Search
Total
7597 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2009-2475 | 1 Sun | 2 Java Se, Openjdk | 2017-09-19 | 7.8 HIGH | N/A |
| Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, might allow context-dependent attackers to obtain sensitive information via vectors involving static variables that are declared without the final keyword, related to (1) LayoutQueue, (2) Cursor.predefined, (3) AccessibleResourceBundle.getContents, (4) ImageReaderSpi.STANDARD_INPUT_TYPE, (5) ImageWriterSpi.STANDARD_OUTPUT_TYPE, (6) the imageio plugins, (7) DnsContext.debug, (8) RmfFileReader/StandardMidiFileWriter.types, (9) AbstractSaslImpl.logger, (10) Synth.Region.uiToRegionMap/lowerCaseNameMap, (11) the Introspector class and a cache of BeanInfo, and (12) JAX-WS, a different vulnerability than CVE-2009-2673. | |||||
| CVE-2009-2332 | 1 Cms.tut.su | 1 Cms Chainuk | 2017-09-19 | 5.0 MEDIUM | N/A |
| CMS Chainuk 1.2 and earlier allows remote attackers to obtain sensitive information via (1) a crafted id parameter to index.php or (2) a nonexistent folder name in the id parameter to admin/admin_delete.php, which reveals the installation path in an error message. | |||||
| CVE-2009-3881 | 1 Sun | 2 Jre, Openjdk | 2017-09-19 | 7.5 HIGH | N/A |
| Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, does not prevent the existence of children of a resurrected ClassLoader, which allows remote attackers to gain privileges via unspecified vectors, related to an "information leak vulnerability," aka Bug Id 6636650. | |||||
| CVE-2009-2329 | 1 Max Kervin | 1 Kervinet Forum | 2017-09-19 | 5.0 MEDIUM | N/A |
| KerviNet Forum 1.1 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) admin/head.php, or (2) voting_diagram.php, (3) voting.php, (4) topics_search.php, (5) topics_list.php, (6) top_part.php, (7) quick_search.php, (8) quick_reply.php, (9) moder_menu.php, (10) messages_list.php, (11) menu.php, (12) head.php, (13) forums_list.php, (14) forum_statistics.php, (15) forum_info.php, or (16) birthday.php in include_files/, which reveals the installation path in an error message. | |||||
| CVE-2009-3756 | 1 Kreotek | 1 Phpbms | 2017-09-19 | 5.0 MEDIUM | N/A |
| phpBMS 0.96 allows remote attackers to obtain sensitive information via a direct request to (1) footer.php, (2) header.php, (3) the show action in advancedsearch.php, and (4) choicelist.php, which reveals the installation path in an error message. | |||||
| CVE-2009-3646 | 1 Intervations | 1 Navicopa Web Server | 2017-09-19 | 5.0 MEDIUM | N/A |
| InterVations NaviCOPA Web Server 3.01 allows remote attackers to obtain the source code for a web page via an HTTP request with the addition of ::$DATA after the HTML file name. | |||||
| CVE-2009-3544 | 1 Xerver | 1 Xerver | 2017-09-19 | 5.0 MEDIUM | N/A |
| Xerver HTTP Server 4.32 allows remote attackers to obtain the source code for a web page via an HTTP request with the addition of ::$DATA after the HTML file name. | |||||
| CVE-2009-3199 | 1 Uebimiau | 1 Uebimiau | 2017-09-19 | 5.0 MEDIUM | N/A |
| Uebimiau Webmail 3.2.0-2.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database with usernames and password hashes via a direct request for system_admin/admin.ucf. | |||||
| CVE-2017-14240 | 1 Dolibarr | 1 Dolibarr | 2017-09-18 | 5.0 MEDIUM | 7.5 HIGH |
| There is a sensitive information disclosure vulnerability in document.php in Dolibarr ERP/CRM version 6.0.0 via the file parameter. | |||||
| CVE-2011-3177 | 1 Yast | 1 Yast2 | 2017-09-18 | 2.1 LOW | 7.8 HIGH |
| The YaST2 network created files with world readable permissions which could have allowed local users to read sensitive material out of network configuration files, like passwords for wireless networks. | |||||
| CVE-2017-2550 | 1 Kubik-rubik | 1 Easy Joomla Backup | 2017-09-18 | 5.0 MEDIUM | 7.5 HIGH |
| Vulnerability in Easy Joomla Backup v3.2.4. The software creates a copy of the backup in the web root with an easily guessable filename. | |||||
