CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
Description
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-116 · CAPEC-13 · CAPEC-169 · CAPEC-22 · CAPEC-224 · CAPEC-285 · CAPEC-287 · CAPEC-290 · CAPEC-291 · CAPEC-292 · CAPEC-293 · CAPEC-294 · CAPEC-295 · CAPEC-296 · CAPEC-297 · CAPEC-298 · CAPEC-299 · CAPEC-300 · CAPEC-301 · CAPEC-302 · CAPEC-303 · CAPEC-304 · CAPEC-305 · CAPEC-306 · CAPEC-307 · CAPEC-308 · CAPEC-309 · CAPEC-310 · CAPEC-312 · CAPEC-313 · CAPEC-317 · CAPEC-318 · CAPEC-319 · CAPEC-320 · CAPEC-321 · CAPEC-322 · CAPEC-323 · CAPEC-324 · CAPEC-325 · CAPEC-326 · CAPEC-327 · CAPEC-328 · CAPEC-329 · CAPEC-330 · CAPEC-472 · CAPEC-497 · CAPEC-508 · CAPEC-573 · CAPEC-574 · CAPEC-575 · CAPEC-576 · CAPEC-577 · CAPEC-59 · CAPEC-60 · CAPEC-616 · CAPEC-643 · CAPEC-646 · CAPEC-651 · CAPEC-79
CVEs mapped to this weakness (11,660)
page 217 of 583| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2014-3753 | Med | 0.36 | 5.5 | 0.01 | Jan 9, 2020 | AgileBits 1Password through 1.0.9.340 allows security feature bypass | ||
| CVE-2016-5346 | Med | 0.36 | 5.5 | 0.00 | Jan 8, 2020 | An Information Disclosure vulnerability exists in the Google Pixel/Pixel SL Qualcomm Avtimer Driver due to a NULL pointer dereference when processing an accept system call by the user process on AF_MSM_IPC sockets, which could let a local malicious user obtain sensitive… | ||
| CVE-2016-6587 | Med | 0.36 | 5.5 | 0.00 | Jan 8, 2020 | An Information Disclosure vulnerability exists in the mid.dat file stored on the SD card in Symantec Norton Mobile Security for Android before 3.16, which could let a local malicious user obtain sensitive information. | ||
| CVE-2012-5476 | Med | 0.36 | 5.5 | 0.00 | Dec 30, 2019 | Within the RHOS Essex Preview (2012.2) of the OpenStack dashboard package, the file /etc/quantum/quantum.conf is world readable which exposes the admin password and token value. | ||
| CVE-2019-4444 | Med | 0.36 | 5.5 | 0.00 | Dec 16, 2019 | IBM API Connect 2018.1 through 2018.4.1.7 Developer Portal's user registration page does not disable password autocomplete. An attacker with access to the browser instance and local system credentials can steal the credentials used for registration. IBM X-Force ID: 163453. | ||
| CVE-2019-1474 | Med | 0.36 | 5.5 | 0.02 | Dec 10, 2019 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1472. | ||
| CVE-2019-1472 | Med | 0.36 | 5.5 | 0.02 | Dec 10, 2019 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1474. | ||
| CVE-2019-1469 | Med | 0.36 | 5.5 | 0.02 | Dec 10, 2019 | An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerability'. | ||
| CVE-2019-1464 | Med | 0.36 | 5.5 | 0.09 | Dec 10, 2019 | An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel Information Disclosure Vulnerability'. | ||
| CVE-2019-1463 | Med | 0.36 | 5.5 | 0.02 | Dec 10, 2019 | An information disclosure vulnerability exists in Microsoft Access software when the software fails to properly handle objects in memory, aka 'Microsoft Access Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1400. | ||
| CVE-2019-1400 | Med | 0.36 | 5.5 | 0.02 | Dec 10, 2019 | An information disclosure vulnerability exists in Microsoft Access software when the software fails to properly handle objects in memory, aka 'Microsoft Access Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1463. | ||
| CVE-2012-1105 | Med | 0.36 | 5.5 | 0.00 | Dec 5, 2019 | An Information Disclosure vulnerability exists in the Jasig Project php-pear-CAS 1.2.2 package in the /tmp directory. The Central Authentication Service client library archives the debug logging file in an insecure manner. | ||
| CVE-2012-5644 | Med | 0.36 | 5.5 | 0.00 | Nov 25, 2019 | libuser has information disclosure when moving user's home directory | ||
| CVE-2012-0843 | Med | 0.36 | 5.5 | 0.00 | Nov 19, 2019 | uzbl: Information disclosure via world-readable cookies storage file | ||
| CVE-2012-0842 | Med | 0.36 | 5.5 | 0.00 | Nov 19, 2019 | surf: cookie jar has read access from other local user | ||
