Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CVEs (10,497)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2017-1342 1Ibm 1Insights Foundation For Energy May 13, 2026 Dec 7, 2017 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 IBM Insights Foundation for Energy 2.0 could reveal sensitive information in error messages to authenticated users that could e used to conduct further attacks. IBM X-Force ID: 126457.
CVE-2017-17449 1Linux 1Linux Kernel May 13, 2026 Dec 7, 2017 N/A· v4 4.7 MEDIUM· v3 1.9 LOW· v2 The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel through 4.14.4, when CONFIG_NLMON is enabled, does not restrict observations of Netlink messages to a single net namespace, which all...Show more The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel through 4.14.4, when CONFIG_NLMON is enabled, does not restrict observations of Netlink messages to a single net namespace, which allows local users to obtain sensitive information by leveraging the CAP_NET_ADMIN capability to sniff an nlmon interface for all Netlink activity on the system.Show less
CVE-2017-17068 1Auth0 1Auth0.js May 13, 2026 Dec 6, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12. This vulnerability allows an attacker to acquire authenticated users' tokens and invoke services on a user's behal...Show more A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12. This vulnerability allows an attacker to acquire authenticated users' tokens and invoke services on a user's behalf if the target site or application uses a popup callback page with auth0.popup.callback().Show less
CVE-2017-13175 1Google 1Android May 13, 2026 Dec 6, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An information disclosure vulnerability in the NVIDIA libwilhelm. Product: Android. Versions: Android kernel. Android ID A-64339309. References: N-CVE-2017-13175.
CVE-2017-13169 1Google 1Android May 13, 2026 Dec 6, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An information disclosure vulnerability in the kernel camera server. Product: Android. Versions: Android kernel. Android ID A-37512375.
CVE-2017-13164 1Google 1Android May 13, 2026 Dec 6, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An information disclosure vulnerability in the kernel binder driver. Product: Android. Versions: Android kernel. Android ID A-36007193.
CVE-2017-13159 1Google 1Android May 13, 2026 Dec 6, 2017 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 An information disclosure vulnerability in the Android system (activitymanagerservice). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-32879772.
CVE-2017-13158 1Google 1Android May 13, 2026 Dec 6, 2017 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 An information disclosure vulnerability in the Android system (activitymanagerservice). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-32879915.
CVE-2017-13157 1Google 1Android May 13, 2026 Dec 6, 2017 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 An information disclosure vulnerability in the Android system (activitymanagerservice). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-32990341.
CVE-2017-13152 1Google 1Android May 13, 2026 Dec 6, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An information disclosure vulnerability in the Android media framework (libmedia drm). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-62872384.
CVE-2017-13150 1Google 1Android May 13, 2026 Dec 6, 2017 N/A· v4 9.1 CRITICAL· v3 8.5 HIGH· v2 An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-38328132.
CVE-2017-13149 1Google 1Android May 13, 2026 Dec 6, 2017 N/A· v4 9.1 CRITICAL· v3 8.5 HIGH· v2 An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-65719872.
CVE-2017-0879 1Google 1Android May 13, 2026 Dec 6, 2017 N/A· v4 9.1 CRITICAL· v3 8.5 HIGH· v2 An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-65025028.
CVE-2017-11031 1Google 1Android May 13, 2026 Dec 5, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, the VIDIOC_G_SDE_ROTATOR_FENCE ioctl command can be used to cause a Use After Free condition.
CVE-2017-12080 1Synology 1Photo Station May 13, 2026 Dec 4, 2017 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 An information exposure vulnerability in default HTTP configuration file in Synology Photo Station before 6.8.1-3458 and before 6.3-2970 allows remote attackers to obtain sensitive system information via .htaccess file.
CVE-2017-12079 1Synology 1Photo Station May 13, 2026 Dec 4, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Files or directories accessible to external parties vulnerability in picasa.php in Synology Photo Station before 6.8.1-3458 and before 6.3-2970 allows remote attackers to obtain arbitrary files via prog_id field.
CVE-2017-17104 1Fiyo 1Fiyo Cms May 13, 2026 Dec 4, 2017 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 Fiyo CMS 2.0.7 has an arbitrary file read vulnerability in dapur/apps/app_theme/libs/check_file.php via $_GET['src'] or $_GET['name'].
CVE-2017-13664 1Ismartalarm 1Cubeone Firmware May 13, 2026 Dec 1, 2017 N/A· v4 9.8 CRITICAL· v3 5.0 MEDIUM· v2 Password file exposure in firmware in iSmartAlarm CubeOne version 2.2.4.8 and earlier allows attackers to execute arbitrary commands with administrative privileges by retrieving credentials from this file.
CVE-2017-3764 1Lenovo 1Xclarity Administrator May 13, 2026 Nov 30, 2017 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 A vulnerability was identified in Lenovo XClarity Administrator (LXCA) before 1.4.0 where LXCA user account names may be exposed to unauthenticated users with access to the LXCA web user interface. No password informatio...Show more A vulnerability was identified in Lenovo XClarity Administrator (LXCA) before 1.4.0 where LXCA user account names may be exposed to unauthenticated users with access to the LXCA web user interface. No password information of the user accounts is exposed.Show less
CVE-2017-12365 1Cisco 1Webex Meeting Center May 13, 2026 Nov 30, 2017 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 A vulnerability in Cisco WebEx Event Center could allow an authenticated, remote attacker to view unlisted meeting information. The vulnerability is due to a design flaw in the product. An attacker could execute a query...Show more A vulnerability in Cisco WebEx Event Center could allow an authenticated, remote attacker to view unlisted meeting information. The vulnerability is due to a design flaw in the product. An attacker could execute a query on an Event Center site to view scheduled meetings. A successful query would show both listed and unlisted meetings in the displayed information. An attacker could use this information to attend meetings that are not available for their attendance. Cisco Bug IDs: CSCvg33629.Show less

Previous 1...307308309...525 Next