| CVE-2017-1162 | 1 Ibm | 1 Qradar Security Information And Event Manager | 2017-09-16 | 5.0 MEDIUM | 7.5 HIGH |
| IBM QRadar 7.2 and 7.3 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 122957. | |||||
| CVE-2017-0793 | 1 Google | 1 Android | 2017-09-15 | 7.1 HIGH | 5.5 MEDIUM |
| A information disclosure vulnerability in the N/A memory subsystem. Product: Android. Versions: Android kernel. Android ID: A-35764946. | |||||
| CVE-2017-0779 | 1 Google | 1 Android | 2017-09-15 | 4.3 MEDIUM | 5.5 MEDIUM |
| A information disclosure vulnerability in the Android media framework (audioflinger). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-38340117. | |||||
| CVE-2017-14269 | 1 Ee | 2 4gee Wifi Mbb, 4gee Wifi Mbb Firmware | 2017-09-15 | 5.0 MEDIUM | 9.8 CRITICAL |
| EE 4GEE WiFi MBB (before EE60_00_05.00_31) devices allow remote attackers to obtain sensitive information via a JSONP endpoint, as demonstrated by passwords and SMS content. | |||||
| CVE-2017-0776 | 1 Google | 1 Android | 2017-09-15 | 4.3 MEDIUM | 5.5 MEDIUM |
| A information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-38496660. | |||||
| CVE-2017-0777 | 1 Google | 1 Android | 2017-09-15 | 4.3 MEDIUM | 5.5 MEDIUM |
| A information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-38342499. | |||||
| CVE-2015-7836 | 1 Siemens | 1 Ruggedcom Rugged Operating System | 2017-09-15 | 3.3 LOW | N/A |
| Siemens RUGGEDCOM ROS before 4.2.1 allows remote attackers to obtain sensitive information by sniffing the network for VLAN data within the padding section of an Ethernet frame. | |||||
| CVE-2015-6250 | 1 Simple-php-captcha Project | 1 Simple-php-captcha | 2017-09-13 | 5.0 MEDIUM | 5.3 MEDIUM |
| simple-php-captcha before commit 9d65a945029c7be7bb6bc893759e74c5636be694 allows remote attackers to automatically generate the captcha response by running the same code on the client-side. | |||||
| CVE-2015-7248 | 1 Zte | 2 Zxhn H108n R1a, Zxhn H108n R1a Firmware | 2017-09-13 | 5.0 MEDIUM | 7.5 HIGH |
| ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allow remote attackers to discover usernames and password hashes by reading the cgi-bin/webproc HTML source code, a different vulnerability than CVE-2015-8703. | |||||
| CVE-2015-6858 | 1 Hp | 1 Insight Management | 2017-09-13 | 4.3 MEDIUM | 3.7 LOW |
| HP Insight Control server provisioning before 7.5.0 RabbitMQ allows remote attackers to obtain sensitive information via unspecified vectors. | |||||
| CVE-2017-12857 | 1 Polycom | 4 Realpresence Trio, Soundstation Ip, Unified Communications Software and 1 more | 2017-09-13 | 4.0 MEDIUM | 8.8 HIGH |
| Polycom SoundStation IP, VVX, and RealPresence Trio that are running software older than UCS 4.0.12, 5.4.5 rev AG, 5.4.7, 5.5.2, or 5.6.0 are affected by a vulnerability in their UCS web application. This vulnerability could allow an authenticated remote attacker to read a segment of the phone's memory which could contain an administrator's password or other sensitive information. | |||||
| CVE-2017-0792 | 1 Google | 1 Android | 2017-09-12 | 3.3 LOW | 6.5 MEDIUM |
| A information disclosure vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: Android kernel. Android ID: A-37305578. References: B-V2017052301. | |||||
| CVE-2015-7255 | 1 Zte | 12 Gan9.8t101a-b, Gan9.8t101a-b Firmware, Hg110 and 9 more | 2017-09-12 | 5.0 MEDIUM | 7.5 HIGH |
| ZTE OX-330P, ZXHN H108N, W300V1.0.0S_ZRD_TR1_D68, HG110, GAN9.8T101A-B, MF28G, ZXHN H108N use non-unique X.509 certificates and SSH host keys, which might allow remote attackers to obtain credentials or other sensitive information via a man-in-the-middle attack, passive decryption attack, or impersonating a legitimate device. | |||||
| CVE-2017-13774 | 1 Hikvision | 1 Ivms-4200 | 2017-09-12 | 2.1 LOW | 7.8 HIGH |
| Hikvision iVMS-4200 devices before v2.6.2.7 allow local users to generate password-recovery codes via unspecified vectors. | |||||
