Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CVEs (11,927)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2018-11846 1Qualcomm 5Sd 205 Firmware Sd 210 FirmwareSd 212 Firmware+2 more Nov 21, 2024 Oct 26, 2018 N/A· v4 4.7 MEDIUM· v3 4.7 MEDIUM· v2 The use of a non-time-constant memory comparison operation can lead to timing/side channel attacks in Snapdragon Mobile in version SD 210/SD 212/SD 205, SD 845, SD 850
CVE-2018-18655 1Prayer Project 1Prayer Nov 21, 2024 Oct 26, 2018 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 Prayer through 1.3.5 sends a Referer header, containing a user's username, when a user clicks on a link in their email because header.t lacks a no-referrer setting.
CVE-2018-18566 1Polycom 3Unified Communications Software Vvx 500 FirmwareVvx 601 Firmware Nov 21, 2024 Oct 24, 2018 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 The SIP service in Polycom VVX 500 and 601 devices 5.8.0.12848 and earlier allow remote attackers to obtain sensitive phone configuration information by leveraging use with an on-premise installation with Skype for Busin...Show more The SIP service in Polycom VVX 500 and 601 devices 5.8.0.12848 and earlier allow remote attackers to obtain sensitive phone configuration information by leveraging use with an on-premise installation with Skype for Business.Show less
CVE-2018-18467 1Conversations 1Conversations Nov 21, 2024 Oct 23, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An issue was discovered in Daniel Gultsch Conversations 2.3.4. It is possible to spoof a custom message to an existing opened conversation by sending an intent.
CVE-2017-18300 1Qualcomm 8Mdm9206 Firmware Mdm9607 FirmwareMdm9650 Firmware+5 more Nov 21, 2024 Oct 23, 2018 N/A· v4 5.5 MEDIUM· v3 4.9 MEDIUM· v2 Secure display content could be accessed by third party trusted application after creating a fault in other trusted applications in Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, SD 210/SD 212/S...Show more Secure display content could be accessed by third party trusted application after creating a fault in other trusted applications in Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 835, SDA660.Show less
CVE-2018-18428 1Tp Link 1Tl Sc3130 Firmware Nov 21, 2024 Oct 19, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 TP-Link TL-SC3130 1.6.18P12_121101 devices allow unauthenticated RTSP stream access, as demonstrated by a /jpg/image.jpg URI.
CVE-2018-12673 1Sv3c 1H.264 Poe Ip Camera Firmware Nov 21, 2024 Oct 19, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An attacker with remote access to the SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B) web interface can disclose information about the camera including camera hardware, wireles...Show more An attacker with remote access to the SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B) web interface can disclose information about the camera including camera hardware, wireless network, and local area network information.Show less
CVE-2018-12671 1Sv3c 1H.264 Poe Ip Camera Firmware Nov 21, 2024 Oct 19, 2018 N/A· v4 9.8 CRITICAL· v3 5.0 MEDIUM· v2 An attacker with remote access to the SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B) web interface can disclose information about the camera including all password sets set wi...Show more An attacker with remote access to the SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B) web interface can disclose information about the camera including all password sets set within the camera. This information can then be used to gain access to the web interface.Show less
CVE-2018-18390 1Moxa 1Thingspro Nov 21, 2024 Oct 19, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 User Enumeration in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.
CVE-2018-15765 1Dell 1Emc Secure Remote Services Nov 21, 2024 Oct 18, 2018 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains an Information Exposure vulnerability. The log file contents store sensitive data including executed commands to generate authentication tokens whic...Show more Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains an Information Exposure vulnerability. The log file contents store sensitive data including executed commands to generate authentication tokens which may prove useful to an attacker for crafting malicious authentication tokens for querying the application and subsequent attacks.Show less
CVE-2018-18487 1Gxlcms 1Gxlcms Nov 21, 2024 Oct 18, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, the database backup filename generation uses mt_rand() unsafely, resulting in predictable database backup file locations.
CVE-2018-12374 4Canonical DebianMozilla+1 more 7Debian Linux Enterprise LinuxEnterprise Linux Desktop+4 more Nov 21, 2024 Oct 18, 2018 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 Plaintext of decrypted emails can leak through by user submitting an embedded form by pressing enter key within a text input field. This vulnerability affects Thunderbird < 52.9.
CVE-2018-12373 4Canonical DebianMozilla+1 more 7Debian Linux Enterprise LinuxEnterprise Linux Desktop+4 more Nov 21, 2024 Oct 18, 2018 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 dDecrypted S/MIME parts hidden with CSS or the plaintext HTML tag can leak plaintext when included in a HTML reply/forward. This vulnerability affects Thunderbird < 52.9.
CVE-2018-12372 4Canonical DebianMozilla+1 more 7Debian Linux Enterprise LinuxEnterprise Linux Desktop+4 more Nov 21, 2024 Oct 18, 2018 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Decrypted S/MIME parts, when included in HTML crafted for an attack, can leak plaintext when included in a a HTML reply/forward. This vulnerability affects Thunderbird < 52.9.
CVE-2018-12365 4Canonical DebianMozilla+1 more 11Debian Linux Enterprise Linux DesktopEnterprise Linux Server+8 more Nov 21, 2024 Oct 18, 2018 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system without user consent or interaction. This could result in exposure of private local files. This vuln...Show more A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system without user consent or interaction. This could result in exposure of private local files. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.Show less
CVE-2018-12358 2Canonical Mozilla 2Firefox Ubuntu Linux Nov 21, 2024 Oct 18, 2018 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 Service workers can use redirection to avoid the tainting of cross-origin resources in some instances, allowing a malicious site to read responses which are supposed to be opaque. This vulnerability affects Firefox < 61.
CVE-2018-0442 1Cisco 1Wireless Lan Controller Software Nov 21, 2024 Oct 17, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol component of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to retrieve memory con...Show more A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol component of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to retrieve memory contents, which could lead to the disclosure of confidential information. The vulnerability is due to insufficient condition checks in the part of the code that handles CAPWAP keepalive requests. An attacker could exploit this vulnerability by sending a crafted CAPWAP keepalive packet to a vulnerable Cisco WLC device. A successful exploit could allow the attacker to retrieve the contents of device memory, which could lead to the disclosure of confidential information.Show less
CVE-2018-14597 1Broadcom 2Ca Identity Governance Ca Identity Suite Virtual Appliance Nov 21, 2024 Oct 17, 2018 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 CA Technologies Identity Governance 12.6, 14.0, 14.1, and 14.2 and CA Identity Suite Virtual Appliance 14.0, 14.1, and 14.2 provide telling error messages that may allow remote attackers to enumerate account names.
CVE-2018-18376 1Orange 1Airbox Firmware Nov 21, 2024 Oct 16, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 goform/getWlanClientInfo in Orange AirBox Y858_FL_01.16_04 allows remote attackers to discover information about currently connected devices (hostnames, IP addresses, MAC addresses, and connection time) via the rand para...Show more goform/getWlanClientInfo in Orange AirBox Y858_FL_01.16_04 allows remote attackers to discover information about currently connected devices (hostnames, IP addresses, MAC addresses, and connection time) via the rand parameter.Show less
CVE-2018-18073 4Artifex CanonicalDebian+1 more 9Debian Linux Enterprise Linux DesktopEnterprise Linux Server+6 more Nov 21, 2024 Oct 15, 2018 N/A· v4 6.3 MEDIUM· v3 4.3 MEDIUM· v2 Artifex Ghostscript allows attackers to bypass a sandbox protection mechanism by leveraging exposure of system operators in the saved execution stack in an error object.

Previous 1...328329330...597 Next