← Back
CWE-200

10,479 CVEs • Abstraction: Class • Likelihood of Exploit: High

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

JSON object

Loading...

CVEs (10,479)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2019-13075
1Torproject
1Tor Browser
Jun 17, 2026
Jun 30, 2019
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
Tor Browser through 8.5.3 has an information exposure vulnerability. It allows remote attackers to detect the browser's language via vectors involving an IFRAME element, because text in that language is included in the t...Show more
Tor Browser through 8.5.3 has an information exposure vulnerability. It allows remote attackers to detect the browser's language via vectors involving an IFRAME element, because text in that language is included in the title attribute of a LINK element for a non-HTML page. This is related to a behavior of Firefox before 68.Show less
CVE-2019-13055
1Logitech
2K360 Firmware
Unifying Receiver Firmware
Jun 17, 2026
Jun 29, 2019
N/A· v4
6.5 MEDIUM· v3
3.3 LOW· v2
Certain Logitech Unifying devices allow attackers to dump AES keys and addresses, leading to the capability of live decryption of Radio Frequency transmissions, as demonstrated by an attack against a Logitech K360 keyboa...Show more
Certain Logitech Unifying devices allow attackers to dump AES keys and addresses, leading to the capability of live decryption of Radio Frequency transmissions, as demonstrated by an attack against a Logitech K360 keyboard.Show less
CVE-2019-10175
1Kubevirt
1Containerized Data Importer
Jun 17, 2026
Jun 28, 2019
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
A flaw was found in the containerized-data-importer in virt-cdi-cloner, version 1.4, where the host-assisted cloning feature does not determine whether the requesting user has permission to access the Persistent Volume C...Show more
A flaw was found in the containerized-data-importer in virt-cdi-cloner, version 1.4, where the host-assisted cloning feature does not determine whether the requesting user has permission to access the Persistent Volume Claim (PVC) in the source namespace. This could allow users to clone any PVC in the cluster into their own namespace, effectively allowing access to other user's data.Show less
CVE-2018-20812
1Pulsesecure
1Pulse Secure Desktop Client
Nov 21, 2024
Jun 28, 2019
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
An information exposure issue where IPv6 DNS traffic would be sent outside of the VPN tunnel (when Traffic Enforcement was enabled) exists in Pulse Secure Pulse Secure Desktop 9.0R1 and below. This is applicable only to...Show more
An information exposure issue where IPv6 DNS traffic would be sent outside of the VPN tunnel (when Traffic Enforcement was enabled) exists in Pulse Secure Pulse Secure Desktop 9.0R1 and below. This is applicable only to dual-stack (IPv4/IPv6) endpoints.Show less
CVE-2018-20811
1Ivanti
1Connect Secure
Nov 21, 2024
Jun 28, 2019
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
A hidden RPC service issue was found with Pulse Secure Pulse Connect Secure 8.3RX before 8.3R2 and 8.1RX before 8.1R12.
CVE-2018-6177
1Google
1Chrome
Jun 17, 2026
Jun 27, 2019
N/A· v4
4.3 MEDIUM· v3
4.3 MEDIUM· v2
Information leak in media engine in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVE-2018-6168
1Google
1Chrome
Jun 17, 2026
Jun 27, 2019
N/A· v4
6.5 MEDIUM· v3
4.3 MEDIUM· v2
Information leak in media engine in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
CVE-2018-6159
1Google
1Chrome
Jun 17, 2026
Jun 27, 2019
N/A· v4
6.5 MEDIUM· v3
4.3 MEDIUM· v2
Insufficient policy enforcement in ServiceWorker in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
CVE-2018-6150
1Google
1Chrome
Jun 17, 2026
Jun 27, 2019
N/A· v4
6.5 MEDIUM· v3
4.3 MEDIUM· v2
Incorrect handling of CORS in ServiceWorker in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVE-2018-6134
1Google
1Chrome
Jun 17, 2026
Jun 27, 2019
N/A· v4
6.5 MEDIUM· v3
4.3 MEDIUM· v2
Information leak in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to bypass no-referrer policy via a crafted HTML page.
CVE-2018-20073
1Google
1Chrome
Nov 21, 2024
Jun 27, 2019
N/A· v4
5.5 MEDIUM· v3
2.1 LOW· v2
