CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
Description
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-116 · CAPEC-13 · CAPEC-169 · CAPEC-22 · CAPEC-224 · CAPEC-285 · CAPEC-287 · CAPEC-290 · CAPEC-291 · CAPEC-292 · CAPEC-293 · CAPEC-294 · CAPEC-295 · CAPEC-296 · CAPEC-297 · CAPEC-298 · CAPEC-299 · CAPEC-300 · CAPEC-301 · CAPEC-302 · CAPEC-303 · CAPEC-304 · CAPEC-305 · CAPEC-306 · CAPEC-307 · CAPEC-308 · CAPEC-309 · CAPEC-310 · CAPEC-312 · CAPEC-313 · CAPEC-317 · CAPEC-318 · CAPEC-319 · CAPEC-320 · CAPEC-321 · CAPEC-322 · CAPEC-323 · CAPEC-324 · CAPEC-325 · CAPEC-326 · CAPEC-327 · CAPEC-328 · CAPEC-329 · CAPEC-330 · CAPEC-472 · CAPEC-497 · CAPEC-508 · CAPEC-573 · CAPEC-574 · CAPEC-575 · CAPEC-576 · CAPEC-577 · CAPEC-59 · CAPEC-60 · CAPEC-616 · CAPEC-643 · CAPEC-646 · CAPEC-651 · CAPEC-79
CVEs mapped to this weakness (11,323)
page 70 of 567| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-8620 | Hig | 0.49 | 7.5 | 0.02 | Dec 18, 2019 | A user privacy issue was addressed by removing the broadcast MAC address. This issue is fixed in iOS 12.3, tvOS 12.3, watchOS 5.2.1. A device may be passively tracked by its WiFi MAC address. | ||
| CVE-2019-8567 | Hig | 0.49 | 7.5 | 0.01 | Dec 18, 2019 | A user privacy issue was addressed by removing the broadcast MAC address. This issue is fixed in iOS 12.2. A device may be passively tracked by its WiFi MAC address. | ||
| CVE-2019-3992 | Hig | 0.49 | 7.5 | 0.01 | Dec 17, 2019 | ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote unauthenticated attacker can access the server's configuration file by sending an HTTP GET request. Amongst the configuration data, the attacker may gain access to valid admin usernames… | ||
| CVE-2019-0405 | Hig | 0.49 | 7.5 | 0.01 | Dec 11, 2019 | SAP Enable Now, before version 1911, leaks information about the existence of a particular user which can be used to construct a list of users, leading to a user enumeration vulnerability and Information Disclosure. | ||
| CVE-2019-1489 | Hig | 0.49 | 7.5 | 0.08 | Dec 10, 2019 | An information disclosure vulnerability exists when the Windows Remote Desktop Protocol (RDP) fails to properly handle objects in memory, aka 'Remote Desktop Protocol Information Disclosure Vulnerability'. | ||
| CVE-2011-2480 | Hig | 0.49 | 7.5 | 0.02 | Nov 27, 2019 | Information Disclosure vulnerability in the 802.11 stack, as used in FreeBSD before 8.2 and NetBSD when using certain non-x86 architectures. A signedness error in the IEEE80211_IOC_CHANINFO ioctl allows a local unprivileged user to cause the kernel to copy large amounts of… | ||
| CVE-2019-18460 | Hig | 0.49 | 7.5 | 0.01 | Nov 26, 2019 | An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4 in the Comments Search feature provided by the Elasticsearch integration. It has Incorrect Access Control. | ||
| CVE-2016-5724 | Hig | 0.49 | 7.5 | 0.01 | Nov 26, 2019 | Cloudera CDH before 5.9 has Potentially Sensitive Information in Diagnostic Support Bundles. | ||
| CVE-2015-6495 | Hig | 0.49 | 7.5 | 0.01 | Nov 26, 2019 | There is Sensitive Information in Cloudera Manager before 5.4.6 Diagnostic Support Bundles. | ||
| CVE-2012-5535 | Hig | 0.49 | 7.5 | 0.02 | Nov 25, 2019 | gnome-system-log polkit policy allows arbitrary files on the system to be read | ||
| CVE-2012-6079 | Hig | 0.49 | 7.5 | 0.02 | Nov 22, 2019 | W3 Total Cache before 0.9.2.5 exposes sensitive cached database information which allows remote attackers to download this information via their hash keys. | ||
| CVE-2012-6078 | Hig | 0.49 | 7.5 | 0.02 | Nov 22, 2019 | W3 Total Cache before 0.9.2.5 generates hash keys insecurely which allows remote attackers to predict the values of the hashes. | ||
| CVE-2012-6077 | Hig | 0.49 | 7.5 | 0.05 | Nov 22, 2019 | W3 Total Cache before 0.9.2.5 allows remote attackers to retrieve password hash information due to insecure storage of database cache files. | ||
| CVE-2019-6852 | Hig | 0.49 | 7.5 | 0.01 | Nov 20, 2019 | A CWE-200: Information Exposure vulnerability exists in Modicon Controllers (M340 CPUs, M340 communication modules, Premium CPUs, Premium communication modules, Quantum CPUs, Quantum communication modules - see security notification for specific versions), which could cause the… | ||
| CVE-2011-4919 | Hig | 0.49 | 7.5 | 0.03 | Nov 19, 2019 | mpack 1.6 has information disclosure via eavesdropping on mails sent by other users | ||
| CVE-2019-19022 | Hig | 0.49 | 7.5 | 0.01 | Nov 17, 2019 | iTerm2 through 3.3.6 has potentially insufficient documentation about the presence of search history in com.googlecode.iterm2.plist, which might allow remote attackers to obtain sensitive information, as demonstrated by searching for the NoSyncSearchHistory string in .plist… | ||
