← Back
CWE-200

11,754 CVEs • Abstraction: Class • Likelihood of Exploit: High

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

JSON object

Loading...

CVEs (11,754)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2016-8302
1Oracle
1Flexcube Universal Banking
May 13, 2026
Jan 27, 2017
N/A· v4
4.3 MEDIUM· v3
4.0 MEDIUM· v2
Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0 and...Show more
Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0 and 12.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle FLEXCUBE Universal Banking accessible data. CVSS v3.0 Base Score 4.3 (Confidentiality impacts).Show less
CVE-2016-5614
1Oracle
1Flexcube Private Banking
May 13, 2026
Jan 27, 2017
N/A· v4
4.3 MEDIUM· v3
4.0 MEDIUM· v2
Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Product / Instrument Search). Supported versions that are affected are 2.0.1, 2.2.0 and 12.0.1. Easi...Show more
Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Product / Instrument Search). Supported versions that are affected are 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle FLEXCUBE Private Banking accessible data. CVSS v3.0 Base Score 4.3 (Confidentiality impacts).Show less
CVE-2016-3996
1Samsung
1Knox
May 13, 2026
Jan 27, 2017
N/A· v4
5.5 MEDIUM· v3
4.3 MEDIUM· v2
ClipboardDataMgr in Samsung KNOX 1.0.0 and 2.3.0 does not properly check the caller, which allows local users to read KNOX clipboard data via a crafted application.
CVE-2016-1919
1Samsung
1Knox
May 13, 2026
Jan 27, 2017
N/A· v4
4.7 MEDIUM· v3
1.9 LOW· v2
Samsung KNOX 1.0 uses a weak eCryptFS Key generation algorithm, which makes it easier for local users to obtain sensitive information by leveraging knowledge of the TIMA key and a brute-force attack.
CVE-2016-10002
2Debian
Squid Cache
2Debian Linux
Squid
May 13, 2026
Jan 27, 2017
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leake...Show more
Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information.Show less
CVE-2016-9932
1Xen
1Xen
May 13, 2026
Jan 26, 2017
N/A· v4
3.3 LOW· v3
2.1 LOW· v2
CMPXCHG8B emulation in Xen 3.3.x through 4.7.x on x86 systems allows local HVM guest OS users to obtain sensitive information from host stack memory via a "supposedly-ignored" operand size prefix.
CVE-2017-3805
1Cisco
1Iox
May 13, 2026
Jan 26, 2017
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
A vulnerability in the web-based management interface of Cisco IOS and Cisco IOx Software could allow an unauthenticated, remote attacker to view confidential information that is displayed without authenticating to the d...Show more
A vulnerability in the web-based management interface of Cisco IOS and Cisco IOx Software could allow an unauthenticated, remote attacker to view confidential information that is displayed without authenticating to the device. Affected Products: This vulnerability affects Cisco IOS Software and Cisco IOx Software running on IR829, IR809, IE4K, and CGR1K platforms. More Information: CSCvb20897. Known Affected Releases: 1.0(0).Show less
CVE-2017-3797
1Cisco
1Webex Meetings Server
May 13, 2026
Jan 26, 2017
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to view the fully qualified domain name of the Cisco WebEx administration server. More Information: CSCvb60655. Known Affecte...Show more
A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to view the fully qualified domain name of the Cisco WebEx administration server. More Information: CSCvb60655. Known Affected Releases: 2.7.Show less
CVE-2017-5372
1Sap
1Netweaver
May 13, 2026
Jan 23, 2017
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
The function msp (aka MSPRuntimeInterface) in the P4 SERVERCORE component in SAP AS JAVA allows remote attackers to obtain sensitive system information by leveraging a missing authorization check for the (1) getInformati...Show more
The function msp (aka MSPRuntimeInterface) in the P4 SERVERCORE component in SAP AS JAVA allows remote attackers to obtain sensitive system information by leveraging a missing authorization check for the (1) getInformation, (2) getParameters, (3) getServiceInfo, (4) getStatistic, or (5) getClientStatistic function, aka SAP Security Note 2331908.Show less
CVE-2016-6668
1Atlassian
2Confluence Server
Jira Integration For Hipchat
May 13, 2026
Jan 23, 2017
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
The Atlassian Hipchat Integration Plugin for Bitbucket Server 6.26.0 before 6.27.5, 6.28.0 before 7.3.7, and 7.4.0 before 7.8.17; Confluence HipChat plugin 6.26.0 before 7.8.17; and HipChat for JIRA plugin 6.26.0 before...Show more
The Atlassian Hipchat Integration Plugin for Bitbucket Server 6.26.0 before 6.27.5, 6.28.0 before 7.3.7, and 7.4.0 before 7.8.17; Confluence HipChat plugin 6.26.0 before 7.8.17; and HipChat for JIRA plugin 6.26.0 before 7.8.17 allows remote attackers to obtain the secret key for communicating with HipChat instances by reading unspecified pages.Show less
CVE-2017-5182
1Novell
1Open Enterprise Server
May 13, 2026
Jan 23, 2017
N/A· v4
7.5 HIGH· v3
7.8 HIGH· v2
Remote Manager in Open Enterprise Server (OES) allows unauthenticated remote attackers to read any arbitrary file, via a specially crafted URL, that allows complete directory traversal and total information disclosure. T...Show more
Remote Manager in Open Enterprise Server (OES) allows unauthenticated remote attackers to read any arbitrary file, via a specially crafted URL, that allows complete directory traversal and total information disclosure. This vulnerability is present on all versions of OES for linux, it applies to OES2015 SP1 before Maintenance Update 11080, OES2015 before Maintenance Update 11079, OES11 SP3 before Maintenance Update 11078, OES11 SP2 before Maintenance Update 11077).Show less
CVE-2016-5014
1Moodle
1Moodle
May 13, 2026
Jan 20, 2017
N/A· v4
5.4 MEDIUM· v3
5.8 MEDIUM· v2
In Moodle 2.x and 3.x, an unenrolled user still receives event monitor notifications even though they can no longer access the course.
CVE-2016-5012
1Moodle
1Moodle
May 13, 2026
Jan 20, 2017
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
In Moodle 3.x, glossary search displays entries without checking user permissions to view them.
CVE-2016-10143
1Tiki
1Tikiwiki Cms/groupware
May 13, 2026
Jan 20, 2017
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
A vulnerability in Tiki Wiki CMS 15.2 could allow a remote attacker to read arbitrary files on a targeted system via a crafted pathname in a banner URL field.
CVE-2016-5220
1Google
1Chrome
May 13, 2026
Jan 19, 2017
N/A· v4
6.5 MEDIUM· v3
4.3 MEDIUM· v2
PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled navigation within PDFs, which allowed a remote attacker to read local files via a crafted PDF fil...Show more
PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled navigation within PDFs, which allowed a remote attacker to read local files via a crafted PDF file.Show less
CVE-2016-5212
1Google
1Chrome
May 13, 2026
Jan 19, 2017
N/A· v4
6.5 MEDIUM· v3
4.3 MEDIUM· v2
Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android insufficiently sanitized DevTools URLs, which allowed a remote attacker to read local files via a crafted HTML page.
CVE-2016-5201
1Google
1Chrome
May 13, 2026
Jan 19, 2017
N/A· v4
6.5 MEDIUM· v3
4.3 MEDIUM· v2
A leak of privateClass in the extensions API in Google Chrome prior to 54.0.2840.100 for Linux, and 54.0.2840.99 for Windows, and 54.0.2840.98 for Mac allowed a remote attacker to access privileged JavaScript code via a...Show more
A leak of privateClass in the extensions API in Google Chrome prior to 54.0.2840.100 for Linux, and 54.0.2840.99 for Windows, and 54.0.2840.98 for Mac allowed a remote attacker to access privileged JavaScript code via a crafted HTML page.Show less
CVE-2016-9680
1Citrix
1Provisioning Services
May 13, 2026
Jan 18, 2017
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
Citrix Provisioning Services before 7.12 allows attackers to obtain sensitive information from kernel memory via unspecified vectors.
CVE-2016-9677
1Citrix
1Provisioning Services
May 13, 2026
Jan 18, 2017
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
Citrix Provisioning Services before 7.12 allows attackers to obtain sensitive kernel address information via unspecified vectors.
CVE-2017-5223
1Phpmailer Project
1Phpmailer
May 13, 2026
Jan 16, 2017
N/A· v4
5.5 MEDIUM· v3
2.1 LOW· v2
An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to an HTML document to make it usable as an email message body. One of the transformations is to convert relative ima...Show more
An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to an HTML document to make it usable as an email message body. One of the transformations is to convert relative image URLs into attachments using a script-provided base directory. If no base directory is provided, it resolves to /, meaning that relative image URLs get treated as absolute local file paths and added as attachments. To form a remote vulnerability, the msgHTML method must be called, passed an unfiltered, user-supplied HTML document, and must not set a base directory.Show less