← Back
CWE-200

11,637 CVEs • Abstraction: Class • Likelihood of Exploit: High

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

JSON object

Loading...

CVEs (11,637)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2014-9593
1Apache
1Cloudstack
May 6, 2026
Jan 15, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Apache CloudStack before 4.3.2 and 4.4.x before 4.4.2 allows remote attackers to obtain private keys via a listSslCerts API call.
CVE-2015-0583
1Cisco
1Webex Meeting Center
May 6, 2026
Jan 14, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Cisco WebEx Meeting Center does not properly restrict the content of URLs, which allows remote attackers to obtain sensitive information via vectors related to file: URIs, aka Bug ID CSCus18281.
CVE-2014-8637
1Mozilla
2Firefox
Seamonkey
May 6, 2026
Jan 14, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Mozilla Firefox before 35.0 and SeaMonkey before 2.32 do not properly initialize memory for BMP images, which allows remote attackers to obtain sensitive information from process memory via a crafted web page that trigge...Show more
Mozilla Firefox before 35.0 and SeaMonkey before 2.32 do not properly initialize memory for BMP images, which allows remote attackers to obtain sensitive information from process memory via a crafted web page that triggers the rendering of malformed BMP data within a CANVAS element.Show less
CVE-2014-5233
1Siemens
1Simatic Wincc Sm@rtclient
May 6, 2026
Jan 14, 2015
N/A· v4
N/A· v3
1.9 LOW· v2
The Siemens SIMATIC WinCC Sm@rtClient app before 1.0.2 for iOS allows physically proximate attackers to discover Sm@rtServer credentials by leveraging an error in the credential-processing mechanism.
CVE-2014-5231
1Siemens
1Simatic Wincc Sm@rtclient
May 6, 2026
Jan 14, 2015
N/A· v4
N/A· v3
2.1 LOW· v2
The Siemens SIMATIC WinCC Sm@rtClient app before 1.0.2 for iOS allows physically proximate attackers to extract the password from storage via unspecified vectors.
CVE-2014-10026
1Dlink
1Dap 1360 Firmware
May 6, 2026
Jan 13, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
index.cgi in D-Link DAP-1360 with firmware 2.5.4 and earlier allows remote attackers to bypass authentication and obtain sensitive information by setting the client_login cookie to admin.
CVE-2014-10005
1Maianscriptworld
1Maian Uploader
May 6, 2026
Jan 13, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Maian Uploader 4.0 allows remote attackers to obtain sensitive information via a request without the height parameter to load_flv.js.php, which reveals the installation path in an error message.
CVE-2014-100009
1Joomlaskin
1Js Multi Hotel
May 6, 2026
Jan 13, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The Joomlaskin JS Multi Hotel (aka JS MultiHotel and Js-Multi-Hotel) plugin 2.2.1 and earlier for WordPress allows remote attackers to obtain the installation path via a request to (1) functions.php, (2) myCalendar.php,...Show more
The Joomlaskin JS Multi Hotel (aka JS MultiHotel and Js-Multi-Hotel) plugin 2.2.1 and earlier for WordPress allows remote attackers to obtain the installation path via a request to (1) functions.php, (2) myCalendar.php, (3) refreshDate.php, (4) show_image.php, (5) widget.php, (6) phpthumb/GdThumb.inc.php, or (7) phpthumb/thumb_plugins/gd_reflection.inc.php in includes/.Show less
CVE-2014-8035
1Cisco
1Webex Meetings Server
May 6, 2026
Jan 10, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The web framework in Cisco WebEx Meetings Server produces different returned messages for URL requests depending on whether a username exists, which allows remote attackers to enumerate user accounts via a series of requ...Show more
The web framework in Cisco WebEx Meetings Server produces different returned messages for URL requests depending on whether a username exists, which allows remote attackers to enumerate user accounts via a series of requests, aka Bug ID CSCuj40247.Show less
CVE-2015-0922
1Mcafee
1Epolicy Orchestrator
May 6, 2026
Jan 9, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 uses the same secret key across different customers' installations, which allows attackers to obtain the administrator password by leveraging knowledge...Show more
McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 uses the same secret key across different customers' installations, which allows attackers to obtain the administrator password by leveraging knowledge of the encrypted password.Show less
CVE-2014-8032
1Cisco
