CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
Description
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-116 · CAPEC-13 · CAPEC-169 · CAPEC-22 · CAPEC-224 · CAPEC-285 · CAPEC-287 · CAPEC-290 · CAPEC-291 · CAPEC-292 · CAPEC-293 · CAPEC-294 · CAPEC-295 · CAPEC-296 · CAPEC-297 · CAPEC-298 · CAPEC-299 · CAPEC-300 · CAPEC-301 · CAPEC-302 · CAPEC-303 · CAPEC-304 · CAPEC-305 · CAPEC-306 · CAPEC-307 · CAPEC-308 · CAPEC-309 · CAPEC-310 · CAPEC-312 · CAPEC-313 · CAPEC-317 · CAPEC-318 · CAPEC-319 · CAPEC-320 · CAPEC-321 · CAPEC-322 · CAPEC-323 · CAPEC-324 · CAPEC-325 · CAPEC-326 · CAPEC-327 · CAPEC-328 · CAPEC-329 · CAPEC-330 · CAPEC-472 · CAPEC-497 · CAPEC-508 · CAPEC-573 · CAPEC-574 · CAPEC-575 · CAPEC-576 · CAPEC-577 · CAPEC-59 · CAPEC-60 · CAPEC-616 · CAPEC-643 · CAPEC-646 · CAPEC-651 · CAPEC-79
CVEs mapped to this weakness (11,660)
page 426 of 583| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-0709 | Low | 0.21 | 3.3 | 0.00 | Jul 6, 2017 | A information disclosure vulnerability in the HTC sensor hub driver. Product: Android. Versions: Android kernel. Android ID: A-35468048. | ||
| CVE-2017-1176 | Low | 0.21 | 3.3 | 0.00 | Jul 5, 2017 | IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a local user to obtain sensitive information due to inappropriate data retention of attachments. IBM X-Force ID: 123299. | ||
| CVE-2015-9032 | Low | 0.21 | 3.3 | 0.00 | Jun 13, 2017 | In all Android releases from CAF using the Linux kernel, a DRM key was exposed to QTEE applications. | ||
| CVE-2015-9031 | Low | 0.21 | 3.3 | 0.00 | Jun 13, 2017 | In all Android releases from CAF using the Linux kernel, a TZ memory address is exposed to HLOS by HDCP. | ||
| CVE-2017-1125 | Low | 0.21 | 3.3 | 0.00 | Jun 7, 2017 | IBM Cognos Analytics 10.1 and 10.2 could allow a local user to craft a URL which could confirm the existence of and expose postial contents of a file. IBM X-Force ID: 121340. | ||
| CVE-2017-3589 | Low | 0.21 | 3.3 | 0.00 | Apr 24, 2017 | Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Connectors… | ||
| CVE-2017-3498 | Low | 0.21 | 3.3 | 0.00 | Apr 24, 2017 | Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). The supported version that is affected is 11.3. Easily "exploitable" vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to… | ||
| CVE-2014-9680 | Low | 0.21 | 3.3 | 0.00 | Apr 24, 2017 | sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows local users to open arbitrary files for read access (but not view file contents) by running a program within an sudo session, as demonstrated by interfering with… | ||
| CVE-2016-2565 | Low | 0.21 | 3.3 | 0.00 | Apr 13, 2017 | Samsung SecEmailSync on SM-G920F build G920FXXU2COH2 (Galaxy S6) devices allows attackers to read sent e-mail messages, aka SVE-2015-5081. | ||
| CVE-2016-8757 | Low | 0.21 | 3.3 | 0.01 | Apr 2, 2017 | ION memory management module in Huawei P9 phones with software EVA-AL10C00B192 and earlier versions, EVA-DL10C00B192 and earlier versions, EVA-TL10C00B192 and earlier versions, EVA-CL10C00B192 and earlier versions allows attackers to obtain sensitive information from… | ||
| CVE-2015-2246 | Low | 0.21 | 3.3 | 0.00 | Apr 2, 2017 | The MeWidget module on Huawei P7 smartphones with software P7-L10 V100R001C00B136 and earlier versions could lead to the disclosure of contact information. | ||
| CVE-2017-2384 | Low | 0.21 | 3.3 | 0.00 | Apr 2, 2017 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves mishandling of deletion within the SQLite subsystem of the "Safari" component. It allows local users to identify the web-site visits that occurred in Private Browsing mode. | ||
| CVE-2016-6349 | Low | 0.21 | 3.3 | 0.00 | Mar 29, 2017 | The machinectl command in oci-register-machine allows local users to list running containers and possibly obtain sensitive information by running that command. | ||
| CVE-2016-7714 | Low | 0.21 | 3.3 | 0.00 | Feb 20, 2017 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue involves the "IOKit" component. It allows local users to obtain sensitive kernel memory-layout information via… | ||
| CVE-2016-7625 | Low | 0.21 | 3.3 | 0.00 | Feb 20, 2017 | An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the "IOKit" component. It allows local users to obtain sensitive kernel memory-layout information via unspecified vectors. | ||
| CVE-2016-7624 | Low | 0.21 | 3.3 | 0.00 | Feb 20, 2017 | An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the "IOAcceleratorFamily" component. It allows local users to obtain sensitive kernel memory-layout information via unspecified vectors. | ||
| CVE-2016-7620 | Low | 0.21 | 3.3 | 0.00 | Feb 20, 2017 | An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the "IOSurface" component. It allows local users to obtain sensitive kernel memory-layout information via unspecified vectors. | ||
