← Back
CWE-200

11,749 CVEs • Abstraction: Class • Likelihood of Exploit: High

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

JSON object

Loading...

CVEs (11,749)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2016-5306
1Symantec
1Endpoint Protection Manager
May 6, 2026
Jun 30, 2016
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 does not properly implement the HSTS protection mechanism, which makes it easier for remote attackers to obtain sensitive information by sniffing the networ...Show more
Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 does not properly implement the HSTS protection mechanism, which makes it easier for remote attackers to obtain sensitive information by sniffing the network for unintended HTTP traffic on port 8445.Show less
CVE-2016-3651
1Symantec
1Endpoint Protection Manager
May 6, 2026
Jun 30, 2016
N/A· v4
8.0 HIGH· v3
6.0 MEDIUM· v2
Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to discover the PHP JSESSIONID value via unspecified vectors.
CVE-2016-3650
1Symantec
1Endpoint Protection Manager
May 6, 2026
Jun 30, 2016
N/A· v4
8.8 HIGH· v3
4.0 MEDIUM· v2
Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to discover credentials via a brute-force attack.
CVE-2016-3649
1Symantec
1Endpoint Protection Manager
May 6, 2026
Jun 30, 2016
N/A· v4
4.3 MEDIUM· v3
4.0 MEDIUM· v2
Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated administrators to enumerate administrator accounts via modified GET requests.
CVE-2016-3648
1Symantec
1Endpoint Protection Manager
May 6, 2026
Jun 30, 2016
N/A· v4
8.8 HIGH· v3
4.0 MEDIUM· v2
Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to bypass the Authentication Lock protection mechanism, and conduct brute-force password-guessing attacks against manageme...Show more
Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to bypass the Authentication Lock protection mechanism, and conduct brute-force password-guessing attacks against management-console accounts, by entering data into the authorization window.Show less
CVE-2016-4474
1Redhat
1Openstack
May 6, 2026
Jun 30, 2016
N/A· v4
8.8 HIGH· v3
3.3 LOW· v2
The image build process for the overcloud images in Red Hat OpenStack Platform 8.0 (Liberty) director and Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) director (aka overcloud-full) use a default root password o...Show more
The image build process for the overcloud images in Red Hat OpenStack Platform 8.0 (Liberty) director and Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) director (aka overcloud-full) use a default root password of ROOTPW, which allows attackers to gain access via unspecified vectors.Show less
CVE-2016-5835
1Wordpress
1Wordpress
May 6, 2026
Jun 29, 2016
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php.
CVE-2016-0298
1Ibm
1Security Guardium
May 6, 2026
Jun 29, 2016
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
Directory traversal vulnerability in IBM Security Guardium Database Activity Monitor 10 before 10.0p100 allows remote authenticated users to read arbitrary files via a crafted URL.
CVE-2016-0267
1Ibm
1Urbancode Deploy
May 6, 2026
Jun 29, 2016
N/A· v4
7.7 HIGH· v3
4.0 MEDIUM· v2
IBM UrbanCode Deploy 6.0.x before 6.0.1.13, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1 allows remote authenticated users to obtain sensitive cleartext secure-property information via (1) the server UI or (2) a databa...Show more
IBM UrbanCode Deploy 6.0.x before 6.0.1.13, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1 allows remote authenticated users to obtain sensitive cleartext secure-property information via (1) the server UI or (2) a database request.Show less
CVE-2016-5244
4Fedoraproject
LinuxRedhat+1 more
11Enterprise Linux
FedoraLinux Enterprise Debuginfo+8 more
May 6, 2026
Jun 27, 2016
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel through 4.6.3 does not initialize a certain structure member, which allows remote attackers to obtain sensitive information from kernel stack memory by...Show more
The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel through 4.6.3 does not initialize a certain structure member, which allows remote attackers to obtain sensitive information from kernel stack memory by reading an RDS message.Show less
CVE-2016-5243
1Linux
1Linux Kernel
May 6, 2026
Jun 27, 2016
N/A· v4
5.5 MEDIUM· v3
2.1 LOW· v2
