CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Related To CWE-200

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2015-1308 200 +Info 2015-01-26 2015-01-26
4.3
None Remote Medium Not required Partial None None
kde-workspace 4.2.0 and plasma-workspace before 5.1.95 allows remote attackers to obtain input events, and consequently obtain passwords, by leveraging access to the X server when the screen is locked.
2 CVE-2015-1306 200 +Info 2015-01-22 2015-01-23
5.0
None Remote Low Not required Partial None None
The newsletter posting area in the web interface in Sympa 6.0.x before 6.0.10 and 6.1.x before 6.1.24 allows remote attackers to read arbitrary files via unspecified vectors.
3 CVE-2015-0922 200 +Info 2015-01-09 2015-01-22
5.0
None Remote Low Not required Partial None None
McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 uses the same secret key across different customers' installations, which allows attackers to obtain the administrator password by leveraging knowledge of the encrypted password.
4 CVE-2015-0590 200 +Info 2015-01-17 2015-01-20
5.0
None Remote Low Not required Partial None None
Cisco WebEx Meeting Center allows remote attackers to activate disabled meeting attributes, and consequently obtain sensitive information, by providing crafted parameters during a meeting-join action, aka Bug ID CSCuo34165.
5 CVE-2015-0583 200 +Info 2015-01-14 2015-01-22
5.0
None Remote Low Not required Partial None None
Cisco WebEx Meeting Center does not properly restrict the content of URLs, which allows remote attackers to obtain sensitive information via vectors related to file: URIs, aka Bug ID CSCus18281.
6 CVE-2015-0514 200 +Info 2015-01-21 2015-01-23
5.0
None Remote Low Not required Partial None None
EMC M&R (aka Watch4Net) before 6.5u1 and ViPR SRM before 3.6.1 might allow remote attackers to obtain cleartext data-center discovery credentials by leveraging certain SRM access to conduct a decryption attack.
7 CVE-2014-10026 200 Bypass +Info 2015-01-13 2015-01-13
5.0
None Remote Low Not required Partial None None
index.cgi in D-Link DAP-1360 with firmware 2.5.4 and earlier allows remote attackers to bypass authentication and obtain sensitive information by setting the client_login cookie to admin.
8 CVE-2014-10005 200 +Info 2015-01-13 2015-01-13
5.0
None Remote Low Not required Partial None None
Maian Uploader 4.0 allows remote attackers to obtain sensitive information via a request without the height parameter to load_flv.js.php, which reveals the installation path in an error message.
9 CVE-2014-100009 200 +Info 2015-01-13 2015-01-13
5.0
None Remote Low Not required Partial None None
The Joomlaskin JS Multi Hotel (aka JS MultiHotel and Js-Multi-Hotel) plugin 2.2.1 and earlier for WordPress allows remote attackers to obtain the installation path via a request to (1) functions.php, (2) myCalendar.php, (3) refreshDate.php, (4) show_image.php, (5) widget.php, (6) phpthumb/GdThumb.inc.php, or (7) phpthumb/thumb_plugins/gd_reflection.inc.php in includes/.
10 CVE-2014-9593 200 +Info 2015-01-15 2015-01-16
5.0
None Remote Low Not required Partial None None
Apache CloudStack before 4.3.2 and 4.4.x before 4.4.2 allows remote attackers to obtain private keys via a listSslCerts API call.
11 CVE-2014-9579 200 +Info 2015-01-08 2015-01-08
5.0
None Remote Low Not required Partial None None
VDG Security SENSE (formerly DIVA) 2.3.13 stores administrator credentials in cleartext, which allows attackers to obtain sensitive information by reading the plugin configuration files.
12 CVE-2014-9577 200 +Info 2015-01-08 2015-01-08
4.0
None Remote Low Single system Partial None None
VDG Security SENSE (formerly DIVA) 2.3.13 sends the user database when a user logs in, which allows remote authenticated users to obtain usernames and password hashes by logging in to TCP port 51410 and reading the response.
