Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CVEs (11,725)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2015-8569 1Linux 1Linux Kernel May 6, 2026 Dec 28, 2015 N/A· v4 2.3 LOW· v3 1.9 LOW· v2 The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp.c in the Linux kernel through 4.3.3 do not verify an address length, which allows local users to obtain sensitive information from kernel memory an...Show more The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp.c in the Linux kernel through 4.3.3 do not verify an address length, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application.Show less
CVE-2015-8374 1Linux 1Linux Kernel May 6, 2026 Dec 28, 2015 N/A· v4 4.0 MEDIUM· v3 2.1 LOW· v2 fs/btrfs/inode.c in the Linux kernel before 4.3.3 mishandles compressed inline extents, which allows local users to obtain sensitive pre-truncation information from a file via a clone action.
CVE-2015-7885 1Linux 1Linux Kernel May 6, 2026 Dec 28, 2015 N/A· v4 2.3 LOW· v3 2.1 LOW· v2 The dgnc_mgmt_ioctl function in drivers/staging/dgnc/dgnc_mgmt.c in the Linux kernel through 4.3.3 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memo...Show more The dgnc_mgmt_ioctl function in drivers/staging/dgnc/dgnc_mgmt.c in the Linux kernel through 4.3.3 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory via a crafted application.Show less
CVE-2015-7884 1Linux 1Linux Kernel May 6, 2026 Dec 28, 2015 N/A· v4 2.3 LOW· v3 1.9 LOW· v2 The vivid_fb_ioctl function in drivers/media/platform/vivid/vivid-osd.c in the Linux kernel through 4.3.3 does not initialize a certain structure member, which allows local users to obtain sensitive information from kern...Show more The vivid_fb_ioctl function in drivers/media/platform/vivid/vivid-osd.c in the Linux kernel through 4.3.3 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory via a crafted application.Show less
CVE-2015-7665 1Tails Project 1Tails May 6, 2026 Dec 27, 2015 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Tails before 1.7 includes the wget program but does not prevent automatic fallback from passive FTP to active FTP, which allows remote FTP servers to discover the Tor client IP address by reading a (1) PORT or (2) EPRT c...Show more Tails before 1.7 includes the wget program but does not prevent automatic fallback from passive FTP to active FTP, which allows remote FTP servers to discover the Tor client IP address by reading a (1) PORT or (2) EPRT command. NOTE: within wget itself, the automatic fallback is not considered a vulnerability by CVE.Show less
CVE-2015-8253 1Rsi Video Technologies 1Frontel Protocol May 6, 2026 Dec 27, 2015 N/A· v4 3.7 LOW· v3 4.3 MEDIUM· v2 The Frontel protocol before 3 on RSI Video Technologies Videofied devices sets up AES encryption but sends all traffic in cleartext, which allows remote attackers to obtain sensitive (1) message or (2) MJPEG video data b...Show more The Frontel protocol before 3 on RSI Video Technologies Videofied devices sets up AES encryption but sends all traffic in cleartext, which allows remote attackers to obtain sensitive (1) message or (2) MJPEG video data by sniffing the network.Show less
CVE-2015-8252 1Rsi Video Technologies 1Frontel Protocol May 6, 2026 Dec 27, 2015 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 The Frontel protocol before 3 on RSI Video Technologies Videofied devices sends a cleartext serial number, which allows remote attackers to determine a hardcoded key by sniffing the network and performing a "jumbled up"...Show more The Frontel protocol before 3 on RSI Video Technologies Videofied devices sends a cleartext serial number, which allows remote attackers to determine a hardcoded key by sniffing the network and performing a "jumbled up" calculation with this number.Show less
CVE-2015-8669 1Phpmyadmin 1Phpmyadmin May 6, 2026 Dec 26, 2015 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 libraries/config/messages.inc.php in phpMyAdmin 4.0.x before 4.0.10.12, 4.4.x before 4.4.15.2, and 4.5.x before 4.5.3.1 allows remote attackers to obtain sensitive information via a crafted request, which reveals the ful...Show more libraries/config/messages.inc.php in phpMyAdmin 4.0.x before 4.0.10.12, 4.4.x before 4.4.15.2, and 4.5.x before 4.5.3.1 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message.Show less
CVE-2015-6409 1Cisco 1Jabber May 6, 2026 Dec 26, 2015 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 Cisco Jabber 10.6.x, 11.0.x, and 11.1.x on Windows allows man-in-the-middle attackers to conduct STARTTLS downgrade attacks and trigger cleartext XMPP sessions via unspecified vectors, aka Bug ID CSCuw87419.
