Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CVEs (11,647)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2015-4069 1Arcserve 1Arcserve Unified Data Protection May 6, 2026 May 29, 2015 N/A· v4 N/A· v3 7.8 HIGH· v2 The EdgeServiceImpl web service in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive credentials via a crafted SOAP request to the (1) getBackupPolicy or (2) getBackupPolicies method.
CVE-2015-3995 1Sap 1Hana May 6, 2026 May 29, 2015 N/A· v4 N/A· v3 4.0 MEDIUM· v2 SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote authenticated users to read arbitrary files via an IMPORT FROM SQL statement, aka SAP Security Note 2109565.
CVE-2015-0757 1Cisco 1Identity Services Engine Software May 6, 2026 May 29, 2015 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The web framework in Cisco Identity Services Engine (ISE) 1.2(1.901) and 1.3(0.722) does not properly implement session handlers, which allows remote attackers to obtain sensitive information by reading web pages, as dem...Show more The web framework in Cisco Identity Services Engine (ISE) 1.2(1.901) and 1.3(0.722) does not properly implement session handlers, which allows remote attackers to obtain sensitive information by reading web pages, as demonstrated by MnT reports, aka Bug ID CSCuq23140.Show less
CVE-2015-0200 1Ibm 1Websphere Commerce May 6, 2026 May 29, 2015 N/A· v4 N/A· v3 2.1 LOW· v2 IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x before 7.0.0.8 IF2 allows local users to obtain sensitive database information via unspecified vectors.
CVE-2015-2121 1Hp 1Network Virtualization May 6, 2026 May 25, 2015 N/A· v4 N/A· v3 7.8 HIGH· v2 HP Network Virtualization for LoadRunner and Performance Center 8.61 and 11.52 allows remote attackers to read arbitrary files via a crafted filename in a URL to the (1) HttpServlet or (2) NetworkEditorController compone...Show more HP Network Virtualization for LoadRunner and Performance Center 8.61 and 11.52 allows remote attackers to read arbitrary files via a crafted filename in a URL to the (1) HttpServlet or (2) NetworkEditorController component, aka ZDI-CAN-2569.Show less
CVE-2015-0170 1Ibm 1Security Siteprotector System May 6, 2026 May 25, 2015 N/A· v4 N/A· v3 2.1 LOW· v2 IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows local users to obtain sensitive information by reading cached data.
CVE-2014-6190 1Ibm 1Workload Deployer May 6, 2026 May 25, 2015 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The log viewer in IBM Workload Deployer 3.1 before 3.1.0.7 allows remote attackers to obtain sensitive information via a direct request for the URL of a log document.
CVE-2015-1915 1Ibm 1Endpoint Manager Family May 6, 2026 May 25, 2015 N/A· v4 N/A· v3 4.3 MEDIUM· v2 The Endpoint Manager for Remote Control component in IBM Tivoli Endpoint Manager for Lifecycle Management 9.0.1 before IF6 and 9.1.0 before IF6 does not set the secure flag for the session cookie in an https session, whi...Show more The Endpoint Manager for Remote Control component in IBM Tivoli Endpoint Manager for Lifecycle Management 9.0.1 before IF6 and 9.1.0 before IF6 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.Show less
CVE-2015-1909 1Ibm 1Infosphere Master Data Management Server May 6, 2026 May 25, 2015 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The XML parser in the Reference Data Management component in the server in IBM InfoSphere Master Data Management (MDM) 10.1 before IF1, 11.0 before FP3, 11.3, and 11.4 before FP2 allows remote attackers to read arbitrary...Show more The XML parser in the Reference Data Management component in the server in IBM InfoSphere Master Data Management (MDM) 10.1 before IF1, 11.0 before FP3, 11.3, and 11.4 before FP2 allows remote attackers to read arbitrary files, and consequently obtain administrative access, via an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.Show less
CVE-2015-3912 1Huawei 2E355s Mobile Wifi Firmware Webui May 6, 2026 May 21, 2015 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Huawei E355s Mobile WiFi with firmware before 22.158.45.02.625 and WEBUI before 13.100.04.01.625 allows remote attackers to obtain sensitive configuration information by sniffing the network or sending unspecified comman...Show more Huawei E355s Mobile WiFi with firmware before 22.158.45.02.625 and WEBUI before 13.100.04.01.625 allows remote attackers to obtain sensitive configuration information by sniffing the network or sending unspecified commands.Show less
CVE-2015-3999 1Piriform 1Ccleaner May 6, 2026 May 20, 2015 N/A· v4 N/A· v3 2.1 LOW· v2 Piriform CCleaner 3.26.0.1988 through 5.02.5101 writes the filenames to disk when overwriting files, which allows local users to obtain sensitive information by searching unallocated disk space.