13 CVE-2014-9576 200 +Info 2015-01-08 2015-01-08
5.0
None Remote Low Not required Partial None None
VDG Security SENSE (formerly DIVA) 2.3.13 has a hardcoded password of (1) ArpaRomaWi for the root Postgres account and !DVService for the (2) postgres and (3) NTP Windows user accounts, which allows remote attackers to obtain access.
14 CVE-2014-9506 200 +Info 2015-01-04 2015-01-10
3.5
None Remote Medium Single system Partial None None
MantisBT before 1.2.18 does not properly check permissions when sending an email that indicates when a monitored issue is related to another issue, which allows remote authenticated users to obtain sensitive information about restricted issues.
15 CVE-2014-9419 200 Bypass +Info 2014-12-25 2014-12-29
2.1
None Local Low Not required Partial None None
The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel through 3.18.1 does not ensure that Thread Local Storage (TLS) descriptors are loaded before proceeding with other steps, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application that reads a TLS base address.
16 CVE-2014-9408 200 +Info 2014-12-19 2014-12-19
5.0
None Remote Low Not required Partial None None
Ekahau B4 staff badge tag 5.7 with firmware 1.4.52, Real-Time Location System (RTLS) Controller 6.0.5-FINAL, and Activator 3 uses part of the MAC address as part of the RC4 setup key, which makes it easier for remote attackers to guess the key via a brute-force attack.
17 CVE-2014-9361 200 +Priv +Info 2014-12-10 2014-12-11
4.3
None Remote Medium Not required Partial None None
The LoginToboggan module 7.x-1.x before 7.x-1.4 for Drupal does not properly unset the authorized user role for certain users, which allows remote attackers with the pre-authorized role to gain privileges and possibly obtain sensitive information by accessing a Page Not Found (404) page.
18 CVE-2014-9355 200 +Info 2014-12-19 2014-12-22
4.0
None Remote Low Single system Partial None None
Puppet Enterprise before 3.7.1 allows remote authenticated users to obtain licensing and certificate signing request information by leveraging access to an unspecified API endpoint.
19 CVE-2014-9303 200 +Info 2014-12-07 2014-12-08
7.8
None Remote Low Not required Complete None None
EntryPass N5200 Active Network Control Panel allows remote attackers to read device memory and obtain the administrator username and password via a URL starting with an ASCII character o through z or A through D, different vectors than CVE-2014-8868.
20 CVE-2014-9279 200 +Info 2014-12-08 2014-12-09
5.0
None Remote Low Not required Partial None None
The print_test_result function in admin/upgrade_unattended.php in MantisBT 1.1.0a3 through 1.2.x before 1.2.18 allows remote attackers to obtain database credentials via a URL in the hostname parameter and reading the parameters in the response sent to the URL.
21 CVE-2014-9252 200 +Info 2014-12-15 2014-12-16
2.1
None Local Low Not required Partial None None
Zenoss Core through 5 Beta 3 stores cleartext passwords in the session database, which might allow local users to obtain sensitive information by reading database entries, aka ZEN-15416.
22 CVE-2014-9250 200 +Info 2014-12-15 2014-12-16
5.0
None Remote Low Not required Partial None None
Zenoss Core through 5 Beta 3 does not include the HTTPOnly flag in a Set-Cookie header for the authentication cookie, which makes it easier for remote attackers to obtain credential information via script access to this cookie, aka ZEN-10418.
23 CVE-2014-9247 200 +Info 2014-12-15 2014-12-16
4.0
None Remote Low Single system Partial None None
Zenoss Core through 5 Beta 3 allows remote authenticated users to obtain sensitive (1) user account, (2) e-mail address, and (3) role information by visiting the ZenUsers (aka User Manager) page, aka ZEN-15389.
24 CVE-2014-9245 200 +Info 2014-12-15 2014-12-16
5.0
None Remote Low Not required Partial None None
Zenoss Core through 5 Beta 3 allows remote attackers to obtain sensitive information by attempting a product-rename action with an invalid new name and then reading a stack trace, as demonstrated by internal URL information, aka ZEN-15382.
