The XMLHTTP ActiveX controls in XML Core Services 3.0 in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 allow remote attackers to bypass the Same Origin Policy via a web page that is visited in Internet Explorer aka \MSXML Information Disclosure Vulnerability.\


The Graphics Component in Microsoft Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 does not properly process JPEG images which makes it easier for remote attackers to bypass the ASLR protection mechanism via a crafted web site aka \Graphics Component Information Disclosure Vulnerability.\


Zoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 have a database Information Disclosure Vulnerability. Fixed in EventLog Analyzer 10.0 Build 10000.


Microsoft Active Directory Federation Services (AD FS) 2.0 2.1 and 3.0 when a configured SAML Relying Party lacks a sign-out endpoint does not properly process logoff actions which makes it easier for remote attackers to obtain access by leveraging an unattended workstation aka \Active Directory Federation Services Information Disclosure Vulnerability.\


Microsoft Internet Explorer 6 through 8 does not properly handle unspecified special characters in Cascading Style Sheets (CSS) documents which allows remote attackers to obtain sensitive information from a different (1) domain or (2) zone via a crafted web site aka \CSS Special Character Information Disclosure Vulnerability.\


Microsoft Internet Explorer 6 7 and 8 does not prevent rendering of cached content as HTML which allows remote attackers to access content from a different (1) domain or (2) zone via unspecified script code aka \Cross-Domain Information Disclosure Vulnerability \ a different vulnerability than CVE-2010-3348.


Microsoft Internet Explorer 6 through 8 does not properly restrict script access to content from a different (1) domain or (2) zone which allows remote attackers to obtain sensitive information via a crafted web site aka \Cross-Domain Information Disclosure Vulnerability.\


Microsoft Internet Explorer 6 7 and 8 does not prevent rendering of cached content as HTML which allows remote attackers to access content from a different (1) domain or (2) zone via unspecified script code aka \Cross-Domain Information Disclosure Vulnerability \ a different vulnerability than CVE-2010-3342.


The implementation of HTML content creation in Microsoft Internet Explorer 6 through 8 does not remove the Anchor element during pasting and editing which might allow remote attackers to obtain sensitive deleted information by visiting a web page aka \Anchor Element Information Disclosure Vulnerability.\


Microsoft Internet Explorer 6 and 7 on Windows XP and Vista does not prevent script from simulating user interaction with the AutoComplete feature which allows remote attackers to obtain sensitive form information via a crafted web site aka \AutoComplete Information Disclosure Vulnerability.\


Microsoft Internet Explorer 5.01 SP4 6 6 SP1 and 7 does not properly handle unspecified \encoding strings \ which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site aka \Post Encoding Information Disclosure Vulnerability.\


Joomla! Core is prone to an information disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may help in launching further attacks. Joomla! Core versions 1.5.x ranging from 1.5.0 and up to and including 1.5.15 are vulnerable.


Windows Failover Cluster Information Disclosure Vulnerability.


Windows Clustered Shared Volume Information Disclosure Vulnerability. This CVE ID is unique from CVE-2022-29120 CVE-2022-29122 CVE-2022-29134.


Windows Clustered Shared Volume Information Disclosure Vulnerability. This CVE ID is unique from CVE-2022-29120 CVE-2022-29123 CVE-2022-29134.


Windows Print Spooler Information Disclosure Vulnerability. This CVE ID is unique from CVE-2022-29114.


Windows Clustered Shared Volume Information Disclosure Vulnerability. This CVE ID is unique from CVE-2022-29122 CVE-2022-29123 CVE-2022-29134.


Windows Clustered Shared Volume Information Disclosure Vulnerability. This CVE ID is unique from CVE-2022-29120 CVE-2022-29122 CVE-2022-29123.


Windows Print Spooler Information Disclosure Vulnerability. This CVE ID is unique from CVE-2022-29140.


An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5 all versions starting from 14.7 before 14.7.4 all versions starting from 14.8 before 14.8.2. An unauthorised user was able to steal runner registration tokens through an information disclosure vulnerability using quick actions commands.


Reprise License Manager 14.2 is affected by an Information Disclosure vulnerability via a GET request to /goforms/rlminfo. No authentication is required. The information disclosed is associated with software versions process IDs network configuration hostname(s) system architecture and file/directory details.


Windows iSCSI Target Service Information Disclosure Vulnerability.


Windows Hyper-V Shared Virtual Hard Disks Information Disclosure Vulnerability. This CVE ID is unique from CVE-2022-24539 CVE-2022-26783 CVE-2022-26785.


Windows Hyper-V Shared Virtual Hard Disks Information Disclosure Vulnerability. This CVE ID is unique from CVE-2022-24490 CVE-2022-26783 CVE-2022-26785.


Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability.


Skype Extension for Chrome Information Disclosure Vulnerability.


Remote Desktop Protocol Client Information Disclosure Vulnerability.


An information disclosure vulnerability exists in the web interface session cookie functionality of InHand Networks InRouter302 V3.5.4. The session cookie misses the HttpOnly flag making it accessible via JavaScript and thus allowing an attacker able to perform an XSS attack to steal the session cookie.


A CSRF token visible in the URL may possibly lead to information disclosure vulnerability.


Windows DNS Server Information Disclosure Vulnerability.


Windows WLAN AutoConfig Service Information Disclosure Vulnerability.


An information disclosure vulnerability exists in the router configuration export functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to increased privileges. An attacker can send an HTTP request to trigger this vulnerability.


Windows Hyper-V Shared Virtual Hard Disks Information Disclosure Vulnerability. This CVE ID is unique from CVE-2022-24490 CVE-2022-24539 CVE-2022-26783.


Skype for Business Information Disclosure Vulnerability.


Windows Server Service Information Disclosure Vulnerability.


Azure SDK for .NET Information Disclosure Vulnerability.


Azure Site Recovery Information Disclosure Vulnerability. This CVE ID is unique from CVE-2022-26897.


Windows Hyper-V Shared Virtual Hard Disks Information Disclosure Vulnerability. This CVE ID is unique from CVE-2022-24490 CVE-2022-24539 CVE-2022-26785.


Windows NTFS Information Disclosure Vulnerability.


Azure Site Recovery Information Disclosure Vulnerability. This CVE ID is unique from CVE-2022-26896.


VMware Workspace ONE Access Identity Manager and vRealize Automation contain an information disclosure vulnerability due to returning excess information. A malicious actor with remote access may leak the hostname of the target system. Successful exploitation of this issue can lead to targeting victims.


Media Foundation Information Disclosure Vulnerability. This CVE ID is unique from CVE-2022-21977.


Microsoft Excel Information Disclosure Vulnerability.


VMware Cloud Foundation contains an information disclosure vulnerability due to logging of credentials in plain-text within multiple log files on the SDDC Manager. A malicious actor with root access on VMware Cloud Foundation SDDC Manager may be able to view credentials in plaintext within one or more log files.


A remote authenticated information disclosure vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below 6.9.9 and below 6.8.9-HF2 and below 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.


Microsoft Power BI Information Disclosure Vulnerability.


Windows NT Lan Manager Datagram Receiver Driver Information Disclosure Vulnerability.


Microsoft Office Information Disclosure Vulnerability.


Storage Spaces Controller Information Disclosure Vulnerability.


Win32k Information Disclosure Vulnerability.


Remote Desktop Licensing Diagnoser Information Disclosure Vulnerability.


An information disclosure vulnerability exists due to a web server misconfiguration in the Reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send an HTTP request to trigger this vulnerability.


Media Foundation Information Disclosure Vulnerability. This CVE ID is unique from CVE-2022-22010.


Windows GDI+ Information Disclosure Vulnerability. This CVE ID is unique from CVE-2022-21915.


Windows GDI+ Information Disclosure Vulnerability. This CVE ID is unique from CVE-2022-21880.


Microsoft Internet Explorer 5.01 SP4; 6 SP1; 6 and 7 for Windows XP SP2 and SP3; 6 and 7 for Server 2003 SP2; 7 for Vista Gold SP1 and SP2; and 7 for Server 2008 SP2 does not prevent HTML rendering of cached content which allows remote attackers to bypass the Same Origin Policy via unspecified vectors aka \Cross-Domain Information Disclosure Vulnerability.\


An exploitable information disclosure vulnerability exists in the apid daemon of the Circle with Disney running firmware 2.0.1. A specially crafted set of packets can make the Disney Circle dump strings from an internal database into an HTTP response. An attacker needs network connectivity to the Internet to trigger this vulnerability.


An exploitable information disclosure vulnerability exists in the Server Agent functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted TCP packet can cause information disclosure. An attacker can send a crafted TCP packet to trigger this vulnerability.


Microsoft Edge allows remote attackers to obtain sensitive information from process memory via a crafted web site aka \Microsoft Browser Information Disclosure Vulnerability.\ This vulnerability is different from those described in CVE-2017-0009 CVE-2017-0011 CVE-2017-0017 and CVE-2017-0068.


Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 handles certain requests aka \Windows SMB Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-0267 CVE-2017-0268 CVE-2017-0270 CVE-2017-0271 CVE-2017-0274 and CVE-2017-0276.


The Adobe Type Manager Font Driver (ATMFD.dll) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold 1511 1607 and 1703 allows an attacker to gain sensitive information via a specially crafted document or an untrusted website aka \ATMFD.dll Information Disclosure Vulnerability.\


Uniscribe

in

Microsoft

Windows

Vista

Windows

Server

and

and

Windows

allows

remote

attackers

to

obtain

sensitive

information

from

process

memory

via

a

crafted

web

site

aka

\Uniscribe

Information

Disclosure

Vulnerability.\

and


Uniscribe

in

Windows

Server

and

Windows

Windows

Windows

Server

Gold

and

Windows

RT

Windows

Gold

Windows

Server

Microsoft

Office

and

Microsoft

Office

allows

improper

disclosure

of

memory

contents

aka

\Windows

Uniscribe

Information

Disclosure

Vulnerability\.

This

CVE

ID

is

unique

from

and


Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 handles certain requests aka \Windows SMB Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-0267 CVE-2017-0268 CVE-2017-0270 CVE-2017-0274 CVE-2017-0275 and CVE-2017-0276.


An information disclosure vulnerability in Bluetooth could allow a local malicious application to bypass operating system protections that isolate application data from other applications. This issue is rated as Moderate due to details specific to the vulnerability. Product: Android. Versions: 4.4.4 5.0.2 5.1.1 6.0 6.0.1 7.0 7.1.1 7.1.2. Android ID: A-34946955.


An information disclosure vulnerability in libmedia in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it is a general bypass for operating system protections that isolate application data from other applications. Product: Android. Versions: 4.4.4 5.0.2 5.1.1 6.0 6.0.1 7.0 7.1.1. Android ID: A-33861560.


An information disclosure vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-32644895. References: QC-CR#1091939.


The Color Management Module (ICM32.dll) memory handling functionality in Windows Vista SP2 Windows Server 2008 SP2 and R2 and Windows 7 SP1 allows remote attackers to bypass ASLR and execute code in combination with another vulnerability through a crafted website aka \Microsoft Color Management Information Disclosure Vulnerability.\ This vulnerability is different from that described in CVE-2017-0063.


Microsoft Word 2007 SP3 Office 2010 SP2 Word 2010 SP2 Word for Mac 2011 Office Compatibility Pack SP3 Word Automation Services on SharePoint Server 2010 SP2 and Office Web Apps 2010 SP2 allow remote attackers to obtain sensitive information from out-of-bound memory via a crafted Office document aka \Microsoft Office Information Disclosure Vulnerability.\


An information disclosure vulnerability in the Broadcom Wi-Fi driver could enable a local malicious component to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10 Kernel-3.18. Android ID: A-36000515. References: B-RB#117131.


An information disclosure vulnerability in the kernel ION subsystem could enable a local malicious application to access data outside of its permission levels. This issue is rated as Low because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-35644815.


The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 1703 and Windows Server 2016 allows authenticated attackers to obtain sensitive information via a specially crafted document aka \Windows Kernel Information Disclosure Vulnerability \ a different vulnerability than CVE-2017-0175 CVE-2017-0220 and CVE-2017-0259.


An information disclosure vulnerability in the NVIDIA crypto driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel 3.10. Android ID: A-33899858. References: N-CVE-2017-0330.


An information disclosure vulnerability in the kernel UVC driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10 Kernel-3.18. Android ID: A-33300353.


An information disclosure vulnerability in the MediaTek driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission. Product: Android. Versions: N/A. Android ID: A-28449427. References: M-ALPS02710042.


Uniscribe in Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 and Windows 7 SP1 allows remote attackers to obtain sensitive information from process memory via a crafted web site aka \Windows Uniscribe Information Disclosure Vulnerability.\


An information disclosure vulnerability in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 6.0 6.0.1 7.0 7.1.1. Android ID: A-33552073.


An information disclosure vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10 Kernel-3.18. Android ID: A-32877245. References: QC-CR#1087469.


An information disclosure vulnerability in the NVIDIA crypto driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel 3.10. Android ID: A-33898322. References: N-CVE-2017-0328.


An information disclosure vulnerability in libmpeg2 in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access data without permission. Product: Android. Versions: 6.0 6.0.1 7.0 7.1.1. Android ID: A-34093073.


Graphics

in

Windows

Server

and

Windows

Windows

Windows

Server

Gold

and

Windows

RT

Windows

Gold

and

Windows

Server

allows

improper

disclosure

of

memory

contents

aka

\Windows

Graphics

Information

Disclosure

Vulnerability\.

This

CVE

ID

is

unique

from

and


Uniscribe

in

Microsoft

Windows

Vista

Windows

Server

and

and

Windows

allows

remote

attackers

to

obtain

sensitive

information

from

process

memory

via

a

crafted

web

site

aka

\Uniscribe

Information

Disclosure

Vulnerability.\

and


An information disclosure vulnerability in the NVIDIA GPU driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission. Product: Android. Versions: Kernel-3.18. Android ID: A-33245849. References: N-CVE-2017-0334.


An information disclosure vulnerability in lvm/wrapper/Bundle/EffectBundle.cpp in libeffects in Audioserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 4.4.4 5.0.2 5.1.1 6.0 6.0.1 7.0 7.1. Android ID: A-32436341.


An information disclosure vulnerability in visualizer/EffectVisualizer.cpp in libeffects in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 4.4.4 5.0.2 5.1.1 6.0 6.0.1 7.0 7.1. Android ID: A-31781965.


A Win32k information disclosure vulnerability exists in Microsoft Windows when the win32k component improperly provides kernel information. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user's system aka \Win32k Information Disclosure Vulnerability.\


An information disclosure vulnerability in the HTC sound codec driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10. Android ID: A-33547247.


An information disclosure vulnerability in the Qualcomm sound driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10 Kernel-3.18. Android ID: A-31796345. References: QC-CR#1073129.


An information disclosure vulnerability in the Qualcomm crypto engine driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission. Product: Android. Versions: Kernel-3.10 Kernel-3.18. Android ID: A-35393124. References: QC-CR#1088050.


Uniscribe

in

Microsoft

Windows

Vista

Windows

Server

and

Windows

Windows

Windows

Server

Gold

and

Windows

RT

Windows

Gold

and

and

Windows

Server

allows

remote

attackers

to

obtain

sensitive

information

from

process

memory

via

a

crafted

web

site

aka

\Uniscribe

Information

Disclosure

Vulnerability.\

and


An information disclosure vulnerability in AOSP Messaging could enable a remote attacker using a special crafted file to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 6.0 6.0.1 7.0 7.1.1. Android ID: A-32764144.


The

kernel

in

Microsoft

Windows

Server

and

Windows

Windows

Windows

Server

Gold

and

Windows

RT

Windows

Gold

and

Windows

Server

allows

an

authenticated

attacker

to

obtain

information

via

a

specially

crafted

application.

aka

\Windows

Kernel

Information

Disclosure

Vulnerability

a

different

vulnerability

than

and


Microsoft Excel 2007 SP3 Excel 2010 SP2 Excel 2013 RT SP1 Excel 2016 Office Compatibility Pack SP3 and Excel Services on SharePoint Server 2013 SP1 allow remote attackers to obtain sensitive information from process memory via a crafted Office document aka \Microsoft Office Information Disclosure Vulnerability.\


An information disclosure vulnerability in libmpeg2 in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access data without permission. Product: Android. Versions: 6.0 6.0.1 7.0 7.1.1. Android ID: A-34093952.


An information disclosure vulnerability in id3/ID3.cpp in libstagefright in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 4.4.4 5.0.2 5.1.1 6.0 6.0.1 7.0 7.1. Android ID: A-32377688.


An information disclosure vulnerability in the NVIDIA video driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission. Product: Android. Versions: Kernel-3.10. Android ID: A-32721029. References: N-CVE-2017-0448.


An information disclosure vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10 Kernel-3.18. Android ID: A-32073794. References: QC-CR#1100132.


Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site aka \Internet Explorer Information Disclosure Vulnerability.\ This vulnerability is different from those described in CVE-2017-0008 and CVE-2017-0009.


An information disclosure vulnerability in the Qualcomm video driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-32508732. References: QC-CR#1088206.


The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold 1511 and 1607; and Windows Server 2016 allows remote attackers to obtain sensitive information from process memory via a crafted packets aka \Windows SMB Information Disclosure Vulnerability.\


Browsers in Microsoft Edge allow remote attackers to obtain sensitive information from process memory via a crafted web site aka \Microsoft Edge Information Disclosure Vulnerability.\ This vulnerability is different from those described in CVE-2017-0009 CVE-2017-0011 CVE-2017-0017 and CVE-2017-0065.