| CVE-2013-3070 | Hig | 0.49 | 7.5 | 0.02 | Nov 14, 2019 | An Information Disclosure vulnerability exists in Netgear WNDR4700 running firmware 1.0.0.34 in the management web interface, which discloses the PSK of the wireless LAN. | ||
| CVE-2012-1155 | Hig | 0.49 | 7.5 | 0.02 | Nov 14, 2019 | Moodle has a database activity export permission issue where the export function of the database activity module exports all entries even those from groups the user does not belong to | ||
| CVE-2011-4972 | Hig | 0.49 | 7.5 | 0.02 | Nov 13, 2019 | hook_file_download in the CKEditor module 7.x-1.4 for Drupal does not properly restrict access to private files, which allows remote attackers to read private files via a direct request. | ||
| CVE-2019-14367 | Hig | 0.49 | 7.5 | 0.01 | Nov 12, 2019 | Slack-Chat through 1.5.5 leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack (channels, members, etc.). |
- risk 0.49cvss 7.5epss 0.02
A user privacy issue was addressed by removing the broadcast MAC address. This issue is fixed in iOS 12.3, tvOS 12.3, watchOS 5.2.1. A device may be passively tracked by its WiFi MAC address.
- risk 0.49cvss 7.5epss 0.01
A user privacy issue was addressed by removing the broadcast MAC address. This issue is fixed in iOS 12.2. A device may be passively tracked by its WiFi MAC address.
- risk 0.49cvss 7.5epss 0.01
ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote unauthenticated attacker can access the server's configuration file by sending an HTTP GET request. Amongst the configuration data, the attacker may gain access to valid admin usernames…
- risk 0.49cvss 7.5epss 0.01
SAP Enable Now, before version 1911, leaks information about the existence of a particular user which can be used to construct a list of users, leading to a user enumeration vulnerability and Information Disclosure.
- risk 0.49cvss 7.5epss 0.08
An information disclosure vulnerability exists when the Windows Remote Desktop Protocol (RDP) fails to properly handle objects in memory, aka 'Remote Desktop Protocol Information Disclosure Vulnerability'.
- risk 0.49cvss 7.5epss 0.02
Information Disclosure vulnerability in the 802.11 stack, as used in FreeBSD before 8.2 and NetBSD when using certain non-x86 architectures. A signedness error in the IEEE80211_IOC_CHANINFO ioctl allows a local unprivileged user to cause the kernel to copy large amounts of…
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4 in the Comments Search feature provided by the Elasticsearch integration. It has Incorrect Access Control.
- risk 0.49cvss 7.5epss 0.01
Cloudera CDH before 5.9 has Potentially Sensitive Information in Diagnostic Support Bundles.
- risk 0.49cvss 7.5epss 0.01
There is Sensitive Information in Cloudera Manager before 5.4.6 Diagnostic Support Bundles.
- risk 0.49cvss 7.5epss 0.02
gnome-system-log polkit policy allows arbitrary files on the system to be read
- risk 0.49cvss 7.5epss 0.02
W3 Total Cache before 0.9.2.5 exposes sensitive cached database information which allows remote attackers to download this information via their hash keys.
- risk 0.49cvss 7.5epss 0.02
W3 Total Cache before 0.9.2.5 generates hash keys insecurely which allows remote attackers to predict the values of the hashes.
- risk 0.49cvss 7.5epss 0.05
W3 Total Cache before 0.9.2.5 allows remote attackers to retrieve password hash information due to insecure storage of database cache files.
- risk 0.49cvss 7.5epss 0.01
A CWE-200: Information Exposure vulnerability exists in Modicon Controllers (M340 CPUs, M340 communication modules, Premium CPUs, Premium communication modules, Quantum CPUs, Quantum communication modules - see security notification for specific versions), which could cause the…
- risk 0.49cvss 7.5epss 0.03
mpack 1.6 has information disclosure via eavesdropping on mails sent by other users
- risk 0.49cvss 7.5epss 0.01
iTerm2 through 3.3.6 has potentially insufficient documentation about the presence of search history in com.googlecode.iterm2.plist, which might allow remote attackers to obtain sensitive information, as demonstrated by searching for the NoSyncSearchHistory string in .plist…
- risk 0.49cvss 7.5epss 0.02
An Information Disclosure vulnerability exists in Netgear WNDR4700 running firmware 1.0.0.34 in the management web interface, which discloses the PSK of the wireless LAN.
- risk 0.49cvss 7.5epss 0.02
Moodle has a database activity export permission issue where the export function of the database activity module exports all entries even those from groups the user does not belong to
- risk 0.49cvss 7.5epss 0.02
hook_file_download in the CKEditor module 7.x-1.4 for Drupal does not properly restrict access to private files, which allows remote attackers to read private files via a direct request.
- risk 0.49cvss 7.5epss 0.01
Slack-Chat through 1.5.5 leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack (channels, members, etc.).