| CVE-2016-0202 | Low | 0.21 | 3.3 | 0.00 | Feb 8, 2017 | A vulnerability has been identified in tasks, backend object generated for handling any action performed by the application in IBM Cloud Orchestrator. It is possible for an authenticated user to view any task of the current users domain. | ||
| CVE-2016-5938 | Low | 0.21 | 3.3 | 0.00 | Feb 1, 2017 | IBM Kenexa LMS on Cloud allows web pages to be stored locally which can be read by another user on the system. | ||
| CVE-2017-3240 | Low | 0.21 | 3.3 | 0.00 | Jan 27, 2017 | Vulnerability in the RDBMS Security component of Oracle Database Server. The supported version that is affected is 12.1.0.2. Easily exploitable vulnerability allows low privileged attacker having Local Logon privilege with logon to the infrastructure where RDBMS Security… |
- risk 0.21cvss 3.3epss 0.00
A information disclosure vulnerability in the HTC sensor hub driver. Product: Android. Versions: Android kernel. Android ID: A-35468048.
- risk 0.21cvss 3.3epss 0.00
IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a local user to obtain sensitive information due to inappropriate data retention of attachments. IBM X-Force ID: 123299.
- risk 0.21cvss 3.3epss 0.00
In all Android releases from CAF using the Linux kernel, a DRM key was exposed to QTEE applications.
- risk 0.21cvss 3.3epss 0.00
In all Android releases from CAF using the Linux kernel, a TZ memory address is exposed to HLOS by HDCP.
- risk 0.21cvss 3.3epss 0.00
IBM Cognos Analytics 10.1 and 10.2 could allow a local user to craft a URL which could confirm the existence of and expose postial contents of a file. IBM X-Force ID: 121340.
- risk 0.21cvss 3.3epss 0.00
Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Connectors…
- risk 0.21cvss 3.3epss 0.00
Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). The supported version that is affected is 11.3. Easily "exploitable" vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to…
- risk 0.21cvss 3.3epss 0.00
sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows local users to open arbitrary files for read access (but not view file contents) by running a program within an sudo session, as demonstrated by interfering with…
- risk 0.21cvss 3.3epss 0.00
Samsung SecEmailSync on SM-G920F build G920FXXU2COH2 (Galaxy S6) devices allows attackers to read sent e-mail messages, aka SVE-2015-5081.
- risk 0.21cvss 3.3epss 0.01
ION memory management module in Huawei P9 phones with software EVA-AL10C00B192 and earlier versions, EVA-DL10C00B192 and earlier versions, EVA-TL10C00B192 and earlier versions, EVA-CL10C00B192 and earlier versions allows attackers to obtain sensitive information from…
- risk 0.21cvss 3.3epss 0.00
The MeWidget module on Huawei P7 smartphones with software P7-L10 V100R001C00B136 and earlier versions could lead to the disclosure of contact information.
- risk 0.21cvss 3.3epss 0.00
An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves mishandling of deletion within the SQLite subsystem of the "Safari" component. It allows local users to identify the web-site visits that occurred in Private Browsing mode.
- risk 0.21cvss 3.3epss 0.00
The machinectl command in oci-register-machine allows local users to list running containers and possibly obtain sensitive information by running that command.
- risk 0.21cvss 3.3epss 0.00
An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue involves the "IOKit" component. It allows local users to obtain sensitive kernel memory-layout information via…
- risk 0.21cvss 3.3epss 0.00
An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the "IOKit" component. It allows local users to obtain sensitive kernel memory-layout information via unspecified vectors.
- risk 0.21cvss 3.3epss 0.00
An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the "IOAcceleratorFamily" component. It allows local users to obtain sensitive kernel memory-layout information via unspecified vectors.
- risk 0.21cvss 3.3epss 0.00
An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the "IOSurface" component. It allows local users to obtain sensitive kernel memory-layout information via unspecified vectors.
- risk 0.21cvss 3.3epss 0.00
A vulnerability has been identified in tasks, backend object generated for handling any action performed by the application in IBM Cloud Orchestrator. It is possible for an authenticated user to view any task of the current users domain.
- risk 0.21cvss 3.3epss 0.00
IBM Kenexa LMS on Cloud allows web pages to be stored locally which can be read by another user on the system.
- risk 0.21cvss 3.3epss 0.00
Vulnerability in the RDBMS Security component of Oracle Database Server. The supported version that is affected is 12.1.0.2. Easily exploitable vulnerability allows low privileged attacker having Local Logon privilege with logon to the infrastructure where RDBMS Security…