| CVE-2016-3086 | 1 Apache | 1 Hadoop | 2017-09-11 | 5.0 MEDIUM | 9.8 CRITICAL |
| The YARN NodeManager in Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the password for credential store provider used by the NodeManager to YARN Applications. | |||||
| CVE-2015-5677 | 1 Freebsd | 1 Freebsd | 2017-09-10 | 2.1 LOW | 5.5 MEDIUM |
| bsnmpd, as used in FreeBSD 9.3, 10.1, and 10.2, uses world-readable permissions on the snmpd.config file, which allows local users to obtain the secret key for USM authentication by reading the file. | |||||
| CVE-2017-9150 | 1 Linux | 1 Linux Kernel | 2017-09-09 | 2.1 LOW | 5.5 MEDIUM |
| The do_check function in kernel/bpf/verifier.c in the Linux kernel before 4.11.1 does not make the allow_ptr_leaks value available for restricting the output of the print_bpf_insn function, which allows local users to obtain sensitive address information via crafted bpf system calls. | |||||
| CVE-2017-7495 | 1 Linux | 1 Linux Kernel | 2017-09-09 | 2.1 LOW | 5.5 MEDIUM |
| fs/ext4/inode.c in the Linux kernel before 4.6.2, when ext4 data=ordered mode is used, mishandles a needs-flushing-before-commit list, which allows local users to obtain sensitive information from other users' files in opportunistic circumstances by waiting for a hardware reset, creating a new file, making write system calls, and reading this file. | |||||
| CVE-2017-9978 | 1 Osnexus | 1 Quantastor | 2017-09-08 | 5.0 MEDIUM | 5.3 MEDIUM |
| On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, a flaw was found with the error message sent as a response for users that don't exist on the system. An attacker could leverage this information to fine-tune and enumerate valid accounts on the system by searching for common usernames. | |||||
| CVE-2017-11356 | 1 Pega | 1 Pega Platform | 2017-09-08 | 4.0 MEDIUM | 6.5 MEDIUM |
| The application distribution export functionality in PEGA Platform 7.2 ML0 and earlier allows remote authenticated users with certain privileges to obtain sensitive configuration information by leveraging a missing access control. | |||||
| CVE-2014-6107 | 1 Ibm | 1 Security Identity Manager | 2017-09-08 | 4.3 MEDIUM | N/A |
| IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to obtain sensitive cookie information by sniffing the network during an HTTP session. | |||||
| CVE-2014-6114 | 1 Ibm | 3 Operational Decision Manager, Websphere Ilog Jrules, Websphere Operational Decision Management | 2017-09-08 | 5.0 MEDIUM | N/A |
| The Hosted Transparent Decision Service in the Rule Execution Server in IBM WebSphere ILOG JRules 7.1 before MP1 FP5 IF43; WebSphere Operational Decision Management 7.5 before FP3 IF41; and Operational Decision Manager 8.0 before MP1 FP2 IF34, 8.5 before MP1 FP1 IF43, and 8.6 before IF8 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. | |||||
| CVE-2014-6123 | 1 Ibm | 2 Rational Appscan Source, Security Appscan Source | 2017-09-08 | 2.1 LOW | N/A |
| IBM Rational AppScan Source 8.0 through 8.0.0.2 and 8.5 through 8.5.0.1 and Security AppScan Source 8.6 through 8.6.0.2, 8.7 through 8.7.0.1, 8.8, 9.0 through 9.0.0.1, and 9.0.1 allow local users to obtain sensitive credential information by reading installation logs. | |||||
| CVE-2014-6130 | 1 Ibm | 1 Notes Traveler | 2017-09-08 | 5.0 MEDIUM | N/A |
| The IBM Notes Traveler application before 9.0.1.3 for Android lacks a warning message during selection of an HTTP session, which makes it easier for remote attackers to obtain sensitive information by sniffing the network during a session in which the user had intended to use HTTPS. | |||||
| CVE-2014-5448 | 1 Zarafa | 1 Zarafa | 2017-09-08 | 2.1 LOW | N/A |
| Zarafa 5.00 uses world-readable permissions for the files in the log directory, which allows local users to obtain sensitive information by reading the log files. | |||||
| CVE-2014-5449 | 1 Zarafa | 2 Webaccess, Webapp | 2017-09-08 | 2.1 LOW | N/A |