| CVE-2019-1446 | Med | 0.36 | 5.5 | 0.09 | Nov 12, 2019 | An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel Information Disclosure Vulnerability'. | ||
| CVE-2019-1440 | Med | 0.36 | 5.5 | 0.02 | Nov 12, 2019 | An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1436. | ||
| CVE-2019-1436 | Med | 0.36 | 5.5 | 0.02 | Nov 12, 2019 | An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1440. | ||
| CVE-2019-1402 | Med | 0.36 | 5.5 | 0.02 | Nov 12, 2019 | An information disclosure vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka 'Microsoft Office Information Disclosure Vulnerability'. | ||
| CVE-2019-1381 | Med | 0.36 | 5.5 | 0.02 | Nov 12, 2019 | An information disclosure vulnerability exists when the Windows Servicing Stack allows access to unprivileged file locations, aka 'Microsoft Windows Information Disclosure Vulnerability'. |
- risk 0.36cvss 5.5epss 0.01
AgileBits 1Password through 1.0.9.340 allows security feature bypass
- risk 0.36cvss 5.5epss 0.00
An Information Disclosure vulnerability exists in the Google Pixel/Pixel SL Qualcomm Avtimer Driver due to a NULL pointer dereference when processing an accept system call by the user process on AF_MSM_IPC sockets, which could let a local malicious user obtain sensitive…
- risk 0.36cvss 5.5epss 0.00
An Information Disclosure vulnerability exists in the mid.dat file stored on the SD card in Symantec Norton Mobile Security for Android before 3.16, which could let a local malicious user obtain sensitive information.
- risk 0.36cvss 5.5epss 0.00
Within the RHOS Essex Preview (2012.2) of the OpenStack dashboard package, the file /etc/quantum/quantum.conf is world readable which exposes the admin password and token value.
- risk 0.36cvss 5.5epss 0.00
IBM API Connect 2018.1 through 2018.4.1.7 Developer Portal's user registration page does not disable password autocomplete. An attacker with access to the browser instance and local system credentials can steal the credentials used for registration. IBM X-Force ID: 163453.
- risk 0.36cvss 5.5epss 0.02
An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1472.
- risk 0.36cvss 5.5epss 0.02
An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1474.
- risk 0.36cvss 5.5epss 0.02
An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerability'.
- risk 0.36cvss 5.5epss 0.09
An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel Information Disclosure Vulnerability'.
- risk 0.36cvss 5.5epss 0.02
An information disclosure vulnerability exists in Microsoft Access software when the software fails to properly handle objects in memory, aka 'Microsoft Access Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1400.
- risk 0.36cvss 5.5epss 0.02
An information disclosure vulnerability exists in Microsoft Access software when the software fails to properly handle objects in memory, aka 'Microsoft Access Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1463.
- risk 0.36cvss 5.5epss 0.00
An Information Disclosure vulnerability exists in the Jasig Project php-pear-CAS 1.2.2 package in the /tmp directory. The Central Authentication Service client library archives the debug logging file in an insecure manner.
- risk 0.36cvss 5.5epss 0.00
libuser has information disclosure when moving user's home directory
- risk 0.36cvss 5.5epss 0.00
uzbl: Information disclosure via world-readable cookies storage file
- risk 0.36cvss 5.5epss 0.00
surf: cookie jar has read access from other local user
- risk 0.36cvss 5.5epss 0.09
An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel Information Disclosure Vulnerability'.
- risk 0.36cvss 5.5epss 0.02
An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1436.
- risk 0.36cvss 5.5epss 0.02
An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1440.
- risk 0.36cvss 5.5epss 0.02
An information disclosure vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka 'Microsoft Office Information Disclosure Vulnerability'.
- risk 0.36cvss 5.5epss 0.02
An information disclosure vulnerability exists when the Windows Servicing Stack allows access to unprivileged file locations, aka 'Microsoft Windows Information Disclosure Vulnerability'.