Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CVEs (10,332)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2011-3697 1Achievo 1Achievo Apr 29, 2026 Sep 23, 2011 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Achievo 1.4.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/graph/jpgraph/jpgraph_radar.p...Show more Achievo 1.4.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/graph/jpgraph/jpgraph_radar.php and certain other files.Show less
CVE-2011-3696 160cyclecms Project 160cyclecms Apr 29, 2026 Sep 23, 2011 N/A· v4 N/A· v3 5.0 MEDIUM· v2 60cycleCMS 2.5.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by post.php and certain other files.
CVE-2011-3695 1111webcalendar 1111webcalendar Apr 29, 2026 Sep 23, 2011 N/A· v4 N/A· v3 5.0 MEDIUM· v2 111WebCalendar 1.2.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by footer.php and certain other f...Show more 111WebCalendar 1.2.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by footer.php and certain other files.Show less
CVE-2011-3502 1Cogentdatahub 1Cogent Datahub Apr 29, 2026 Sep 16, 2011 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The web server in Cogent DataHub 7.1.1.63 and earlier allows remote attackers to obtain the source code of executable files via a request with a trailing (1) space or (2) %2e (encoded dot).
CVE-2011-3497 1Measuresoft 1Scadapro Apr 29, 2026 Sep 16, 2011 N/A· v4 N/A· v3 10.0 HIGH· v2 service.exe in Measuresoft ScadaPro 4.0.0 and earlier allows remote attackers to execute arbitrary DLL functions via the XF function, possibly related to an insecure exposed method.
CVE-2011-1892 1Microsoft 10Forms Server GrooveGroove Data Bridge Server+7 more Apr 29, 2026 Sep 15, 2011 N/A· v4 N/A· v3 4.0 MEDIUM· v2 Microsoft Office Groove 2007 SP2, SharePoint Workspace 2010 Gold and SP1, Office Forms Server 2007 SP2, Office SharePoint Server 2007 SP2, Office SharePoint Server 2010 Gold and SP1, Office Groove Data Bridge Server 2007...Show more Microsoft Office Groove 2007 SP2, SharePoint Workspace 2010 Gold and SP1, Office Forms Server 2007 SP2, Office SharePoint Server 2007 SP2, Office SharePoint Server 2010 Gold and SP1, Office Groove Data Bridge Server 2007 SP2, Office Groove Management Server 2007 SP2, Groove Server 2010 Gold and SP1, Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010, and Office Web Apps 2010 Gold and SP1 do not properly handle Web Parts containing XML classes referencing external entities, which allows remote authenticated users to read arbitrary files via a crafted XML and XSL file, aka "SharePoint Remote File Disclosure Vulnerability."Show less
CVE-2009-5101 1Pentaho 1Bi Server Apr 29, 2026 Sep 13, 2011 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Pentaho BI Server 1.7.0.1062 and earlier includes the session ID (JSESSIONID) in the URL, which allows attackers to obtain it from session history, referer headers, or sniffing of web traffic.
CVE-2009-5100 1Pentaho 1Bi Server Apr 29, 2026 Sep 13, 2011 N/A· v4 N/A· v3 2.1 LOW· v2 Pentaho BI Server 1.7.0.1062 and earlier does not set the autocomplete tag to off on web pages using a password field, which might allow physically proximate attackers to obtain the password.
CVE-2011-3388 1Opera 1Opera Browser Apr 29, 2026 Sep 6, 2011 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Opera before 11.51 allows remote attackers to cause an insecure site to appear secure or trusted via unspecified actions related to Extended Validation and loading content from trusted sources in an unspecified sequence...Show more Opera before 11.51 allows remote attackers to cause an insecure site to appear secure or trusted via unspecified actions related to Extended Validation and loading content from trusted sources in an unspecified sequence that causes the address field and page information dialog to contain security information based on the trusted site, instead of the insecure site.Show less
CVE-2011-1643 1Cisco 2Unified Communications Manager Unified Presence Server Apr 29, 2026 Aug 29, 2011 N/A· v4 N/A· v3 10.0 HIGH· v2 Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x, 7.x before 7.1(5b)su4, 8.0, and 8.5 before 8.5(1)su2 and Cisco Unified Presence Server 6.x, 7.x, 8.0, and 8.5 before 8.5xnr allow remote attacker...Show more Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x, 7.x before 7.1(5b)su4, 8.0, and 8.5 before 8.5(1)su2 and Cisco Unified Presence Server 6.x, 7.x, 8.0, and 8.5 before 8.5xnr allow remote attackers to read database data by connecting to a query interface through an SSL session, aka Bug IDs CSCti81574, CSCto63060, CSCto72183, and CSCto73833.Show less
CVE-2011-2737 1Rsa 1Envision Apr 29, 2026 Aug 25, 2011 N/A· v4 N/A· v3 5.0 MEDIUM· v2 RSA enVision 3.x and 4.x before 4 SP4 P3 allows remote attackers to read arbitrary files via unspecified vectors, related to an "arbitrary file retrieval vulnerability."