Use of extended attributes in downloads in Google Chrome prior to 72.0.3626.81 allowed a local attacker to read download URLs via the filesystem.
CVE-2018-1734
1Ibm
8Rational Collaborative Lifecycle Management
Rational Doors Next GenerationRational Engineering Lifecycle Manager+5 more
Nov 21, 2024
Jun 27, 2019
N/A· v4
4.3 MEDIUM· v3
4.0 MEDIUM· v2
IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1 discloses sensitive information in error messages that may be used by a malicious user to orchestrate further attacks. IBM X-Force ID: 147838.
CVE-2018-2013
1Ibm
1Api Connect
Nov 21, 2024
Jun 25, 2019
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
IBM API Connect 2018.1 through 2018.4.1.5 could disclose sensitive information to an unauthorized user that could aid in further attacks against the system. IBM X-Force ID: 155193.
CVE-2018-2011
1Ibm
1Api Connect
Nov 21, 2024
Jun 25, 2019
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
IBM API Connect 2018.1 through 2018.4.1.5 could allow an attacker to obtain sensitive information from a specially crafted HTTP request that could aid an attacker in further attacks against the system. IBM X-Force ID: 15...Show more
IBM API Connect 2018.1 through 2018.4.1.5 could allow an attacker to obtain sensitive information from a specially crafted HTTP request that could aid an attacker in further attacks against the system. IBM X-Force ID: 155150.Show less
CVE-2014-9699
1Makerbot
1Replicator 5th Generation Firmware
Nov 21, 2024
Jun 24, 2019
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
The MakerBot Replicator 5G printer runs an Apache HTTP Server with directory indexing enabled. Apache logs, system logs, design files (i.e., a history of print files), and more are exposed to unauthenticated attackers th...Show more
The MakerBot Replicator 5G printer runs an Apache HTTP Server with directory indexing enabled. Apache logs, system logs, design files (i.e., a history of print files), and more are exposed to unauthenticated attackers through this HTTP server.Show less
CVE-2019-11648
1Netiq
1Self Service Password Reset
Jun 17, 2026
Jun 24, 2019
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
An information leakage exists in Micro Focus NetIQ Self Service Password Reset Software all versions prior to version 4.4. The vulnerability could be exploited to expose sensitive information.
CVE-2018-15665
1Cloudera
1Data Science Workbench
Nov 21, 2024
Jun 21, 2019
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
An issue was discovered in Cloudera Data Science Workbench (CDSW) 1.2.x through 1.4.0. Unauthenticated users can get a list of user accounts.
CVE-2016-7404
1Openstack
1Magnum
Nov 21, 2024
Jun 21, 2019
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
OpenStack Magnum passes OpenStack credentials into the Heat templates creating its instances. While these should just be used for retrieving the instances' SSL certificates, they allow full API access, though and can be...Show more
OpenStack Magnum passes OpenStack credentials into the Heat templates creating its instances. While these should just be used for retrieving the instances' SSL certificates, they allow full API access, though and can be used to perform any API operation the user is authorized to perform.Show less
CVE-2019-11233
1Eic
1Biyan
Jun 17, 2026
Jun 19, 2019
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
EXCELLENT INFOTEK BiYan v1.57 ~ v2.8 allows an attacker to leak user information without being authenticated, by sending a LOGIN_ID element to the auth/main/asp/check_user_login_info.aspx URI, and then reading the respon...Show more
EXCELLENT INFOTEK BiYan v1.57 ~ v2.8 allows an attacker to leak user information without being authenticated, by sending a LOGIN_ID element to the auth/main/asp/check_user_login_info.aspx URI, and then reading the response, as demonstrated by the KW_EMAIL or KW_TEL field.Show less
CVE-2017-1107
1Ibm
1Marketing Platform
Nov 21, 2024
Jun 19, 2019
N/A· v4
4.3 MEDIUM· v3
4.0 MEDIUM· v2
IBM Marketing Platform 9.1.0, 9.1.2, 10.0, and 10.1 exposes sensitive information in the headers that could be used by an authenticated attacker in further attacks against the system. IBM X-Force ID: 120906.