Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CVEs (11,638)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2015-0178 1Ibm 1Liberty May 6, 2026 Mar 18, 2015 N/A· v4 N/A· v3 4.3 MEDIUM· v2 The Java overlay feature in IBM Bluemix Liberty before 1.13-20150209-1122 for Java does not properly support WAR applications, which allows remote attackers to obtain sensitive information via unspecified vectors.
CVE-2014-6131 1Ibm 5Rational Collaborative Lifecycle Management Rational Doors Next GenerationRational Quality Manager+2 more May 6, 2026 Mar 18, 2015 N/A· v4 N/A· v3 4.0 MEDIUM· v2 IBM Rational Jazz Team Server (JTS), as used in Rational Collaborative Lifecycle Management 3.x and 4.x before 4.0.7 iFix4 and 5.x before 5.0.2 iFix2; Rational Quality Manager 2.x and 3.x before 3.0.1.6 iFix5, 4.x before...Show more IBM Rational Jazz Team Server (JTS), as used in Rational Collaborative Lifecycle Management 3.x and 4.x before 4.0.7 iFix4 and 5.x before 5.0.2 iFix2; Rational Quality Manager 2.x and 3.x before 3.0.1.6 iFix5, 4.x before 4.0.7 iFix4, and 5.x before 5.0.2 iFix2; Rational Team Concert 2.x and 3.x before 3.0.1.6 iFix5, 4.x before 4.0.7 iFix4, and 5.x before 5.0.2 iFix2; Rational DOORS Next Generation 4.x before 4.0.7 iFix4 and 5.x before 5.0.2 iFix2; Rational Requirements Composer 2.x and 3.x before 3.0.1.6 iFix5; and other products, allows remote authenticated users to read the dashboards of arbitrary users via unspecified vectors.Show less
CVE-2015-2045 3Debian FedoraprojectXen 3Debian Linux FedoraXen May 6, 2026 Mar 12, 2015 N/A· v4 N/A· v3 2.1 LOW· v2 The HYPERVISOR_xen_version hypercall in Xen 3.2.x through 4.5.x does not properly initialize data structures, which allows local guest users to obtain sensitive information via unspecified vectors.
CVE-2015-2044 1Xen 1Xen May 6, 2026 Mar 12, 2015 N/A· v4 N/A· v3 2.1 LOW· v2 The emulation routines for unspecified X86 devices in Xen 3.2.x through 4.5.x does not properly initialize data, which allow local HVM guest users to obtain sensitive information via vectors involving an unsupported acce...Show more The emulation routines for unspecified X86 devices in Xen 3.2.x through 4.5.x does not properly initialize data, which allow local HVM guest users to obtain sensitive information via vectors involving an unsupported access size.Show less
CVE-2015-1064 1Apple 1Iphone Os May 6, 2026 Mar 12, 2015 N/A· v4 N/A· v3 1.9 LOW· v2 Springboard in Apple iOS before 8.2 allows physically proximate attackers to bypass an intended activation requirement and read the home screen by leveraging an application crash during the activation process.
CVE-2015-0094 1Microsoft 9Windows 7 Windows 8Windows 8.1+6 more May 6, 2026 Mar 11, 2015 N/A· v4 N/A· v3 2.1 LOW· v2 The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do...Show more The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly restrict the availability of address information during a function call, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application, aka "Microsoft Windows Kernel Memory Disclosure Vulnerability."Show less
CVE-2015-0089 1Microsoft 9Windows 7 Windows 8Windows 8.1+6 more May 6, 2026 Mar 11, 2015 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows re...Show more Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to obtain sensitive information from kernel memory, and possibly bypass the KASLR protection mechanism, via a crafted font, aka "Adobe Font Driver Information Disclosure Vulnerability," a different vulnerability than CVE-2015-0087.Show less
CVE-2015-0087 1Microsoft 9Windows 7 Windows 8Windows 8.1+6 more May 6, 2026 Mar 11, 2015 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows re...Show more Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to obtain sensitive information from kernel memory, and possibly bypass the KASLR protection mechanism, via a crafted font, aka "Adobe Font Driver Information Disclosure Vulnerability," a different vulnerability than CVE-2015-0089.Show less
CVE-2015-0080 1Microsoft 9Windows 7 Windows 8Windows 8.1+6 more May 6, 2026 Mar 11, 2015 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly initialize mem...Show more Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly initialize memory for rendering of malformed PNG images, which allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Malformed PNG Parsing Information Disclosure Vulnerability."Show less
CVE-2015-0077 1Microsoft 9Windows 7 Windows 8Windows 8.1+6 more May 6, 2026 Mar 11, 2015 N/A· v4 N/A· v3 2.1 LOW· v2 The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do...Show more The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly initialize function buffers, which allows local users to obtain sensitive information from kernel memory, and possibly bypass the ASLR protection mechanism, via a crafted application, aka "Microsoft Windows Kernel Memory Disclosure Vulnerability."Show less
CVE-2015-0076 1Microsoft 8Windows 7 Windows 8Windows 8.1+5 more May 6, 2026 Mar 11, 2015 N/A· v4 N/A· v3 4.3 MEDIUM· v2 The photo-decoder implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly i...Show more The photo-decoder implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly initialize memory for rendering of JXR images, which allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "JPEG XR Parser Information Disclosure Vulnerability."Show less
CVE-2015-2184 1Ajsquare 1Zeuscart May 6, 2026 Mar 10, 2015 N/A· v4 N/A· v3 5.0 MEDIUM· v2 ZeusCart 4 allows remote attackers to obtain configuration information via a getphpinfo action to admin/, which calls the phpinfo function.
