CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
Description
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-116 · CAPEC-13 · CAPEC-169 · CAPEC-22 · CAPEC-224 · CAPEC-285 · CAPEC-287 · CAPEC-290 · CAPEC-291 · CAPEC-292 · CAPEC-293 · CAPEC-294 · CAPEC-295 · CAPEC-296 · CAPEC-297 · CAPEC-298 · CAPEC-299 · CAPEC-300 · CAPEC-301 · CAPEC-302 · CAPEC-303 · CAPEC-304 · CAPEC-305 · CAPEC-306 · CAPEC-307 · CAPEC-308 · CAPEC-309 · CAPEC-310 · CAPEC-312 · CAPEC-313 · CAPEC-317 · CAPEC-318 · CAPEC-319 · CAPEC-320 · CAPEC-321 · CAPEC-322 · CAPEC-323 · CAPEC-324 · CAPEC-325 · CAPEC-326 · CAPEC-327 · CAPEC-328 · CAPEC-329 · CAPEC-330 · CAPEC-472 · CAPEC-497 · CAPEC-508 · CAPEC-573 · CAPEC-574 · CAPEC-575 · CAPEC-576 · CAPEC-577 · CAPEC-59 · CAPEC-60 · CAPEC-616 · CAPEC-643 · CAPEC-646 · CAPEC-651 · CAPEC-79
CVEs mapped to this weakness (11,323)
page 69 of 567| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2013-5687 | Hig | 0.49 | 7.5 | 0.01 | Feb 14, 2020 | RiskNet Acquirer before hotfix 6.0 b7+ADHOC-443 ApplicationServiceBean contains a service information disclosure. | ||
| CVE-2012-6091 | Hig | 0.49 | 7.5 | 0.02 | Feb 13, 2020 | Zend_XmlRpc Class in Magento before 1.7.0.2 contains an information disclosure vulnerability. | ||
| CVE-2011-3901 | Hig | 0.49 | 7.5 | 0.01 | Feb 12, 2020 | Android SQLite Journal before 4.0.1 has an information disclosure vulnerability. | ||
| CVE-2013-4166 | Hig | 0.49 | 7.5 | 0.02 | Feb 6, 2020 | The gpg_ctx_add_recipient function in camel/camel-gpg-context.c in GNOME Evolution 3.8.4 and earlier and Evolution Data Server 3.9.5 and earlier does not properly select the GPG key to use for email encryption, which might cause the email to be encrypted with the wrong key and… | ||
| CVE-2015-2802 | Hig | 0.49 | 7.5 | 0.06 | Feb 4, 2020 | An Information Disclosure vulnerability exists in HP SiteScope 11.2 and 11.3 on Windows, Linux and Solaris, HP Asset Manager 9.30 through 9.32, 9.40 through 9.41, 9.50, and Asset Manager Cloudsystem Chargeback 9.40, which could let a remote malicious user obtain sensitive… | ||
| CVE-2013-2676 | Hig | 0.49 | 7.5 | 0.02 | Feb 4, 2020 | Brother MFC-9970CDW 1.10 firmware L devices contain an information disclosure vulnerability which allows remote attackers to view private IP addresses and other sensitive information. | ||
| CVE-2011-4937 | Hig | 0.49 | 7.5 | 0.02 | Feb 4, 2020 | Joomla! 1.7.1 has core information disclosure due to inadequate error checking. | ||
| CVE-2016-4676 | Hig | 0.49 | 7.5 | 0.02 | Feb 3, 2020 | A Cross-origin vulnerability exists in WebKit in Apple Safari before 10.0.1 when processing location attributes, which could let a remote malicious user obtain sensitive information. | ||
| CVE-2013-2674 | Hig | 0.49 | 7.5 | 0.03 | Feb 3, 2020 | Brother MFC-9970CDW 1.10 firmware L devices contain an information disclosure vulnerability which allows remote attackers to view sensitive information from referrer logs due to inadequate handling of HTTP referrer headers. | ||
| CVE-2011-4088 | Hig | 0.49 | 7.5 | 0.02 | Jan 31, 2020 | ABRT might allow attackers to obtain sensitive information from crash reports. | ||
| CVE-2019-19550 | Hig | 0.49 | 7.5 | 0.02 | Jan 31, 2020 | Remote Authentication Bypass in Senior Rubiweb 6.2.34.28 and 6.2.34.37 allows admin access to sensitive information of affected users using vulnerable versions. The attacker only needs to provide the correct URL. | ||
| CVE-2020-1940 | Hig | 0.49 | 7.5 | 0.05 | Jan 28, 2020 | The optional initial password change and password expiration features present in Apache Jackrabbit Oak 1.2.0 to 1.22.0 are prone to a sensitive information disclosure vulnerability. The code mandates the changed password to be passed as an additional attribute to the credentials… | ||
| CVE-2019-5470 | Hig | 0.49 | 7.5 | 0.02 | Jan 28, 2020 | An information disclosure issue was discovered GitLab versions < 12.1.2, < 12.0.4, and < 11.11.6 in the security dashboard which could result in disclosure of vulnerability feedback information. | ||
| CVE-2019-15583 | Hig | 0.49 | 7.5 | 0.01 | Jan 28, 2020 | An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). When an issue was moved to a public project from a private one, the associated private labels and the private project namespace would be disclosed… | ||
| CVE-2013-2499 | Hig | 0.49 | 7.5 | 0.03 | Jan 27, 2020 | SimpleHRM 2.3 and earlier could allow remote attackers to bypass the authentication process in 'user_manager.php' via spoofing a cookie. | ||
| CVE-2011-3613 | Hig | 0.49 | 7.5 | 0.02 | Jan 22, 2020 | An issue exists in Vanilla Forums before 2.0.17.9 due to the way cookies are handled. | ||
| CVE-2018-16269 | Hig | 0.49 | 7.5 | 0.01 | Jan 22, 2020 | The wnoti system service in Samsung Galaxy Gear series allows an unprivileged process to take over the internal notification message data, due to improper D-Bus security policy configurations. This affects Tizen-based firmwares including Samsung Galaxy Gear series before build… | ||
| CVE-2019-14301 | Hig | 0.49 | 7.5 | 0.01 | Jan 10, 2020 | Ricoh SP C250DN 1.06 devices have Incorrect Access Control (issue 1 of 2). | ||
| CVE-2012-4420 | Hig | 0.49 | 7.5 | 0.05 | Dec 26, 2019 | An information disclosure flaw was found in the way the Java Virtual Machine (JVM) implementation of Java SE 7 as provided by OpenJDK 7 incorrectly initialized integer arrays after memory allocation (in certain circumstances they had nonzero elements right after the allocation).… | ||
| CVE-2019-15576 | Hig | 0.49 | 7.5 | 0.02 | Dec 18, 2019 | An information disclosure vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed an attacker to view private system notes from a GraphQL endpoint. |
- risk 0.49cvss 7.5epss 0.01
RiskNet Acquirer before hotfix 6.0 b7+ADHOC-443 ApplicationServiceBean contains a service information disclosure.