CVE-2011-3265 1Zabbix 1Zabbix Apr 29, 2026 Aug 19, 2011 N/A· v4 N/A· v3 5.0 MEDIUM· v2 popup.php in Zabbix before 1.8.7 allows remote attackers to read the contents of arbitrary database tables via a modified srctbl parameter.
CVE-2011-3264 1Zabbix 1Zabbix Apr 29, 2026 Aug 19, 2011 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Zabbix before 1.8.6 allows remote attackers to obtain sensitive information via an invalid srcfld2 parameter to popup.php, which reveals the installation path in an error message.
CVE-2011-2986 1Mozilla 3Firefox SeamonkeyThunderbird Apr 29, 2026 Aug 18, 2011 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Mozilla Firefox 4.x through 5, Thunderbird before 6, SeaMonkey 2.x before 2.3, and possibly other products, when the Direct2D (aka D2D) API is used on Windows, allows remote attackers to bypass the Same Origin Policy, an...Show more Mozilla Firefox 4.x through 5, Thunderbird before 6, SeaMonkey 2.x before 2.3, and possibly other products, when the Direct2D (aka D2D) API is used on Windows, allows remote attackers to bypass the Same Origin Policy, and obtain sensitive image data from a different domain, by inserting this data into a canvas.Show less
CVE-2011-2983 1Mozilla 3Firefox SeamonkeyThunderbird Apr 29, 2026 Aug 18, 2011 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Mozilla Firefox before 3.6.20, Thunderbird 2.x and 3.x before 3.1.12, SeaMonkey 1.x and 2.x, and possibly other products does not properly handle the RegExp.input property, which allows remote attackers to bypass the Sam...Show more Mozilla Firefox before 3.6.20, Thunderbird 2.x and 3.x before 3.1.12, SeaMonkey 1.x and 2.x, and possibly other products does not properly handle the RegExp.input property, which allows remote attackers to bypass the Same Origin Policy and read data from a different domain via a crafted web site, possibly related to a use-after-free.Show less
CVE-2011-3011 1Ca 1Arcserve D2d Apr 29, 2026 Aug 15, 2011 N/A· v4 N/A· v3 5.0 MEDIUM· v2 BaseServiceImpl.class in CA ARCserve D2D r15 does not properly handle sessions, which allows remote attackers to obtain credentials, and consequently execute arbitrary commands, via unspecified vectors.
CVE-2011-3128 1Wordpress 1Wordpress Apr 29, 2026 Aug 10, 2011 N/A· v4 N/A· v3 5.0 MEDIUM· v2 WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 treats unattached attachments as published, which might allow remote attackers to obtain sensitive data via vectors related to wp-includes/post.php.
CVE-2011-3126 1Wordpress 1Wordpress Apr 29, 2026 Aug 10, 2011 N/A· v4 N/A· v3 5.0 MEDIUM· v2 WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 allows remote attackers to determine usernames of non-authors via canonical redirects.
CVE-2011-1978 1Microsoft 1.net Framework Apr 29, 2026 Aug 10, 2011 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Microsoft .NET Framework 2.0 SP2, 3.5.1, and 4 does not properly validate the System.Net.Sockets trust level, which allows remote attackers to obtain sensitive information or trigger arbitrary outbound network traffic vi...Show more Microsoft .NET Framework 2.0 SP2, 3.5.1, and 4 does not properly validate the System.Net.Sockets trust level, which allows remote attackers to obtain sensitive information or trigger arbitrary outbound network traffic via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka "Socket Restriction Bypass Vulnerability."Show less
CVE-2011-1977 1Microsoft 2.net Framework Chart Control For Microsoft .net Framework Apr 29, 2026 Aug 10, 2011 N/A· v4 N/A· v3 4.3 MEDIUM· v2 The ASP.NET Chart controls in Microsoft .NET Framework 4, and Chart Control for Microsoft .NET Framework 3.5 SP1, do not properly verify functions in URIs, which allows remote attackers to read arbitrary files via specia...Show more The ASP.NET Chart controls in Microsoft .NET Framework 4, and Chart Control for Microsoft .NET Framework 3.5 SP1, do not properly verify functions in URIs, which allows remote attackers to read arbitrary files via special characters in a URI in an HTTP request, aka "Chart Control Information Disclosure Vulnerability."Show less

Previous 1...475476477...517 Next