The kernel-mode drivers in Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 and Windows Server 2012 Gold allow a local authenticated attacker to execute a specially crafted application to obtain kernel information aka \Win32k Information Disclosure Vulnerability.\


Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 handles certain requests aka \Windows SMB Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-0267 CVE-2017-0268 CVE-2017-0270 CVE-2017-0271 CVE-2017-0275 and CVE-2017-0276.


An information disclosure vulnerability in the Filesystem could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 7.0 7.1.1. Android ID: A-32799236.


Uniscribe in Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 1703 Windows Server 2016 Microsoft Office 2007 SP3 Microsoft Office 2010 SP2 and Microsoft Office Word Viewer allows improper disclosure of memory contents aka \Windows Uniscribe Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-0282 CVE-2017-0284 and CVE-2017-8534.


Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 handles certain requests aka \Windows SMB Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-0267 CVE-2017-0268 CVE-2017-0271 CVE-2017-0274 CVE-2017-0275 and CVE-2017-0276.


The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold 1511 and 1607 allows remote attackers to obtain sensitive information from process memory via a crafted web site aka \GDI+ Information Disclosure Vulnerability.\ This vulnerability is different from those described in CVE-2017-0060 and CVE-2017-0062.


An information disclosure vulnerability in AOSP Messaging could enable a local malicious application to bypass operating system protections that isolate application data from other applications. This issue is rated as High because it could be used to gain access to data that the application does not have access to. Product: Android. Versions: 6.0 6.0.1 7.0 7.1.1. Android ID: A-32161610.


An information disclosure vulnerability in the Qualcomm sound codec driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10. Android ID: A-35392586. References: QC-CR#832915.


The VBScript engine in Microsoft Internet Explorer 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site aka \Scripting Engine Information Disclosure Vulnerability.\ This vulnerability is different from those described in CVE-2017-0018 and CVE-2017-0037.


Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 handles certain requests aka \Windows SMB Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-0267 CVE-2017-0270 CVE-2017-0271 CVE-2017-0274 CVE-2017-0275 and CVE-2017-0276.


An information disclosure vulnerability in the Synaptics touchscreen driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Low because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10 Kernel-3.18. Android ID: A-35472278.


Uniscribe

in

Microsoft

Windows

Vista

Windows

Server

and

and

Windows

allows

remote

attackers

to

obtain

sensitive

information

from

process

memory

via

a

crafted

web

site

aka

\Uniscribe

Information

Disclosure

Vulnerability.\

and


The Windows kernel in Microsoft Windows 8.1 Windows Server 2012 R2 Windows RT 8.1 Windows 10 Gold 1511 1607 1703 and Windows Server 2016 allows authenticated attackers to obtain sensitive information via a specially crafted document aka \Windows Kernel Information Disclosure Vulnerability \ a different vulnerability than CVE-2017-0175 CVE-2017-0220 and CVE-2017-0258.


An information disclosure vulnerability in the Qualcomm sound driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10 Kernel-3.18. Android ID: A-33649808. References: QC-CR#1097569.


An information disclosure vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission. Product: Android. Versions: Kernel-3.10 Kernel-3.18. Android ID: A-34327795. References: QC-CR#2005832.


An information disclosure vulnerability exists when the Windows Hyper-V Network Switch running on a Windows 8.1 Windows Server 2008 Windows Server 2008 R2 Windows Server 2012 or Windows Server 2012 R2 host operating system fails to properly validate input from an authenticated user on a guest operating system aka \Hyper-V Information Disclosure Vulnerability.\ This CVE ID is unique from CVE-2017-0169.


An information disclosure vulnerability in the MediaTek video codec driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: N/A. Android ID: A-32370398. References: M-ALPS03069985.


Windows Performance Monitor in Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 1703 and Windows Server 2016 allows an information disclosure vulnerability due to the way it parses XML input aka \Windows Performance Monitor Information Disclosure Vulnerability\.


The

kernel

in

Microsoft

Windows

Server

Windows

Windows

Windows

Server

Gold

and

Windows

RT

Windows

Gold

and

Windows

Server

allows

an

authenticated

attacker

to

obtain

information

via

a

specially

crafted

application.

aka

\Windows

Kernel

Information

Disclosure

Vulnerability

a

different

vulnerability

than


An information disclosure vulnerability in Bluetooth component could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate due to details specific to the vulnerability. Product: Android. Versions: 4.4.4 5.0.2 5.1.1 6.0 6.0.1 7.0 7.1.1 7.1.2. Android ID: A-33899337.


Active Directory Federation Services in Microsoft Windows 10 1607 Windows Server 2008 SP2 and R2 SP1 Windows Server 2012 Gold and R2 and Windows Server 2016 allows local users to obtain sensitive information via a crafted application aka \Microsoft Active Directory Federation Services Information Disclosure Vulnerability.\


Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site aka \Internet Explorer Information Disclosure Vulnerability.\ This vulnerability is different from those described in CVE-2017-0009 and CVE-2017-0059.


An information disclosure vulnerability in lvm/wrapper/Bundle/EffectBundle.cpp in libeffects in the Qualcomm audio post processor could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 5.0.2 5.1.1 6.0 6.0.1 7.0 7.1. Android ID: A-32588016.


An information disclosure vulnerability in the Synaptics touchscreen driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10 Kernel-3.18. Android ID: A-33555878.


An information disclosure vulnerability in the Qualcomm camera driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Low because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10. Android ID: A-32873615. References: QC-CR#1093693.


An information disclosure vulnerability in the Synaptics touchscreen driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-32511682.


An information disclosure vulnerability in the Framework APIs could enable a local malicious application to bypass operating system protections that isolate application data from other applications. This issue is rated as High because it could be used to gain access to data that the application does not have access to. Product: Android. Versions: 4.4.4 5.0.2 5.1.1 6.0 6.0.1 7.0 7.1.1 7.1.2. Android ID: A-34128677.


An information disclosure vulnerability in silk/NLSF_stabilize.c in libopus in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 5.0.2 5.1.1 6.0 6.0.1 7.0 7.1. Android ID: A-31607432.


An information disclosure vulnerability in AOSP Messaging could enable a remote attacker using a special crafted file to access data outside of its permission levels. This issue is rated as Moderate because it is a general bypass for a user level defense in depth or exploit mitigation technology in a privileged process. Product: Android. Versions: 6.0 6.0.1 7.0 7.1.1. Android ID: A-32322450.


DNS client in Microsoft Windows 8.1; Windows Server 2012 R2 Windows RT 8.1; Windows 10 Gold 1511 and 1607; and Windows Server 2016 fails to properly process DNS queries which allows remote attackers to obtain sensitive information via (1) convincing a workstation user to visit an untrusted webpage or (2) tricking a server into sending a DNS query to a malicious DNS server aka \Windows DNS Query Information Disclosure Vulnerability.\


Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 handles certain requests aka \Windows SMB Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-0267 CVE-2017-0268 CVE-2017-0270 CVE-2017-0271 CVE-2017-0274 and CVE-2017-0275.


An information disclosure vulnerability in lvm/wrapper/Bundle/EffectBundle.cpp in libeffects in the Qualcomm audio post processor could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 5.0.2 5.1.1 6.0 6.0.1 7.0 7.1. Android ID: A-32588756.


Graphics

in

Windows

Server

and

Windows

Windows

Windows

Server

Gold

and

Windows

RT

Windows

Gold

and

Windows

Server

allows

improper

disclosure

of

memory

contents

aka

\Graphics

Uniscribe

Information

Disclosure

Vulnerability\.

This

CVE

ID

is

unique

from

and


An information disclosure vulnerability in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access data without permission. Product: Android. Versions: 4.4.4 5.0.2 5.1.1 6.0 6.0.1 7.0 7.1.1. Android ID: A-34056274.


An information disclosure vulnerability in AOSP Mail could enable a local malicious application to bypass operating system protections that isolate application data from other applications. This issue is rated as High because it could be used to gain access to data that the application does not have access to. Product: Android. Versions: 4.4.4 5.0.2 5.1.1 6.0 6.0.1 7.0 7.1.1. Android ID: A-32615212.


An information disclosure vulnerability exists in Microsoft Edge when the Chakra scripting engine does not properly handle objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user's system a.k.a. \Scripting Engine Information Disclosure Vulnerability.\


An information disclosure vulnerability in the kernel trace subsystem could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10 Kernel-3.18. Android ID: A-34277115.


The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold 1511 and 1607 allows remote attackers to obtain sensitive information from process memory via a crafted web site aka \GDI+ Information Disclosure Vulnerability.\ This vulnerability is different from those described in CVE-2017-0060 and CVE-2017-0073.


An information disclosure vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10 Kernel-3.18. Android ID: A-32074353. References: QC-CR#1104731.


An information disclosure vulnerability in the Qualcomm camera driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10 Kernel-3.18. Android ID: A-34230377. References: QC-CR#1086833.