| Zarafa WebAccess 4.1 and WebApp uses world-readable permissions for the files in their tmp directory, which allows local users to obtain sensitive information by reading temporary session data. | |||||
| CVE-2014-6075 | 1 Ibm | 3 Qradar Risk Manager, Qradar Security Information And Event Manager, Qradar Vulnerability Manager | 2017-09-08 | 5.0 MEDIUM | N/A |
| IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, place credentials in URLs, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history. | |||||
| CVE-2014-6083 | 1 Ibm | 2 Security Access Manager For Mobile, Security Access Manager For Web | 2017-09-08 | 5.0 MEDIUM | N/A |
| IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allow remote attackers to obtain sensitive cookie information by sniffing the network during an HTTP session. | |||||
| CVE-2014-6086 | 1 Ibm | 2 Security Access Manager For Mobile, Security Access Manager For Web | 2017-09-08 | 5.0 MEDIUM | N/A |
| IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 do not ensure that HTTPS is used, which allows remote attackers to obtain sensitive information by sniffing the network during an HTTP session. | |||||
| CVE-2014-6088 | 1 Ibm | 2 Security Access Manager For Mobile, Security Access Manager For Web | 2017-09-08 | 5.0 MEDIUM | N/A |
| IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allow remote attackers to obtain sensitive information by sniffing the network during use of the null SSL cipher. | |||||
| CVE-2015-1457 | 1 Fortinet | 1 Fortiauthenticator | 2017-09-08 | 4.9 MEDIUM | N/A |
| Fortinet FortiAuthenticator 3.0.0 allows local users to read arbitrary files via the -f flag to the dig command. | |||||
| CVE-2014-8832 | 1 Apple | 1 Mac Os X | 2017-09-08 | 4.9 MEDIUM | N/A |
| The indexing functionality in Spotlight in Apple OS X before 10.10.2 writes memory contents to an external hard drive, which allows local users to obtain sensitive information by reading from this drive. | |||||
| CVE-2014-6138 | 1 Ibm | 1 Websphere Datapower Xc10 Appliance Firmware | 2017-09-08 | 4.0 MEDIUM | N/A |
| The IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows remote authenticated users to bypass intended grid-data access restrictions via unspecified vectors. | |||||
| CVE-2014-6143 | 1 Ibm | 1 Websphere Datapower Xc10 Appliance Firmware | 2017-09-08 | 2.1 LOW | N/A |
| The IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows local users to obtain sensitive information by reading a response. | |||||
| CVE-2014-6146 | 1 Ibm | 1 Sterling B2b Integrator | 2017-09-08 | 1.9 LOW | N/A |
| IBM Sterling B2B Integrator 5.2.x through 5.2.4, when the Connect:Direct Server Adapter is configured, does not properly process the logging configuration, which allows local users to obtain sensitive information by reading log files. | |||||
| CVE-2014-6147 | 1 Ibm | 1 Flex System Manager | 2017-09-08 | 2.1 LOW | N/A |
| IBM Flex System Manager (FSM) 1.1.x.x, 1.2.0.x, 1.2.1.x, 1.3.0.0, 1.3.1.0, and 1.3.2.0 allows local users to obtain sensitive information, and consequently gain privileges or conduct impersonation attacks, via unspecified vectors. | |||||
| CVE-2014-6164 | 1 Ibm | 1 Websphere Application Server | 2017-09-08 | 5.0 MEDIUM | N/A |
| IBM WebSphere Application Server 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.4 allows remote attackers to spoof OpenID and OpenID Connect cookies, and consequently obtain sensitive information, via a crafted URL. | |||||
| CVE-2014-6170 | 1 Ibm | 2 Integration Bus, Websphere Message Broker | 2017-09-08 | 5.0 MEDIUM | N/A |
| The HTTPInput node in IBM WebSphere Message Broker 7.0 before 7.0.0.8 and 8.0 before 8.0.0.6 and IBM Integration Bus 9.0 before 9.0.0.4 allows remote attackers to obtain sensitive information by triggering a SOAP fault. | |||||
| CVE-2014-6172 | 1 Ibm | 1 Api Management | 2017-09-08 | 5.0 MEDIUM | N/A |
| IBM API Management 3.0 before 3.0.4.0 IF1 allows remote attackers to obtain sensitive analytics information in an encrypted form via unspecified vectors. | |||||