25 CVE-2014-9225 200 +Info 2015-01-21 2015-01-22
4.0
None Remote Low Single system Partial None None
The ajaxswing webui in the management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced (SDCS:SA) 6.0.x through 6.0 MP1 allows remote authenticated users to obtain sensitive server information via unspecified vectors.
26 CVE-2014-9199 200 +Info 2015-01-16 2015-01-21
5.0
None Remote Low Not required Partial None None
The Clorius Controls Java web client before 01.00.0009g allows remote attackers to discover credentials by sniffing the network for cleartext-equivalent traffic.
27 CVE-2014-9177 200 +Info 2014-12-02 2014-12-02
5.0
None Remote Low Not required Partial None None
The HTML5 MP3 Player with Playlist Free plugin before 2.7 for WordPress allows remote attackers to obtain the installation path via a request to html5plus/playlist.php.
28 CVE-2014-9162 200 +Info 2014-12-10 2014-12-11
5.0
None Remote Low Not required Partial None None
Adobe Flash Player before 13.0.0.259 and 14.x through 16.x before 16.0.0.235 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to obtain sensitive information via unspecified vectors.
29 CVE-2014-9156 200 +Info 2014-12-01 2014-12-01
4.0
None Remote Low Single system Partial None None
The FileField module 6.x-3.x before 6.x-3.13 for Drupal does not properly check permissions to view files, which allows remote authenticated users with permission to create or edit content to read private files by attaching an uploaded file.
30 CVE-2014-9154 200 +Info 2014-12-01 2014-12-05
4.0
None Remote Low Single system Partial None None
The Notify module 7.x-1.x before 7.x-1.1 for Drupal does not properly restrict access to (1) new or (2) modified nodes or (3) their fields, which allows remote authenticated users to obtain node titles, teasers, and fields by reading a notification email.
31 CVE-2014-9025 200 +Info 2014-11-20 2014-11-21
5.0
None Remote Low Not required Partial None None
The default checkout completion rule in the commerce_order module in the Drupal Commerce module 7.x-1.x before 7.x-1.10 for Drupal uses the email address as the username for new accounts created at checkout, which allows remote attackers to obtain sensitive information via unspecified vectors.
32 CVE-2014-9018 200 +Info 2014-12-03 2014-12-17
5.0
None Remote Low Not required Partial None None
Icecast before 2.4.1 transmits the output of the on-connect script, which might allow remote attackers to obtain sensitive information, related to shared file descriptors.
33 CVE-2014-8874 200 +Info 2014-12-02 2014-12-03
5.0
None Remote Low Not required Partial None None
The ke_questionnaire extension 2.5.2 and earlier for TYPO3 uses predictable names for the questionnaire answer forms, which makes it easier for remote attackers to obtain sensitive information via a direct request.
34 CVE-2014-8788 200 +Info 2014-12-02 2014-12-05
4.0
None Remote Low Single system Partial None None
GleamTech FileVista before 6.1 allows remote authenticated users to obtain sensitive information via a crafted path when saving a zip file, which reveals the installation path in an error message.
35 CVE-2014-8775 200 +Info 2014-12-03 2014-12-05
5.0
None Remote Low Not required Partial None None
MODX Revolution 2.x before 2.2.15 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
36 CVE-2014-8762 200 +Info 2014-10-22 2014-11-13
5.0
None Remote Low Not required Partial None None
The ajax_mediadiff function in DokuWiki before 2014-05-05a allows remote attackers to access arbitrary images via a crafted namespace in the ns parameter.
37 CVE-2014-8761 200 +Info 2014-10-22 2014-11-13
5.0
None Remote Low Not required Partial None None
inc/template.php in DokuWiki before 2014-05-05a only checks for access to the root namespace, which allows remote attackers to access arbitrary images via a media file details ajax call.
38 CVE-2014-8736 200 Bypass +Info 2014-11-12 2014-11-13
5.0
None Remote Low Not required Partial None None
The Open Atrium Core module for Drupal before 7.x-2.22 allows remote attackers to bypass access restrictions and read file attachments that have been removed from a node by leveraging a previous revision of the node.
