Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CVEs (11,927)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2018-7977 1Huawei 1Fusionsphere Openstack Jun 17, 2026 Nov 27, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 There is an information leakage vulnerability on several Huawei products. Due to insufficient communication protection for specific services, a remote, unauthorized attacker can exploit this vulnerability to connect to s...Show more There is an information leakage vulnerability on several Huawei products. Due to insufficient communication protection for specific services, a remote, unauthorized attacker can exploit this vulnerability to connect to specific services to obtain additional information. Successful exploitation of this vulnerability can lead to information leakage.Show less
CVE-2018-7961 1Huawei 1Emily Al00a Firmware Jun 17, 2026 Nov 27, 2018 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 There is a smart SMS verification code vulnerability in some Huawei smart phones. An attacker should trick a user to access malicious Website or malicious App and register. Due to incorrect processing of the smart SMS ve...Show more There is a smart SMS verification code vulnerability in some Huawei smart phones. An attacker should trick a user to access malicious Website or malicious App and register. Due to incorrect processing of the smart SMS verification code, successful exploitation can cause sensitive information leak.Show less
CVE-2018-7946 1Huawei 2Honor 7a Firmware Honor 9 Lite Firmware Jun 17, 2026 Nov 27, 2018 N/A· v4 4.3 MEDIUM· v3 1.9 LOW· v2 There is an information leak vulnerability in some Huawei smartphones. An attacker may do some specific configuration in the smartphone and trick a user into inputting some sensitive information. Due to improper design,...Show more There is an information leak vulnerability in some Huawei smartphones. An attacker may do some specific configuration in the smartphone and trick a user into inputting some sensitive information. Due to improper design, successful exploit may cause some information leak.Show less
CVE-2018-13352 1Terra Master 1Terramaster Operating System Nov 21, 2024 Nov 27, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Session Exposure in the web application for TerraMaster TOS version 3.1.03 allows attackers to view active session tokens in a world-readable directory.
CVE-2018-10142 1Paloaltonetworks 1Expedition Nov 21, 2024 Nov 27, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The Expedition Migration tool 1.0.106 and earlier may allow an unauthenticated attacker to enumerate files on the operating system.
CVE-2018-6266 1Nvidia 1Geforce Experience Jun 17, 2026 Nov 27, 2018 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 NVIDIA GeForce Experience contains a vulnerability in all versions prior to 3.16 on Windows where a local user may obtain third party integration parameters, which may lead to information disclosure.
CVE-2018-19609 1Showdoc 1Showdoc Nov 21, 2024 Nov 27, 2018 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 ShowDoc 2.4.1 allows remote attackers to obtain sensitive information by navigating with a modified page_id, as demonstrated by reading note content, or discovering a username in the JSON data at a diff URL.
CVE-2018-13319 1Buffalo 1Ts5600d1206 Firmware Nov 21, 2024 Nov 26, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Incorrect access control in get_portal_info in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to determine sensitive device information via an unauthenticated POST request.
CVE-2018-16862 4Canonical DebianLinux+1 more 4Debian Linux Enterprise LinuxLinux Kernel+1 more Nov 21, 2024 Nov 26, 2018 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 A security flaw was found in the Linux kernel in a way that the cleancache subsystem clears an inode after the final file truncation (removal). The new file created with the same inode may contain leftover pages from cle...Show more A security flaw was found in the Linux kernel in a way that the cleancache subsystem clears an inode after the final file truncation (removal). The new file created with the same inode may contain leftover pages from cleancache and the old file data instead of the new one.Show less
CVE-2018-1843 1Ibm 1Cloud Private Nov 21, 2024 Nov 21, 2018 N/A· v4 4.1 MEDIUM· v3 1.9 LOW· v2 The Identity and Access Management (IAM) services (IBM Cloud Private 3.1.0) do not use a secure channel, such as SSL, to exchange information only when accessed internally from within the cluster. It could be possible fo...Show more The Identity and Access Management (IAM) services (IBM Cloud Private 3.1.0) do not use a secure channel, such as SSL, to exchange information only when accessed internally from within the cluster. It could be possible for an attacker with access to network traffic to sniff packets from the connection and uncover data. IBM X-Force ID: 150903Show less
CVE-2018-18865 1Royalapplications 2Royal Ts Royal Tsx Nov 21, 2024 Nov 20, 2018 N/A· v4 8.1 HIGH· v3 4.3 MEDIUM· v2 The Royal browser extensions TS before 4.3.60728 (Release Date 2018-07-28) and TSX before 3.3.1 (Release Date 2018-09-13) allow Credentials Disclosure.
