CWE-200
11,756 CVEs • Abstraction: Class • Likelihood of Exploit: High
Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVEs (11,756)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
MatrixSSL before 3.8.3 configured with RSA Cipher Suites allows remote attackers to obtain sensitive information via a Bleichenbacher variant attack. |
MatrixSSL before 3.8.7, when the DHE_RSA based cipher suite is supported, makes it easier for remote attackers to obtain RSA private key information by conducting a Lenstra side-channel attack. |
The autocomplete feature in the E-Mail share dialog in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticated users to obtain sensitive information via u...Show more |
The password reset functionality in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 sends different error messages depending on whether the username is valid, which allows re...Show more |
2Linux Redhat2Enterprise Linux Linux KernelMay 13, 2026 Mar 3, 2017 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 Kernel Samepage Merging (KSM) in the Linux kernel 2.6.32 through 4.x does not prevent use of a write-timing side channel, which allows guest OS users to defeat the ASLR protection mechanism on other guest OS instances vi...Show more |
1Netapp 1Ontap Select Deploy Administration Utility May 13, 2026 Mar 1, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The NetApp ONTAP Select Deploy administration utility 2.0 through 2.2.1 might allow remote attackers to obtain sensitive information via unspecified vectors. |
1Siemens 3Sinumerik Integrate Access Mymachine/ethernet Sinumerik Integrate Operate ClientSinumerik OperateMay 13, 2026 Mar 1, 2017 N/A· v4 7.4 HIGH· v3 5.8 MEDIUM· v2 Siemens SINUMERIK Integrate Operate Clients between 2.0.3.00.016 (including) and 2.0.6 (excluding) and between 3.0.4.00.032 (including) and 3.0.6 (excluding) contain a vulnerability that could allow an attacker to read a...Show more |
Yandex Browser for iOS before 16.10.0.2357 does not properly restrict processing of facetime:// URLs, which allows remote attackers to initiate facetime-call without user's approval and obtain video and audio data from a...Show more |
5Allwinner AmdIntel+2 more20A64 Athlon Ii 640 X4Atom C2750+17 moreMay 13, 2026 Feb 27, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Page table walks conducted by the MMU during virtual to physical address translation leave a trace in the last level cache of modern ARM processors. By performing a side-channel attack on the MMU operations, it is possib...Show more |
5Allwinner AmdIntel+2 more20A64 Athlon Ii 640 X4Atom C2750+17 moreMay 13, 2026 Feb 27, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Page table walks conducted by the MMU during virtual to physical address translation leave a trace in the last level cache of modern AMD processors. By performing a side-channel attack on the MMU operations, it is possib...Show more |
5Allwinner AmdIntel+2 more20A64 Athlon Ii 640 X4Atom C2750+17 moreMay 13, 2026 Feb 27, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Page table walks conducted by the MMU during virtual to physical address translation leave a trace in the last level cache of modern Intel processors. By performing a side-channel attack on the MMU operations, it is poss...Show more |
Plone 3.3 through 5.1a1 allows remote attackers to obtain information about the ID of sensitive content via unspecified vectors. |
In versions of wolfSSL before 3.10.2 the function fp_mul_comba makes it easier to extract RSA key information for a malicious user who has access to view cache on a machine. |
1Dlink 1Websmart Dgs 1510 Series Firmware May 13, 2026 Feb 23, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 D-Link DGS-1510-28XMP, DGS-1510-28X, DGS-1510-52X, DGS-1510-52, DGS-1510-28P, DGS-1510-28, and DGS-1510-20 Websmart devices with firmware before 1.31.B003 allow attackers to conduct Unauthenticated Information Disclosure...Show more |
Under non-standard configurations, IBM WebSphere MQ might send password data in clear text over the network. This data could be intercepted using man in the middle techniques. |
Xen 4.7 allows local guest OS users to obtain sensitive host information by loading a 32-bit ELF symbol table. |
1Cisco 1Intrusion Prevention System Device Manager May 13, 2026 Feb 22, 2017 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 A vulnerability in the web-based management interface of the Cisco Intrusion Prevention System Device Manager (IDM) could allow an unauthenticated, remote attacker to view sensitive information stored in certain HTML com...Show more |
1Cisco 1Secure Access Control System May 13, 2026 Feb 22, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A vulnerability in the web interface of the Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to disclose sensitive information. More Information: CSCvc04854. Known Affected Release...Show more |
1Cisco 1Unified Communications Manager May 13, 2026 Feb 22, 2017 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 A vulnerability in the web framework Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to view sensitive data. More Information: CSCvb61689. Known Affected Releases: 11.5(1.11007.2). Kn...Show more |
1Dell 1Vce Vision Intelligent Operations May 13, 2026 Feb 21, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The "Plug-in for VMware vCenter" in VCE Vision Intelligent Operations before 2.6.5 sends a cleartext HTTP response upon a request for the Settings screen, which allows remote attackers to discover the admin user password...Show more |