Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CVEs (11,770)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2017-0068 1Microsoft 1Edge May 13, 2026 Mar 17, 2017 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 Browsers in Microsoft Edge allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Microsoft Edge Information Disclosure Vulnerability." This vulnerability is different fro...Show more Browsers in Microsoft Edge allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Microsoft Edge Information Disclosure Vulnerability." This vulnerability is different from those described in CVE-2017-0009, CVE-2017-0011, CVE-2017-0017, and CVE-2017-0065.Show less
CVE-2017-0065 1Microsoft 1Edge May 13, 2026 Mar 17, 2017 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 Microsoft Edge allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability." This vulnerability is different from those...Show more Microsoft Edge allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability." This vulnerability is different from those described in CVE-2017-0009, CVE-2017-0011, CVE-2017-0017, and CVE-2017-0068.Show less
CVE-2017-0063 1Microsoft 8Windows 10 Windows 7Windows 8.1+5 more May 13, 2026 Mar 17, 2017 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 The Color Management Module (ICM32.dll) memory handling functionality in Windows Vista SP2; Windows Server 2008 SP2 and R2; and Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold...Show more The Color Management Module (ICM32.dll) memory handling functionality in Windows Vista SP2; Windows Server 2008 SP2 and R2; and Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to bypass ASLR and execute code in combination with another vulnerability through a crafted website, aka "Microsoft Color Management Information Disclosure Vulnerability." This vulnerability is different from that described in CVE-2017-0061.Show less
CVE-2017-0062 1Microsoft 7Windows 10 Windows 7Windows 8.1+4 more May 13, 2026 Mar 17, 2017 N/A· v4 4.7 MEDIUM· v3 1.9 LOW· v2 The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 all...Show more The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "GDI+ Information Disclosure Vulnerability." This vulnerability is different from those described in CVE-2017-0060 and CVE-2017-0073.Show less
CVE-2017-0061 1Microsoft 3Windows 7 Windows Server 2008Windows Vista May 13, 2026 Mar 17, 2017 N/A· v4 5.3 MEDIUM· v3 2.6 LOW· v2 The Color Management Module (ICM32.dll) memory handling functionality in Windows Vista SP2, Windows Server 2008 SP2 and R2, and Windows 7 SP1 allows remote attackers to bypass ASLR and execute code in combination with an...Show more The Color Management Module (ICM32.dll) memory handling functionality in Windows Vista SP2, Windows Server 2008 SP2 and R2, and Windows 7 SP1 allows remote attackers to bypass ASLR and execute code in combination with another vulnerability through a crafted website, aka "Microsoft Color Management Information Disclosure Vulnerability." This vulnerability is different from that described in CVE-2017-0063.Show less
CVE-2017-0060 1Microsoft 14Live Meeting LyncOffice+11 more May 13, 2026 Mar 17, 2017 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 all...Show more The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "GDI+ Information Disclosure Vulnerability." This vulnerability is different from those described in CVE-2017-0060 and CVE-2017-0062.Show less
CVE-2017-0057 1Microsoft 5Windows 10 Windows 8.1Windows Rt 8.1+2 more May 13, 2026 Mar 17, 2017 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 DNS client in Microsoft Windows 8.1; Windows Server 2012 R2, Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 fails to properly process DNS queries, which allows remote attackers to obtain sensiti...Show more DNS client in Microsoft Windows 8.1; Windows Server 2012 R2, Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 fails to properly process DNS queries, which allows remote attackers to obtain sensitive information via (1) convincing a workstation user to visit an untrusted webpage or (2) tricking a server into sending a DNS query to a malicious DNS server, aka "Windows DNS Query Information Disclosure Vulnerability."Show less
CVE-2017-0049 1Microsoft 1Internet Explorer May 13, 2026 Mar 17, 2017 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 The VBScript engine in Microsoft Internet Explorer 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Scripting Engine Information Disclosure Vulnerability." This...Show more The VBScript engine in Microsoft Internet Explorer 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Scripting Engine Information Disclosure Vulnerability." This vulnerability is different from those described in CVE-2017-0018, and CVE-2017-0037.Show less