- risk 0.49cvss 7.5epss 0.02
Zend_XmlRpc Class in Magento before 1.7.0.2 contains an information disclosure vulnerability.
- risk 0.49cvss 7.5epss 0.01
Android SQLite Journal before 4.0.1 has an information disclosure vulnerability.
- risk 0.49cvss 7.5epss 0.02
The gpg_ctx_add_recipient function in camel/camel-gpg-context.c in GNOME Evolution 3.8.4 and earlier and Evolution Data Server 3.9.5 and earlier does not properly select the GPG key to use for email encryption, which might cause the email to be encrypted with the wrong key and…
- risk 0.49cvss 7.5epss 0.06
An Information Disclosure vulnerability exists in HP SiteScope 11.2 and 11.3 on Windows, Linux and Solaris, HP Asset Manager 9.30 through 9.32, 9.40 through 9.41, 9.50, and Asset Manager Cloudsystem Chargeback 9.40, which could let a remote malicious user obtain sensitive…
- risk 0.49cvss 7.5epss 0.02
Brother MFC-9970CDW 1.10 firmware L devices contain an information disclosure vulnerability which allows remote attackers to view private IP addresses and other sensitive information.
- risk 0.49cvss 7.5epss 0.02
Joomla! 1.7.1 has core information disclosure due to inadequate error checking.
- risk 0.49cvss 7.5epss 0.02
A Cross-origin vulnerability exists in WebKit in Apple Safari before 10.0.1 when processing location attributes, which could let a remote malicious user obtain sensitive information.
- risk 0.49cvss 7.5epss 0.03
Brother MFC-9970CDW 1.10 firmware L devices contain an information disclosure vulnerability which allows remote attackers to view sensitive information from referrer logs due to inadequate handling of HTTP referrer headers.
- risk 0.49cvss 7.5epss 0.02
ABRT might allow attackers to obtain sensitive information from crash reports.
- risk 0.49cvss 7.5epss 0.02
Remote Authentication Bypass in Senior Rubiweb 6.2.34.28 and 6.2.34.37 allows admin access to sensitive information of affected users using vulnerable versions. The attacker only needs to provide the correct URL.
- risk 0.49cvss 7.5epss 0.05
The optional initial password change and password expiration features present in Apache Jackrabbit Oak 1.2.0 to 1.22.0 are prone to a sensitive information disclosure vulnerability. The code mandates the changed password to be passed as an additional attribute to the credentials…
- risk 0.49cvss 7.5epss 0.02
An information disclosure issue was discovered GitLab versions < 12.1.2, < 12.0.4, and < 11.11.6 in the security dashboard which could result in disclosure of vulnerability feedback information.
- risk 0.49cvss 7.5epss 0.01
An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). When an issue was moved to a public project from a private one, the associated private labels and the private project namespace would be disclosed…
- risk 0.49cvss 7.5epss 0.03
SimpleHRM 2.3 and earlier could allow remote attackers to bypass the authentication process in 'user_manager.php' via spoofing a cookie.
- risk 0.49cvss 7.5epss 0.02
An issue exists in Vanilla Forums before 2.0.17.9 due to the way cookies are handled.
- risk 0.49cvss 7.5epss 0.01
The wnoti system service in Samsung Galaxy Gear series allows an unprivileged process to take over the internal notification message data, due to improper D-Bus security policy configurations. This affects Tizen-based firmwares including Samsung Galaxy Gear series before build…
- risk 0.49cvss 7.5epss 0.01
Ricoh SP C250DN 1.06 devices have Incorrect Access Control (issue 1 of 2).
- risk 0.49cvss 7.5epss 0.05
An information disclosure flaw was found in the way the Java Virtual Machine (JVM) implementation of Java SE 7 as provided by OpenJDK 7 incorrectly initialized integer arrays after memory allocation (in certain circumstances they had nonzero elements right after the allocation).…
- risk 0.49cvss 7.5epss 0.02
An information disclosure vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed an attacker to view private system notes from a GraphQL endpoint.