Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CVEs (10,460)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2017-0027 1Microsoft 3Excel Office Compatibility PackSharepoint Server May 13, 2026 Mar 17, 2017 N/A· v4 4.7 MEDIUM· v3 2.6 LOW· v2 Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Services on SharePoint Server 2013 SP1 allow remote attackers to obtain sensitive information from process...Show more Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Services on SharePoint Server 2013 SP1 allow remote attackers to obtain sensitive information from process memory via a crafted Office document, aka "Microsoft Office Information Disclosure Vulnerability."Show less
CVE-2017-0011 1Microsoft 1Edge May 13, 2026 Mar 17, 2017 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 Microsoft Edge allows remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Edge Information Disclosure Vulnerability." This vulnerability is different from those described in CVE-2017-0...Show more Microsoft Edge allows remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Edge Information Disclosure Vulnerability." This vulnerability is different from those described in CVE-2017-0009, CVE-2017-0017, CVE-2017-0065, and CVE-2017-0068.Show less
CVE-2017-0009 1Microsoft 1Internet Explorer May 13, 2026 Mar 17, 2017 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability." This vulnerability is d...Show more Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability." This vulnerability is different from those described in CVE-2017-0011, CVE-2017-0017, CVE-2017-0065, and CVE-2017-0068.Show less
CVE-2017-0008 1Microsoft 1Internet Explorer May 13, 2026 Mar 17, 2017 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability." This vulnerability...Show more Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability." This vulnerability is different from those described in CVE-2017-0009 and CVE-2017-0059.Show less
CVE-2017-5537 1Weblate 1Weblate May 13, 2026 Mar 15, 2017 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a seri...Show more The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a series of requests.Show less
CVE-2017-5496 1Sawmill 1Sawmill May 13, 2026 Mar 15, 2017 N/A· v4 9.8 CRITICAL· v3 5.0 MEDIUM· v2 Sawmill Enterprise 8.7.9 allows remote attackers to gain login access by leveraging knowledge of a password hash.
CVE-2017-5583 1Paloaltonetworks 1Pan Os May 13, 2026 Mar 15, 2017 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 The Management Web Interface in Palo Alto Networks PAN-OS before 6.1.16, 7.0.x before 7.0.13, and 7.1.x before 7.1.8 allows remote authenticated users to read arbitrary files via unspecified vectors.
CVE-2016-8016 1Mcafee 1Virusscan Enterprise May 13, 2026 Mar 14, 2017 N/A· v4 3.4 LOW· v3 3.5 LOW· v2 Information exposure in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows authenticated remote attackers to obtain the existence of unauthorized files on the system via a URL parameter.
CVE-2016-8747 2Apache Netapp 3Oncommand Insight Oncommand ShiftTomcat Apr 16, 2026 Mar 14, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations. Http11InputBuffer.java allows remote attackers to read data that was intended to...Show more An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations. Http11InputBuffer.java allows remote attackers to read data that was intended to be associated with a different request.Show less
CVE-2014-8688 1Telegram 1Messenger May 13, 2026 Mar 14, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An issue was discovered in Telegram Messenger 2.6 for iOS and 1.8.2 for Android. Secret chat messages are available in cleartext in process memory and a .db file.
CVE-2015-6671 1Edx 1Edx Platform May 13, 2026 Mar 13, 2017 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging access to a databa...Show more Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging access to a database backup.Show less
CVE-2017-5674 1Embedthis 1Goahead May 13, 2026 Mar 13, 2017 N/A· v4 9.8 CRITICAL· v3 5.0 MEDIUM· v2 A vulnerability in a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models allows an attacker to craft a malformed HTTP ("GET system.ini HTTP/1.1\n\n" - note the lack of "/"...Show more A vulnerability in a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models allows an attacker to craft a malformed HTTP ("GET system.ini HTTP/1.1\n\n" - note the lack of "/" in the path field of the request) request that will disclose the configuration file with the login password.Show less
CVE-2016-5894 1Ibm 1Websphere Commerce May 13, 2026 Mar 8, 2017 N/A· v4 5.1 MEDIUM· v3 1.9 LOW· v2 IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 7.0 and 8.0 is vulnerable to information disclosure vulnerability. A local user could view a plain text password in a Unix console. IBM Reference #:...Show more IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 7.0 and 8.0 is vulnerable to information disclosure vulnerability. A local user could view a plain text password in a Unix console. IBM Reference #: 1997408.Show less
CVE-2017-0537 1Linux 1Linux Kernel May 13, 2026 Mar 8, 2017 N/A· v4 4.7 MEDIUM· v3 2.6 LOW· v2 An information disclosure vulnerability in the kernel USB gadget driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first require...Show more An information disclosure vulnerability in the kernel USB gadget driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-31614969.Show less
CVE-2017-0536 1Linux 1Linux Kernel May 13, 2026 Mar 8, 2017 N/A· v4 4.7 MEDIUM· v3 2.6 LOW· v2 An information disclosure vulnerability in the Synaptics touchscreen driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first req...Show more An information disclosure vulnerability in the Synaptics touchscreen driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-33555878.Show less
CVE-2017-0535 1Linux 1Linux Kernel May 13, 2026 Mar 8, 2017 N/A· v4 4.7 MEDIUM· v3 2.6 LOW· v2 An information disclosure vulnerability in the HTC sound codec driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires...Show more An information disclosure vulnerability in the HTC sound codec driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10. Android ID: A-33547247.Show less
CVE-2017-0534 1Linux 1Linux Kernel May 13, 2026 Mar 8, 2017 N/A· v4 4.7 MEDIUM· v3 2.6 LOW· v2 An information disclosure vulnerability in the Qualcomm video driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires c...Show more An information disclosure vulnerability in the Qualcomm video driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-32508732. References: QC-CR#1088206.Show less
CVE-2017-0533 1Linux 1Linux Kernel May 13, 2026 Mar 8, 2017 N/A· v4 4.7 MEDIUM· v3 2.6 LOW· v2 An information disclosure vulnerability in the Qualcomm video driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires c...Show more An information disclosure vulnerability in the Qualcomm video driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-32509422. References: QC-CR#1088206.Show less
CVE-2017-0532 1Google 1Android May 13, 2026 Mar 8, 2017 N/A· v4 4.7 MEDIUM· v3 2.6 LOW· v2 An information disclosure vulnerability in the MediaTek video codec driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requ...Show more An information disclosure vulnerability in the MediaTek video codec driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: N/A. Android ID: A-32370398. References: M-ALPS03069985.Show less
CVE-2017-0531 1Linux 1Linux Kernel May 13, 2026 Mar 8, 2017 N/A· v4 4.7 MEDIUM· v3 2.6 LOW· v2 An information disclosure vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires c...Show more An information disclosure vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-32877245. References: QC-CR#1087469.Show less

Previous 1...353354355...523 Next