Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CVEs (11,749)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2016-1860 1Apple 1Mac Os X May 6, 2026 Jun 19, 2016 N/A· v4 3.3 LOW· v3 4.3 MEDIUM· v2 Intel Graphics Driver in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app, a different vulnerability than CVE-2016-1862.
CVE-2016-1196 1Cybozu 1Garoon May 6, 2026 Jun 19, 2016 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote authenticated users to bypass intended access restrictions and obtain sensitive Address Book information via an API call, a different vulnerability than CVE-2015-7776.
CVE-2016-1192 1Cybozu 1Garoon May 6, 2026 Jun 19, 2016 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 Directory traversal vulnerability in the logging implementation in Cybozu Garoon 3.7 through 4.2 allows remote authenticated users to read a log file via unspecified vectors.
CVE-2015-7776 1Cybozu 1Garoon May 6, 2026 Jun 19, 2016 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 Cybozu Garoon 3.x and 4.x before 4.2.0 does not properly restrict loading of IMG elements, which makes it easier for remote attackers to track users via a crafted HTML e-mail message, a different vulnerability than CVE-2...Show more Cybozu Garoon 3.x and 4.x before 4.2.0 does not properly restrict loading of IMG elements, which makes it easier for remote attackers to track users via a crafted HTML e-mail message, a different vulnerability than CVE-2016-1196.Show less
CVE-2015-7462 1Ibm 1Websphere Mq May 6, 2026 Jun 19, 2016 N/A· v4 4.4 MEDIUM· v3 2.1 LOW· v2 IBM WebSphere MQ 8.0.0.4 on IBM i platforms allows local users to discover cleartext certificate-keystore passwords within MQ trace output by leveraging administrator privileges to execute the mqcertck program.
CVE-2016-1225 1Trendmicro 1Internet Security May 6, 2026 Jun 19, 2016 N/A· v4 6.5 MEDIUM· v3 5.0 MEDIUM· v2 Trend Micro Internet Security 8 and 10 allows remote attackers to read arbitrary files via unspecified vectors.
CVE-2016-4816 1Buffalo 34Bhr 4grv Firmware Dwr Hp G300nh FirmwareFs 600dhp Firmware+31 more May 6, 2026 Jun 19, 2016 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 BUFFALO WZR-600DHP3 devices with firmware 2.16 and earlier and WZR-S600DHP devices allow remote attackers to discover credentials and other sensitive information via unspecified vectors.
CVE-2016-1427 1Cisco 1Prime Network Registrar May 6, 2026 Jun 18, 2016 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The System Configuration Protocol (SCP) core messaging interface in Cisco Prime Network Registrar 8.2 before 8.2.3.1 and 8.3 before 8.3.2 allows remote attackers to obtain sensitive information via crafted SCP messages,...Show more The System Configuration Protocol (SCP) core messaging interface in Cisco Prime Network Registrar 8.2 before 8.2.3.1 and 8.3 before 8.3.2 allows remote attackers to obtain sensitive information via crafted SCP messages, aka Bug ID CSCuv35694.Show less
CVE-2016-3234 1Microsoft 6Office Office Compatibility PackOffice Web Apps+3 more Oct 15, 2026 Jun 16, 2016 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Server 2013 SP1, Office...Show more Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps 2010 SP2, and Office Web Apps Server 2013 SP1 allow remote attackers to obtain sensitive information from process memory via a crafted Office document, aka "Microsoft Office Information Disclosure Vulnerability."Show less
CVE-2016-3232 1Microsoft 1Windows Server 2012 May 6, 2026 Jun 16, 2016 N/A· v4 5.0 MEDIUM· v3 2.1 LOW· v2 The Virtual PCI (VPCI) virtual service provider in Microsoft Windows Server 2012 Gold and R2 allows local users to obtain sensitive information from uninitialized memory locations via a crafted application, aka "Windows...Show more The Virtual PCI (VPCI) virtual service provider in Microsoft Windows Server 2012 Gold and R2 allows local users to obtain sensitive information from uninitialized memory locations via a crafted application, aka "Windows Virtual PCI Information Disclosure Vulnerability."Show less
CVE-2016-3216 1Microsoft 7Windows 10 Windows 7Windows 8.1+4 more May 6, 2026 Jun 16, 2016 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 GDI32.dll in the Graphics component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows rem...Show more GDI32.dll in the Graphics component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to bypass the ASLR protection mechanism via unspecified vectors, aka "Windows Graphics Component Information Disclosure Vulnerability."Show less