An information disclosure vulnerability in AOSP Messaging could enable a local malicious application to bypass operating system protections that isolate application data from other applications. This issue is rated as High because it could be used to gain access to data that the application does not have access to. Product: Android. Versions: 6.0 6.0.1 7.0 7.1.1. Android ID: A-32807795.


An information disclosure vulnerability in Audioserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 4.4.4 5.0.2 5.1.1 6.0 6.0.1 7.0 7.1.1. Android ID: A-32720785.


The GDI component in Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and Windows Server 2016 allows remote attackers to obtain sensitive information from process memory via a crafted web site aka \GDI Information Disclosure Vulnerability.\


An information disclosure vulnerability in Audioserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 4.4.4 5.0.2 5.1.1 6.0 6.0.1 7.0 7.1. Android IDs: A-32438594 A-32635664.


Hyper-V in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1 Windows Server 2012 Gold and R2; Windows 10 Gold 1511 and 1607; and Windows Server 2016 allows guest OS users to obtain sensitive information from host OS memory via a crafted application aka \Hyper-V Information Disclosure Vulnerability.\


A Win32k information disclosure vulnerability exists in Windows 8.1 Windows RT 8.1 Windows Server 2012 Windows Server 2012 R2 Windows 10 and Windows Server 2016 when the win32k component improperly provides kernel information. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user's system aka \Win32k Information Disclosure Vulnerability.\ This CVE ID is unique from CVE-2017-0189.


An information disclosure vulnerability in libskia could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access data without permission. Product: Android. Versions: 4.4.4 5.0.2 5.1.1 6.0 6.0.1 7.0 7.1.1. Android ID: A-33897722.


Graphics

in

Windows

Server

and

Windows

Windows

Windows

Server

Gold

and

Windows

RT

Windows

Gold

and

Windows

Server

allows

improper

disclosure

of

memory

contents

aka

\Windows

Graphics

Information

Disclosure

Vulnerability\.

This

CVE

ID

is

unique

from

and


An information disclosure vulnerability in the Framework APIs could enable a local malicious application to bypass operating system protections that isolate application data from other applications. This issue is rated as High because it could be used to gain access to data that the application does not have access to. Product: Android. Versions: 5.0.2 5.1.1 6.0 6.0.1 7.0 7.1.1. Android ID: A-32555637.


An information disclosure vulnerability in the Qualcomm camera driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10 Kernel-3.18. Android ID: A-35399756. References: QC-CR#1093232.


The Color Management Module (ICM32.dll) memory handling functionality in Windows Vista SP2; Windows Server 2008 SP2 and R2; and Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold 1511 and 1607; and Windows Server 2016 allows remote attackers to bypass ASLR and execute code in combination with another vulnerability through a crafted website aka \Microsoft Color Management Information Disclosure Vulnerability.\ This vulnerability is different from that described in CVE-2017-0061.


The Windows kernel in Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 and Windows Server 2012 Gold allows authenticated attackers to obtain sensitive information via a specially crafted document aka \Windows Kernel Information Disclosure Vulnerability \ a different vulnerability than CVE-2017-0175 CVE-2017-0258 and CVE-2017-0259.


Uniscribe

in

Windows

Server

and

Windows

Windows

Windows

Server

Gold

and

Windows

RT

Windows

Gold

Windows

Server

Microsoft

Office

and

Microsoft

Office

allows

improper

disclosure

of

memory

contents

aka

\Windows

Uniscribe

Information

Disclosure

Vulnerability\.

This

CVE

ID

is

unique

from

and


Uniscribe

in

Microsoft

Windows

Vista

Windows

Server

and

and

Windows

allows

remote

attackers

to

obtain

sensitive

information

from

process

memory

via

a

crafted

web

site

aka

\Uniscribe

Information

Disclosure

Vulnerability.\

and


An information disclosure vulnerability in the Broadcom Wi-Fi driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10 Kernel-3.18. Android ID: A-32475556. References: B-RB#112953.


An information disclosure vulnerability in the Qualcomm camera driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10 Kernel-3.18. Android ID: A-35214296. References: QC-CR#1086833.


An information disclosure vulnerability in the factory reset process could enable a local malicious attacker to access data from the previous owner. This issue is rated as Moderate due to the possibility of bypassing device protection. Product: Android. Versions: 4.4.4 5.0.2 5.1.1 6.0 6.0.1 7.0 7.1.1. Android ID: A-30681079.


An information disclosure vulnerability in the MediaTek command queue driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission. Product: Android. Versions: N/A. Android ID: A-35142799. References: M-ALPS03161531.


Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 handles certain requests aka \Windows SMB Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-0268 CVE-2017-0270 CVE-2017-0271 CVE-2017-0274 CVE-2017-0275 and CVE-2017-0276.


An information disclosure vulnerability exists when Windows Hyper-V running on a Windows 8.1 Windows Server 2012. or Windows Server 2012 R2 host operating system fails to properly validate input from an authenticated user on a guest operating system aka \Hyper-V Information Disclosure Vulnerability.\ This CVE ID is unique from CVE-2017-0168.


An information disclosure vulnerability in the Qualcomm video driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-32509422. References: QC-CR#1088206.


An information disclosure vulnerability in libziparchive could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 5.0.2 5.1.1 6.0 6.0.1 7.0 7.1.1 7.1.2. Android ID: A-36392138.


An information disclosure vulnerability in File-Based Encryption could enable a local malicious attacker to bypass operating system protections for the lock screen. This issue is rated as Moderate due to the possibility of bypassing the lock screen. Product: Android. Versions: 7.0 7.1.1. Android ID: A-32793550.


Windows Media Player in Microsoft Windows 8.1; Windows Server 2012 R2; Windows RT 8.1; Windows 7 SP1; Windows 2008 SP2 and R2 SP1 Windows Server 2016; Windows Vista SP2; and Windows 10 Gold 1511 and 1607 allows remote attackers to obtain sensitive information via a crafted web site aka \Windows Media Player Information Disclosure Vulnerability.\


An information disclosure vulnerability in libavc in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access data without permission. Product: Android. Versions: 6.0 6.0.1 7.0 7.1.1. Android ID: A-33551775.


The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold 1511 and 1607 allows remote attackers to obtain sensitive information from process memory via a crafted web site aka \Windows GDI+ Information Disclosure Vulnerability.\ This vulnerability is different from those described in CVE-2017-0060 and CVE-2017-0062.


An information disclosure vulnerability in lvm/wrapper/Bundle/EffectBundle.cpp in libeffects in Audioserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 4.4.4 5.0.2 5.1.1 6.0 6.0.1 7.0 7.1. Android ID: A-32584034.


An information disclosure vulnerability in the NVIDIA GPU driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission. Product: Android. Versions: Kernel-3.18. Android ID: A-33042679. References: N-CVE-2017-0336.


Microsoft Edge allows remote attackers to obtain sensitive information via a crafted web site aka \Microsoft Edge Information Disclosure Vulnerability.\ This vulnerability is different from those described in CVE-2017-0009 CVE-2017-0017 CVE-2017-0065 and CVE-2017-0068.


The Windows kernel in Windows Server 2008 SP2 and R2 SP1 and Windows 7 SP1 allows authenticated attackers to obtain sensitive information via a specially crafted document aka \Windows Kernel Information Disclosure Vulnerability \ a different vulnerability than CVE-2017-0220 CVE-2017-0258 and CVE-2017-0259.


An information disclosure vulnerability in Bluetooth component could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it is a general bypass for operating system protections that isolate application data from other applications. Product: Android. Versions: 4.4.4 5.0.2 5.1.1 6.0 6.0.1 7.0 7.1.1 7.1.2. Android ID: A-35310991.


An information disclosure vulnerability in the kernel USB gadget driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-31614969.


The Microsoft Server Block Message (SMB) on Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 allows an information disclosure vulnerability in the way that it handles certain requests aka \Windows SMB Information Disclosure Vulnerability\.


Windows kernel in Windows 8.1 and RT 8.1 Server 2012 and R2 Windows 10 Gold 1511 1607 1703 and 1709 Windows Server 2016 and Windows Server version 1709 allows an attacker to log in and run a specially crafted application due to the Windows kernel improperly initializing a memory address aka \Windows Kernel Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-11849 CVE-2017-11851 and CVE-2017-11853.


Internet Explorer in Microsoft Windows 7 SP1 Windows Server 2008 SP2 and R2 SP1 Windows 8.1 and Windows RT 8.1 Windows Server 2012 and R2 and Windows 10 Gold 1511 1607 1703 1709 Windows Server 2016 and Windows Server version 1709 allows an attacker to obtain information to further compromise the user's system due to how the scripting engine handles objects in memory aka \Scripting Engine Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-11791.


Microsoft GDI Component in Windows 7 SP1 and Windows Server 2008 SP2 and R2 SP1 allows an attacker to log on to an affected system and run a specially crafted application to compromise the user's system due improperly disclosing kernel memory addresses aka \Windows GDI Information Disclosure Vulnerability\.


