← Back
CWE-200

10,417 CVEs • Abstraction: Class • Likelihood of Exploit: High

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

JSON object

Loading...

CVEs (10,417)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2015-6355
1Cisco
1Unified Computing System
May 6, 2026
Nov 4, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The web interface in Cisco Unified Computing System (UCS) 2.2(5b)A on blade servers allows remote attackers to obtain potentially sensitive version information by visiting an unspecified URL, aka Bug ID CSCuw87226.
CVE-2015-8074
1Google
1Android
May 6, 2026
Nov 3, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
mediaserver in Android before 5.1.1 LMY48X allows remote attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, aka internal bugs 23540907 and 2351514...Show more
mediaserver in Android before 5.1.1 LMY48X allows remote attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, aka internal bugs 23540907 and 23515142, a different vulnerability than CVE-2015-6611.Show less
CVE-2015-6611
1Google
1Android
May 6, 2026
Nov 3, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
mediaserver in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, aka internal...Show more
mediaserver in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, aka internal bugs 23905951, 23912202, 23953967, 23696300, 23600291, 23756261, 23541506, 23284974, 23542351, and 23542352, a different vulnerability than CVE-2015-8074.Show less
CVE-2015-6352
1Cisco
2Hosted Collaboration Solution
Unified Communications Domain Manager
May 6, 2026
Oct 30, 2015
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Cisco Unified Communications Domain Manager before 10.6(1) provides different error messages for pathname access attempts depending on whether the pathname exists, which allows remote attackers to map a filesystem via a...Show more
Cisco Unified Communications Domain Manager before 10.6(1) provides different error messages for pathname access attempts depending on whether the pathname exists, which allows remote attackers to map a filesystem via a series of requests, aka Bug ID CSCut67891.Show less
CVE-2015-6344
1Cisco
1Asa Cx Context Aware Security Software
May 6, 2026
Oct 30, 2015
N/A· v4
N/A· v3
4.0 MEDIUM· v2
The web-based GUI in Cisco Adaptive Security Appliance (ASA) CX Context-Aware Security 9.3(4.1.11) allows remote authenticated users to bypass intended access restrictions and obtain sensitive user information via an uns...Show more
The web-based GUI in Cisco Adaptive Security Appliance (ASA) CX Context-Aware Security 9.3(4.1.11) allows remote authenticated users to bypass intended access restrictions and obtain sensitive user information via an unspecified HTTP request, aka Bug ID CSCuv74105.Show less
CVE-2015-7859
1Joomla
1Joomla
May 6, 2026
Oct 29, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The com_contenthistory component in Joomla! 3.2 before 3.4.5 does not properly check ACLs, which allows remote attackers to obtain sensitive information via unspecified vectors.
CVE-2015-7902
1Infinite Automation Systems
1Mango Automation
May 6, 2026
Oct 28, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 provides different error messages for failed login attempts in unspecified circumstances, which allows remote attackers to obtain sensitive info...Show more
Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 provides different error messages for failed login attempts in unspecified circumstances, which allows remote attackers to obtain sensitive information via a series of requests.Show less
CVE-2015-7900
1Infinite Automation Systems
1Mango Automation
May 6, 2026
Oct 28, 2015
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote attackers to obtain sensitive debugging information by entering a crafted URL to trigger an exception, and then visiting a certain...Show more
Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote attackers to obtain sensitive debugging information by entering a crafted URL to trigger an exception, and then visiting a certain status page.Show less
CVE-2015-7836
1Siemens
1Ruggedcom Rugged Operating System
May 6, 2026
Oct 28, 2015
N/A· v4
N/A· v3
3.3 LOW· v2
Siemens RUGGEDCOM ROS before 4.2.1 allows remote attackers to obtain sensitive information by sniffing the network for VLAN data within the padding section of an Ethernet frame.
CVE-2015-5713
1Tibco
2Spotfire Analytics Platform For Aws
Spotfire Server
May 6, 2026
Oct 28, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Spotfire Parsing Library and Spotfire Security Filter in TIBCO Spotfire Server 5.5.x before 5.5.4, 6.0.x before 6.0.5, 6.5.x before 6.5.4, and 7.0.x before 7.0.1 and Spotfire Analytics Platform before 7.0.2 for AWS Marke...Show more
