← Back
CWE-200

11,637 CVEs • Abstraction: Class • Likelihood of Exploit: High

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

JSON object

Loading...

CVEs (11,637)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2015-0597
1Cisco
1Webex Meetings Server
May 6, 2026
Feb 2, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The Forgot Password feature in Cisco WebEx Meetings Server 1.5(.1.131) and earlier allows remote attackers to enumerate administrative accounts via crafted packets, aka Bug IDs CSCuj67166 and CSCuj67159.
CVE-2015-0595
1Cisco
1Webex Meetings Server
May 6, 2026
Feb 2, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The XMLAPI in Cisco WebEx Meetings Server 1.5(.1.131) and earlier allows remote attackers to obtain sensitive information by reading return messages from crafted GET requests, aka Bug ID CSCuj67079.
CVE-2014-6170
1Ibm
2Integration Bus
Websphere Message Broker
May 6, 2026
Feb 2, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The HTTPInput node in IBM WebSphere Message Broker 7.0 before 7.0.0.8 and 8.0 before 8.0.0.6 and IBM Integration Bus 9.0 before 9.0.0.4 allows remote attackers to obtain sensitive information by triggering a SOAP fault.
CVE-2014-8839
1Apple
1Mac Os X
May 6, 2026
Jan 30, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Spotlight in Apple OS X before 10.10.2 does not enforce the Mail "Load remote content in messages" configuration, which allows remote attackers to discover recipient IP addresses by including an inline image in an HTML e...Show more
Spotlight in Apple OS X before 10.10.2 does not enforce the Mail "Load remote content in messages" configuration, which allows remote attackers to discover recipient IP addresses by including an inline image in an HTML e-mail message and logging HTTP requests for this image's URL.Show less
CVE-2014-8834
1Apple
1Mac Os X
May 6, 2026
Jan 30, 2015
N/A· v4
N/A· v3
2.1 LOW· v2
UserAccountUpdater in Apple OS X 10.10 before 10.10.2 stores a PDF document's password in a printing preference file, which allows local users to obtain sensitive information by reading a file.
CVE-2014-8832
1Apple
1Mac Os X
May 6, 2026
Jan 30, 2015
N/A· v4
N/A· v3
4.9 MEDIUM· v2
The indexing functionality in Spotlight in Apple OS X before 10.10.2 writes memory contents to an external hard drive, which allows local users to obtain sensitive information by reading from this drive.
CVE-2014-4499
1Apple
1Mac Os X
May 6, 2026
Jan 30, 2015
N/A· v4
N/A· v3
2.1 LOW· v2
The App Store process in CommerceKit Framework in Apple OS X before 10.10.2 places Apple ID credentials in App Store logs, which allows local users to obtain sensitive information by reading a file.
CVE-2014-4491
1Apple
3Iphone Os
Mac Os XTvos
May 6, 2026
Jan 30, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The extension APIs in the kernel in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 do not prevent the presence of addresses within an OSBundleMachOHeaders key in a response, which makes it e...Show more
The extension APIs in the kernel in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 do not prevent the presence of addresses within an OSBundleMachOHeaders key in a response, which makes it easier for attackers to bypass the ASLR protection mechanism via a crafted app.Show less
CVE-2015-0236
3Canonical
MageiaRedhat
7Enterprise Linux Desktop
Enterprise Linux Hpc NodeEnterprise Linux Server+4 more
May 6, 2026
Jan 29, 2015
N/A· v4
N/A· v3
3.5 LOW· v2
libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDo...Show more
libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface.Show less
CVE-2015-1308
1Kde
2Kde Workspace
Plasma Workspace
May 6, 2026
Jan 26, 2015
N/A· v4
N/A· v3
4.3 MEDIUM· v2
kde-workspace 4.2.0 and plasma-workspace before 5.1.95 allows remote attackers to obtain input events, and consequently obtain passwords, by leveraging access to the X server when the screen is locked.
CVE-2015-0310
1Adobe
1Flash Player
Apr 21, 2026
Jan 23, 2015
N/A· v4
7.8 HIGH· v3
10.0 HIGH· v2
Adobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before 11.2.202.438 on Linux does not properly restrict discovery of memory addresses, which allows attackers to bypass...Show more
Adobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before 11.2.202.438 on Linux does not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism on Windows, and have an unspecified impact on other platforms, via unknown vectors, as exploited in the wild in January 2015.Show less
CVE-2015-1306
1Sympa
1Sympa
May 6, 2026
Jan 22, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The newsletter posting area in the web interface in Sympa 6.0.x before 6.0.10 and 6.1.x before 6.1.24 allows remote attackers to read arbitrary files via unspecified vectors.
CVE-2014-8008
1Cisco
1Unified Communications Manager
May 6, 2026
Jan 22, 2015
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Absolute path traversal vulnerability in the Real-Time Monitoring Tool (RTMT) API in Cisco Unified Communications Manager (CUCM) allows remote authenticated users to read arbitrary files via a full pathname in an API com...Show more
Absolute path traversal vulnerability in the Real-Time Monitoring Tool (RTMT) API in Cisco Unified Communications Manager (CUCM) allows remote authenticated users to read arbitrary files via a full pathname in an API command, aka Bug ID CSCur49414.Show less
CVE-2013-6892
2Debian
Websvn
2Debian Linux
Websvn
May 6, 2026
Jan 21, 2015
N/A· v4
N/A· v3
3.5 LOW· v2
WebSVN 2.3.3 allows remote authenticated users to read arbitrary files via a symlink attack in a commit.
CVE-2015-0514
1Emc
2Vipr Srm
Watch4net
May 6, 2026
Jan 21, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
EMC M&R (aka Watch4Net) before 6.5u1 and ViPR SRM before 3.6.1 might allow remote attackers to obtain cleartext data-center discovery credentials by leveraging certain SRM access to conduct a decryption attack.
CVE-2014-9225
2Broadcom
Symantec
2Data Center Security
Symantec Critical System Protection
May 6, 2026
Jan 21, 2015
N/A· v4
N/A· v3
4.0 MEDIUM· v2
The ajaxswing webui in the management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced (SDCS:SA) 6.0.x through 6.0 MP1 allows remote authenticated...Show more
The ajaxswing webui in the management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced (SDCS:SA) 6.0.x through 6.0 MP1 allows remote authenticated users to obtain sensitive server information via unspecified vectors.Show less
CVE-2014-6172
1Ibm
1Api Management
May 6, 2026
Jan 21, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
IBM API Management 3.0 before 3.0.4.0 IF1 allows remote attackers to obtain sensitive analytics information in an encrypted form via unspecified vectors.
CVE-2015-0590
1Cisco
1Webex Meeting Center
May 6, 2026
Jan 17, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Cisco WebEx Meeting Center allows remote attackers to activate disabled meeting attributes, and consequently obtain sensitive information, by providing crafted parameters during a meeting-join action, aka Bug ID CSCuo341...Show more
Cisco WebEx Meeting Center allows remote attackers to activate disabled meeting attributes, and consequently obtain sensitive information, by providing crafted parameters during a meeting-join action, aka Bug ID CSCuo34165.Show less
CVE-2014-4835
1Ibm
3Serverguide
Toolscenter SuiteUpdatexpress System Packs Installer
May 6, 2026
Jan 17, 2015
N/A· v4
N/A· v3
2.1 LOW· v2
IBM ServerGuide before 9.63, UpdateXpress System Packs Installer (UXSPI) before 9.63, and ToolsCenter Suite before 9.63 place credentials in logs, which allows local users to obtain sensitive information by reading a fil...Show more
IBM ServerGuide before 9.63, UpdateXpress System Packs Installer (UXSPI) before 9.63, and ToolsCenter Suite before 9.63 place credentials in logs, which allows local users to obtain sensitive information by reading a file.Show less
CVE-2014-9199
1Clorius Controls A/s
1Java Web Client
May 6, 2026
Jan 17, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The Clorius Controls Java web client before 01.00.0009g allows remote attackers to discover credentials by sniffing the network for cleartext-equivalent traffic.