CWE-200

Wonder CMS 2014 allows remote attackers to obtain sensitive information by viewing /files/password, which reveals the un

GetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to (1) data/users/<user

Information disclosure issue in qdPM 8.3 allows remote attackers to obtain sensitive information via a direct request to

The get_sessions servlet in CA Unified Infrastructure Management (formerly CA Nimsoft Monitor) before 8.5 and CA Unified

saned in sane-backends 1.0.25 allows remote attackers to obtain sensitive memory information via a crafted SANE_NET_CONT

EMC RecoverPoint versions prior to 5.0 and EMC RecoverPoint for Virtual Machines versions prior to 5.0 have an SSL Strip

The SAML2 implementation in Identity Server in NetIQ Access Manager 4.1 before 4.1.2 HF1 and 4.2 before 4.2.2 was handli

Presence of a .htaccess file could leak information in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before SP

QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by

MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize

An issue was discovered in certain Apple products. macOS Server before 5.3 is affected. The issue involves the "Wiki Ser

Huawei Tecal RH1288 V2 V100R002C00SPC107 and earlier versions, Tecal RH2265 V2 V100R002C00, Tecal RH2285 V2 V100R002C00S

Technicolor TC7200 with firmware STD6.01.12 could allow remote attackers to obtain sensitive information.

Apache Geode before 1.1.1, when a cluster has enabled security by setting the security-manager property, allows remote a

Vision Critical before 2014-05-30 allows attackers to read arbitrary files via unspecified vectors, as demonstrated by i

Philips In.Sight B120/37 allows remote attackers to obtain sensitive information via a direct request, related to yoics.

iBaby M6 allows remote attackers to obtain sensitive information, related to the ibabycloud.com service.

OSRAM SYLVANIA Osram Lightify Home before 2016-07-26 stores a PSK in cleartext under /private/var/mobile/Containers/Data

CloudView NMS before 2.10a allows remote attackers to obtain sensitive information via a direct request for admin/auto.d

In KeePassX before 0.4.4, a cleartext copy of password data is created upon a cancel of an XML export action. This allow

botan 1.11.x before 1.11.22 makes it easier for remote attackers to decrypt TLS ciphertext data via a padding-oracle att

An exploitable information disclosure vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wirele

Moxa MXView 2.8 allows remote attackers to read web server's private key file, no access control.

A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.

Samsung Android devices with L(5.0/5.1), M(6.0), and N(7.x) software allow attackers to obtain sensitive information by

Red Hat OpenShift Enterprise 2 does not include the HTTPOnly flag in a Set-Cookie header for the GEARID cookie, which ma

MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1, when $wgBlockDisablesLogin is true, might allo

MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 does not generate head items in the context of

Information disclosure in Netgear WN604 before 3.3.3; WNAP210, WNAP320, WNDAP350, and WNDAP360 before 3.5.5.0; and WND93

ExaGrid appliances with firmware before 4.8 P26 have a default SSH public key in the authorized_keys file for root, whic

An information leak vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pa

Atlassian Confluence 6.x before 6.0.7 allows remote attackers to bypass authentication and read any blog or page via the

Adobe Experience Manager Forms versions 6.2, 6.1, 6.0 have an information disclosure vulnerability resulting from abuse

ASUS RT-AC* and RT-N* devices with firmware before 3.0.0.4.380.7378 allow JSONP Information Disclosure such as a network

It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9

PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign server

The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user auth

A vulnerability in Cisco WebEx Meetings Server could allow unauthenticated, remote attackers to gain information that co

A vulnerability in the web interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote at

jasypt before 1.9.2 allows a timing attack against the password hash comparison.

An information-leakage issue was discovered on Mimosa Client Radios before 2.2.3 and Mimosa Backhaul Radios before 2.2.3

Metadata Anonymisation Toolkit (MAT) 0.6 and 0.6.1 silently fails to perform "Clean metadata" actions upon invocation fr

Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1)

The mDNS module in Huawei WLAN AC6005, AC6605, and ACU2 devices with software before V200R006C00SPC100 allows remote att

The from method in library/core/class.email.php in Vanilla Forums before 2.3.1 allows remote attackers to spoof the emai

NetApp OnCommand Unified Manager Core Package 5.x before 5.2.2P1 might allow remote attackers to obtain sensitive inform

A password management vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to carry out inf

Juniper Networks QFX3500, QFX3600, QFX5100, QFX5200, EX4300 and EX4600 devices running Junos OS 14.1X53 prior to 14.1X53

In Lenovo Service Bridge before version 4, an insecure HTTP connection is used by LSB to send system serial number, mach

An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, it is possible