CVE-2016-3215 1Microsoft 4Edge Windows 10Windows 8.1+1 more May 6, 2026 Jun 16, 2016 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 1511, and Microsoft Edge allow remote attackers to obtain sensitive information from process memory via a crafted PDF document, aka "Windows PDF Informat...Show more Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 1511, and Microsoft Edge allow remote attackers to obtain sensitive information from process memory via a crafted PDF document, aka "Windows PDF Information Disclosure Vulnerability," a different vulnerability than CVE-2016-3201.Show less
CVE-2016-3201 1Microsoft 4Edge Windows 10Windows 8.1+1 more May 6, 2026 Jun 16, 2016 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 Gold and 1511, and Microsoft Edge allow remote attackers to obtain sensitive information from process memory via a crafted PDF document, aka "Windows PDF...Show more Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 Gold and 1511, and Microsoft Edge allow remote attackers to obtain sensitive information from process memory via a crafted PDF document, aka "Windows PDF Information Disclosure Vulnerability," a different vulnerability than CVE-2016-3215.Show less
CVE-2016-0028 1Microsoft 1Outlook Web Access May 6, 2026 Jun 16, 2016 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 Outlook Web Access (OWA) in Microsoft Exchange Server 2013 SP1, Cumulative Update 11, and Cumulative Update 12 and 2016 Gold and Cumulative Update 1 does not properly restrict loading of IMG elements, which makes it easi...Show more Outlook Web Access (OWA) in Microsoft Exchange Server 2013 SP1, Cumulative Update 11, and Cumulative Update 12 and 2016 Gold and Cumulative Update 1 does not properly restrict loading of IMG elements, which makes it easier for remote attackers to track users via a crafted HTML e-mail message, aka "Microsoft Exchange Information Disclosure Vulnerability."Show less
CVE-2016-5367 1Huawei 1Honor Ws851 Firmware May 6, 2026 Jun 14, 2016 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Huawei Honor WS851 routers with software 1.1.21.1 and earlier allow remote attackers to obtain sensitive information via unspecified vectors, aka HWPSIRT-2016-05053.
CVE-2015-8869 3Fedoraproject OcamlOpensuse 3Fedora OcamlOpensuse May 6, 2026 Jun 13, 2016 N/A· v4 9.1 CRITICAL· v3 6.4 MEDIUM· v2 OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sensitive information as demonstrated by a long string to the String.copy function.
CVE-2016-2832 3Canonical MozillaOpensuse 4Firefox LeapOpensuse+1 more May 6, 2026 Jun 13, 2016 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 Mozilla Firefox before 47.0 allows remote attackers to discover the list of disabled plugins via a fingerprinting attack involving Cascading Style Sheets (CSS) pseudo-classes.
CVE-2016-2500 1Google 1Android May 6, 2026 Jun 13, 2016 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 Activity Manager in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 does not properly terminate process groups, which allows attackers to obtain sensitive information via a crafted application,...Show more Activity Manager in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 does not properly terminate process groups, which allows attackers to obtain sensitive information via a crafted application, aka internal bug 19285814.Show less
CVE-2016-2499 1Google 1Android May 6, 2026 Jun 13, 2016 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 AudioSource.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 does not initialize certain data, which allows attackers to obtain sensitive...Show more AudioSource.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 does not initialize certain data, which allows attackers to obtain sensitive information via a crafted application, aka internal bug 27855172.Show less
CVE-2016-2498 1Google 1Android May 6, 2026 Jun 13, 2016 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 The Qualcomm Wi-Fi driver in Android before 2016-06-01 on Nexus 7 (2013) devices allows attackers to bypass intended data-access restrictions via a crafted application, aka internal bug 27777162.

Previous 1...451452453...588 Next