← Back
CWE-200

11,645 CVEs • Abstraction: Class • Likelihood of Exploit: High

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

JSON object

Loading...

CVEs (11,645)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2015-1116
1Apple
1Iphone Os
May 6, 2026
Apr 10, 2015
N/A· v4
N/A· v3
2.1 LOW· v2
The UIKit View component in Apple iOS before 8.3 displays unblurred application snapshots in the Task Switcher, which makes it easier for physically proximate attackers to obtain sensitive information by reading the devi...Show more
The UIKit View component in Apple iOS before 8.3 displays unblurred application snapshots in the Task Switcher, which makes it easier for physically proximate attackers to obtain sensitive information by reading the device screen.Show less
CVE-2015-1114
1Apple
2Iphone Os
Tvos
May 6, 2026
Apr 10, 2015
N/A· v4
N/A· v3
1.9 LOW· v2
The Sandbox Profiles component in Apple iOS before 8.3 and Apple TV before 7.2 allows attackers to discover hardware identifiers via a crafted app.
CVE-2015-1113
1Apple
1Iphone Os
May 6, 2026
Apr 10, 2015
N/A· v4
N/A· v3
1.9 LOW· v2
The Sandbox Profiles component in Apple iOS before 8.3 allows attackers to read the (1) telephone number or (2) e-mail address of a recent contact via a crafted app.
CVE-2015-1112
1Apple
2Iphone Os
Safari
May 6, 2026
Apr 10, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, as used on iOS before 8.3 and other platforms, does not properly delete browsing-history data from the history.plist file, which allows attackers to obta...Show more
Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, as used on iOS before 8.3 and other platforms, does not properly delete browsing-history data from the history.plist file, which allows attackers to obtain sensitive information by reading this file.Show less
CVE-2015-1111
1Apple
1Iphone Os
May 6, 2026
Apr 10, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Safari in Apple iOS before 8.3 does not delete Recently Closed Tabs data in response to a history-clearing action, which allows attackers to obtain sensitive information by reading a history file.
CVE-2015-1110
1Apple
2Iphone Os
Tvos
May 6, 2026
Apr 10, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The Podcasts component in Apple iOS before 8.3 and Apple TV before 7.2 allows remote attackers to discover unique identifiers by reading asset-download request data.
CVE-2015-1109
1Apple
1Iphone Os
May 6, 2026
Apr 10, 2015
N/A· v4
N/A· v3
2.1 LOW· v2
NetworkExtension in Apple iOS before 8.3 stores credentials in VPN configuration logs, which makes it easier for physically proximate attackers to obtain sensitive information by reading a log file.
CVE-2015-1108
1Apple
1Iphone Os
May 6, 2026
Apr 10, 2015
N/A· v4
N/A· v3
2.1 LOW· v2
The Lock Screen component in Apple iOS before 8.3 does not properly enforce the limit on incorrect passcode-authentication attempts, which makes it easier for physically proximate attackers to obtain access by making man...Show more
The Lock Screen component in Apple iOS before 8.3 does not properly enforce the limit on incorrect passcode-authentication attempts, which makes it easier for physically proximate attackers to obtain access by making many passcode guesses.Show less
CVE-2015-1106
1Apple
1Iphone Os
May 6, 2026
Apr 10, 2015
N/A· v4
N/A· v3
2.1 LOW· v2
The QuickType feature in the Keyboards subsystem in Apple iOS before 8.3 allows physically proximate attackers to discover passcodes by reading the lock screen during use of a Bluetooth keyboard.
CVE-2015-1097
1Apple
2Iphone Os
Tvos
May 6, 2026
Apr 10, 2015
N/A· v4
N/A· v3
1.9 LOW· v2
IOMobileFramebuffer in Apple iOS before 8.3 and Apple TV before 7.2 allows attackers to obtain sensitive information about kernel memory via a crafted app.
CVE-2015-1096
1Apple
3Iphone Os
Mac Os XTvos
May 6, 2026
Apr 10, 2015
N/A· v4
N/A· v3
1.9 LOW· v2
IOHIDFamily in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows attackers to obtain sensitive information about kernel memory via a crafted app.
CVE-2015-1094
1Apple
2Iphone Os
Tvos
May 6, 2026
Apr 10, 2015
N/A· v4
N/A· v3
1.9 LOW· v2
IOAcceleratorFamily in Apple iOS before 8.3 and Apple TV before 7.2 allows attackers to obtain sensitive information about kernel memory via a crafted app.
