Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CVEs (10,459)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2016-6859 1Sap 1Hybris May 6, 2026 Dec 31, 2016 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 Hybris Management Console (HMC) in SAP Hybris before 6.0 allows remote attackers to obtain sensitive information by triggering an error and then reading a Java stack trace.
CVE-2016-9845 1Qemu 1Qemu May 6, 2026 Dec 29, 2016 N/A· v4 6.5 MEDIUM· v3 2.1 LOW· v2 QEMU (aka Quick Emulator) built with the Virtio GPU Device emulator support is vulnerable to an information leakage issue. It could occur while processing 'VIRTIO_GPU_CMD_GET_CAPSET_INFO' command. A guest user/process co...Show more QEMU (aka Quick Emulator) built with the Virtio GPU Device emulator support is vulnerable to an information leakage issue. It could occur while processing 'VIRTIO_GPU_CMD_GET_CAPSET_INFO' command. A guest user/process could use this flaw to leak contents of the host memory bytes.Show less
CVE-2016-5329 1Vmware 1Fusion May 6, 2026 Dec 29, 2016 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 VMware Fusion 8.x before 8.5 on OS X, when System Integrity Protection (SIP) is enabled, allows local users to determine kernel memory addresses and bypass the kASLR protection mechanism via unspecified vectors.
CVE-2016-5328 1Vmware 1Tools May 6, 2026 Dec 29, 2016 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 VMware Tools 9.x and 10.x before 10.1.0 on OS X, when System Integrity Protection (SIP) is enabled, allows local users to determine kernel memory addresses and bypass the kASLR protection mechanism via unspecified vector...Show more VMware Tools 9.x and 10.x before 10.1.0 on OS X, when System Integrity Protection (SIP) is enabled, allows local users to determine kernel memory addresses and bypass the kASLR protection mechanism via unspecified vectors.Show less
CVE-2016-9756 1Linux 1Linux Kernel May 6, 2026 Dec 28, 2016 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 arch/x86/kvm/emulate.c in the Linux kernel before 4.8.12 does not properly initialize Code Segment (CS) in certain error cases, which allows local users to obtain sensitive information from kernel stack memory via a craf...Show more arch/x86/kvm/emulate.c in the Linux kernel before 4.8.12 does not properly initialize Code Segment (CS) in certain error cases, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.Show less
CVE-2016-9908 1Qemu 1Qemu May 6, 2026 Dec 23, 2016 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 Quick Emulator (Qemu) built with the Virtio GPU Device emulator support is vulnerable to an information leakage issue. It could occur while processing 'VIRTIO_GPU_CMD_GET_CAPSET' command. A guest user/process could use t...Show more Quick Emulator (Qemu) built with the Virtio GPU Device emulator support is vulnerable to an information leakage issue. It could occur while processing 'VIRTIO_GPU_CMD_GET_CAPSET' command. A guest user/process could use this flaw to leak contents of the host memory bytes.Show less
CVE-2016-6910 1Google 1Android May 6, 2026 Dec 23, 2016 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 The non-existent notification listener vulnerability was introduced in the initial Android 5.0.2 builds for the Samsung Galaxy S6 Edge devices, but the vulnerability can persist on the device even after the device has be...Show more The non-existent notification listener vulnerability was introduced in the initial Android 5.0.2 builds for the Samsung Galaxy S6 Edge devices, but the vulnerability can persist on the device even after the device has been upgraded to an Android 5.1.1 or 6.0.1 build. The vulnerable system app gives a non-existent app the ability to read the notifications from the device, which a third-party app can utilize if it uses a package name of com.samsung.android.app.portalservicewidget. This vulnerability allows an unprivileged third-party app to obtain the text of the user's notifications, which tend to contain personal data.Show less
CVE-2016-7555 1Ffmpeg 1Ffmpeg May 6, 2026 Dec 23, 2016 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 The avi_read_header function in libavformat/avidec.c in FFmpeg before 3.1.4 is vulnerable to memory leak when decoding an AVI file that has a crafted "strh" structure.
