Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CVEs (10,496)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2018-16224 1Ismartalarm 1Cubeone Firmware Nov 21, 2024 Nov 20, 2018 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Incorrect access control for the diagnostic files of the iSmartAlarm Cube One through 2.2.4.10 allows an attacker to retrieve them via a specifically crafted TCP request to port 12345 and 22306, and access sensitive info...Show more Incorrect access control for the diagnostic files of the iSmartAlarm Cube One through 2.2.4.10 allows an attacker to retrieve them via a specifically crafted TCP request to port 12345 and 22306, and access sensitive information from the device.Show less
CVE-2018-1841 1Ibm 1Cloud Private Nov 21, 2024 Nov 19, 2018 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 IBM Cloud Private 2.1.0 could allow a local user to obtain the CA Private Key due to it being world readable in boot/master node. IBM X-Force ID: 150901.
CVE-2018-7360 1Zte 1Zxhn F670 Firmware Jun 17, 2026 Nov 16, 2018 N/A· v4 6.5 MEDIUM· v3 3.3 LOW· v2 All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by information exposure vulnerability, which may allow an unauthenticated attacker to get the GPON SN information via appviahttp service.
CVE-2018-1639 1Ibm 1Jazz Reporting Service Nov 21, 2024 Nov 16, 2018 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 The Report Builder of Jazz Reporting Service 5.0 through 5.0.2 and 6.0 through 6.0.6 could allow an authenticated user to obtain sensitive information beyond its assigned privileges. IBM X-Force ID: 144579.
CVE-2018-9071 1Lenovo 1Chassis Management Module Firmware Jun 17, 2026 Nov 16, 2018 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Lenovo Chassis Management Module (CMM) prior to version 2.0.0 allows unauthenticated users to retrieve information related to the current authentication configuration settings. Exposed settings relate to password lengths...Show more Lenovo Chassis Management Module (CMM) prior to version 2.0.0 allows unauthenticated users to retrieve information related to the current authentication configuration settings. Exposed settings relate to password lengths, expiration, and lockout configuration.Show less
CVE-2018-5407 7Canonical DebianNodejs+4 more 20Api Gateway Application ServerDebian Linux+17 more Jun 17, 2026 Nov 15, 2018 N/A· v4 4.7 MEDIUM· v3 1.9 LOW· v2 Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.
CVE-2018-9543 1Google 1Android Jun 17, 2026 Nov 14, 2018 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 In trim_device of f2fs_format_utils.c, it is possible that the data partition is not wiped during a factory reset. This could lead to local information disclosure after factory reset with no additional execution privileg...Show more In trim_device of f2fs_format_utils.c, it is possible that the data partition is not wiped during a factory reset. This could lead to local information disclosure after factory reset with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-112868088.Show less
CVE-2018-9526 1Google 1Android Jun 17, 2026 Nov 14, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In device configuration data, there is an improperly configured setting. This could lead to remote disclosure of device location. User interaction is not needed for exploitation. Product: Android. Versions: Android-9. An...Show more In device configuration data, there is an improperly configured setting. This could lead to remote disclosure of device location. User interaction is not needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112159033Show less
CVE-2018-6082 3Debian GoogleRedhat 5Chrome Debian LinuxEnterprise Linux Desktop+2 more Jun 17, 2026 Nov 14, 2018 N/A· v4 4.7 MEDIUM· v3 4.3 MEDIUM· v2 Including port 22 in the list of allowed FTP ports in Networking in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially enumerate internal host services via a crafted HTML page.
CVE-2018-6079 3Debian GoogleRedhat 5Chrome Debian LinuxEnterprise Linux Desktop+2 more Jun 17, 2026 Nov 14, 2018 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Inappropriate sharing of TEXTURE_2D_ARRAY/TEXTURE_3D data between tabs in WebGL in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVE-2018-6077 3Debian GoogleRedhat 5Chrome Debian LinuxEnterprise Linux Desktop+2 more Jun 17, 2026 Nov 14, 2018 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Displacement map filters being applied to cross-origin images in Blink SVG rendering in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVE-2018-6075 3Debian GoogleRedhat 5Chrome Debian LinuxLinux Desktop+2 more Jun 17, 2026 Nov 14, 2018 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Incorrect handling of specified filenames in file downloads in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page and user interaction.
