Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CVEs (11,566)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2014-0891 1Ibm 1Websphere Application Server May 6, 2026 Jun 28, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.33, 8.0.x before 8.0.0.9, and 8.5.x before 8.5.5.2 allows remote attackers to obtain sensitive information by leveraging incorrect request handling by the (1) Pro...Show more IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.33, 8.0.x before 8.0.0.9, and 8.5.x before 8.5.5.2 allows remote attackers to obtain sensitive information by leveraging incorrect request handling by the (1) Proxy or (2) ODR server.Show less
CVE-2014-4027 5Canonical F5Linux+2 more 26Big Ip Access Policy Manager Big Ip Advanced Firewall ManagerBig Ip Analytics+23 more May 6, 2026 Jun 23, 2014 N/A· v4 N/A· v3 2.3 LOW· v2 The rd_build_device_space function in drivers/target/target_core_rd.c in the Linux kernel before 3.14 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from r...Show more The rd_build_device_space function in drivers/target/target_core_rd.c in the Linux kernel before 3.14 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from ramdisk_mcp memory by leveraging access to a SCSI initiator.Show less
CVE-2014-1739 3Canonical LinuxSuse 5Linux Enterprise High Availability Extension Linux KernelSuse Linux Enterprise Desktop+2 more May 6, 2026 Jun 23, 2014 N/A· v4 N/A· v3 2.1 LOW· v2 The media_device_enum_entities function in drivers/media/media-device.c in the Linux kernel before 3.14.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel...Show more The media_device_enum_entities function in drivers/media/media-device.c in the Linux kernel before 3.14.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory by leveraging /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call.Show less
CVE-2014-3296 1Cisco 1Webex Meetings Server May 6, 2026 Jun 21, 2014 N/A· v4 N/A· v3 4.0 MEDIUM· v2 The XML programmatic interface (XML PI) in Cisco WebEx Meeting Server 1.5(.1.131) and earlier allows remote authenticated users to obtain sensitive meeting information via a crafted URL, aka Bug ID CSCum03527.
CVE-2014-4153 1Alienvault 1Open Source Security Information Management May 6, 2026 Jun 18, 2014 N/A· v4 N/A· v3 7.8 HIGH· v2 The av-centerd SOAP service in AlienVault OSSIM before 4.8.0 allows remote attackers to read arbitrary files via a crafted get_file request.
CVE-2014-2000 1Ntt 1050 Plus May 6, 2026 Jun 18, 2014 N/A· v4 N/A· v3 2.6 LOW· v2 The NTT 050 plus application before 4.2.1 for Android allows attackers to obtain sensitive information by leveraging the ability to read system log files.
CVE-2014-3249 1Puppet 1Puppet Enterprise May 6, 2026 Jun 17, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Puppet Enterprise 2.8.x before 2.8.7 allows remote attackers to obtain sensitive information via vectors involving hiding and unhiding nodes.
CVE-2014-1777 1Microsoft 1Internet Explorer May 6, 2026 Jun 11, 2014 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Microsoft Internet Explorer 10 and 11 allows remote attackers to read local files on the client via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."
CVE-2014-0220 1Cloudera 1Cloudera Manager May 6, 2026 Jun 10, 2014 N/A· v4 N/A· v3 4.0 MEDIUM· v2 Cloudera Manager before 4.8.3 and 5.x before 5.0.1 allows remote authenticated users to obtain sensitive configuration information via the API.
CVE-2013-5760 1Qnap 2Photo Station Photo Station Firmware May 6, 2026 Jun 9, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 QNAP Photo Station before firmware 4.0.3 build0912 allows remote attackers to list OS user accounts via a request to photo/p/api/list.php.
CVE-2013-4728 1Ddsn 1Cm3 Acora Content Management System May 6, 2026 Jun 6, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, allows remote attackers to obtain sensitive information via a .. (dot dot) in the "l" parameter, which reveals the i...Show more DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, allows remote attackers to obtain sensitive information via a .. (dot dot) in the "l" parameter, which reveals the installation path in an error message.Show less
CVE-2013-4727 1Ddsn 1Cm3 Acora Content Management System May 6, 2026 Jun 6, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, allows remote attackers to obtain sensitive information via a request to Admin/top.aspx.
