CWE-200
11,867 CVEs • Abstraction: Class • Likelihood of Exploit: High
Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVEs (11,867)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the "Graphics Drivers" component. It allows attackers to bypass intended memory-read restrictions via a crafted app. |
An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the "Intel Graphics Driver" component. It allows attackers to bypass intended memory-read restrictions via a crafted...Show more |
The install-chef-suse.sh script shipped with crowbar before 2012-10-02 is creating files containing confidential data with insecure permissions, allowing local users to read confidential data. |
Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, as demonstrated by discovering a license key. |
A vulnerability in the web portal authentication process of Cisco Prime Collaboration Provisioning could allow an unauthenticated, local attacker to view sensitive data. The vulnerability is due to improper logging of au...Show more |
aegir is a module to help automate JavaScript project management. Version 12.0.0 through and including 12.0.7 bundled and published to npm the user (that performed a aegir-release) GitHub token. |
1Coffescript Project 1Coffescript Nov 21, 2024 Jun 7, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The cofee-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. |
1Coffescript Project 1Coffescript Nov 21, 2024 Jun 7, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The coffescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. |
The jquey module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. |
1Coffescript Project 1Coffescript Nov 21, 2024 Jun 7, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The coffe-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. |
1Cofeescript Project 1Cofeescript Nov 21, 2024 Jun 7, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The cofeescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. |
The module botbait is a tool to be used to track bot and automated tools usage with-in the npm ecosystem. botbait is known to record and track user information. The module tracks the following information. Source IP proc...Show more |
1Cross Env.js Project 1Cross Env.js Nov 21, 2024 Jun 7, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 cross-env.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
nodesass was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
smb was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
1Shadowsock Project 1Shadowsock Nov 21, 2024 Jun 7, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 shadowsock was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
mongose was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
1Http Proxy.js Project 1Http Proxy.js Nov 21, 2024 Jun 7, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 http-proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
crossenv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |