← Back
CWE-200

10,400 CVEs • Abstraction: Class • Likelihood of Exploit: High

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

JSON object

Loading...

CVEs (10,400)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2014-3543
1Moodle
1Moodle
May 6, 2026
Jul 29, 2014
N/A· v4
N/A· v3
4.3 MEDIUM· v2
mod/imscp/locallib.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via a package with a manifest file cont...Show more
mod/imscp/locallib.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via a package with a manifest file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue affecting IMSCP resources and the IMSCC format.Show less
CVE-2014-3542
1Moodle
1Moodle
May 6, 2026
Jul 29, 2014
N/A· v4
N/A· v3
4.3 MEDIUM· v2
mod/lti/service.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via an XML external entity declaration in...Show more
mod/lti/service.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.Show less
CVE-2014-3304
1Cisco
1Webex Meetings Server
May 6, 2026
Jul 28, 2014
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The OutlookAction Class in Cisco WebEx Meetings Server allows remote attackers to enumerate user accounts by entering crafted URLs and examining the returned messages, aka Bug ID CSCuj81722.
CVE-2014-3303
1Cisco
1Webex Meetings Server
May 6, 2026
Jul 28, 2014
N/A· v4
N/A· v3
4.0 MEDIUM· v2
The web framework in Cisco WebEx Meetings Server does not properly restrict the content of query strings, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-serve...Show more
The web framework in Cisco WebEx Meetings Server does not properly restrict the content of query strings, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history, aka Bug ID CSCuj81713.Show less
CVE-2014-5107
2Concrete5
Concretecms
2Concrete5
Concrete Cms
May 6, 2026
Jul 28, 2014
N/A· v4
N/A· v3
5.0 MEDIUM· v2
concrete5 before 5.6.3 allows remote attackers to obtain the installation path via a direct request to (1) system/basics/editor.php, (2) system/view.php, (3) system/environment/file_storage_locations.php, (4) system/mail...Show more
concrete5 before 5.6.3 allows remote attackers to obtain the installation path via a direct request to (1) system/basics/editor.php, (2) system/view.php, (3) system/environment/file_storage_locations.php, (4) system/mail/importers.php, (5) system/mail/method.php, (6) system/permissions/file_types.php, (7) system/permissions/files.php, (8) system/permissions/tasks.php, (9) system/permissions/users.php, (10) system/seo/view.php, (11) view.php, (12) users/attributes.php, (13) scrapbook/view.php, (14) pages/attributes.php, (15) files/attributes.php, or (16) files/search.php in single_pages/dashboard/.Show less
CVE-2014-4747
1Ibm
1Sametime
May 6, 2026
Jul 26, 2014
N/A· v4
N/A· v3
2.1 LOW· v2
The Classic Meeting Server in IBM Sametime 8.x through 8.5.2.1 allows physically proximate attackers to discover a meeting password hash by leveraging access to an unattended workstation to read HTML source code within a...Show more
The Classic Meeting Server in IBM Sametime 8.x through 8.5.2.1 allows physically proximate attackers to discover a meeting password hash by leveraging access to an unattended workstation to read HTML source code within a victim's browser.Show less
CVE-2014-3301
1Cisco
1Webex Meetings Server
May 6, 2026
Jul 26, 2014
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The ProfileAction controller in Cisco WebEx Meetings Server (CWMS) 1.5(.1.131) and earlier allows remote attackers to obtain sensitive information by reading stack traces in returned messages, aka Bug ID CSCuj81700.
CVE-2014-4682
1Siemens
2Simatic Pcs7
Wincc
May 6, 2026
Jul 24, 2014
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The WebNavigator server in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows remote attackers to obtain sensitive information via an HTTP request.
CVE-2014-4980
1Tenable
2Nessus
Web Ui
May 6, 2026
Jul 23, 2014
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The /server/properties resource in Tenable Web UI before 2.3.5 for Nessus 5.2.3 through 5.2.7 allows remote attackers to obtain sensitive information via the token parameter.
CVE-2014-3530
1Redhat
1Jboss Enterprise Application Platform
May 6, 2026
Jul 22, 2014
N/A· v4
N/A· v3
7.5 HIGH· v2
The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote...Show more
The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.Show less
CVE-2014-2519
1Emc
1Recoverpoint Appliance
May 6, 2026
Jul 19, 2014
N/A· v4
N/A· v3
5.8 MEDIUM· v2