Microsoft Outlook 2016 allows an attacker to obtain the email content of a user due to how Outlook 2016 discloses user email content aka \Microsoft Outlook Information Disclosure Vulnerability.\


Microsoft graphics in Windows 7 SP1 and Windows Server 2008 SP2 and R2 SP1 allows an attacker to potentially read data that was not intended to be disclosed due to the way that the Microsoft Windows Embedded OpenType (EOT) font engine parses specially crafted embedded fonts aka \Windows EOT Font Engine Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-11832.


Internet Explorer in Microsoft Windows 7 SP1 Windows Server 2008 and R2 SP1 Windows 8.1 and Windows RT 8.1 Windows Server 2012 and R2 and Windows 10 Gold 1511 1607 1703 1709 and Windows Server 2016 allows an attacker to obtain information to further compromise the user's system due to how Internet Explorer handles objects in memory aka \Scripting Engine Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-11887 and CVE-2017-11919.


Windows kernel in Windows 7 SP1 Windows Server 2008 SP2 and R2 SP1 Windows 8.1 and RT 8.1 Server 2012 and R2 Windows 10 Gold 1511 1607 1703 and 1709 Windows Server 2016 and Windows Server version 1709 allows an attacker to log in and run a specially crafted application due to the Windows kernel improperly initializing a memory address aka \Windows Kernel Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-11842 CVE-2017-11849 and CVE-2017-11851.


Windows kernel in Windows 7 SP1 Windows 8.1 and RT 8.1 Windows Server 2008 SP2 and R2 SP1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 1703 1709 Windows Server 2016 and Windows Server version 1709 allows an attacker to log on to an affected system and run a specially crafted application that can compromise the user's system due to how the Windows kernel initializes memory aka \Windows Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-11880.


The Microsoft Windows Search component on Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 allows an information disclosure when it fails to properly handle objects in memory aka \Microsoft Search Information Disclosure Vulnerability\.


Internet Explorer in Microsoft Windows 7 SP1 Windows Server 2008 SP2 and R2 SP1 Windows 8.1 and Windows RT 8.1 Windows Server 2012 and R2 and Windows 10 Gold 1511 1607 1703 1709 and Windows Server 2016 allows an attacker to obtain information to further compromise the user's system due to how Internet Explorer handle objects in memory aka \Scripting Engine Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-11906 and CVE-2017-11919.


Windows 7 SP1 Windows 8.1 and RT 8.1 Windows Server 2008 SP2 and R2 SP1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 1703 and 1709 Windows Server 2016 and Windows Server version 1709 allow an information vulnerability due to the way the Windows its:// protocol handler determines the zone of a request aka \Microsoft Windows Information Disclosure Vulnerability\.


Windows Media Player in Windows 7 SP1 Windows Server 2008 SP2 and R2 SP1 Windows 8.1 and RT 8.1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 1703 and 1709 Windows Server 2016 and Windows Server version 1709 allows remote attackers to test for the presence of files on disk via a specially crafted application. due to the way Windows Media Player discloses file information aka \Windows Media Player Information Disclosure Vulnerability.\


Microsoft Edge in Microsoft Windows 10 Gold 1511 1607 1703 1709 Windows Server 2016 and Windows Server version 1709 allows an attacker to determine the origin of all webpages in the affected browser due to how Microsoft Edge handles cross-origin requests aka \Microsoft Edge Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-11803 and CVE-2017-11844.


Windows kernel in Windows 7 SP1 Windows Server 2008 SP2 and R2 SP1 Windows 8.1 and RT 8.1 Server 2012 and R2 Windows 10 Gold 1511 1607 1703 and 1709 Windows Server 2016 and Windows Server version 1709 allows an attacker to log in and run a specially crafted application due to the Windows kernel improperly initializing a memory address aka \Windows Kernel Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-11842 CVE-2017-11851 and CVE-2017-11853.


The Microsoft Windows Graphics Device Interface (GDI) on Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 allows an information disclosure vulnerability in the way it handles objects in memory aka \Windows GDI Information Disclosure Vulnerability\.


Microsoft Office 2016 Click-to-Run (C2R) allows an information disclosure vulnerability due to the way Microsoft Office enforces DRM copy/paste permissions aka \Microsoft Office Information Disclosure Vulnerability\.


ChakraCore and Internet Explorer in Microsoft Windows 7 SP1 Windows Server 2008 SP2 and R2 SP1 Windows 8.1 and Windows RT 8.1 Windows Server 2012 and R2 and Microsoft Edge and Internet Explorer in Windows 10 Gold 1511 1607 1703 1709 Windows Server 2016 and Windows Server version 1709 allows an attacker to obtain information to further compromise the user's system due to how the scripting engine handles objects in memory aka \Scripting Engine Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-11834.


Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to obtain information to further compromise the user's system due to how Microsoft Edge handles objects in memory aka \Microsoft Edge Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-8726 and CVE-2017-11803.


Microsoft Edge in Microsoft Windows 10 1703 1709 and Windows Server version 1709 allows an attacker to obtain information to further compromise the user's system due to how Microsoft Edge handles objects in memory aka \Microsoft Edge Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-11803 and CVE-2017-11833.


The Microsoft Windows Kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 allows an information disclosure vulnerability when it improperly validates objects in memory aka \Windows Information Disclosure Vulnerability\.


Internet Explorer in Microsoft Windows 7 SP1 Windows Server 2008 SP2 and R2 SP1 Windows 8.1 and Windows RT 8.1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 1703 and Windows Server 2016 allows an attacker to obtain information to further compromise the user's system due to how Internet Explorer handles objects in memory aka \Internet Explorer Information Disclosure Vulnerability\.


Windows kernel in Windows 7 SP1 Windows Server 2008 SP2 and R2 SP1 Windows 8.1 and RT 8.1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 allows an attacker to run a specially crafted application and obtain information to further compromise the user's system due to the Windows kernel improperly initializing objects in memory aka \Windows Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-11831.


Microsoft Exchange Server 2013 and Microsoft Exchange Server 2016 allow an input sanitization issue with Microsoft Exchange that could potentially result in unintended Information Disclosure aka \Microsoft Exchange Information Disclosure Vulnerability\


ChakraCore and Internet Explorer in Microsoft Windows 7 SP1 Windows Server 2008 R2 SP1 Windows 8.1 and Windows RT 8.1 Windows Server 2012 R2 and Windows 10 Gold 1511 1607 1703 1709 Windows Server 2016 and Microsoft Edge in Windows 10 Gold 1511 1607 1703 1709 and Windows Server 2016 allows an attacker to obtain information to further compromise the user's system due to how the scripting engine handles objects in memory aka \Scripting Engine Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-11887 and CVE-2017-11906.


Microsoft Graphics Component in Windows 8.1 and RT 8.1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 1703 and 1709 Windows Server 2016 and Windows Server version 1709 allows an attacker to log on to an affected system and run a specially crafted application due to improper handling of objects in memory aka \Microsoft Graphics Component Information Disclosure Vulnerability\.


Microsoft Office 2013 RT SP1 Microsoft Office 2013 SP1 and Microsoft Office 2016 allow an information disclosure vulnerability due to the way certain functions handle objects in memory aka \Microsoft Office Information Disclosure Vulnerability\.


The Microsoft Windows embedded OpenType (EOT) font engine in Windows 7 SP1 Windows Server 2008 SP2 and 2008 R2 SP1 and Windows Server 2012 allows an attacker to potentially read data that was not intended to be disclosed due to the way that the Microsoft Windows EOT font engine parses specially crafted embedded fonts aka \Windows EOT Font Engine Information Disclosure Vulnerability.\ This CVE ID is unique from CVE-2017-11835.


Internet Explorer in Microsoft Microsoft Windows 7 SP1 Windows Server 2008 SP2 Windows 8.1 and Windows RT 8.1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 1703 1709 Windows Server 2016 and Windows Server version 1709 allows an attacker to detect the navigation of the user leaving a maliciously crafted page due to how page content is handled by Internet Explorer aka \Internet Explorer Information Disclosure Vulnerability\.


Microsoft Edge in Microsoft Windows 10 1703 1709 and Windows Server version 1709 allows an attacker to obtain information to further compromise the user's system due to how Microsoft Edge handles objects in memory aka \Microsoft Edge Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-11833 and CVE-2017-11844.


An information disclosure vulnerability exists in the iConfig proxy request of Zabbix server 2.4.X. A specially crafted iConfig proxy request can cause the Zabbix server to send the configuration information of any Zabbix proxy resulting in information disclosure. An attacker can make requests from an active Zabbix proxy to trigger this vulnerability.


jenkins before versions 2.44 2.32.2 is vulnerable to an information disclosure vulnerability in search suggestions (SECURITY-385). The autocomplete feature on the search box discloses the names of the views in its suggestions including the ones for which the current user does not have access to.


An information disclosure vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an unprivileged authenticated network-based attacker to replicate the underlying Junos OS VM and all data it maintains to their local system for future analysis.