CVE-2015-1091
1Apple
2Iphone Os
Mac Os X
May 6, 2026
Apr 10, 2015
N/A· v4
N/A· v3
4.3 MEDIUM· v2
The CFNetwork Session component in Apple iOS before 8.3 and Apple OS X before 10.10.3 does not properly handle request headers during processing of redirects in HTTP responses, which allows remote attackers to bypass the...Show more
The CFNetwork Session component in Apple iOS before 8.3 and Apple OS X before 10.10.3 does not properly handle request headers during processing of redirects in HTTP responses, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.Show less
CVE-2015-1090
1Apple
1Iphone Os
May 6, 2026
Apr 10, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
CFNetwork in Apple iOS before 8.3 does not delete HTTP Strict Transport Security (HSTS) state information in response to a Safari history-clearing action, which allows attackers to obtain sensitive information by reading...Show more
CFNetwork in Apple iOS before 8.3 does not delete HTTP Strict Transport Security (HSTS) state information in response to a Safari history-clearing action, which allows attackers to obtain sensitive information by reading a history file.Show less
CVE-2015-1089
1Apple
2Iphone Os
Mac Os X
May 6, 2026
Apr 10, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
CFNetwork in Apple iOS before 8.3 and Apple OS X before 10.10.3 does not properly handle cookies during processing of redirects in HTTP responses, which allows remote attackers to bypass the Same Origin Policy via a craf...Show more
CFNetwork in Apple iOS before 8.3 and Apple OS X before 10.10.3 does not properly handle cookies during processing of redirects in HTTP responses, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.Show less
CVE-2015-3030
1Mcafee
1Advanced Threat Defense
May 6, 2026
Apr 8, 2015
N/A· v4
N/A· v3
4.0 MEDIUM· v2
The web interface in McAfee Advanced Threat Defense (MATD) before 3.4.4.63 allows remote authenticated users to obtain sensitive configuration information via unspecified vectors.
CVE-2015-1602
1Siemens
1Simatic Step 7
May 6, 2026
Apr 6, 2015
N/A· v4
N/A· v3
2.1 LOW· v2
Siemens SIMATIC STEP 7 (TIA Portal) 12 and 13 before 13 SP1 Upd1 improperly stores password data within project files, which makes it easier for local users to determine cleartext (1) protection-level passwords or (2) we...Show more
Siemens SIMATIC STEP 7 (TIA Portal) 12 and 13 before 13 SP1 Upd1 improperly stores password data within project files, which makes it easier for local users to determine cleartext (1) protection-level passwords or (2) web-server passwords by leveraging the ability to read these files.Show less
CVE-2015-1890
1Ibm
1General Parallel File System
May 6, 2026
Apr 6, 2015
N/A· v4
N/A· v3
3.5 LOW· v2
/usr/lpp/mmfs/bin/gpfs.snap in IBM General Parallel File System (GPFS) 4.1 before 4.1.0.7 produces an archive potentially containing cleartext keys, and lacks a warning about reviewing this archive to detect included key...Show more
/usr/lpp/mmfs/bin/gpfs.snap in IBM General Parallel File System (GPFS) 4.1 before 4.1.0.7 produces an archive potentially containing cleartext keys, and lacks a warning about reviewing this archive to detect included keys, which might allow remote attackers to obtain sensitive information by leveraging access to a technical-support data stream.Show less
CVE-2015-0777
1Xen
1Xen
May 6, 2026
Apr 5, 2015
N/A· v4
N/A· v3
2.1 LOW· v2
drivers/xen/usbback/usbback.c in linux-2.6.18-xen-3.4.0 (aka the Xen 3.4.x support patches for the Linux kernel 2.6.18), as used in the Linux kernel 2.6.x and 3.x in SUSE Linux distributions, allows guest OS users to obt...Show more
drivers/xen/usbback/usbback.c in linux-2.6.18-xen-3.4.0 (aka the Xen 3.4.x support patches for the Linux kernel 2.6.18), as used in the Linux kernel 2.6.x and 3.x in SUSE Linux distributions, allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory via unspecified vectors.Show less
CVE-2015-0992
1Inductiveautomation
1Ignition
May 6, 2026
Apr 3, 2015
N/A· v4
N/A· v3
2.1 LOW· v2
Inductive Automation Ignition 7.7.2 stores cleartext OPC Server credentials, which allows local users to obtain sensitive information via unspecified vectors.