CVE-2013-4725 1Ddsn 1Cm3 Acora Content Management System May 6, 2026 Jun 6, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, does not set the secure flag for an unspecified cookie in an https session, which makes it easier for remote attacke...Show more DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, does not set the secure flag for an unspecified cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.Show less
CVE-2013-4724 1Ddsn 1Cm3 Acora Content Management System May 6, 2026 Jun 6, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, does not include the HTTPOnly flag in a Set-Cookie header for an unspecified cookie, which makes it easier for remot...Show more DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, does not include the HTTPOnly flag in a Set-Cookie header for an unspecified cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.Show less
CVE-2014-3917 3Linux RedhatSuse 4Enterprise Linux Enterprise MrgLinux Enterprise Desktop+1 more May 6, 2026 Jun 5, 2014 N/A· v4 N/A· v3 3.3 LOW· v2 kernel/auditsc.c in the Linux kernel through 3.14.5, when CONFIG_AUDITSYSCALL is enabled with certain syscall rules, allows local users to obtain potentially sensitive single-bit values from kernel memory or cause a deni...Show more kernel/auditsc.c in the Linux kernel through 3.14.5, when CONFIG_AUDITSYSCALL is enabled with certain syscall rules, allows local users to obtain potentially sensitive single-bit values from kernel memory or cause a denial of service (OOPS) via a large value of a syscall number.Show less
CVE-2014-3956 4Fedoraproject FreebsdHp+1 more 4Fedora FreebsdHpux+1 more May 6, 2026 Jun 4, 2014 N/A· v4 N/A· v3 1.9 LOW· v2 The sm_close_on_exec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and consequently skips setting expected FD_CLOEXEC flags, which allows local users to access unintended high-numbered fi...Show more The sm_close_on_exec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and consequently skips setting expected FD_CLOEXEC flags, which allows local users to access unintended high-numbered file descriptors via a custom mail-delivery program.Show less
CVE-2014-3946 1Typo3 1Typo3 May 6, 2026 Jun 3, 2014 N/A· v4 N/A· v3 4.0 MEDIUM· v2 The query caching functionality in the Extbase Framework component in TYPO3 6.2.0 before 6.2.3 does not properly validate group permissions, which allows remote authenticated users to read arbitrary queries via unspecifi...Show more The query caching functionality in the Extbase Framework component in TYPO3 6.2.0 before 6.2.3 does not properly validate group permissions, which allows remote authenticated users to read arbitrary queries via unspecified vectors.Show less
CVE-2013-1818 1Mediawiki 1Mediawiki May 6, 2026 Jun 2, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 maintenance/mwdoc-filter.php in MediaWiki before 1.20.3 allows remote attackers to read arbitrary files via unspecified vectors.
CVE-2014-0217 1Moodle 1Moodle May 6, 2026 May 27, 2014 N/A· v4 N/A· v3 4.3 MEDIUM· v2 enrol/index.php in Moodle 2.6.x before 2.6.3 does not check for the moodle/course:viewhiddencourses capability before listing hidden courses, which allows remote attackers to obtain sensitive name and summary information...Show more enrol/index.php in Moodle 2.6.x before 2.6.3 does not check for the moodle/course:viewhiddencourses capability before listing hidden courses, which allows remote attackers to obtain sensitive name and summary information about these courses by leveraging the guest role and visiting a crafted URL.Show less
CVE-2014-0215 1Moodle 1Moodle May 6, 2026 May 27, 2014 N/A· v4 N/A· v3 4.0 MEDIUM· v2 The blind-marking implementation in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 allows remote authenticated users to de-anonymize student identities by (1) using a screen reader...Show more The blind-marking implementation in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 allows remote authenticated users to de-anonymize student identities by (1) using a screen reader or (2) reading the HTML source.Show less

Previous 1...498499500...579 Next