Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CVEs (10,487)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2018-1000410 1Jenkins 1Jenkins Nov 21, 2024 Jan 9, 2019 N/A· v4 7.8 HIGH· v3 2.1 LOW· v2 An information exposure vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier, and the Stapler framework used by these releases, in core/src/main/java/org/kohsuke/stapler/RequestImpl.java, core/src/m...Show more An information exposure vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier, and the Stapler framework used by these releases, in core/src/main/java/org/kohsuke/stapler/RequestImpl.java, core/src/main/java/hudson/model/Descriptor.java that allows attackers with Overall/Administer permission or access to the local file system to obtain credentials entered by users if the form submission could not be successfully processed.Show less
CVE-2018-6179 3Debian GoogleRedhat 5Chrome Debian LinuxEnterprise Linux Desktop+2 more Jun 17, 2026 Jan 9, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Insufficient enforcement of file access permission in the activeTab case in Extensions in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious extension to access files on t...Show more Insufficient enforcement of file access permission in the activeTab case in Extensions in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious extension to access files on the local file system via a crafted Chrome Extension.Show less
CVE-2018-6164 3Debian GoogleRedhat 5Chrome Debian LinuxEnterprise Linux Desktop+2 more Jun 17, 2026 Jan 9, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Insufficient origin checks for CSS content in Blink in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVE-2018-6147 3Debian GoogleRedhat 5Chrome Debian LinuxEnterprise Linux Desktop+2 more Jun 17, 2026 Jan 9, 2019 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 Lack of secure text entry mode in Browser UI in Google Chrome on Mac prior to 67.0.3396.62 allowed a local attacker to obtain potentially sensitive information from process memory via a local process.
CVE-2018-6137 3Debian GoogleRedhat 5Chrome Debian LinuxEnterprise Linux Desktop+2 more Jun 17, 2026 Jan 9, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 CSS Paint API in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVE-2018-6117 3Debian GoogleRedhat 5Chrome Debian LinuxEnterprise Linux Desktop+2 more Jun 17, 2026 Jan 9, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Confusing settings in Autofill in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
CVE-2018-6109 3Debian GoogleRedhat 5Chrome Debian LinuxEnterprise Linux Desktop+2 more Jun 17, 2026 Jan 9, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 readAsText() can indefinitely read the file picked by the user, rather than only once at the time the file is picked in File API in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to access data on the use...Show more readAsText() can indefinitely read the file picked by the user, rather than only once at the time the file is picked in File API in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to access data on the user file system without explicit consent via a crafted HTML page.Show less
CVE-2018-6093 3Debian GoogleRedhat 5Chrome Debian LinuxEnterprise Linux Desktop+2 more Jun 17, 2026 Jan 9, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Insufficient origin checks in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVE-2018-16078 2Google Redhat 4Chrome Enterprise Linux DesktopEnterprise Linux Server+1 more Nov 21, 2024 Jan 9, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Unsafe handling of credit card details in Autofill in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
CVE-2019-0545 1Microsoft 2.net Core .net Framework Jun 17, 2026 Jan 8, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An information disclosure vulnerability exists in .NET Framework and .NET Core which allows bypassing Cross-origin Resource Sharing (CORS) configurations, aka ".NET Framework Information Disclosure Vulnerability." This a...Show more An information disclosure vulnerability exists in .NET Framework and .NET Core which allows bypassing Cross-origin Resource Sharing (CORS) configurations, aka ".NET Framework Information Disclosure Vulnerability." This affects Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.6, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.7/4.7.1/4.7.2, .NET Core 2.1, Microsoft .NET Framework 4.7.1/4.7.2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, .NET Core 2.2, Microsoft .NET Framework 4.7.2.Show less