1Webex Meetings Server
May 6, 2026
Jan 9, 2015
N/A· v4
N/A· v3
4.0 MEDIUM· v2
The OutlookAction LI in Cisco WebEx Meetings Server allows remote authenticated users to obtain sensitive encrypted-password information via unspecified vectors, aka Bug IDs CSCuj40453 and CSCuj40449.
CVE-2014-9579
1Vdgsecurity
1Vdg Sense
May 6, 2026
Jan 8, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
VDG Security SENSE (formerly DIVA) 2.3.13 stores administrator credentials in cleartext, which allows attackers to obtain sensitive information by reading the plugin configuration files.
CVE-2014-9577
1Vdgsecurity
1Vdg Sense
May 6, 2026
Jan 8, 2015
N/A· v4
N/A· v3
4.0 MEDIUM· v2
VDG Security SENSE (formerly DIVA) 2.3.13 sends the user database when a user logs in, which allows remote authenticated users to obtain usernames and password hashes by logging in to TCP port 51410 and reading the respo...Show more
VDG Security SENSE (formerly DIVA) 2.3.13 sends the user database when a user logs in, which allows remote authenticated users to obtain usernames and password hashes by logging in to TCP port 51410 and reading the response.Show less
CVE-2014-9576
1Vdgsecurity
1Vdg Sense
May 6, 2026
Jan 8, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
VDG Security SENSE (formerly DIVA) 2.3.13 has a hardcoded password of (1) ArpaRomaWi for the root Postgres account and !DVService for the (2) postgres and (3) NTP Windows user accounts, which allows remote attackers to o...Show more
VDG Security SENSE (formerly DIVA) 2.3.13 has a hardcoded password of (1) ArpaRomaWi for the root Postgres account and !DVService for the (2) postgres and (3) NTP Windows user accounts, which allows remote attackers to obtain access.Show less
CVE-2014-4638
1Emc
1Documentum Wdk
May 6, 2026
Jan 7, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
EMC Documentum Web Development Kit (WDK) before 6.8 allows remote attackers to conduct frame-injection attacks and obtain sensitive information via unspecified vectors.
CVE-2014-9506
1Mantisbt
1Mantisbt
May 6, 2026
Jan 4, 2015
N/A· v4
N/A· v3
3.5 LOW· v2
MantisBT before 1.2.18 does not properly check permissions when sending an email that indicates when a monitored issue is related to another issue, which allows remote authenticated users to obtain sensitive information...Show more
MantisBT before 1.2.18 does not properly check permissions when sending an email that indicates when a monitored issue is related to another issue, which allows remote authenticated users to obtain sensitive information about restricted issues.Show less
CVE-2011-5314
1Redaxscript
1Redaxscript
May 6, 2026
Jan 1, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
templates/default/index.php in Redaxscript 0.3.2 allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message.
CVE-2011-2727
1Tribiq
1Tribiq Cms
May 6, 2026
Dec 30, 2014
N/A· v4
N/A· v3
4.3 MEDIUM· v2
The (1) templatewrap/templatefoot.php, (2) cmsjs/plugin.js.php, and (3) cmsincludes/cms_plugin_api_link.inc.php scripts in Tribal Tribiq CMS before 5.2.7c allow remote attackers to obtain sensitive information via a dire...Show more
The (1) templatewrap/templatefoot.php, (2) cmsjs/plugin.js.php, and (3) cmsincludes/cms_plugin_api_link.inc.php scripts in Tribal Tribiq CMS before 5.2.7c allow remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message.Show less
CVE-2014-1908
1Videowhisper
1Videowhisper Live Streaming Integration
May 6, 2026
Dec 29, 2014
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The error-handling feature in (1) bp.php, (2) videowhisper_streaming.php, and (3) ls/rtmp.inc.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to obtain sensit...Show more
The error-handling feature in (1) bp.php, (2) videowhisper_streaming.php, and (3) ls/rtmp.inc.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message.Show less
CVE-2014-6123
1Ibm
2Rational Appscan Source
Security Appscan Source
May 6, 2026
Dec 29, 2014
N/A· v4
N/A· v3
2.1 LOW· v2
IBM Rational AppScan Source 8.0 through 8.0.0.2 and 8.5 through 8.5.0.1 and Security AppScan Source 8.6 through 8.6.0.2, 8.7 through 8.7.0.1, 8.8, 9.0 through 9.0.0.1, and 9.0.1 allow local users to obtain sensitive cred...Show more
IBM Rational AppScan Source 8.0 through 8.0.0.2 and 8.5 through 8.5.0.1 and Security AppScan Source 8.6 through 8.6.0.2, 8.7 through 8.7.0.1, 8.8, 9.0 through 9.0.0.1, and 9.0.1 allow local users to obtain sensitive credential information by reading installation logs.Show less