← Back
CWE-200

11,928 CVEs • Abstraction: Class • Likelihood of Exploit: High

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

JSON object

Loading...

CVEs (11,928)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2011-5282
1Mirc
1Mirc
Nov 21, 2024
Jan 21, 2020
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
mIRC prior to 7.22 has a message leak because chopping of outbound messages is mishandled.
CVE-2017-3211
1Yopify
1Yopify
Nov 21, 2024
Jan 15, 2020
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
Yopify, an e-commerce notification plugin, up to April 06, 2017, leaks the first name, last initial, city, and recent purchase data of customers, all without user authorization.
CVE-2020-6954
1Cayintech
1Smp Pro4 Firmware
Jun 17, 2026
Jan 13, 2020
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
An issue was discovered on Cayin SMP-PRO4 devices. A user can discover a saved password by viewing the URL after a Connection String Test. This password is shown in the webpass parameter of a media_folder.cgi?apply_mode=...Show more
An issue was discovered on Cayin SMP-PRO4 devices. A user can discover a saved password by viewing the URL after a Connection String Test. This password is shown in the webpass parameter of a media_folder.cgi?apply_mode=ping_server URI.Show less
CVE-2020-5197
1Gitlab
1Gitlab
Jun 17, 2026
Jan 13, 2020
N/A· v4
4.3 MEDIUM· v3
3.5 LOW· v2
An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 5.1 through 12.6.1. It has Incorrect Access Control.
CVE-2014-6038
1Zohocorp
1Manageengine Eventlog Analyzer
Nov 21, 2024
Jan 13, 2020
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
Zoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 have a database Information Disclosure Vulnerability. Fixed in EventLog Analyzer 10.0 Build 10000.
CVE-2019-14301
1Ricoh
52M 2700 Firmware
M 2701 FirmwareM C250fw Firmware+49 more
Jun 17, 2026
Jan 10, 2020
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
Ricoh SP C250DN 1.06 devices have Incorrect Access Control (issue 1 of 2).
CVE-2019-4559
1Ibm
1Qradar Security Information And Event Manager
Jun 17, 2026
Jan 10, 2020
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
IBM QRadar SIEM 7.3.0 through 7.3.3 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 166355.
CVE-2014-5011
1Dompdf Project
1Dompdf
Nov 21, 2024
Jan 10, 2020
N/A· v4
6.5 MEDIUM· v3
4.3 MEDIUM· v2
DOMPDF before 0.6.2 allows Information Disclosure.
CVE-2012-2724
1Md Systems
1Simplenews
Nov 21, 2024
Jan 9, 2020
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
The Simplenews module 6.x-1.x before 6.x-1.4, 6.x-2.x before 6.x-2.0-alpha4, and 7.x-1.x before 7.x-1.0-rc1 for Drupal reveals the email addresses of new mailing list subscribers when confirmation is required, which allo...Show more
The Simplenews module 6.x-1.x before 6.x-1.4, 6.x-2.x before 6.x-2.0-alpha4, and 7.x-1.x before 7.x-1.0-rc1 for Drupal reveals the email addresses of new mailing list subscribers when confirmation is required, which allows remote attackers to obtain sensitive information via the confirmation page.Show less
CVE-2019-6331
1Hp
1Samsung Mobile Print
Jun 17, 2026
Jan 9, 2020
N/A· v4
3.3 LOW· v3
2.1 LOW· v2
An issue was found in Samsung Mobile Print (Android) versions prior to 4.08.007. A potential security vulnerability caused by incomplete obfuscation of application configuration information.
CVE-2014-3753
11password
11password
Nov 21, 2024
Jan 9, 2020
N/A· v4
5.5 MEDIUM· v3
4.3 MEDIUM· v2
AgileBits 1Password through 1.0.9.340 allows security feature bypass
CVE-2019-17018
1Mozilla
1Firefox
Jun 17, 2026
Jan 8, 2020
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
When in Private Browsing Mode on Windows 10, the Windows keyboard may retain word suggestions to improve the accuracy of the keyboard. This vulnerability affects Firefox < 72.
CVE-2016-5346
1Google
1Android
Nov 21, 2024
Jan 8, 2020
N/A· v4
5.5 MEDIUM· v3
2.1 LOW· v2
An Information Disclosure vulnerability exists in the Google Pixel/Pixel SL Qualcomm Avtimer Driver due to a NULL pointer dereference when processing an accept system call by the user process on AF_MSM_IPC sockets, which...Show more
An Information Disclosure vulnerability exists in the Google Pixel/Pixel SL Qualcomm Avtimer Driver due to a NULL pointer dereference when processing an accept system call by the user process on AF_MSM_IPC sockets, which could let a local malicious user obtain sensitive information (Android Bug ID A-32551280).Show less
CVE-2016-6587
1Symantec
1Norton Mobile Security
Nov 21, 2024
Jan 8, 2020
N/A· v4
5.5 MEDIUM· v3
2.1 LOW· v2
An Information Disclosure vulnerability exists in the mid.dat file stored on the SD card in Symantec Norton Mobile Security for Android before 3.16, which could let a local malicious user obtain sensitive information.
CVE-2019-14820
1Redhat
4Jboss Enterprise Application Platform
Jboss FuseKeycloak+1 more
Jun 17, 2026
Jan 8, 2020
N/A· v4
4.3 MEDIUM· v3
4.0 MEDIUM· v2
It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker...Show more
It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information.Show less
CVE-2020-6170
1Genexis
1Platinum 4410 Firmware
Jun 17, 2026
Jan 8, 2020
N/A· v4
9.8 CRITICAL· v3
5.0 MEDIUM· v2
An authentication bypass vulnerability on Genexis Platinum-4410 v2.1 P4410-V2 1.28 devices allows attackers to obtain cleartext credentials from the HTML source code of the cgi-bin/index2.asp URI.
CVE-2014-5209
2F5
Ntp
25Big Ip Access Policy Manager
Big Ip Advanced Firewall ManagerBig Ip Analytics+22 more
Nov 21, 2024
Jan 8, 2020
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET_RESTRICT control message, which could let a malicious user obtain sensitive information.
CVE-2019-6700
1Fortinet
1Fortisiem
Jun 17, 2026
Jan 7, 2020
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
An information exposure vulnerability in the external authentication profile form of FortiSIEM 5.2.2 and earlier may allow an authenticated attacker to retrieve the external authentication password via the HTML source co...Show more
An information exposure vulnerability in the external authentication profile form of FortiSIEM 5.2.2 and earlier may allow an authenticated attacker to retrieve the external authentication password via the HTML source code.Show less
CVE-2019-9541
1Telos
1Automated Message Handling System
Jun 17, 2026
Jan 3, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
: Information Exposure vulnerability in itemlookup.asp of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos Automated Message Hand...Show more
: Information Exposure vulnerability in itemlookup.asp of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos Automated Message Handling System versions prior to 4.1.5.5.Show less
CVE-2019-19256
1Gitlab
1Gitlab
Jun 17, 2026
Jan 3, 2020
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
GitLab Enterprise Edition (EE) 12.2 and later through 12.5 has Incorrect Access Control.