CWE-200
11,741 CVEs • Abstraction: Class • Likelihood of Exploit: High
Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVEs (11,741)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
3Erlang OpensuseOracle3Erlang/otp OpensuseSolarisMay 6, 2026 Apr 7, 2016 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of...Show more |
1Sap 1Netweaver Application Server Java May 6, 2026 Apr 7, 2016 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 The chat feature in the Real-Time Collaboration (RTC) services 7.3 and 7.4 in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to obtain sensitive user information by visiting webdynpro/resources/sap.com/tc~...Show more |
NetApp Clustered Data ONTAP 8.3.1 does not properly verify X.509 certificates from TLS servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. |
1Eaton Lighting Systems 1Eg2 Web Control May 6, 2026 Apr 6, 2016 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Eaton Lighting EG2 Web Control 4.04P and earlier allows remote attackers to read the configuration file, and consequently discover credentials, via a direct request. |
1Redhat 1Jboss Wildfly Application Server May 6, 2026 Apr 1, 2016 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the (1)...Show more |
Wiki Server in Apple OS X Server before 5.1 allows remote attackers to obtain sensitive information from Wiki pages via unspecified vectors. |
The Page Loading implementation in WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles HTTP responses with a 3xx (aka redirection) status code, which allows remote attackers to spoof the displayed URL, bypass...Show more |
The Page Loading implementation in WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles character encoding during access to cached data, which allows remote attackers to bypass the Same Origin Policy and obtai...Show more |
WebKit in Apple iOS before 9.3 does not prevent hidden web views from reading orientation and motion data, which allows remote attackers to obtain sensitive information about a device's physical environment via a crafted...Show more |
WebKit in Apple iOS before 9.3 and Safari before 9.1 allows remote attackers to bypass the Same Origin Policy and obtain physical-location data via a crafted geolocation request. |
The Top Sites feature in Apple Safari before 9.1 mishandles cookie storage, which makes it easier for remote web servers to track users via unspecified vectors. |
The Content Security Policy (CSP) implementation in Messages in Apple OS X before 10.11.4 allows remote attackers to obtain sensitive information via a javascript: URL. |
The kernel in Apple iOS before 9.3 and OS X before 10.11.4 allows attackers to obtain sensitive memory-layout information or cause a denial of service (out-of-bounds read) via a crafted app. |
1Apple 4Iphone Os Mac Os XTvos+1 moreMay 6, 2026 Mar 24, 2016 N/A· v4 3.3 LOW· v3 4.3 MEDIUM· v2 IOHIDFamily in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows attackers to obtain sensitive kernel memory-layout information via a crafted app. |
lms/templates/footer-edx-new.html in Open edX edx-platform before 2015-01-29 does not properly restrict links on the password-reset page, which allows user-assisted remote attackers to discover password-reset tokens by r...Show more |
Siemens APOGEE Insight uses weak permissions for the application folder, which allows local users to obtain sensitive information or modify data via unspecified vectors. |
1Hp 1System Management Homepage May 6, 2026 Mar 18, 2016 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 HPE System Management Homepage before 7.5.4 allows remote authenticated users to obtain sensitive information via unspecified vectors. |
1Hp 2Enterprise Security Manager Enterprise Security Manager ExpressMay 6, 2026 Mar 17, 2016 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 HPE ArcSight ESM before 6.8c, and ArcSight ESM Express before 6.9.1, allows remote authenticated users to obtain sensitive information via unspecified vectors. |
Mozilla Firefox before 45.0 does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted Jav...Show more |
3Mozilla NovellOpensuse4Firefox LeapOpensuse+1 moreMay 6, 2026 Mar 13, 2016 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 Mozilla Firefox before 45.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by reading a Content Security Policy (CSP) violation report that contains path information associated...Show more |