CVE-2014-4776 1Ibm 1License Metric Tool May 6, 2026 May 20, 2015 N/A· v4 N/A· v3 2.1 LOW· v2 IBM License Metric Tool 9 before 9.1.0.2 does not have an off autocomplete attribute for authentication fields, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
CVE-2014-6211 1Ibm 1Websphere Commerce May 6, 2026 May 20, 2015 N/A· v4 N/A· v3 2.1 LOW· v2 The command-line scripts in IBM WebSphere Commerce 6.0 through 6.0.0.11, 7.0 through 7.0.0.9, and 7.0 Feature Pack 2 through 8, when debugging is configured, do not properly restrict the logging of personal data, which a...Show more The command-line scripts in IBM WebSphere Commerce 6.0 through 6.0.0.11, 7.0 through 7.0.0.9, and 7.0 Feature Pack 2 through 8, when debugging is configured, do not properly restrict the logging of personal data, which allows local users to obtain sensitive information by reading a log file.Show less
CVE-2015-2718 2Mozilla Opensuse 2Firefox Opensuse May 6, 2026 May 14, 2015 N/A· v4 N/A· v3 4.3 MEDIUM· v2 The WebChannel.jsm module in Mozilla Firefox before 38.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive webchannel-response data via a crafted web site containing an IFRAME element referenc...Show more The WebChannel.jsm module in Mozilla Firefox before 38.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive webchannel-response data via a crafted web site containing an IFRAME element referencing a different web site that is intended to read this data.Show less
CVE-2015-2711 2Mozilla Opensuse 2Firefox Opensuse May 6, 2026 May 14, 2015 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Mozilla Firefox before 38.0 does not recognize a referrer policy delivered by a referrer META element in cases of context-menu navigation and middle-click navigation, which allows remote attackers to obtain sensitive inf...Show more Mozilla Firefox before 38.0 does not recognize a referrer policy delivered by a referrer META element in cases of context-menu navigation and middle-click navigation, which allows remote attackers to obtain sensitive information by reading web-server Referer logs that contain private data in a URL, as demonstrated by a private path component.Show less
CVE-2014-1900 1Y Cam 18Ycb001 Firmware Ycb002 FirmwareYcb003 Firmware+15 more May 6, 2026 May 14, 2015 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Y-Cam camera models SD range YCB003, YCK003, and YCW003; S range YCB004, YCK004, YCW004; EyeBall YCEB03; Bullet VGA YCBL03 and YCBLB3; Bullet HD 720 YCBLHD5; Y-cam Classic Range YCB002, YCK002, and YCW003; and Y-cam Orig...Show more Y-Cam camera models SD range YCB003, YCK003, and YCW003; S range YCB004, YCK004, YCW004; EyeBall YCEB03; Bullet VGA YCBL03 and YCBLB3; Bullet HD 720 YCBLHD5; Y-cam Classic Range YCB002, YCK002, and YCW003; and Y-cam Original Range YCB001, YCW001, running firmware 4.30 and earlier, allow remote attackers to bypass authentication and obtain sensitive information via a leading "/./" in a request to en/account/accedit.asp.Show less
CVE-2015-3092 1Adobe 4Air Air SdkAir Sdk & Compiler+1 more May 6, 2026 May 13, 2015 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compile...Show more Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors, a different vulnerability than CVE-2015-3091.Show less
CVE-2015-3091 1Adobe 4Air Air SdkAir Sdk & Compiler+1 more May 6, 2026 May 13, 2015 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compile...Show more Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors, a different vulnerability than CVE-2015-3092.Show less
CVE-2015-3058 3Adobe AppleMicrosoft 4Acrobat Acrobat ReaderMac Os X+1 more May 6, 2026 May 13, 2015 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to obtain sensitive information from process memory via unspecified vectors.
CVE-2015-1716 1Microsoft 9Windows 7 Windows 8Windows 8.1+6 more May 6, 2026 May 13, 2015 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Schannel in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly...Show more Schannel in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly restrict Diffie-Hellman Ephemeral (DHE) key lengths, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors, aka "Schannel Information Disclosure Vulnerability."Show less

Previous 1...480481482...583 Next