39 CVE-2014-8735 200 +Info 2014-11-12 2014-11-13
4.0
None Remote Low Single system Partial None None
The Bad Behavior module 6.x-2.x before 6.x-2.2216 and 7.x-2.x before 7.x-2.2216 for Drupal logs usernames and passwords, which allows remote authenticated users with the "administer bad behavior" permission to obtain sensitive information by reading a log file.
40 CVE-2014-8709 200 +Info 2014-11-10 2014-12-30
5.0
None Remote Low Not required Partial None None
The ieee80211_fragment function in net/mac80211/tx.c in the Linux kernel before 3.13.5 does not properly maintain a certain tail pointer, which allows remote attackers to obtain sensitive cleartext information by reading packets.
41 CVE-2014-8678 200 +Info 2014-11-25 2014-11-26
7.8
None Remote Low Not required Complete None None
The ConfigSaveServlet servlet in ManageEngine OpUtils before build 71024 allows remote attackers to "disclose" files via a crafted filename, related to "saveFile."
42 CVE-2014-8666 200 +Info 2014-11-06 2014-11-06
5.0
None Remote Low Not required Partial None None
The User & Server configuration, InfoView refresh, user rights (BI-BIP-ADM) component in SAP Business Intellignece allows remote attackers to obtain audit event details via unspecified vectors.
43 CVE-2014-8665 200 +Info 2014-11-06 2014-11-06
5.0
None Remote Low Not required Partial None None
The SAP Business Intelligence Development Workbench allows remote attackers to obtain sensitive information by reading unspecified files.
44 CVE-2014-8637 200 +Info 2015-01-14 2015-01-22
5.0
None Remote Low Not required Partial None None
Mozilla Firefox before 35.0 and SeaMonkey before 2.32 do not properly initialize memory for BMP images, which allows remote attackers to obtain sensitive information from process memory via a crafted web page that triggers the rendering of malformed BMP data within a CANVAS element.
45 CVE-2014-8566 200 DoS Overflow +Info 2014-11-15 2014-11-20
6.4
None Remote Low Not required Partial None Partial
The mod_auth_mellon module before 0.8.1 allows remote attackers to obtain sensitive information or cause a denial of service (segmentation fault) via unspecified vectors related to a "session overflow" involving "sessions overlapping in memory."
46 CVE-2014-8553 200 +Info 2014-12-17 2015-01-10
5.0
None Remote Low Not required Partial None None
The mci_account_get_array_by_id function in api/soap/mc_account_api.php in MantisBT before 1.2.18 allows remote attackers to obtain sensitive information via a (1) mc_project_get_users, (2) mc_issue_get, (3) mc_filter_get_issues, or (4) mc_project_get_issues SOAP request.
47 CVE-2014-8552 200 +Info 2014-11-26 2014-11-26
5.0
None Remote Low Not required Partial None None
The WinCC server in Siemens SIMATIC WinCC 7.0 through SP3, 7.2 before Update 9, and 7.3 before Update 2; SIMATIC PCS 7 7.1 through SP4, 8.0 through SP2, and 8.1; and TIA Portal 13 before Update 6 allows remote attackers to read arbitrary files via crafted packets.
48 CVE-2014-8537 200 +Info 2014-10-29 2014-11-13
2.1
None Local Low Not required Partial None None
McAfee Network Data Loss Prevention (NDLP) before 9.2.2 allows local users to obtain sensitive information by reading the logs.
49 CVE-2014-8536 200 +Info 2014-10-29 2014-11-13
2.1
None Local Low Not required Partial None None
McAfee Network Data Loss Prevention (NDLP) before 9.2.2 allows local users to obtain sensitive information by reading unspecified error messages.
50 CVE-2014-8528 200 +Info 2014-10-29 2014-10-30
2.1
None Local Low Not required Partial None None
McAfee Network Data Loss Prevention (NDLP) before 9.3 logs session IDs, which allows local users to obtain sensitive information by reading the audit log.
Total number of vulnerabilities : 1806   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.