Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CVEs (11,927)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2018-7938 1Huawei 1P10 Firmware Jun 17, 2026 Sep 4, 2018 N/A· v4 3.3 LOW· v3 4.3 MEDIUM· v2 P10 Huawei smartphones with the versions before Victoria-AL00AC00B217 have an information leak vulnerability due to the lack of permission validation. An attacker tricks a user into installing a malicious application on...Show more P10 Huawei smartphones with the versions before Victoria-AL00AC00B217 have an information leak vulnerability due to the lack of permission validation. An attacker tricks a user into installing a malicious application on the smart phone, and the application can read some hardware serial number, which may cause sensitive information leak.Show less
CVE-2018-10927 4Debian GlusterOpensuse+1 more 5Debian Linux Enterprise Linux ServerGlusterfs+2 more Nov 21, 2024 Sep 4, 2018 N/A· v4 8.1 HIGH· v3 5.5 MEDIUM· v2 A flaw was found in RPC request using gfs3_lookup_req in glusterfs server. An authenticated attacker could use this flaw to leak information and execute remote denial of service by crashing gluster brick process.
CVE-2018-10913 4Debian GlusterOpensuse+1 more 5Debian Linux Enterprise Linux ServerGlusterfs+2 more Nov 21, 2024 Sep 4, 2018 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 An information disclosure vulnerability was discovered in glusterfs server. An attacker could issue a xattr request via glusterfs FUSE to determine the existence of any file.
CVE-2018-10911 4Debian GlusterOpensuse+1 more 7Debian Linux Enterprise Linux DesktopEnterprise Linux Server+4 more Nov 21, 2024 Sep 4, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A flaw was found in the way dic_unserialize function of glusterfs does not handle negative key length values. An attacker could use this flaw to read memory from other locations into the stored dict value.
CVE-2018-16323 2Canonical Imagemagick 2Imagemagick Ubuntu Linux Nov 21, 2024 Sep 1, 2018 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 ReadXBMImage in coders/xbm.c in ImageMagick before 7.0.8-9 leaves data uninitialized when processing an XBM file that has a negative pixel value. If the affected code is used as a library loaded into a process that inclu...Show more ReadXBMImage in coders/xbm.c in ImageMagick before 7.0.8-9 leaves data uninitialized when processing an XBM file that has a negative pixel value. If the affected code is used as a library loaded into a process that includes sensitive information, that information sometimes can be leaked via the image data.Show less
CVE-2018-6259 1Nvidia 1Geforce Experience Jun 17, 2026 Aug 31, 2018 N/A· v4 2.5 LOW· v3 1.9 LOW· v2 NVIDIA GeForce Experience all versions prior to 3.14.1 contains a potential vulnerability when GameStream is enabled, an attacker has system access, and certain system features are enabled, where limited information disc...Show more NVIDIA GeForce Experience all versions prior to 3.14.1 contains a potential vulnerability when GameStream is enabled, an attacker has system access, and certain system features are enabled, where limited information disclosure may be possible.Show less
CVE-2018-15364 1Trendmicro 1Officescan Xg Nov 21, 2024 Aug 30, 2018 N/A· v4 4.7 MEDIUM· v3 1.9 LOW· v2 A Named Pipe Request Processing Out-of-Bounds Read Information Disclosure vulnerability in Trend Micro OfficeScan XG (12.0) could allow a local attacker to disclose sensitive information on vulnerable installations. An a...Show more A Named Pipe Request Processing Out-of-Bounds Read Information Disclosure vulnerability in Trend Micro OfficeScan XG (12.0) could allow a local attacker to disclose sensitive information on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit the vulnerability.Show less
CVE-2018-14902 1Epson 1Iprint Nov 21, 2024 Aug 30, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The ContentProvider in the EPSON iPrint application 6.6.3 for Android does not properly restrict data access. This allows an attacker's application to read scanned documents.
CVE-2016-0205 1Ibm 1Cloud Orchestrator Nov 21, 2024 Aug 30, 2018 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 A vulnerability has been identified in IBM Cloud Orchestrator 2.3, 2.3.0.1, 2.4, and 2.4.0.1 that could allow an attacker after authentication to enumerate valid users of the system. IBM X-Force ID: 109394.