An information disclosure vulnerability exists in the Multi-Camera interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. A specially crafted request on port 10001 can allow for a user to retrieve sensitive information without authentication.


Adobe Captivate versions 9 and earlier have an information disclosure vulnerability resulting from abuse of the quiz reporting feature in Captivate.


Adobe Acrobat Reader 2017.009.20058 and earlier 2017.008.30051 and earlier 2015.006.30306 and earlier and 11.0.20 and earlier has an information disclosure vulnerability when handling links in a PDF document.


In BlackBerry QNX Software Development Platform (SDP) 6.6.0 an information disclosure vulnerability in the default configuration of the QNX SDP could allow an attacker to gain information relating to memory layout that could be used in a blended attack by executing commands targeting procfs resources.


There is a sensitive information disclosure vulnerability in document.php in Dolibarr ERP/CRM version 6.0.0 via the file parameter.


An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2 5.4.0 to 5.4.8 and 5.2 all versions allows SSL VPN web portal users to access internal FortiOS configuration information (eg:addresses) via specifically crafted URLs inside the SSL-VPN web portal.


An uninitialized pointer information disclosure vulnerability in Trend Micro Mobile Security (Enterprise) versions 9.7 and below could allow an unauthenticated remote attacker to disclosure sensitive information on a vulnerable system.


An Information Disclosure vulnerability in Fortinet FortiClient for Windows 5.6.0 and below versions FortiClient for Mac OSX 5.6.0 and below versions and FortiClient SSLVPN Client for Linux 4.4.2334 and below versions allows regular users to see each other's VPN authentication credentials due to improperly secured storage locations.


Skybox Manager Client Application prior to 8.5.501 is prone to an information disclosure vulnerability of user password hashes. A local authenticated attacker can access the password hashes in a debugger-pause state during the authentication process.


An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2 5.4.0 to 5.4.5 5.2 and below versions allow an admin user with super_admin privileges to view the current SSL VPN web portal session info which may contains user credentials through the fnsysctl CLI command.


A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated adjacent attacker to reset the Autonomic Control Plane (ACP) of an affected system and view ACP packets that are transferred in clear text within an affected system an Information Disclosure Vulnerability. More Information: CSCvd51214. Known Affected Releases: Denali-16.2.1 Denali-16.3.1.


An information disclosure vulnerability exists in the Thermal Driver where a missing bounds checking in the thermal driver could allow a read from an arbitrary kernel address. This issue is rated as moderate. Product: Pixel. Versions: N/A. Android ID: A-34702397. References: N-CVE-2017-6275.


Huawei smartphones with software of TAG-AL00C92B168 have an information disclosure vulnerability. An attacker tricks the user to install a crafted application this application simulate click action to back up data in a non-encrypted way using an Android assist function. Successful exploit could result in information disclosure.


VMware vCenter Server (6.5 prior to 6.5 U1) contains an information disclosure vulnerability. This issue may allow plaintext credentials to be obtained when using the vCenter Server Appliance file-based backup feature.


EMC RSA Archer Security Operations Management with RSA Unified Collector Framework versions prior to 1.3.1.52 contain a sensitive information disclosure vulnerability that could potentially be exploited by malicious users to compromise an affected system.


Information Disclosure vulnerability in creer_fichier_zip in admin/maintenance.php in BlogoText through 3.7.6 allows remote attackers to defeat a filename-randomization protection mechanism and read backup archives on Windows servers by providing the archiv~1.zip name (aka an 8.3 filename).


Huawei P9 smartphones with the versions before EVA-AL10C00B399SP02 have an information disclosure vulnerability. The software does not properly protect certain resource which can be accessed by multithreading. An attacker tricks the user who has root privilege to install a crafted application successful exploit could result in kernel information disclosure.


Huawei Honor Smart Scale Application with software of 1.1.1 has an information disclosure vulnerability. The application does not sufficiently restrict the resource which can be accessed by certain protocol. An attacker could trick the user to click a malicious link successful exploit could cause information disclosure.


Huawei

use

the

CIDAM

protocol

which

contains

sensitive

information

in

the

message

when

it

is

implemented.

So

these

products

has

an

information

disclosure

vulnerability.

An

authenticated

remote

attacker

could

track

and

get

the

message

of

a

target

system.

Successful

exploit

could

allow

the

attacker

to

get

the

information

and

cause

the

sensitive

information

disclosure.


A remote information disclosure vulnerability in HPE Matrix Operating Environment version v7.6 was found.


A remote sql information disclosure vulnerability in HPE Network Automation version 9.1x 9.2x 10.0x 10.1x and 10.2x were found.


JasperReports library components contain an information disclosure vulnerability. This vulnerability includes the theoretical disclosure of any accessible information from the host file system. Affects TIBCO JasperReports Library Community Edition (versions 6.4.0 and below) TIBCO JasperReports Library for ActiveMatrix BPM (versions 6.2.0 and below) TIBCO JasperReports Professional (versions 6.2.1 and below and 6.3.0) TIBCO JasperReports Server (versions 6.1.1 and below 6.2.0 6.2.1 6.3.0) TIBCO JasperReports Server Community Edition (versions 6.3.0 and below) TIBCO JasperReports Server for ActiveMatrix BPM (versions 6.2.0 and below) TIBCO Jaspersoft for AWS with Multi-Tenancy (versions 6.3.0 and below) TIBCO Jaspersoft Reporting and Analytics for AWS (versions 6.3.0 and below) and TIBCO Jaspersoft Studio for ActiveMatrix BPM (versions 6.2.0 and below).


All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sensitive information from the bluetoothd process memory. This vulnerability lies in the processing of SDP search attribute requests.


In BlackBerry QNX Software Development Platform (SDP) 6.6.0 and 6.5.0 SP1 and earlier an information disclosure vulnerability in the default configuration of the QNX SDP could allow an attacker to gain information relating to memory layout of higher privileged processes by manipulating environment variables that influence the loader.


Internet Explorer in Microsoft Windows 7 SP1 Windows Server 2008 R2 SP1 Windows 8.1 and Windows RT 8.1 and Windows Server 2012 and R2 allow an attacker to detect specific files on the user's computer when affected Microsoft scripting engines do not properly handle objects in memory aka \Microsoft Browser Information Disclosure Vulnerability\.


Windows GDI+ on Microsoft Windows Server 2008 SP2 and R2 SP1 and Windows 7 SP1 allows information disclosure by the way it discloses kernel memory addresses aka \Windows GDI+ Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-8684 and CVE-2017-8688.


Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to obtain information to further compromise the user's system due to the way that the Microsoft Edge scripting engine handles objects in memory aka \Scripting Engine Information Disclosure Vulnerability\.


The Microsoft Common Console Document (.msc) in Microsoft Windows 7 SP1 Windows Server 2008 SP2 and R2 SP1 allows an attacker to read arbitrary files via an XML external entity (XXE) declaration due to the way that the Microsoft Common Console Document (.msc) parses XML input containing a reference to an external entity aka \Windows Information Disclosure Vulnerability\.


Graphics

in

Windows

Server

and

Windows

Windows

Windows

Server

Gold

and

Windows

RT

Windows

Gold

Windows

Server

Microsoft

Office

Service

Pack

and

Microsoft

Office

Service

Pack

allows

improper

disclosure

of

memory

contents

aka

\Graphics

Uniscribe

Information

Disclosure

Vulnerability\.

This

CVE

ID

is

unique

from

and


Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to obtain information to further compromise the user's system due to the Chakra scripting engine not properly handling objects in memory aka \Scripting Engine Information Disclosure Vulnerability\.


The

kernel

in

Microsoft

Windows

Server

and

Windows

Windows

Windows

Server

Gold

and

Windows

RT

Windows

Gold

and

Windows

Server

allows

an

authenticated

attacker

to

obtain

information

via

a

specially

crafted

application.

aka

\Windows

Kernel

Information

Disclosure

Vulnerability

a

different

vulnerability

than

and


Windows System Information Console in Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 1703 and Windows Server 2016 allows an information disclosure vulnerability improperly parses XML input containing a reference to an external entity aka \Windows System Information Console Information Disclosure Vulnerability\.


The Volume Manager Extension Driver in Microsoft Windows 7 SP1 Windows Server 2008 SP2 and R2 SP1 Windows 8.1 and Windows RT 8.1 Windows Server 2012 and R2 allows an attacker to run a specially crafted application and obtain kernel information aka \Volume Manager Extension Driver Information Disclosure Vulnerability\.


Microsoft Edge in Windows 10 1607 and 1703 and Windows Server 2016 allows an attacker to read the URL of a cross-origin request when the Microsoft Edge Fetch API incorrectly handles a filtered response type aka \Microsoft Edge Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-8498.


Windows PDF in Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 1703 and Windows Server 2016 allows information disclosure when a user opens a specially crafted PDF file aka \Windows PDF Information Disclosure Vulnerability\.


Microsoft Edge in Microsoft Windows 10 Version 1703 allows an attacker to obtain information to further compromise the user's system due to the way that Microsoft Edge handles objects in memory aka \Microsoft Edge Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-8643 and CVE-2017-8648.


