Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CVEs (10,496)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2018-12374 4Canonical DebianMozilla+1 more 7Debian Linux Enterprise LinuxEnterprise Linux Desktop+4 more Nov 21, 2024 Oct 18, 2018 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 Plaintext of decrypted emails can leak through by user submitting an embedded form by pressing enter key within a text input field. This vulnerability affects Thunderbird < 52.9.
CVE-2018-12373 4Canonical DebianMozilla+1 more 7Debian Linux Enterprise LinuxEnterprise Linux Desktop+4 more Nov 21, 2024 Oct 18, 2018 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 dDecrypted S/MIME parts hidden with CSS or the plaintext HTML tag can leak plaintext when included in a HTML reply/forward. This vulnerability affects Thunderbird < 52.9.
CVE-2018-12372 4Canonical DebianMozilla+1 more 7Debian Linux Enterprise LinuxEnterprise Linux Desktop+4 more Nov 21, 2024 Oct 18, 2018 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Decrypted S/MIME parts, when included in HTML crafted for an attack, can leak plaintext when included in a a HTML reply/forward. This vulnerability affects Thunderbird < 52.9.
CVE-2018-12365 4Canonical DebianMozilla+1 more 11Debian Linux Enterprise Linux DesktopEnterprise Linux Server+8 more Nov 21, 2024 Oct 18, 2018 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system without user consent or interaction. This could result in exposure of private local files. This vuln...Show more A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system without user consent or interaction. This could result in exposure of private local files. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.Show less
CVE-2018-12358 2Canonical Mozilla 2Firefox Ubuntu Linux Nov 21, 2024 Oct 18, 2018 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 Service workers can use redirection to avoid the tainting of cross-origin resources in some instances, allowing a malicious site to read responses which are supposed to be opaque. This vulnerability affects Firefox < 61.
CVE-2018-0442 1Cisco 1Wireless Lan Controller Software Nov 21, 2024 Oct 17, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol component of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to retrieve memory con...Show more A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol component of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to retrieve memory contents, which could lead to the disclosure of confidential information. The vulnerability is due to insufficient condition checks in the part of the code that handles CAPWAP keepalive requests. An attacker could exploit this vulnerability by sending a crafted CAPWAP keepalive packet to a vulnerable Cisco WLC device. A successful exploit could allow the attacker to retrieve the contents of device memory, which could lead to the disclosure of confidential information.Show less
CVE-2018-14597 1Broadcom 2Ca Identity Governance Ca Identity Suite Virtual Appliance Nov 21, 2024 Oct 17, 2018 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 CA Technologies Identity Governance 12.6, 14.0, 14.1, and 14.2 and CA Identity Suite Virtual Appliance 14.0, 14.1, and 14.2 provide telling error messages that may allow remote attackers to enumerate account names.
CVE-2018-18376 1Orange 1Airbox Firmware Nov 21, 2024 Oct 16, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 goform/getWlanClientInfo in Orange AirBox Y858_FL_01.16_04 allows remote attackers to discover information about currently connected devices (hostnames, IP addresses, MAC addresses, and connection time) via the rand para...Show more goform/getWlanClientInfo in Orange AirBox Y858_FL_01.16_04 allows remote attackers to discover information about currently connected devices (hostnames, IP addresses, MAC addresses, and connection time) via the rand parameter.Show less
CVE-2018-18073 4Artifex CanonicalDebian+1 more 9Debian Linux Enterprise Linux DesktopEnterprise Linux Server+6 more Nov 21, 2024 Oct 15, 2018 N/A· v4 6.3 MEDIUM· v3 4.3 MEDIUM· v2 Artifex Ghostscript allows attackers to bypass a sandbox protection mechanism by leveraging exposure of system operators in the saved execution stack in an error object.
CVE-2018-18289 1Mesilat 1Zabbix Nov 21, 2024 Oct 14, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The MESILAT Zabbix plugin before 1.1.15 for Atlassian Confluence allows attackers to read arbitrary files.
CVE-2018-18287 1Asus 1Rt Ac58u Firmware Nov 21, 2024 Oct 14, 2018 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 On ASUS RT-AC58U 3.0.0.4.380_6516 devices, remote attackers can discover hostnames and IP addresses by reading dhcpLeaseInfo data in the HTML source code of the Main_Login.asp page.
CVE-2018-8890 1Blackberry 1Unified Endpoint Manager Jun 17, 2026 Oct 12, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An information disclosure vulnerability in the Management Console of BlackBerry UEM 12.8.0 and 12.8.1 could allow an attacker to take over a UEM user's session and perform administrative actions in the context of the use...Show more An information disclosure vulnerability in the Management Console of BlackBerry UEM 12.8.0 and 12.8.1 could allow an attacker to take over a UEM user's session and perform administrative actions in the context of the user.Show less
CVE-2018-1838 1Ibm 1Websphere Application Server Nov 21, 2024 Oct 12, 2018 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 IBM WebSphere Application Server 8.5 and 9.0 in IBM Cloud could allow a remote attacker to obtain sensitive information caused by improper handling of passwords. IBM X-Force ID: 150811.
CVE-2018-1708 1Ibm 2Platform Symphony Specturm Symphony Nov 21, 2024 Oct 11, 2018 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 IBM Spectrum Symphony 7.1.2 and 7.2.0.2 could allow an authenticated user to obtain sensitive user information such as passwords through the WebUI. IBM X-Force ID: 146343.
CVE-2018-12161 1Intel 1Raid Web Console Nov 21, 2024 Oct 10, 2018 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Insufficient session validation in the webserver component of the Intel Rapid Web Server 3 may allow an unauthenticated user to potentially disclose information via network access.
CVE-2018-12158 1Intel 1Next Unit Of Computing Firmware Nov 21, 2024 Oct 10, 2018 N/A· v4 6.0 MEDIUM· v3 5.6 MEDIUM· v2 Insufficient input validation in BIOS update utility in Intel NUC FW kits downloaded before May 24, 2018 may allow a privileged user to potentially trigger a denial of service or information disclosure via local access.
CVE-2018-17917 1Xiongmaitech 1Xmeye P2p Cloud Server Nov 21, 2024 Oct 10, 2018 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use MAC addresses to enumerate potential Cloud IDs. Using this ID, the attacker can discover and connect to valid devi...Show more All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use MAC addresses to enumerate potential Cloud IDs. Using this ID, the attacker can discover and connect to valid devices using one of the supported apps.Show less
CVE-2018-8472 1Microsoft 8Windows 10 Windows 7Windows 8.1+5 more Jun 17, 2026 Oct 10, 2018 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, allowing an attacker to retrieve information from a targeted system, aka "Windows GDI...Show more An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, allowing an attacker to retrieve information from a targeted system, aka "Windows GDI Information Disclosure Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.Show less
CVE-2018-8427 1Microsoft 7Excel Viewer OfficeOffice 365 Proplus+4 more Jun 17, 2026 Oct 10, 2018 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka "Microsoft Graphics Components Information Disclosure Vulnerability." This affects Microsoft Offi...Show more An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka "Microsoft Graphics Components Information Disclosure Vulnerability." This affects Microsoft Office, Microsoft Office Word Viewer, Office 365 ProPlus, Windows Server 2008, Microsoft PowerPoint Viewer, Microsoft Excel Viewer.Show less
CVE-2018-8330 1Microsoft 7Windows 10 Windows 7Windows 8.1+4 more Jun 17, 2026 Oct 10, 2018 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnerability." This affects Windows 7, Windows Server 2012 R2, Wind...Show more An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.Show less

Previous 1...257258259...525 Next