CVE-2014-6048 1Phpmyfaq 1Phpmyfaq Nov 21, 2024 Aug 28, 2018 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 phpMyFAQ before 2.8.13 allows remote attackers to read arbitrary attachments via a direct request.
CVE-2018-13391 1Atlassian 2Jira Jira Server Nov 21, 2024 Aug 28, 2018 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 The ProfileLinkUserFormat component of Jira Server before version 7.6.8, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 befo...Show more The ProfileLinkUserFormat component of Jira Server before version 7.6.8, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3 and from version 7.11.0 before version 7.11.2 allows remote attackers who can access & view an issue to obtain the email address of the reporter and assignee user of an issue despite the configured email visibility setting being set to hidden.Show less
CVE-2018-1705 1Ibm 2Platform Symphony Spectrum Symphony Nov 21, 2024 Aug 28, 2018 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 contain an information disclosure vulnerability that could allow an authenticated attacker to obtain highly sensitive information...Show more IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 contain an information disclosure vulnerability that could allow an authenticated attacker to obtain highly sensitive information. IBM X-Force ID: 146340.Show less
CVE-2018-15919 2Netapp Openbsd 6Cloud Backup Cn1610 FirmwareData Ontap Edge+3 more Dec 18, 2025 Aug 28, 2018 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. NOTE: the discoverer states 'We understand that t...Show more Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. NOTE: the discoverer states 'We understand that the OpenSSH developers do not want to treat such a username enumeration (or "oracle") as a vulnerability.'Show less
CVE-2017-15139 2Openstack Redhat 2Cinder Openstack Nov 21, 2024 Aug 27, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to contain previous data. It specifically affects ScaleIO volumes...Show more A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to contain previous data. It specifically affects ScaleIO volumes using thin volumes and zero padding. This could lead to leakage of sensitive information between tenants.Show less
CVE-2018-1644 1Ibm 1Websphere Commerce Nov 21, 2024 Aug 27, 2018 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 9.0.0.0 - 9.0.0.4, 8.0.0.0 - 8.0.0.19, 8.0.1.0 - 8.0.1.13, 8.0.3.0 - 8.0.3.6, 8.0.4.0 - 8.0.4.14, and 7.0.0.0 Feature Pack 8 could allow an authenti...Show more IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 9.0.0.0 - 9.0.0.4, 8.0.0.0 - 8.0.0.19, 8.0.1.0 - 8.0.1.13, 8.0.3.0 - 8.0.3.6, 8.0.4.0 - 8.0.4.14, and 7.0.0.0 Feature Pack 8 could allow an authenticated user to obtain sensitive information about another user.Show less
CVE-2018-15698 1Asustor 1Data Master Nov 21, 2024 Aug 27, 2018 N/A· v4 6.5 MEDIUM· v3 6.8 MEDIUM· v2 ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to read any file on the file system when providing the full path to loginimage.cgi.
CVE-2018-15697 1Asustor 1Data Master Nov 21, 2024 Aug 27, 2018 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to read any file on a share by providing the full path. For example, /home/admin/.ash_history.
CVE-2018-15696 1Asustor 1Data Master Nov 21, 2024 Aug 27, 2018 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to enumerate all user accounts via user.cgi.
CVE-2017-18345 1Joomanager Project 1Joomanager Nov 21, 2024 Aug 26, 2018 N/A· v4 9.8 CRITICAL· v3 5.0 MEDIUM· v2 The Joomanager component through 2.0.0 for Joomla! has an arbitrary file download issue, resulting in exposing the credentials of the database via an index.php?option=com_joomanager&controller=details&task=download&path=...Show more The Joomanager component through 2.0.0 for Joomla! has an arbitrary file download issue, resulting in exposing the credentials of the database via an index.php?option=com_joomanager&controller=details&task=download&path=configuration.php request.Show less
CVE-2018-11654 1Seasofsolutions 1Ip Camera Firmware Nov 21, 2024 Aug 24, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Information disclosure in Netwave IP camera at get_status.cgi (via HTTP on port 8000) allows an unauthenticated attacker to exfiltrate sensitive information from the device.

Previous 1...334335336...597 Next