Windows Uniscribe in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold 1511 1607 1703 and Server 2016; Office 2007 SP3; Office 2010 SP2; Word Viewer; Office for Mac 2011 and 2016; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Lync 2010 Attendee; and Live Meeting 2007 Add-in and Console allows an attacker to obtain information to further compromise a user's system via a specially crafted document or an untrusted webpage aka \Graphics Component Information Disclosure Vulnerability.\


Microsoft Outlook 2007 SP3 Outlook 2010 SP2 Outlook 2013 SP1 Outlook 2013 RT SP1 and Outlook 2016 as packaged in Microsoft Office allows an information disclosure vulnerability due to the way that it discloses the contents of its memory aka \Microsoft Office Outlook Information Disclosure Vulnerability\.


HPE XP Storage using Hitachi Global Link Manager (HGLM) has a local authenticated information disclosure vulnerability in HGLM version HGLM 6.3.0-00 to 8.5.2-00.


The

kernel

in

Microsoft

Windows

Server

Windows

Windows

Windows

Server

Gold

and

Windows

RT

Windows

Gold

and

Windows

Server

allows

an

authenticated

attacker

to

obtain

information

via

a

specially

crafted

application.

aka

\Windows

Kernel

Information

Disclosure

Vulnerability

a

different

vulnerability

than

and


Microsoft Windows 7 SP1 Windows Server 2008 SP2 and R2 SP1 Windows 8.1 and Windows RT 8.1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 allow an authenticated attacker to run a specially crafted application when the Windows kernel improperly initializes objects in memory aka \Win32k Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-8471 CVE-2017-8472 CVE-2017-8473 CVE-2017-8475 CVE-2017-8477 and CVE-2017-8484.


Microsoft Windows 7 SP1 Windows Server 2008 SP2 and R2 SP1 Windows 8.1 and Windows RT 8.1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 allow an authenticated attacker to run a specially crafted application when the Windows kernel improperly initializes objects in memory aka \Win32k Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-8470 CVE-2017-8471 CVE-2017-8472 CVE-2017-8473 CVE-2017-8475 and CVE-2017-8477.


Microsoft Windows 7 SP1 Windows Server 2008 SP2 and R2 SP1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 allow an authenticated attacker to run a specially crafted application when the Windows kernel improperly initializes objects in memory aka \Win32k Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-8470 CVE-2017-8471 CVE-2017-8472 CVE-2017-8473 CVE-2017-8477 and CVE-2017-8484.


Microsoft Edge in Microsoft Windows Version 1703 allows an attacker to obtain information to further compromise the user's system due to the way that Microsoft Edge handles objects in memory aka \Microsoft Edge Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-8597 and CVE-2017-8643.


Microsoft Edge in Windows 10 1607 and 1703 and Windows Server 2016 allows an attacker to read data not intended to be disclosed when Edge allows JavaScript XML DOM objects to detect installed browser extensions aka \Microsoft Edge Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-8504.


Microsoft Windows 7 SP1 Windows Server 2008 SP2 and R2 SP1 Windows 8.1 and Windows RT 8.1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 allow an authenticated attacker to run a specially crafted application when the Windows kernel improperly initializes objects in memory aka \Win32k Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-8470 CVE-2017-8472 CVE-2017-8473 CVE-2017-8475 CVE-2017-8477 and CVE-2017-8484.


Windows GDI+ on Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 allows information disclosure by the way it discloses kernel memory addresses aka \Windows GDI+ Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-8684 and CVE-2017-8685.


Windows GDI+ on Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT 8.1 allows information disclosure by the way it discloses kernel memory addresses aka \Windows GDI+ Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-8685 and CVE-2017-8688.


The Windows Hyper-V component on Microsoft Windows 10 1607 and Windows Server 2016 allows an information disclosure vulnerability when it fails to properly validate input from an authenticated user on a guest operating system aka \Hyper-V Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-8707 CVE-2017-8706 CVE-2017-8712 and CVE-2017-8713.


Microsoft Edge in Microsoft Windows 10 Gold 1511 1607 1703 and Windows Server 2016 allows an attacker to disclose information due to the way that Microsoft Edge handles objects in memory aka \Microsoft Edge Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-8652 and CVE-2017-8662.


The

kernel

in

Microsoft

Windows

Server

and

Windows

Windows

Windows

Server

Gold

and

Windows

RT

Windows

Gold

and

Windows

Server

allows

an

authenticated

attacker

to

obtain

information

via

a

specially

crafted

application.

aka

\Windows

Kernel

Information

Disclosure

Vulnerability

a

different

vulnerability

than

and


Uniscribe

in

Windows

Server

and

Windows

Windows

Windows

Server

Gold

and

Windows

RT

Windows

Gold

Windows

Server

Microsoft

Office

and

Microsoft

Office

allows

improper

disclosure

of

memory

contents

aka

\Windows

Uniscribe

Information

Disclosure

Vulnerability\.

This

CVE

ID

is

unique

from

and


Microsoft Windows 7 SP1 Windows Server 2008 SP2 and R2 SP1 Windows 8.1 and Windows RT 8.1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 1703 and Windows Server 2016 allows an information disclosure due to the way it handles objects in memory aka \Win32k Information Disclosure Vulnerability\.


Microsoft Windows 7 SP1 Windows Server 2008 SP2 and R2 SP1 Windows 8.1 and Windows RT 8.1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 allow an authenticated attacker to run a specially crafted application when the Windows kernel improperly initializes objects in memory aka \Win32k Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-8470 CVE-2017-8471 CVE-2017-8472 CVE-2017-8473 CVE-2017-8475 and CVE-2017-8484.


Microsoft Windows 7 SP1 Windows Server 2008 SP2 and R2 SP1 Windows 8.1 and Windows RT 8.1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 allow an attacker to obtain information to further compromise the user's system when Windows Search fails to handle objects in memory aka \Windows Search Information Disclosure Vulnerability\.


Microsoft Windows 7 SP1 Windows Server 2008 SP2 and R2 SP1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 and Windows Server 2016 allow an authenticated attacker to run a specially crafted application when the Windows kernel improperly initializes objects in memory aka \Win32k Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-8470 CVE-2017-8471 CVE-2017-8472 CVE-2017-8475 CVE-2017-8477 and CVE-2017-8484.


Microsoft Edge in Microsoft Windows 10 Gold 1511 1607 1703 and Windows Server 2016 allows an attacker to disclose information due to the way that Microsoft Edge handles objects in memory aka \Microsoft Edge Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-8644 and CVE-2017-8662.


Internet Explorer in Microsoft Windows 7 SP1 Windows Server 2008 R2 SP1 Windows 8.1 and Windows RT 8.1 Windows Server 2012 R2 and Microsoft Edge and Internet Explorer in Windows 10 Gold 1511 1607 1703 and Windows Server 2016 allow an attacker to obtain specific information used in the parent domain due to Microsoft browser parent domain verification in certain functionality aka \Microsoft Browser Information Disclosure Vulnerability\.


The Windows Hyper-V component on Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 allows an information disclosure vulnerability when it fails to properly validate input from an authenticated user on a guest operating system aka Hyper-V Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-8706 CVE-2017-8711 CVE-2017-8712 and CVE-2017-8713.


Graphics

in

Windows

Server

and

Windows

Windows

Windows

Server

Gold

and

Windows

RT

Windows

Gold

and

Windows

Server

allows

improper

disclosure

of

memory

contents

aka

\Graphics

Uniscribe

Information

Disclosure

Vulnerability\.

This

CVE

ID

is

unique

from

and


The Windows Hyper-V component on Microsoft Windows Windows 8.1 Windows Server 2012 Gold and R2 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 allows an information disclosure vulnerability when it fails to properly validate input from an authenticated user on a guest operating system aka \Hyper-V Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-8707 CVE-2017-8711 CVE-2017-8712 and CVE-2017-8706.


The Windows GDI+ component on Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 allows an information disclosure vulnerability when it improperly discloses kernel memory addresses aka \Win32k Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-8678 CVE-2017-8680 CVE-2017-8681 and CVE-2017-8687.


The Windows Hyper-V component on Microsoft Windows 10 1607 1703 and Windows Server 2016 allows an information disclosure vulnerability when it fails to properly validate input from an authenticated user on a guest operating system aka \Hyper-V Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-8707 CVE-2017-8711 CVE-2017-8706 and CVE-2017-8713.


The Windows Graphics Device Interface (GDI) in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold 1511 1607 1703 and Server 2016; Office 2007 SP3; Office 2010 SP2; Word Viewer; Office for Mac 2011 and 2016; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Lync 2010 Attendee; and Live Meeting 2007 Add-in and Console allows an authenticated attacker to retrieve information from a targeted system via a specially crafted application aka \Windows GDI+ Information Disclosure Vulnerability.\


Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 allows an information disclosure vulnerability when it fails to properly initialize a memory address aka \Windows Kernel Information Disclosure Vulnerability\.