CVE-2018-6066 3Debian GoogleRedhat 5Chrome Debian LinuxLinux Desktop+2 more Jun 17, 2026 Nov 14, 2018 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Lack of CORS checking by ResourceFetcher/ResourceLoader in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVE-2018-17468 3Debian GoogleRedhat 5Chrome Debian LinuxEnterprise Linux Desktop+2 more Nov 21, 2024 Nov 14, 2018 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Incorrect handling of timer information during navigation in Blink in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obtain cross origin URLs via a crafted HTML page.
CVE-2018-3621 1Intel 1Driver&support Assistant Nov 21, 2024 Nov 14, 2018 N/A· v4 6.5 MEDIUM· v3 3.3 LOW· v2 Insufficient input validation in the Intel Driver & Support Assistant before 3.6.0.4 may allow an unauthenticated user to potentially enable information disclosure via adjacent access.
CVE-2018-8565 1Microsoft 7Windows 10 Windows 7Windows 8.1+4 more Jun 17, 2026 Nov 14, 2018 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka "Win32k Information Disclosure Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows...Show more An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka "Win32k Information Disclosure Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.Show less
CVE-2018-8558 1Microsoft 2Office Office 365 Proplus Jun 17, 2026 Nov 14, 2018 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 An information disclosure vulnerability exists when Microsoft Outlook fails to respect "Default link type" settings configured via the SharePoint Online Admin Center, aka "Microsoft Outlook Information Disclosure Vulnera...Show more An information disclosure vulnerability exists when Microsoft Outlook fails to respect "Default link type" settings configured via the SharePoint Online Admin Center, aka "Microsoft Outlook Information Disclosure Vulnerability." This affects Office 365 ProPlus, Microsoft Office. This CVE ID is unique from CVE-2018-8579.Show less
CVE-2018-8454 1Microsoft 3Windows 10 Windows Server 2016Windows Server 2019 Jun 17, 2026 Nov 14, 2018 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 An information disclosure vulnerability exists when Windows Audio Service fails to properly handle objects in memory, aka "Windows Audio Service Information Disclosure Vulnerability." This affects Windows 10 Servers, Win...Show more An information disclosure vulnerability exists when Windows Audio Service fails to properly handle objects in memory, aka "Windows Audio Service Information Disclosure Vulnerability." This affects Windows 10 Servers, Windows 10, Windows Server 2019.Show less
CVE-2018-6260 1Nvidia 1Gpu Driver Jun 17, 2026 Nov 13, 2018 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 NVIDIA graphics driver contains a vulnerability that may allow access to application data processed on the GPU through a side channel exposed by the GPU performance counters. Local user access is required. This is not a...Show more NVIDIA graphics driver contains a vulnerability that may allow access to application data processed on the GPU through a side channel exposed by the GPU performance counters. Local user access is required. This is not a network or remote attack vector.Show less
CVE-2018-15771 1Emc 2Recoverpoint Recoverpoint For Virtual Machines Nov 21, 2024 Nov 13, 2018 N/A· v4 5.5 MEDIUM· v3 4.9 MEDIUM· v2 Dell EMC RecoverPoint versions prior to 5.1.2.1 and RecoverPoint for VMs versions prior to 5.2.0.2 contain an information disclosure vulnerability. A malicious boxmgmt user may potentially be able to determine the existe...Show more Dell EMC RecoverPoint versions prior to 5.1.2.1 and RecoverPoint for VMs versions prior to 5.2.0.2 contain an information disclosure vulnerability. A malicious boxmgmt user may potentially be able to determine the existence of any system file via Boxmgmt CLI.Show less

Previous 1...254255256...525 Next