CVE-2016-7091 1Redhat 5Enterprise Linux Enterprise Linux DesktopEnterprise Linux Hpc Node+2 more May 6, 2026 Dec 22, 2016 N/A· v4 4.4 MEDIUM· v3 4.9 MEDIUM· v2 sudo: It was discovered that the default sudo configuration on Red Hat Enterprise Linux and possibly other Linux implementations preserves the value of INPUTRC which could lead to information disclosure. A local user wit...Show more sudo: It was discovered that the default sudo configuration on Red Hat Enterprise Linux and possibly other Linux implementations preserves the value of INPUTRC which could lead to information disclosure. A local user with sudo access to a restricted program that uses readline could use this flaw to read content from specially formatted files with elevated privileges provided by sudo.Show less
CVE-2016-7172 1Netapp 1Snap Creator Framework May 6, 2026 Dec 21, 2016 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 NetApp Snap Creator Framework before 4.3.1 discloses sensitive information which could be viewed by an unauthorized user.
CVE-2016-7295 1Microsoft 8Windows 10 Windows 7Windows 8.1+5 more May 6, 2026 Dec 20, 2016 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 The Common Log File System (CLFS) driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, a...Show more The Common Log File System (CLFS) driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows local users to obtain sensitive information from process memory via a crafted application, aka "Windows Common Log File System Driver Information Disclosure Vulnerability."Show less
CVE-2016-7284 1Microsoft 1Internet Explorer May 6, 2026 Dec 20, 2016 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 Microsoft Internet Explorer 10 and 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."
CVE-2016-7278 1Microsoft 1Internet Explorer May 6, 2026 Dec 20, 2016 N/A· v4 5.3 MEDIUM· v3 2.6 LOW· v2 Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Windows Hyperlink Object Library Information Disclosure Vulnerability."
CVE-2016-7258 1Microsoft 2Windows 10 Windows Server 2016 May 6, 2026 Dec 20, 2016 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 The kernel in Microsoft Windows 10 Gold, 1511, and 1607 and Windows Server 2016 mishandles page-fault system calls, which allows local users to obtain sensitive information from arbitrary processes via a crafted applicat...Show more The kernel in Microsoft Windows 10 Gold, 1511, and 1607 and Windows Server 2016 mishandles page-fault system calls, which allows local users to obtain sensitive information from arbitrary processes via a crafted application, aka "Windows Kernel Memory Address Information Disclosure Vulnerability."Show less
CVE-2016-7257 1Microsoft 4Office For Mac Windows 7Windows Server 2008+1 more May 6, 2026 Dec 20, 2016 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 The GDI component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Office for Mac 2011, and Office 2016 for Mac allows remote attackers to obtain sensitive information from process memor...Show more The GDI component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Office for Mac 2011, and Office 2016 for Mac allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "GDI Information Disclosure Vulnerability."Show less
CVE-2016-7219 1Microsoft 8Windows 10 Windows 7Windows 8.1+5 more May 6, 2026 Dec 20, 2016 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 The Crypto driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016...Show more The Crypto driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows local users to obtain sensitive information via a crafted application, aka "Windows Crypto Driver Information Disclosure Vulnerability."Show less
CVE-2016-10005 1Sap 1Solution Manager May 6, 2026 Dec 19, 2016 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Webdynpro in SAP Solman 7.1 through 7.31 allows remote attackers to obtain sensitive information via webdynpro/dispatcher/sap.com/caf~eu~gp~example~timeoff~wd requests, aka SAP Security Note 2344524.
CVE-2016-9159 1Siemens 2Simatic S7 300 Cpu Firmware Simatic S7 400 Cpu Firmware Jun 2, 2026 Dec 17, 2016 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 A vulnerability has been identified in SIMATIC S7-300 CPU family (All versions), SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP V6 and below CPU family (incl...Show more A vulnerability has been identified in SIMATIC S7-300 CPU family (All versions), SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP V6 and below CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 V6 and earlier CPU family (All versions), SIMATIC S7-400 V7 CPU family (All versions), SIMATIC S7-410 V8 CPU family (All versions), SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants) (All versions). An attacker with network access to port 102/tcp (ISO-TSAP) or via Profibus could obtain credentials from the PLC if protection-level 2 is configured on the affected devices.Show less
CVE-2016-8820 1Nvidia 1Gpu Driver May 6, 2026 Dec 16, 2016 N/A· v4 6.1 MEDIUM· v3 5.6 MEDIUM· v2 All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where a check on a function return value is missing, potentially allowing an unin...Show more All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where a check on a function return value is missing, potentially allowing an uninitialized value to be used as the source of a strcpy() call, leading to denial of service or information disclosure.Show less
CVE-2015-3271 1Apache 1Tika May 6, 2026 Dec 15, 2016 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Apache Tika server (aka tika-server) in Apache Tika 1.9 might allow remote attackers to read arbitrary files via the HTTP fileUrl header.

Previous 1...367368369...523 Next