CVE-2018-16224 1Ismartalarm 1Cubeone Firmware Nov 21, 2024 Nov 20, 2018 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Incorrect access control for the diagnostic files of the iSmartAlarm Cube One through 2.2.4.10 allows an attacker to retrieve them via a specifically crafted TCP request to port 12345 and 22306, and access sensitive info...Show more Incorrect access control for the diagnostic files of the iSmartAlarm Cube One through 2.2.4.10 allows an attacker to retrieve them via a specifically crafted TCP request to port 12345 and 22306, and access sensitive information from the device.Show less
CVE-2018-1841 1Ibm 1Cloud Private Nov 21, 2024 Nov 19, 2018 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 IBM Cloud Private 2.1.0 could allow a local user to obtain the CA Private Key due to it being world readable in boot/master node. IBM X-Force ID: 150901.
CVE-2018-7360 1Zte 1Zxhn F670 Firmware Jun 17, 2026 Nov 16, 2018 N/A· v4 6.5 MEDIUM· v3 3.3 LOW· v2 All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by information exposure vulnerability, which may allow an unauthenticated attacker to get the GPON SN information via appviahttp service.
CVE-2018-1639 1Ibm 1Jazz Reporting Service Nov 21, 2024 Nov 16, 2018 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 The Report Builder of Jazz Reporting Service 5.0 through 5.0.2 and 6.0 through 6.0.6 could allow an authenticated user to obtain sensitive information beyond its assigned privileges. IBM X-Force ID: 144579.
CVE-2018-9071 1Lenovo 1Chassis Management Module Firmware Jun 17, 2026 Nov 16, 2018 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Lenovo Chassis Management Module (CMM) prior to version 2.0.0 allows unauthenticated users to retrieve information related to the current authentication configuration settings. Exposed settings relate to password lengths...Show more Lenovo Chassis Management Module (CMM) prior to version 2.0.0 allows unauthenticated users to retrieve information related to the current authentication configuration settings. Exposed settings relate to password lengths, expiration, and lockout configuration.Show less
CVE-2018-5407 7Canonical DebianNodejs+4 more 20Api Gateway Application ServerDebian Linux+17 more Oct 8, 2026 Nov 15, 2018 N/A· v4 4.7 MEDIUM· v3 1.9 LOW· v2 Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.
CVE-2018-9543 1Google 1Android Jun 17, 2026 Nov 14, 2018 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 In trim_device of f2fs_format_utils.c, it is possible that the data partition is not wiped during a factory reset. This could lead to local information disclosure after factory reset with no additional execution privileg...Show more In trim_device of f2fs_format_utils.c, it is possible that the data partition is not wiped during a factory reset. This could lead to local information disclosure after factory reset with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-112868088.Show less
CVE-2018-9526 1Google 1Android Jun 17, 2026 Nov 14, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In device configuration data, there is an improperly configured setting. This could lead to remote disclosure of device location. User interaction is not needed for exploitation. Product: Android. Versions: Android-9. An...Show more In device configuration data, there is an improperly configured setting. This could lead to remote disclosure of device location. User interaction is not needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112159033Show less
CVE-2018-6082 3Debian GoogleRedhat 5Chrome Debian LinuxEnterprise Linux Desktop+2 more Jun 17, 2026 Nov 14, 2018 N/A· v4 4.7 MEDIUM· v3 4.3 MEDIUM· v2 Including port 22 in the list of allowed FTP ports in Networking in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially enumerate internal host services via a crafted HTML page.

Previous 1...325326327...597 Next