Spotfire Parsing Library and Spotfire Security Filter in TIBCO Spotfire Server 5.5.x before 5.5.4, 6.0.x before 6.0.5, 6.5.x before 6.5.4, and 7.0.x before 7.0.1 and Spotfire Analytics Platform before 7.0.2 for AWS Marketplace allow remote attackers to obtain sensitive log information by visiting an unspecified URL.Show less
CVE-2015-5712
1Tibco
2Spotfire Analytics Platform For Aws
Spotfire Server
May 6, 2026
Oct 28, 2015
N/A· v4
N/A· v3
4.0 MEDIUM· v2
Spotfire Parsing Library and Spotfire Security Filter in TIBCO Spotfire Server 5.5.x before 5.5.4, 6.0.x before 6.0.5, 6.5.x before 6.5.4, and 7.0.x before 7.0.1 and Spotfire Analytics Platform before 7.0.2 for AWS Marke...Show more
Spotfire Parsing Library and Spotfire Security Filter in TIBCO Spotfire Server 5.5.x before 5.5.4, 6.0.x before 6.0.5, 6.5.x before 6.5.4, and 7.0.x before 7.0.1 and Spotfire Analytics Platform before 7.0.2 for AWS Marketplace allow remote authenticated users to obtain sensitive system information by visiting an unspecified URL.Show less
CVE-2015-3969
1Janitza
5Umg 508
Umg 509Umg 511+2 more
May 6, 2026
Oct 28, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Janitza UMG 508, 509, 511, 604, and 605 devices allow remote attackers to obtain sensitive network-connection information via a request to UDP port (1) 1234 or (2) 1235.
CVE-2015-5223
1Openstack
1Swift
May 6, 2026
Oct 26, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
OpenStack Object Storage (Swift) before 2.4.0 allows attackers to obtain sensitive information via a PUT tempurl and a DLO object manifest that references an object in another container.
CVE-2015-5288
1Postgresql
1Postgresql
May 6, 2026
Oct 26, 2015
N/A· v4
N/A· v3
6.4 MEDIUM· v2
The crypt function in contrib/pgcrypto in PostgreSQL before 9.0.23, 9.1.x before 9.1.19, 9.2.x before 9.2.14, 9.3.x before 9.3.10, and 9.4.x before 9.4.5 allows attackers to cause a denial of service (server crash) or re...Show more
The crypt function in contrib/pgcrypto in PostgreSQL before 9.0.23, 9.1.x before 9.1.19, 9.2.x before 9.2.14, 9.3.x before 9.3.10, and 9.4.x before 9.4.5 allows attackers to cause a denial of service (server crash) or read arbitrary server memory via a "too-short" salt.Show less
CVE-2015-5448
1Numara
1Asset Manager
May 6, 2026
Oct 26, 2015
N/A· v4
N/A· v3
2.1 LOW· v2
HP Asset Manager 9.40 and 9.41 before 9.41.11103 P4-rev1 and 9.50 before 9.50.11925 P3 allows local users to obtain sensitive information via unspecified vectors.
CVE-2015-4981
1Ibm
2General Parallel File System
Spectrum Scale
May 6, 2026
Oct 26, 2015
N/A· v4
N/A· v3
2.1 LOW· v2
IBM General Parallel File System (GPFS) 3.5.x before 3.5.0.27 and 4.1.x before 4.1.1.2 and Spectrum Scale 4.1.1.x before 4.1.1.2 allow local users to obtain sensitive information from system memory via unspecified vector...Show more
IBM General Parallel File System (GPFS) 3.5.x before 3.5.0.27 and 4.1.x before 4.1.1.2 and Spectrum Scale 4.1.1.x before 4.1.1.2 allow local users to obtain sensitive information from system memory via unspecified vectors.Show less
CVE-2015-1005
1Ininet Solutions
1Scada Web Server
May 6, 2026
Oct 25, 2015
N/A· v4
N/A· v3
2.1 LOW· v2
IniNet embeddedWebServer (aka eWebServer) before 2.02 for Windows CE uses cleartext for password storage, which allows context-dependent attackers to obtain sensitive information via unspecified vectors.
CVE-2015-7022
1Apple
1Iphone Os
May 6, 2026
Oct 23, 2015
N/A· v4
N/A· v3
4.3 MEDIUM· v2
The Telephony subsystem in Apple iOS before 9.1 allows attackers to obtain sensitive call-status information via a crafted app.
CVE-2015-7000
1Apple
1Iphone Os
May 6, 2026
Oct 23, 2015
N/A· v4
N/A· v3
2.1 LOW· v2
Notification Center in Apple iOS before 9.1 mishandles changes to "Show on Lock Screen" settings, which allows physically proximate attackers to obtain sensitive information by looking for a (1) Phone or (2) Messages not...Show more
Notification Center in Apple iOS before 9.1 mishandles changes to "Show on Lock Screen" settings, which allows physically proximate attackers to obtain sensitive information by looking for a (1) Phone or (2) Messages notification on the lock screen soon after a setting was disabled.Show less
CVE-2015-7032
1Apple
4Iwork
KeynoteNumbers+1 more
May 6, 2026
Oct 18, 2015
N/A· v4
N/A· v3
4.3 MEDIUM· v2
The Apple iWork application before 2.6 for iOS, Apple Keynote before 6.6, Apple Pages before 5.6, and Apple Numbers before 3.6 allow remote attackers to obtain sensitive information via a crafted document.