The tipc_nl_compat_link_dump function in net/tipc/netlink_compat.c in the Linux kernel through 4.6.3 does not properly copy a certain string, which allows local users to obtain sensitive information from kernel stack mem...Show more
The tipc_nl_compat_link_dump function in net/tipc/netlink_compat.c in the Linux kernel through 4.6.3 does not properly copy a certain string, which allows local users to obtain sensitive information from kernel stack memory by reading a Netlink message.Show less
CVE-2014-9903
1Linux
1Linux Kernel
May 6, 2026
Jun 27, 2016
N/A· v4
5.5 MEDIUM· v3
2.1 LOW· v2
The sched_read_attr function in kernel/sched/core.c in the Linux kernel 3.14-rc before 3.14-rc4 uses an incorrect size, which allows local users to obtain sensitive information from kernel stack memory via a crafted sche...Show more
The sched_read_attr function in kernel/sched/core.c in the Linux kernel 3.14-rc before 3.14-rc4 uses an incorrect size, which allows local users to obtain sensitive information from kernel stack memory via a crafted sched_getattr system call.Show less
CVE-2016-0259
1Ibm
1Websphere Mq
May 6, 2026
Jun 26, 2016
N/A· v4
2.5 LOW· v3
2.1 LOW· v2
runmqsc in IBM WebSphere MQ 8.x before 8.0.0.5 allows local users to bypass an intended +dsp authority requirement and obtain sensitive information via unspecified display commands.
CVE-2016-1193
1Cybozu
1Garoon
May 6, 2026
Jun 25, 2016
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
Cybozu Garoon 3.7 through 4.2 allows remote attackers to obtain sensitive email-reading information via unspecified vectors.
CVE-2016-5722
1Huawei
1Ocean Stor Firmware
May 6, 2026
Jun 24, 2016
N/A· v4
7.3 HIGH· v3
7.5 HIGH· v2
Huawei OceanStor 5300 V3, 5500 V3, 5600 V3, 5800 V3, 6800 V3, 18800 V3, and 18500 V3 before V300R003C10 sends the plaintext session token in the HTTP header, which allows remote attackers to conduct replay attacks and ob...Show more
Huawei OceanStor 5300 V3, 5500 V3, 5600 V3, 5800 V3, 6800 V3, 18800 V3, and 18500 V3 before V300R003C10 sends the plaintext session token in the HTTP header, which allows remote attackers to conduct replay attacks and obtain sensitive information by sniffing the network.Show less
CVE-2016-5709
1Solarwinds
1Virtualization Manager
May 6, 2026
Jun 24, 2016
N/A· v4
4.7 MEDIUM· v3
1.9 LOW· v2
SolarWinds Virtualization Manager 6.3.1 and earlier uses weak encryption to store passwords in /etc/shadow, which allows local users with superuser privileges to obtain user passwords via a brute force attack.
CVE-2016-5021
1F5
16Big Ip Access Policy Manager
Big Ip Advanced Firewall ManagerBig Ip Analytics+13 more
May 6, 2026
Jun 24, 2016
N/A· v4
4.9 MEDIUM· v3
4.0 MEDIUM· v2
The iControl REST service in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.5.x before 11.5.4, 11.6.x before 11.6.1, and 12.x before 12.0.0 HF3; BIG-IP DNS 12.x before 12.0.0 HF3; BIG-IP GTM 11...Show more
The iControl REST service in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.5.x before 11.5.4, 11.6.x before 11.6.1, and 12.x before 12.0.0 HF3; BIG-IP DNS 12.x before 12.0.0 HF3; BIG-IP GTM 11.5.x before 11.5.4 and 11.6.x before 11.6.1; BIG-IQ Cloud and Security 4.0.0 through 4.5.0; BIG-IQ Device 4.2.0 through 4.5.0; BIG-IQ ADC 4.5.0; BIG-IQ Centralized Management 4.6.0; and BIG-IQ Cloud and Orchestration 1.0.0 allows remote authenticated administrators to obtain sensitive information via unspecified vectors.Show less
CVE-2015-8289
1Netgear
2D3600 Firmware
D6000 Firmware
May 6, 2026
Jun 20, 2016
N/A· v4
7.5 HIGH· v3
4.3 MEDIUM· v2
The password-recovery feature on NETGEAR D3600 devices with firmware 1.0.0.49 and D6000 devices with firmware 1.0.0.49 and earlier allows remote attackers to discover the cleartext administrator password by reading the c...Show more
The password-recovery feature on NETGEAR D3600 devices with firmware 1.0.0.49 and D6000 devices with firmware 1.0.0.49 and earlier allows remote attackers to discover the cleartext administrator password by reading the cgi-bin/passrec.asp HTML source code.Show less
CVE-2016-1864
1Apple
2Iphone Os
Safari
May 6, 2026
Jun 19, 2016
N/A· v4
4.3 MEDIUM· v3
5.0 MEDIUM· v2
The XSS auditor in WebKit, as used in Apple iOS before 9.3 and Safari before 9.1, does not properly handle redirects in block mode, which allows remote attackers to obtain sensitive information via a crafted URL.
CVE-2016-1862
1Apple
1Mac Os X
May 6, 2026
Jun 19, 2016
N/A· v4
3.3 LOW· v3
4.3 MEDIUM· v2
Intel Graphics Driver in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app, a different vulnerability than CVE-2016-1860.