CVE-2017-0043 1Microsoft 4Windows 10 Windows Server 2008Windows Server 2012+1 more May 13, 2026 Mar 17, 2017 N/A· v4 5.3 MEDIUM· v3 2.9 LOW· v2 Active Directory Federation Services in Microsoft Windows 10 1607, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 Gold and R2, and Windows Server 2016 allows local users to obtain sensitive information via a cra...Show more Active Directory Federation Services in Microsoft Windows 10 1607, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 Gold and R2, and Windows Server 2016 allows local users to obtain sensitive information via a crafted application, aka "Microsoft Active Directory Federation Services Information Disclosure Vulnerability."Show less
CVE-2017-0042 1Microsoft 8Windows 10 Windows 7Windows 8.1+5 more May 13, 2026 Mar 17, 2017 N/A· v4 3.1 LOW· v3 2.6 LOW· v2 Windows Media Player in Microsoft Windows 8.1; Windows Server 2012 R2; Windows RT 8.1; Windows 7 SP1; Windows 2008 SP2 and R2 SP1, Windows Server 2016; Windows Vista SP2; and Windows 10 Gold, 1511, and 1607 allows remote...Show more Windows Media Player in Microsoft Windows 8.1; Windows Server 2012 R2; Windows RT 8.1; Windows 7 SP1; Windows 2008 SP2 and R2 SP1, Windows Server 2016; Windows Vista SP2; and Windows 10 Gold, 1511, and 1607 allows remote attackers to obtain sensitive information via a crafted web site, aka "Windows Media Player Information Disclosure Vulnerability."Show less
CVE-2017-0027 1Microsoft 3Excel Office Compatibility PackSharepoint Server May 13, 2026 Mar 17, 2017 N/A· v4 4.7 MEDIUM· v3 2.6 LOW· v2 Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Services on SharePoint Server 2013 SP1 allow remote attackers to obtain sensitive information from process...Show more Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Services on SharePoint Server 2013 SP1 allow remote attackers to obtain sensitive information from process memory via a crafted Office document, aka "Microsoft Office Information Disclosure Vulnerability."Show less
CVE-2017-0011 1Microsoft 1Edge May 13, 2026 Mar 17, 2017 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 Microsoft Edge allows remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Edge Information Disclosure Vulnerability." This vulnerability is different from those described in CVE-2017-0...Show more Microsoft Edge allows remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Edge Information Disclosure Vulnerability." This vulnerability is different from those described in CVE-2017-0009, CVE-2017-0017, CVE-2017-0065, and CVE-2017-0068.Show less
CVE-2017-0009 1Microsoft 1Internet Explorer May 13, 2026 Mar 17, 2017 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability." This vulnerability is d...Show more Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability." This vulnerability is different from those described in CVE-2017-0011, CVE-2017-0017, CVE-2017-0065, and CVE-2017-0068.Show less
CVE-2017-0008 1Microsoft 1Internet Explorer May 13, 2026 Mar 17, 2017 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability." This vulnerability...Show more Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability." This vulnerability is different from those described in CVE-2017-0009 and CVE-2017-0059.Show less
CVE-2017-5537 1Weblate 1Weblate May 13, 2026 Mar 15, 2017 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a seri...Show more The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a series of requests.Show less
CVE-2017-5496 1Sawmill 1Sawmill May 13, 2026 Mar 15, 2017 N/A· v4 9.8 CRITICAL· v3 5.0 MEDIUM· v2 Sawmill Enterprise 8.7.9 allows remote attackers to gain login access by leveraging knowledge of a password hash.
CVE-2017-5583 1Paloaltonetworks 1Pan Os May 13, 2026 Mar 15, 2017 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 The Management Web Interface in Palo Alto Networks PAN-OS before 6.1.16, 7.0.x before 7.0.13, and 7.1.x before 7.1.8 allows remote authenticated users to read arbitrary files via unspecified vectors.
CVE-2016-8016 1Mcafee 1Virusscan Enterprise May 13, 2026 Mar 14, 2017 N/A· v4 3.4 LOW· v3 3.5 LOW· v2 Information exposure in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows authenticated remote attackers to obtain the existence of unauthorized files on the system via a URL parameter.
CVE-2016-8747 2Apache Netapp 3Oncommand Insight Oncommand ShiftTomcat Apr 16, 2026 Mar 14, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations. Http11InputBuffer.java allows remote attackers to read data that was intended to...Show more An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations. Http11InputBuffer.java allows remote attackers to read data that was intended to be associated with a different request.Show less
CVE-2014-8688 1Telegram 1Messenger May 13, 2026 Mar 14, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An issue was discovered in Telegram Messenger 2.6 for iOS and 1.8.2 for Android. Secret chat messages are available in cleartext in process memory and a .db file.

Previous 1...418419420...589 Next