CVE-2015-0271 1Redhat 1Openstack May 6, 2026 Mar 10, 2015 N/A· v4 N/A· v3 4.0 MEDIUM· v2 The log-viewing function in the Red Hat redhat-access-plugin before 6.0.3 for OpenStack Dashboard (horizon) allows remote attackers to read arbitrary files via a crafted path.
CVE-2014-8112 1Fedoraproject 2389 Directory Server Fedora May 6, 2026 Mar 10, 2015 N/A· v4 N/A· v3 4.0 MEDIUM· v2 389 Directory Server 1.3.1.x, 1.3.2.x before 1.3.2.27, and 1.3.3.x before 1.3.3.9 stores "unhashed" passwords even when the nsslapd-unhashed-pw-switch option is set to off, which allows remote authenticated users to obta...Show more 389 Directory Server 1.3.1.x, 1.3.2.x before 1.3.2.27, and 1.3.3.x before 1.3.3.9 stores "unhashed" passwords even when the nsslapd-unhashed-pw-switch option is set to off, which allows remote authenticated users to obtain sensitive information by reading the Changelog.Show less
CVE-2014-8105 1Fedoraproject 2389 Directory Server Fedora May 6, 2026 Mar 10, 2015 N/A· v4 N/A· v3 5.0 MEDIUM· v2 389 Directory Server before 1.3.2.27 and 1.3.3.x before 1.3.3.9 does not properly restrict access to the "cn=changelog" LDAP sub-tree, which allows remote attackers to obtain sensitive information from the changelog via...Show more 389 Directory Server before 1.3.2.27 and 1.3.3.x before 1.3.3.9 does not properly restrict access to the "cn=changelog" LDAP sub-tree, which allows remote attackers to obtain sensitive information from the changelog via unspecified vectors.Show less
CVE-2015-2206 2Fedoraproject Phpmyadmin 2Fedora Phpmyadmin May 6, 2026 Mar 9, 2015 N/A· v4 N/A· v3 5.0 MEDIUM· v2 libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may b...Show more libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.Show less
CVE-2015-1165 3Bestpractical DebianFedoraproject 3Debian Linux FedoraRequest Tracker May 6, 2026 Mar 9, 2015 N/A· v4 N/A· v3 5.0 MEDIUM· v2 RT (aka Request Tracker) 3.8.8 through 4.x before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to obtain sensitive RSS feed URLs and ticket data via unspecified vectors.
CVE-2015-1598 1Siemens 1Spcanywhere May 6, 2026 Mar 7, 2015 N/A· v4 N/A· v3 2.1 LOW· v2 The Siemens SPCanywhere application for Android does not properly store application passwords, which allows physically proximate attackers to obtain sensitive information by examining the device filesystem.
CVE-2015-1595 1Siemens 1Spcanywhere May 6, 2026 Mar 7, 2015 N/A· v4 N/A· v3 4.3 MEDIUM· v2 The Siemens SPCanywhere application for Android and iOS does not use encryption during lookups of system ID to IP address mappings, which allows man-in-the-middle attackers to discover alarm IP addresses and spoof server...Show more The Siemens SPCanywhere application for Android and iOS does not use encryption during lookups of system ID to IP address mappings, which allows man-in-the-middle attackers to discover alarm IP addresses and spoof servers by intercepting the client-server data stream.Show less
CVE-2015-2214 1Netcat 1Netcat May 6, 2026 Mar 5, 2015 N/A· v4 N/A· v3 5.0 MEDIUM· v2 NetCat 5.01 and earlier allows remote attackers to obtain the installation path via the redirect_url parameter to netshop/post.php.

Previous 1...485486487...582 Next