CVE-2018-1993 1Ibm 1Spectrum Scale Nov 21, 2024 Jan 8, 2019 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 IBM Spectrum Scale (GPFS) 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.2.3, and 5.0.0 where the use of Local Read Only Cache (LROC) is enabled may caused read operation on a file to return data from a different file. IBM X-Force ID: 15...Show more IBM Spectrum Scale (GPFS) 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.2.3, and 5.0.0 where the use of Local Read Only Cache (LROC) is enabled may caused read operation on a file to return data from a different file. IBM X-Force ID: 154440.Show less
CVE-2018-1932 1Ibm 1Api Connect Nov 21, 2024 Jan 8, 2019 N/A· v4 4.9 MEDIUM· v3 4.0 MEDIUM· v2 IBM API Connect 5.0.0.0 through 5.0.8.4 is affected by a vulnerability in the role-based access control in the management server that could allow an authenticated user to obtain highly sensitive information. IBM X-Force...Show more IBM API Connect 5.0.0.0 through 5.0.8.4 is affected by a vulnerability in the role-based access control in the management server that could allow an authenticated user to obtain highly sensitive information. IBM X-Force ID: 153175.Show less
CVE-2018-3986 1Telegram 1Telegram Nov 21, 2024 Jan 3, 2019 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 An exploitable information disclosure vulnerability exists in the "Secret Chats" functionality of the Telegram Android messaging application version 4.9.0. The "Secret Chats" functionality allows a user to delete all tra...Show more An exploitable information disclosure vulnerability exists in the "Secret Chats" functionality of the Telegram Android messaging application version 4.9.0. The "Secret Chats" functionality allows a user to delete all traces of a chat, either by using a time trigger or by direct request. There is a bug in this functionality that leaves behind photos taken and shared on the secret chats, even after the chats are deleted. These photos will be stored in the device and accessible to all applications installed on the Android device.Show less
CVE-2018-16870 1Wolfssl 1Wolfssl Nov 21, 2024 Jan 3, 2019 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 It was found that wolfssl before 3.15.7 is vulnerable to a new variant of the Bleichenbacher attack to perform downgrade attacks against TLS. This may lead to leakage of sensible data.
CVE-2018-16876 4Canonical DebianRedhat+1 more 9Ansible Ansible EngineDebian Linux+6 more Nov 21, 2024 Jan 3, 2019 N/A· v4 5.3 MEDIUM· v3 3.5 LOW· v2 ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible data.
CVE-2017-18326 1Qualcomm 34Mdm9607 Firmware Mdm9615 FirmwareMdm9625 Firmware+31 more Nov 21, 2024 Jan 3, 2019 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 Cryptographic keys are printed in modem debug messages in snapdragon mobile and snapdragon wear in versions MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 410/...Show more Cryptographic keys are printed in modem debug messages in snapdragon mobile and snapdragon wear in versions MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 636, SD 650/52, SD 800, SD 810, SD 820, SD 835, SDA660, SDM630, SDM660, Snapdragon_High_Med_2016.Show less
CVE-2017-18324 1Qualcomm 32Mdm9206 Firmware Mdm9607 FirmwareMdm9615 Firmware+29 more Nov 21, 2024 Jan 3, 2019 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 Cryptographic key material leaked in debug messages - GERAN in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD...Show more Cryptographic key material leaked in debug messages - GERAN in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 800, SD 810, SD 820, SD 835, SD 855, SDX24, Snapdragon_High_Med_2016.Show less
CVE-2017-18322 1Qualcomm 31Mdm9206 Firmware Mdm9607 FirmwareMdm9615 Firmware+28 more Nov 21, 2024 Jan 3, 2019 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 Cryptographic key material leaked in WCDMA debug messages in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD...Show more Cryptographic key material leaked in WCDMA debug messages in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 800, SD 810, SD 820, SD 835, Snapdragon_High_Med_2016.Show less
CVE-2017-18321 1Qualcomm 4Mdm9650 Firmware Mdm9655 FirmwareSd 835 Firmware+1 more Nov 21, 2024 Jan 3, 2019 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 Security keys used by the terminal and NW for a session could be leaked in snapdragon mobile in versions MDM9650, MDM9655, SD 835, SDA660.
CVE-2018-7900 1Huawei 6Hg8010h Firmware Hg8040h FirmwareHg8045q Firmware+3 more Jun 17, 2026 Jan 2, 2019 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 There is an information leak vulnerability in some Huawei HG products. An attacker may obtain information about the HG device by exploiting this vulnerability.

Previous 1...248249250...525 Next