← Back
CWE-200

10,332 CVEs • Abstraction: Class • Likelihood of Exploit: High

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

JSON object

Loading...

CVEs (10,332)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2010-2754
1Mozilla
3Firefox
SeamonkeyThunderbird
Apr 29, 2026
Jul 30, 2010
N/A· v4
N/A· v3
5.0 MEDIUM· v2
dom/base/nsJSEnvironment.cpp in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 does not properly suppress a script's URL in c...Show more
dom/base/nsJSEnvironment.cpp in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 does not properly suppress a script's URL in certain circumstances involving a redirect and an error message, which allows remote attackers to obtain sensitive information about script parameters via a crafted HTML document, related to the window.onerror handler.Show less
CVE-2009-4961
1Lanai Core
1Lanai Core
Apr 29, 2026
Jul 28, 2010
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Lanai Core 0.6 allows remote attackers to obtain configuration information via a direct request to info.php, which calls the phpinfo function.
CVE-2010-2859
1Boesch It
1Simpnews
Apr 29, 2026
Jul 25, 2010
N/A· v4
N/A· v3
5.0 MEDIUM· v2
news.php in SimpNews 2.47.3 and earlier allows remote attackers to obtain sensitive information via an invalid lang parameter, which reveals the installation path in an error message.
CVE-2009-4951
1Hans Olthoff
1Alternet Csa Out
Apr 29, 2026
Jul 22, 2010
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Unspecified vulnerability in the ClickStream Analyzer [output] (alternet_csa_out) extension 0.3.0 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown vectors.
CVE-2009-4943
1Impactsoftcompany
1Adpeeps
Apr 29, 2026
Jul 22, 2010
N/A· v4
N/A· v3
5.0 MEDIUM· v2
index.php in AdPeeps 8.5d1 allows remote attackers to obtain sensitive information via (1) a view_adrates action with an invalid uid parameter, which reveals the installation path in an error message; or (2) an adminlogi...Show more
index.php in AdPeeps 8.5d1 allows remote attackers to obtain sensitive information via (1) a view_adrates action with an invalid uid parameter, which reveals the installation path in an error message; or (2) an adminlogin action with a crafted uid parameter, which reveals the version number.Show less
CVE-2010-2659
1Opera
1Opera Browser
Apr 29, 2026
Jul 8, 2010
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Opera before 10.50 on Windows, before 10.52 on Mac OS X, and before 10.60 on UNIX platforms makes widget properties accessible to third-party domains, which allows remote attackers to obtain potentially sensitive informa...Show more
Opera before 10.50 on Windows, before 10.52 on Mac OS X, and before 10.60 on UNIX platforms makes widget properties accessible to third-party domains, which allows remote attackers to obtain potentially sensitive information via a crafted web site.Show less
CVE-2010-2612
1Hp
2Openvms
Openvms For Integrity Servers
Apr 29, 2026
Jul 2, 2010
N/A· v4
N/A· v3
2.1 LOW· v2
Unspecified vulnerability in the HP OpenVMS Auditing feature in OpenVMS ALPHA 7.3-2, 8.2, and 8.3; and OpenVMS for Integrity Servers 8.3 AND 8.3-1H1; allows local users to obtain sensitive information via unknown vectors...Show more
Unspecified vulnerability in the HP OpenVMS Auditing feature in OpenVMS ALPHA 7.3-2, 8.2, and 8.3; and OpenVMS for Integrity Servers 8.3 AND 8.3-1H1; allows local users to obtain sensitive information via unknown vectors.Show less
CVE-2010-1407
1Apple
1Iphone Os
Apr 29, 2026
Jun 22, 2010
N/A· v4
N/A· v3
4.3 MEDIUM· v2
WebKit in Apple iOS before 4 on the iPhone and iPod touch does not properly implement the history.replaceState method in certain situations involving IFRAME elements, which allows remote attackers to obtain sensitive inf...Show more
WebKit in Apple iOS before 4 on the iPhone and iPod touch does not properly implement the history.replaceState method in certain situations involving IFRAME elements, which allows remote attackers to obtain sensitive information via a crafted HTML document.Show less
CVE-2010-2336
1Yamamah
1Yamamah
Apr 29, 2026
Jun 18, 2010
N/A· v4
N/A· v3
5.0 MEDIUM· v2
index.php in Yamamah Photo Gallery 1.00 allows remote attackers to obtain the source code of executable files within the web document root via the download parameter.
CVE-2010-2333
1Litespeedtech
1Litespeed Web Server
Apr 29, 2026
Jun 18, 2010
N/A· v4
N/A· v3
5.0 MEDIUM· v2
LiteSpeed Technologies LiteSpeed Web Server 4.0.x before 4.0.15 allows remote attackers to read the source code of scripts via an HTTP request with a null byte followed by a .txt file extension.
CVE-2010-2326
1Ibm
1Websphere Application Server
Apr 29, 2026
Jun 18, 2010
N/A· v4
N/A· v3
4.3 MEDIUM· v2
IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.11, when addNode -trace is used during node federation, allows attackers to obtain sensitive information about CIMMetadataCollectorImpl trace actions by reading the...Show more
IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.11, when addNode -trace is used during node federation, allows attackers to obtain sensitive information about CIMMetadataCollectorImpl trace actions by reading the addNode.log file.Show less
CVE-2010-2323
1Ibm
1Websphere Application Server
Apr 29, 2026
Jun 18, 2010
N/A· v4
N/A· v3
5.0 MEDIUM· v2
IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.11 on z/OS might allow attackers to obtain sensitive information by reading the default_create.log file that is associated with profile creation by the BBOWWPFx job...Show more
IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.11 on z/OS might allow attackers to obtain sensitive information by reading the default_create.log file that is associated with profile creation by the BBOWWPFx job and the zPMT.Show less
CVE-2010-2068
1Apache
1Http Server
Apr 29, 2026
Jun 18, 2010
N/A· v4
N/A· v3
5.0 MEDIUM· v2
mod_proxy_http.c in mod_proxy_http in the Apache HTTP Server 2.2.9 through 2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in certain configurations involving proxy worker pools, does not properly det...Show more
mod_proxy_http.c in mod_proxy_http in the Apache HTTP Server 2.2.9 through 2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in certain configurations involving proxy worker pools, does not properly detect timeouts, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request.Show less
CVE-2010-2263
1F5
1Nginx
Apr 29, 2026
Jun 15, 2010
N/A· v4
N/A· v3
5.0 MEDIUM· v2
nginx 0.8 before 0.8.40 and 0.7 before 0.7.66, when running on Windows, allows remote attackers to obtain source code or unparsed content of arbitrary files under the web document root by appending ::$DATA to the URI.
CVE-2010-2264
1Apple
2Safari
Webkit
Apr 29, 2026
Jun 11, 2010
N/A· v4
N/A· v3
4.3 MEDIUM· v2
The Cascading Style Sheets (CSS) implementation in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, does not properly handle the :visited pseudo-class, which a...Show more
The Cascading Style Sheets (CSS) implementation in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, does not properly handle the :visited pseudo-class, which allows remote attackers to obtain sensitive information about visited web pages via a crafted HTML document.Show less
CVE-2010-1406
1Apple
2Safari
Webkit
Apr 29, 2026
Jun 11, 2010
N/A· v4
N/A· v3
4.3 MEDIUM· v2
WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, sends an https URL in the Referer header of an http request in certain circumstances involving https to http r...Show more
WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, sends an https URL in the Referer header of an http request in certain circumstances involving https to http redirection, which allows remote HTTP servers to obtain potentially sensitive information via standard HTTP logging, a related issue to CVE-2010-0660.Show less
CVE-2010-1393
1Apple
2Safari
Webkit
Apr 29, 2026
Jun 11, 2010
N/A· v4
N/A· v3
4.3 MEDIUM· v2
The Cascading Style Sheets (CSS) implementation in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to discover sensitive URLs via an H...Show more
The Cascading Style Sheets (CSS) implementation in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to discover sensitive URLs via an HREF attribute associated with a redirecting URL.Show less
CVE-2010-1388
1Apple
2Safari
Webkit
Apr 29, 2026
Jun 11, 2010
N/A· v4
N/A· v3
4.3 MEDIUM· v2
WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6, and before 4.1 on Mac OS X 10.4, does not properly handle clipboard (1) drag and (2) paste operations for URLs, which allows user-assisted remote attackers...Show more
WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6, and before 4.1 on Mac OS X 10.4, does not properly handle clipboard (1) drag and (2) paste operations for URLs, which allows user-assisted remote attackers to read arbitrary files via a crafted HTML document.Show less
CVE-2010-1384
1Apple
1Safari
Apr 29, 2026
Jun 11, 2010
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, does not provide a warning about a (1) http or (2) https URL that contains a username and password, which makes it easie...Show more
Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, does not provide a warning about a (1) http or (2) https URL that contains a username and password, which makes it easier for remote attackers to conduct phishing attacks via a crafted URL.Show less
CVE-2010-2190
1Php
1Php
Apr 29, 2026
Jun 8, 2010
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The (1) trim, (2) ltrim, (3) rtrim, and (4) substr_replace functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a usersp...Show more
The (1) trim, (2) ltrim, (3) rtrim, and (4) substr_replace functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.Show less