Microsoft Edge in Microsoft Windows 10 Gold 1511 1607 1703 and Windows Server 2016 allows an attacker to leave a malicious website open during user clipboard activities due to the way that Microsoft Edge handles clipboard events aka \Microsoft Edge Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-8597 and CVE-2017-8648.


Microsoft Win32k in Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 allows an information disclosure vulnerability when it fails to properly handle objects in memory aka \Win32k Information Disclosure Vulnerability\.


The

kernel

in

Microsoft

Windows

Server

and

Windows

Windows

Windows

Server

Gold

and

Windows

RT

Windows

Gold

and

Windows

Server

allows

an

authenticated

attacker

to

obtain

information

via

a

specially

crafted

application.

aka

\Windows

Kernel

Information

Disclosure

Vulnerability

a

different

vulnerability

than

and


The Microsoft Graphics Component on Microsoft Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 allows an information disclosure vulnerability in the way it handles objects in memory aka \Microsoft Graphics Information Disclosure Vulnerability\.


Microsoft SQL Server Analysis Services in Microsoft SQL Server 2012 Microsoft SQL Server 2014 and Microsoft SQL Server 2016 allows an information disclosure vulnerability when it improperly enforces permissions aka \Microsoft SQL Server Analysis Services Information Disclosure Vulnerability\.


Microsoft Windows 7 SP1 Windows Server 2008 SP2 and R2 SP1 and Windows Server 2012 allow an authenticated attacker to run a specially crafted application when the Windows kernel improperly initializes objects in memory aka \Win32k Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-8470 CVE-2017-8471 CVE-2017-8473 CVE-2017-8475 CVE-2017-8477 and CVE-2017-8484.


The Windows Hyper-V component on Microsoft Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 allows an information disclosure vulnerability when it fails to properly validate input from an authenticated user on a guest operating system aka \Hyper-V Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-8707 CVE-2017-8711 CVE-2017-8712 and CVE-2017-8713.


Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to disclose information due to how strings are validated in specific scenarios aka \Microsoft Edge Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-8644 and CVE-2017-8652.


The kernel in Microsoft Windows 8.1 Windows Server 2012 R2 Windows RT 8.1 and Windows 10 Gold and 1511 allows local users to bypass the KASLR protection mechanism and consequently discover a driver base address via a crafted application aka \Windows Kernel Memory Information Disclosure Vulnerability.\


Microsoft Silverlight 5 before 5.1.41105.00 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site aka \Microsoft Silverlight Information Disclosure Vulnerability \ a different vulnerability than CVE-2015-6165.


The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines as used in Internet Explorer 8 through 11 and other products allow remote attackers to obtain sensitive information from process memory via a crafted web site aka \Scripting Engine Information Disclosure Vulnerability.\


Windows Media Center in Microsoft Windows Vista SP2 Windows 7 SP1 Windows 8 and Windows 8.1 allows remote attackers to read arbitrary files via a crafted .mcl file aka \Windows Media Center Information Disclosure Vulnerability.\


The kernel in Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT Gold and 8.1 and Windows 10 Gold and 1511 allows local users to bypass the KASLR protection mechanism and consequently discover a driver base address via a crafted application aka \Windows Kernel Memory Information Disclosure Vulnerability.\


The XML DTD parser in Microsoft .NET Framework 2.0 SP2 3.5 3.5.1 4 4.5 4.5.1 4.5.2 and 4.6 allows remote attackers to read arbitrary files via an external entity declaration in conjunction with an entity reference related to an XML External Entity (XXE) issue aka \.NET Information Disclosure Vulnerability.\


Microsoft Silverlight 5 before 5.1.41105.00 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site aka \Microsoft Silverlight Information Disclosure Vulnerability \ a different vulnerability than CVE-2015-6114.


Adobe Font Driver in Microsoft Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 allows remote attackers to obtain sensitive information from kernel memory and possibly bypass the KASLR protection mechanism via a crafted font aka \Adobe Font Driver Information Disclosure Vulnerability \ a different vulnerability than CVE-2015-0087.


Microsoft Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 do not properly initialize memory for rendering of malformed PNG images which allows remote attackers to obtain sensitive information from process memory via a crafted web site aka \Malformed PNG Parsing Information Disclosure Vulnerability.\


Microsoft Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 do not properly initialize memory for TIFF images which allows remote attackers to obtain sensitive information from process memory via a crafted image file aka \TIFF Processing Information Disclosure Vulnerability.\


The photo-decoder implementation in Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 does not properly initialize memory for rendering of JXR images which allows remote attackers to obtain sensitive information from process memory via a crafted web site aka \JPEG XR Parser Information Disclosure Vulnerability.\


Adobe Font Driver in Microsoft Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 allows remote attackers to obtain sensitive information from kernel memory and possibly bypass the KASLR protection mechanism via a crafted font aka \Adobe Font Driver Information Disclosure Vulnerability \ a different vulnerability than CVE-2015-0089.


Microsoft Active Directory Federation Services (AD FS) 3.0 on Windows Server 2012 R2 does not properly handle logoff actions which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation aka \Active Directory Federation Services Information Disclosure Vulnerability.\


Schannel in Microsoft Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 does not properly restrict Diffie-Hellman Ephemeral (DHE) key lengths which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors aka \Schannel Information Disclosure Vulnerability.\


ASP.NET in Microsoft .NET Framework 1.1 SP1 2.0 SP2 3.5 3.5.1 4 4.5 4.5.1 and 4.5.2 when the customErrors configuration is disabled allows remote attackers to obtain sensitive configuration-file information via a crafted request aka \ASP.NET Information Disclosure Vulnerability.\


The kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 allow local users to obtain sensitive information from kernel memory via a crafted application aka \Microsoft Windows Kernel Information Disclosure Vulnerability.\


win32k.sys in the kernel-mode drivers in Microsoft Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 allows local users to obtain sensitive information from kernel memory via a crafted application aka \Win32k Information Disclosure Vulnerability \ a different vulnerability than CVE-2015-2381.


win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 allows local users to obtain sensitive information from uninitialized kernel memory via a crafted application aka \Win32k Information Disclosure Vulnerability.\


The InfoPath Forms Services component in Microsoft SharePoint Server 2007 SP3 and 2010 SP2 misparses DTDs which allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference related to an XML External Entity (XXE) issue aka \Microsoft SharePoint Information Disclosure Vulnerability.\


Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 and SP1 allows remote attackers to obtain sensitive stacktrace information via a crafted request aka \Exchange Information Disclosure Vulnerability.\


Microsoft XML Core Services 3.0 5.0 and 6.0 supports SSL 2.0 which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and conducting a decryption attack aka \MSXML Information Disclosure Vulnerability \ a different vulnerability than CVE-2015-2434.


Microsoft XML Core Services 3.0 and 5.0 supports SSL 2.0 which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and conducting a decryption attack aka \MSXML Information Disclosure Vulnerability \ a different vulnerability than CVE-2015-2471.


win32k.sys in the kernel-mode drivers in Microsoft Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 allows local users to obtain sensitive information from kernel memory via a crafted application aka \Win32k Information Disclosure Vulnerability \ a different vulnerability than CVE-2015-2382.


The WebDAV client in Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 supports SSL 2.0 which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and conducting a decryption attack aka \WebDAV Client Information Disclosure Vulnerability.\


An Information Disclosure vulnerability exists in HP SiteScope 11.2 and 11.3 on Windows Linux and Solaris HP Asset Manager 9.30 through 9.32 9.40 through 9.41 9.50 and Asset Manager Cloudsystem Chargeback 9.40 which could let a remote malicious user obtain sensitive information. This is the TLS vulnerability known as the RC4 cipher Bar Mitzvah vulnerability.


Cross-domain vulnerability in Microsoft Internet Explorer 6.0 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site which then makes that content available through the outerHTML attribute of the object aka \Redirect Cross-Domain Information Disclosure Vulnerability.\


Microsoft Internet Explorer 5.01 and 6 allows certain script to persist across navigations between pages which allows remote attackers to obtain the window location of visited web pages in other domains or zones aka \Window Location Information Disclosure Vulnerability.\


A component in Microsoft Outlook Express 6 allows remote attackers to bypass domain restrictions and obtain sensitive information via redirections with the mhtml: URI handler as originally reported for Internet Explorer 6 and 7 aka \URL Redirect Cross Domain Information Disclosure Vulnerability.\


The Server Service (SRV.SYS driver) in Microsoft Windows 2000 SP4 XP SP1 and SP2 Server 2003 up to SP1 and other products allows remote attackers to obtain sensitive information via crafted requests that leak information in SMB buffers which are not properly initialized aka \SMB Information Disclosure Vulnerability.\


Microsoft Internet Explorer 6 and earlier allows remote attackers to obtain sensitive information via unspecified uses of the OBJECT HTML tag which discloses the absolute path of the corresponding TIF folder aka \TIF Folder Information Disclosure Vulnerability \ and a different issue than CVE-2006-5578.