CWE-200
11,928 CVEs • Abstraction: Class • Likelihood of Exploit: High
Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVEs (11,928)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK stores sensitive information under the web root with insufficient access control, which allows remote attackers to read backup files via a direct request for rom-0. |
3Canonical DebianLinux3Debian Linux Linux KernelUbuntu LinuxNov 21, 2024 Feb 20, 2020 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 fs/proc/base.c in the Linux kernel through 3.1 allows local users to obtain sensitive keystroke information via access to /proc/interrupts. |
The vault subsystem in Ansible before 1.5.5 does not set the umask before creation or modification of a vault file, which allows local users to obtain sensitive key information by reading a file. |
An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0. It can leak consoleauth tokens into log files. An attacker with read access to the service's logs may obtain tokens use...Show more |
The wpCentral plugin before 1.5.1 for WordPress allows disclosure of the connection key. |
GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request endpoint. |
GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via the activity timeline. |
1Lenovo 1Xclarity Administrator Jun 17, 2026 Feb 14, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An information disclosure vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow unauthenticated access to some configuration files which may contain usernames, licens...Show more |
1Aicorporation 1Risknet Acquirer Nov 21, 2024 Feb 14, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 RiskNet Acquirer before hotfix 6.0 b7+ADHOC-443 ApplicationServiceBean contains a service information disclosure. |
Zend_XmlRpc Class in Magento before 1.7.0.2 contains an information disclosure vulnerability. |
An exploitable information disclosure vulnerability exists in the 'Secret Chats' functionality of Rakuten Viber on Android 9.3.0.6. The 'Secret Chats' functionality allows a user to delete all traces of a chat either by...Show more |
1Sap 1Netweaver Application Server Java Jun 17, 2026 Feb 12, 2020 N/A· v4 5.8 MEDIUM· v3 5.0 MEDIUM· v2 Certain vulnerable endpoints in SAP NetWeaver AS Java (Heap Dump Application), versions 7.30, 7.31, 7.40, 7.50, provide valuable information about the system like hostname, server node and installation path that could be...Show more |
Android SQLite Journal before 4.0.1 has an information disclosure vulnerability. |
The Bluetooth stack in Android before 2.3.6 allows a physically proximate attacker to obtain contact information via an AT phonebook transfer. |
Tube Map Live Underground for Android before 3.0.22 has an Information Disclosure Vulnerability |
1Syska 1Smartlight Rainbow Led Smart Bulb Firmware Nov 21, 2024 Feb 10, 2020 N/A· v4 6.5 MEDIUM· v3 3.3 LOW· v2 Syska Smart Bulb devices through 2017-08-06 receive RGB parameters over cleartext Bluetooth Low Energy (BLE), leading to sniffing, reverse engineering, and replay attacks. |
1Blackberry 1Playbook Firmware Nov 21, 2024 Feb 10, 2020 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 BlackBerry PlayBook before 2.1 has an Information Disclosure Vulnerability via a Web browser component error |
HP Systems Insight Manager before 7.0 allows a remote user on adjacent network to access information |
1Basic Webmail Project 1Basic Webmail Nov 21, 2024 Feb 8, 2020 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 The Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with the "access basic_webmail" permission to read arbitrary users' email addresses. |
Open-School Community Edition 2.2 does not properly restrict access to the export functionality, which allows remote authenticated users to obtain sensitive information via the r parameter with the value export to index....Show more |