Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CVEs (11,928)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-19254 1Gitlab 1Gitlab Jun 17, 2026 Jan 3, 2020 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 GitLab Community Edition (CE) and Enterprise Edition (EE). 9.6 and later through 12.5 has Incorrect Access Control.
CVE-2014-6275 2Debian Fusionforge 2Debian Linux Fusionforge Nov 21, 2024 Jan 2, 2020 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 FusionForge before 5.3.2 use scripts that run under the shared Apache user, which is also used by project homepages by default. If project webpages are hosted on the same server than FusionForge, it can allow users to in...Show more FusionForge before 5.3.2 use scripts that run under the shared Apache user, which is also used by project homepages by default. If project webpages are hosted on the same server than FusionForge, it can allow users to incorrectly access on-disk private data in FusionForge.Show less
CVE-2018-20495 1Gitlab 1Gitlab Nov 21, 2024 Dec 30, 2019 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 An issue was discovered in GitLab Community and Enterprise Edition 11.3.x and 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows Information Exposure.
CVE-2018-20488 1Gitlab 1Gitlab Nov 21, 2024 Dec 30, 2019 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows Information Exposure.
CVE-2012-5476 2Debian Openstack 2Debian Linux Horizon Nov 21, 2024 Dec 30, 2019 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 Within the RHOS Essex Preview (2012.2) of the OpenStack dashboard package, the file /etc/quantum/quantum.conf is world readable which exposes the admin password and token value.
CVE-2018-1682 1Ibm 1Watston Studio Local Nov 21, 2024 Dec 30, 2019 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 IBM Watson Studio Local 1.2.3 could disclose sensitive information over the network that an attacked could use in further attacks against the system. IBM X-Force ID: 145238.
CVE-2013-4868 1Karotz 1Api Nov 21, 2024 Dec 27, 2019 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Karotz API 12.07.19.00: Session Token Information Disclosure
CVE-2012-4420 1Oracle 1Jdk Nov 21, 2024 Dec 26, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An information disclosure flaw was found in the way the Java Virtual Machine (JVM) implementation of Java SE 7 as provided by OpenJDK 7 incorrectly initialized integer arrays after memory allocation (in certain circumsta...Show more An information disclosure flaw was found in the way the Java Virtual Machine (JVM) implementation of Java SE 7 as provided by OpenJDK 7 incorrectly initialized integer arrays after memory allocation (in certain circumstances they had nonzero elements right after the allocation). A remote attacker could use this flaw to obtain potentially sensitive information.Show less
CVE-2019-19983 1Fastvelocity 1Minify Jun 17, 2026 Dec 26, 2019 N/A· v4 4.3 MEDIUM· v3 3.5 LOW· v2 In the WordPress plugin, Fast Velocity Minify before 2.7.7, the full web root path to the running WordPress application can be discovered. In order to exploit this vulnerability, FVM Debug Mode needs to be enabled and an...Show more In the WordPress plugin, Fast Velocity Minify before 2.7.7, the full web root path to the running WordPress application can be discovered. In order to exploit this vulnerability, FVM Debug Mode needs to be enabled and an admin-ajax request needs to call the fastvelocity_min_files action.Show less
CVE-2019-11294 1Cloudfoundry 2Capi Release Cf Deployment Jun 17, 2026 Dec 19, 2019 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 Cloud Foundry Cloud Controller API (CAPI), version 1.88.0, allows space developers to list all global service brokers, including service broker URLs and GUIDs, which should only be accessible to admins.
CVE-2019-5073 1Wago 2Pfc 100 Firmware Pfc 200 Firmware Jun 17, 2026 Dec 18, 2019 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 An exploitable information exposure vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC200 Firmware versions 03.01.07(13) and 03.00.39(12), and WAGO PFC100 Firmware version 03.00.39(12). A...Show more An exploitable information exposure vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC200 Firmware versions 03.01.07(13) and 03.00.39(12), and WAGO PFC100 Firmware version 03.00.39(12). A specially crafted set of packets can cause an external tool to fail, resulting in uninitialized stack data to be copied to the response packet buffer. An attacker can send unauthenticated packets to trigger this vulnerability.Show less
CVE-2019-15580 1Gitlab 1Gitlab Jun 17, 2026 Dec 18, 2019 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 An information exposure vulnerability exists in gitlab.com <v12.3.2, <v12.2.6, and <v12.1.10 when using the blocking merge request feature, it was possible for an unauthenticated user to see the head pipeline data of a p...Show more An information exposure vulnerability exists in gitlab.com <v12.3.2, <v12.2.6, and <v12.1.10 when using the blocking merge request feature, it was possible for an unauthenticated user to see the head pipeline data of a public project even though pipeline visibility was restricted.Show less
CVE-2019-15577 1Gitlab 1Gitlab Jun 17, 2026 Dec 18, 2019 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 An information disclosure vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed project milestones to be disclosed via groups browsing.
CVE-2019-15576 1Gitlab 1Gitlab Jun 17, 2026 Dec 18, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An information disclosure vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed an attacker to view private system notes from a GraphQL endpoint.
CVE-2019-8730 1Apple 1Mac Os X Jun 17, 2026 Dec 18, 2019 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 The contents of locked notes sometimes appeared in search results. This issue was addressed with improved data cleanup. This issue is fixed in macOS Catalina 10.15. A local user may be able to view a user’s locked notes.
CVE-2019-8620 1Apple 3Iphone Os TvosWatchos Jun 17, 2026 Dec 18, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A user privacy issue was addressed by removing the broadcast MAC address. This issue is fixed in iOS 12.3, tvOS 12.3, watchOS 5.2.1. A device may be passively tracked by its WiFi MAC address.
CVE-2019-8567 1Apple 1Iphone Os Jun 17, 2026 Dec 18, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A user privacy issue was addressed by removing the broadcast MAC address. This issue is fixed in iOS 12.2. A device may be passively tracked by its WiFi MAC address.
CVE-2019-3993 2Elog Project Fedoraproject 2Elog Fedora Jun 17, 2026 Dec 17, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote unauthenticated attacker can recover a user's password hash by sending a crafted HTTP POST request.
CVE-2019-3992 2Elog Project Fedoraproject 2Elog Fedora Jun 17, 2026 Dec 17, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote unauthenticated attacker can access the server's configuration file by sending an HTTP GET request. Amongst the configuration...Show more ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote unauthenticated attacker can access the server's configuration file by sending an HTTP GET request. Amongst the configuration data, the attacker may gain access to valid admin usernames and, in older versions of ELOG, passwords.Show less
CVE-2019-12414 1Apache 1Superset Jun 17, 2026 Dec 16, 2019 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 In Apache Incubator Superset before 0.32, a user can view database names that he has no access to on a dropdown list in SQLLab

Previous 1...293294295...597 Next