The default configuration of EMC RecoverPoint Appliance (RPA) 4.1 before 4.1.0.1 does not enable a firewall, which allows remote attackers to obtain potentially sensitive information about open ports, or cause a denial o...Show more
The default configuration of EMC RecoverPoint Appliance (RPA) 4.1 before 4.1.0.1 does not enable a firewall, which allows remote attackers to obtain potentially sensitive information about open ports, or cause a denial of service, by sending packets to many ports.Show less
CVE-2014-3064
1Ibm
2Infosphere Master Data Management Collaboration Server
Infosphere Master Data Management Server For Product Information Management
May 6, 2026
Jul 19, 2014
N/A· v4
N/A· v3
6.3 MEDIUM· v2
The GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0 FP4 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 allows remote a...Show more
The GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0 FP4 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 allows remote authenticated users to read arbitrary files via a crafted UNIX file parameter.Show less
CVE-2014-3045
1Ibm
1Scale Out Network Attached Storage
May 6, 2026
Jul 19, 2014
N/A· v4
N/A· v3
2.1 LOW· v2
IBM Scale Out Network Attached Storage (SONAS) 1.3.x and 1.4.x before 1.4.3.3 places an administrative password in the shell history upon use of the -p option to chuser, which allows local users to obtain sensitive infor...Show more
IBM Scale Out Network Attached Storage (SONAS) 1.3.x and 1.4.x before 1.4.3.3 places an administrative password in the shell history upon use of the -p option to chuser, which allows local users to obtain sensitive information by leveraging root access.Show less
CVE-2014-2368
1Advantech
1Advantech Webaccess
May 6, 2026
Jul 19, 2014
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The BrowseFolder method in the bwocxrun ActiveX control in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a crafted call.
CVE-2014-2367
1Advantech
1Advantech Webaccess
May 6, 2026
Jul 19, 2014
N/A· v4
N/A· v3
4.3 MEDIUM· v2
The ChkCookie subroutine in an ActiveX control in broadweb/include/gChkCook.asp in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a crafted call.
CVE-2014-2366
1Advantech
1Advantech Webaccess
May 6, 2026
Jul 19, 2014
N/A· v4
N/A· v3
4.0 MEDIUM· v2
upAdminPg.asp in Advantech WebAccess before 7.2 allows remote authenticated users to discover credentials by reading HTML source code.
CVE-2014-4347
1Citrix
4Netscaler Access Gateway
Netscaler Access Gateway FirmwareNetscaler Application Delivery Controller+1 more
May 6, 2026
Jul 16, 2014
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway (formerly Access Gateway Enterprise Edition) before 9.3-62.4 and 10.x before 10.1-126.12 allows attackers to obtain sensitive information via v...Show more
Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway (formerly Access Gateway Enterprise Edition) before 9.3-62.4 and 10.x before 10.1-126.12 allows attackers to obtain sensitive information via vectors related to a cookie.Show less
CVE-2014-4031
1Arubanetworks
1Clearpass
May 6, 2026
Jul 15, 2014
N/A· v4
N/A· v3
4.0 MEDIUM· v2
The Policy Manager in Aruba Networks ClearPass 5.x, 6.0.x, 6.1.x through 6.1.4.61696, 6.2.x through 6.2.6.62196, and 6.3.x before 6.3.4 allows remote authenticated users to obtain database credentials via unspecified vec...Show more
The Policy Manager in Aruba Networks ClearPass 5.x, 6.0.x, 6.1.x through 6.1.4.61696, 6.2.x through 6.2.6.62196, and 6.3.x before 6.3.4 allows remote authenticated users to obtain database credentials via unspecified vectors.Show less
CVE-2014-4942
1Levelfourdevelopment
1Wp Easycart
May 6, 2026
Jul 11, 2014
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The EasyCart (wp-easycart) plugin before 2.0.6 for WordPress allows remote attackers to obtain configuration information via a direct request to inc/admin/phpinfo.php, which calls the phpinfo function.
CVE-2014-3485
1Redhat
1Enterprise Virtualization
May 6, 2026
Jul 11, 2014
N/A· v4
N/A· v3
4.0 MEDIUM· v2
The REST API in the ovirt-engine in oVirt, as used in Red Hat Enterprise Virtualization (rhevm) 3.4, allows remote authenticated users to read arbitrary files and have other unspecified impact via unknown vectors, relate...Show more
The REST API in the ovirt-engine in oVirt, as used in Red Hat Enterprise Virtualization (rhevm) 3.4, allows remote authenticated users to read arbitrary files and have other unspecified impact via unknown vectors, related to an XML External Entity (XXE) issue.Show less