 and 11.x before 11.2.202.238 on Linux, before 11.1.111.16 on Android 2.x and 3.x, and before 11.1.115.17 on Android 4.x; Adobe AIR before 3.4.0.2540; and Adobe AIR SDK before 3.4.0.2540 allow remote attackers to read content from a different domain via a crafted web site.Show less
CVE-2012-4219 1Phpmyadmin 1Phpmyadmin Apr 29, 2026 Aug 21, 2012 N/A· v4 N/A· v3 5.0 MEDIUM· v2 show_config_errors.php in phpMyAdmin 3.5.x before 3.5.2.1 allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message, related to lack of inclusio...Show more show_config_errors.php in phpMyAdmin 3.5.x before 3.5.2.1 allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message, related to lack of inclusion of the common.inc.php library file.Show less
CVE-2012-2387 1Debian 1Devotee Apr 29, 2026 Aug 20, 2012 N/A· v4 N/A· v3 5.0 MEDIUM· v2 devotee 0.1 patch 2 uses a 32-bit seed for generating 48-bit random numbers, which makes it easier for remote attackers to obtain the secret monikers via a brute force attack.
CVE-2012-4007 1Mixi 1Mixi Apr 29, 2026 Aug 17, 2012 N/A· v4 N/A· v3 4.3 MEDIUM· v2 The mixi application before 4.3.0 for Android allows remote attackers to read potentially sensitive information in friends' comments via a crafted application that leverages the storage of these comments on an SD card.
CVE-2012-4006 2Gree Kddi & Gree 8Gree Gree MarketHaconiwa+5 more Apr 29, 2026 Aug 17, 2012 N/A· v4 N/A· v3 4.3 MEDIUM· v2 The GREE application before 1.4.0, GREE Tanken Dorirando application before 1.0.7, GREE Tsurisuta application before 1.5.0, GREE Monpura application before 1.1.1, GREE Kaizokuoukoku Columbus application before 1.3.5, GRE...Show more The GREE application before 1.4.0, GREE Tanken Dorirando application before 1.0.7, GREE Tsurisuta application before 1.5.0, GREE Monpura application before 1.1.1, GREE Kaizokuoukoku Columbus application before 1.3.5, GREE haconiwa application before 1.1.0, GREE Seisen Cerberus application before 1.1.0, and KDDI&GREE GREE Market application before 2.1.2 for Android do not properly implement the WebView class, which allows remote attackers to obtain sensitive information via a crafted application.Show less
CVE-2012-2168 1Ibm 1Rational Clearquest Apr 29, 2026 Aug 17, 2012 N/A· v4 N/A· v3 4.0 MEDIUM· v2 IBM Rational ClearQuest 7.1.x before 7.1.2.7 and 8.x before 8.0.0.3 allows remote authenticated users to obtain sensitive stack-trace information from CM server error messages via an invalid parameter.
CVE-2012-2165 1Ibm 1Rational Clearquest Apr 29, 2026 Aug 17, 2012 N/A· v4 N/A· v3 3.5 LOW· v2 IBM Rational ClearQuest 7.1.x before 7.1.2.7 and 8.x before 8.0.0.3, when ClearQuest Authentication is enabled, allows remote authenticated users to read password hashes via a user query.
CVE-2012-0744 1Ibm 1Rational Clearquest Apr 29, 2026 Aug 17, 2012 N/A· v4 N/A· v3 5.0 MEDIUM· v2 IBM Rational ClearQuest 7.1.x through 7.1.2.7 and 8.x through 8.0.0.3 allows remote attackers to obtain potentially sensitive information via a request to a (1) snoop, (2) hello, (3) ivt/, (4) hitcount, (5) HitCount.jsp,...Show more IBM Rational ClearQuest 7.1.x through 7.1.2.7 and 8.x through 8.0.0.3 allows remote attackers to obtain potentially sensitive information via a request to a (1) snoop, (2) hello, (3) ivt/, (4) hitcount, (5) HitCount.jsp, (6) HelloHTMLError.jsp, (7) HelloHTML.jsp, (8) HelloVXMLError.jsp, (9) HelloVXML.jsp, (10) HelloWMLError.jsp, (11) HelloWML.jsp, or (12) cqweb/j_security_check sample script.Show less
CVE-2012-3249 1Hp 1Fortify Software Security Center Apr 29, 2026 Aug 16, 2012 N/A· v4 N/A· v3 4.0 MEDIUM· v2 HP Fortify Software Security Center 3.1, 3.3, 3.4, and 3.5 allows remote authenticated users to obtain sensitive information via unspecified vectors.
CVE-2012-3248 1Hp 1Fortify Software Security Center Apr 29, 2026 Aug 16, 2012 N/A· v4 N/A· v3 5.0 MEDIUM· v2 HP Fortify Software Security Center 3.1, 3.3, 3.4, and 3.5 allows remote attackers to obtain sensitive information via unspecified vectors.
CVE-2012-4332 1Barandisolutions 1Shareyourcart Apr 29, 2026 Aug 14, 2012 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The ShareYourCart plugin 1.7.1 for WordPress allows remote attackers to obtain the installation path via unspecified vectors related to the SDK.
CVE-2012-4257 1George Karpouzas 1Yet Another Question & Answer System Apr 29, 2026 Aug 13, 2012 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Yaqas (Yet Another Question & Answer System) 1.0 Alpha 1 allows remote attackers to obtain sensitive information via an invalid character in the PHPSESSID, which reveals the installation path in an error message.
CVE-2012-4256 1Joobi 1Com Jnews Apr 29, 2026 Aug 13, 2012 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The jNews (com_jnews) component 7.5.1 for Joomla! allows remote attackers to obtain sensitive information via the emailsearch parameter, which reveals the installation path in an error message.
CVE-2012-4255 1Mysqldumper 1Mysqldumper Apr 29, 2026 Aug 13, 2012 N/A· v4 N/A· v3 4.3 MEDIUM· v2 MySQLDumper 1.24.4 allows remote attackers to obtain sensitive information via a direct request to learn/cubemail/refresh_dblist.php, which reveals the installation path in an error message.
CVE-2012-4254 1Mysqldumper 1Mysqldumper Apr 29, 2026 Aug 13, 2012 N/A· v4 N/A· v3 4.3 MEDIUM· v2 MySQLDumper 1.24.4 allows remote attackers to obtain sensitive information (Notices) via a direct request to (1) learn/cubemail/restore.php or (2) learn/cubemail/dump.php.
CVE-2012-2327 1Mybb 1Mybb Apr 29, 2026 Aug 13, 2012 N/A· v4 N/A· v3 5.0 MEDIUM· v2 MyBB (aka MyBulletinBoard) before 1.6.7 allows remote attackers to obtain sensitive information via a malformed forumread cookie, which reveals the installation path in an error message.

Previous 1...519520521...577 Next