CWE-200

Foreman after 1.1 and before 1.9.0-RC1 does not redirect HTTP requests to HTTPS when the require_ssl setting is set to t

The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589, NVG599, and unspecified other devices, when IP Passthrough mo

The automatic version check functionality in the tools in Percona Toolkit 2.1 allows man-in-the-middle attackers to obta

The VIP.com application for IOS and Android allows remote attackers to obtain sensitive information and hijack the authe

Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before

Pandora iOS app prior to version 8.3.2 fails to properly validate SSL certificates provided by HTTPS connections, which

In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the SNMP read-only (RO) community string has access

Sensitive Information Disclosure in com.trend.iwss.gui.servlet.ConfigBackup in Trend Micro InterScan Web Security Virtua

An information disclosure vulnerability in the Qualcomm bootloader could help to enable a local malicious application to

The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master witho

An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions p

Hikvision iVMS-4200 devices before v2.6.2.7 allow local users to generate password-recovery codes via unspecified vector

The YaST2 network created files with world readable permissions which could have allowed local users to read sensitive m

The Files APP 7.1.1.309 and earlier versions in some Huawei mobile phones has a brute-force password cracking vulnerabil

An access flaw was found in Heketi 5, where the heketi.json configuration file was world readable. An attacker having lo

Web2py versions 2.14.5 and below was affected by Local File Inclusion vulnerability, which allows a malicious intended u

MetroCluster Tiebreaker for clustered Data ONTAP in versions before 1.2 discloses sensitive information in cleartext whi

Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled wi

The OTR plugin for Gajim sends information in cleartext when using XHTML, which allows remote attackers to obtain sensit

Citrix Provisioning Services before 7.12 allows attackers to obtain sensitive information from kernel memory via unspeci

A vulnerability in Tiki Wiki CMS 15.2 could allow a remote attacker to read arbitrary files on a targeted system via a c

Remote Manager in Open Enterprise Server (OES) allows unauthenticated remote attackers to read any arbitrary file, via a

The Atlassian Hipchat Integration Plugin for Bitbucket Server 6.26.0 before 6.27.5, 6.28.0 before 7.3.7, and 7.4.0 befor

The function msp (aka MSPRuntimeInterface) in the P4 SERVERCORE component in SAP AS JAVA allows remote attackers to obta

Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.2

An issue was discovered on the D-Link DWR-932B router. qmiweb provides sensitive information for CfgType=get_homeCfg req

MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to obtain sensit

MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow remote attackers to obtain sensitive in

MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows might allow remote atta

IBM Security Privileged Identity Manager could allow a remote attacker to obtain sensitive information, caused by the fa

IBM UrbanCode Deploy could allow an authenticated user with access to the REST endpoints to access API and CLI getResour

NetApp SnapDrive for Windows before 7.0.2P4, 7.0.3, and 7.1 before 7.1.3P1 allows remote attackers to obtain sensitive i

NetApp Clustered Data ONTAP before 8.3.2P7 allows remote attackers to obtain SMB share information via unspecified vecto

A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may

The timing attack protection in Rijndael::Enc::ProcessAndXorBlock and Rijndael::Dec::ProcessAndXorBlock in Crypto++ (aka

An issue was discovered in OmniMetrix OmniView, Version 1.2. The OmniView web application transmits credentials with the

An issue was discovered in Advantech SUISAccess Server Version 3.0 and prior. An attacker could traverse the file system

An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware Vers

The "Plug-in for VMware vCenter" in VCE Vision Intelligent Operations before 2.6.5 sends a cleartext HTTP response upon

A vulnerability in the web interface of the Cisco Secure Access Control System (ACS) could allow an unauthenticated, rem

D-Link DGS-1510-28XMP, DGS-1510-28X, DGS-1510-52X, DGS-1510-52, DGS-1510-28P, DGS-1510-28, and DGS-1510-20 Websmart devi

Page table walks conducted by the MMU during virtual to physical address translation leave a trace in the last level cac

Page table walks conducted by the MMU during virtual to physical address translation leave a trace in the last level cac

Page table walks conducted by the MMU during virtual to physical address translation leave a trace in the last level cac

The NetApp ONTAP Select Deploy administration utility 2.0 through 2.2.1 might allow remote attackers to obtain sensitive

An information disclosure vulnerability in the logging implementation of BlackBerry Good Control Server versions earlier

Cloudera Manager 5.5 and earlier allows remote attackers to obtain sensitive information via a (1) stderr.log or (2) std

Cloudera Manager 5.5 and earlier allows remote attackers to enumerate user sessions via a request to /api/v11/users/sess

An issue was discovered in Telegram Messenger 2.6 for iOS and 1.8.2 for Android. Secret chat messages are available in c

An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-pro