CVE-2015-7934 1Adcon 1A840 Telemetry Gateway Base Station Firmware May 6, 2026 Dec 24, 2015 N/A· v4 8.6 HIGH· v3 5.0 MEDIUM· v2 The Java client in Adcon Telemetry A840 Telemetry Gateway Base Station allows remote attackers to discover log-file pathnames via unspecified vectors.
CVE-2015-7932 1Adcon 1A840 Telemetry Gateway Base Station Firmware May 6, 2026 Dec 24, 2015 N/A· v4 8.6 HIGH· v3 5.0 MEDIUM· v2 Adcon Telemetry A840 Telemetry Gateway Base Station allows remote attackers to obtain sensitive information by sniffing the network.
CVE-2015-7931 1Adcon 1A840 Telemetry Gateway Base Station Firmware May 6, 2026 Dec 24, 2015 N/A· v4 8.7 HIGH· v3 5.8 MEDIUM· v2 The Java client in Adcon Telemetry A840 Telemetry Gateway Base Station does not authenticate the station device, which allows man-in-the-middle attackers to spoof devices and obtain sensitive information by reading clear...Show more The Java client in Adcon Telemetry A840 Telemetry Gateway Base Station does not authenticate the station device, which allows man-in-the-middle attackers to spoof devices and obtain sensitive information by reading cleartext packet data, related to the lack of SSL support.Show less
CVE-2015-7929 1Ewon 1Ewon Firmware May 6, 2026 Dec 23, 2015 N/A· v4 4.3 MEDIUM· v3 5.0 MEDIUM· v2 eWON devices with firmware through 10.1s0 support unspecified GET requests, which might allow remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) th...Show more eWON devices with firmware through 10.1s0 support unspecified GET requests, which might allow remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history.Show less
CVE-2015-7928 1Ewon 1Ewon Firmware May 6, 2026 Dec 23, 2015 N/A· v4 8.5 HIGH· v3 5.0 MEDIUM· v2 eWON devices with firmware before 10.1s0 do not have an off autocomplete attribute for a password field, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
CVE-2015-7926 1Ewon 1Ewon Firmware May 6, 2026 Dec 23, 2015 N/A· v4 9.9 CRITICAL· v3 5.0 MEDIUM· v2 eWON devices with firmware before 10.1s0 omit RBAC for I/O server information and status requests, which allows remote attackers to obtain sensitive information via an unspecified URL.
CVE-2015-7935 1Motorola 1Moscad Ip Gateway Firmware May 6, 2026 Dec 23, 2015 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Motorola Solutions MOSCAD IP Gateway allows remote attackers to read arbitrary files via unspecified vectors.
CVE-2015-6471 1Eaton 1Proview May 6, 2026 Dec 23, 2015 N/A· v4 5.3 MEDIUM· v3 4.3 MEDIUM· v2 Eaton Cooper Power Systems ProView 4.x and 5.x before 5.1 on Form 6 controls and Idea and IdeaPLUS relays does not properly initialize padding fields in Ethernet packets, which allows remote attackers to obtain sensitive...Show more Eaton Cooper Power Systems ProView 4.x and 5.x before 5.1 on Form 6 controls and Idea and IdeaPLUS relays does not properly initialize padding fields in Ethernet packets, which allows remote attackers to obtain sensitive information by reading packet data.Show less
CVE-2015-7908 1Honeywell 2Midas Black Firmware Midas Firmware May 6, 2026 Dec 21, 2015 N/A· v4 N/A· v3 9.3 HIGH· v2 Honeywell Midas gas detectors before 1.13b3 and Midas Black gas detectors before 2.13b3 allow remote attackers to discover cleartext passwords by sniffing the network.
CVE-2015-6556 1Symantec 1Endpoint Encryption May 6, 2026 Dec 18, 2015 N/A· v4 N/A· v3 2.3 LOW· v2 EACommunicatorSrv.exe in the Framework Service in the client in Symantec Endpoint Encryption (SEE) before 11.1.0 allows remote authenticated users to discover credentials by triggering a memory dump.
CVE-2015-6428 1Cisco 1Dpq3925 8x4 Docsis 3.0 Wireless Residential Gateway With Embedded Digital Voice Adapter May 6, 2026 Dec 18, 2015 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Cisco DPQ3925 devices with EDVA r1 Base allow remote attackers to obtain sensitive information via a crafted HTTP request, aka Bug ID CSCuv03958.

Previous 1...465466467...587 Next