The Console in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x 7.x and 9.x before 9.1.0.3 does not provide an encrypted session for transmitting login credentials which allows remote attackers to obtain sensitive information by sniffing the network.


The Engine in TIBCO Spotfire Web Player 3.3.x before 3.3.3 4.0.x before 4.0.3 4.5.x before 4.5.1 and 5.0.x before 5.0.1 does not properly implement access control which allows remote attackers to obtain sensitive information or modify data via unspecified vectors.


IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to obtain sensitive information about application implementation via unspecified vectors a different vulnerability than CVE-2013-0463 CVE-2013-2987 CVE-2013-3020 CVE-2013-0568 CVE-2013-0475 and CVE-2013-0567.


frontcontroller.jsp in IBM Maximo Asset Management 7.x before 7.5.0.6 and SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2 allows remote authenticated users to obtain sensitive information via an invalid action_code.


The report API in the crypto user configuration API in the Linux kernel through 3.8.2 uses an incorrect C library function for copying strings which allows local users to obtain sensitive information from kernel stack memory by leveraging the CAP_NET_ADMIN capability.


modules/gallery/helpers/data_rest.php in Gallery 3 before 3.0.9 allows remote attackers to bypass intended access restrictions and obtain sensitive information (image files) via the \full\ string in the size parameter.


net/bridge/br_mdb.c in the Linux kernel before 3.8.4 does not initialize certain structures which allows local users to obtain sensitive information from kernel memory via a crafted application.


SoftBank Wi-Fi Spot Configuration Software as used on SoftBank SHARP 3G handsets SoftBank Panasonic 3G handsets SoftBank NEC 3G handsets SoftBank Samsung 3G handsets SoftBank mobile Wi-Fi routers SoftBank Android smartphones with the Wi-Fi application before 1.7.1 SoftBank Windows Mobile smartphones with the WISPrClient application before 1.3.1 SoftBank Disney Mobile Android smartphones with the Wi-Fi application before 1.7.1 and WILLCOM Android smartphones with the Wi-Fi application before 1.7.1 does not properly connect to access points which allows remote attackers to obtain sensitive information by leveraging access to an 802.11 network.


Unspecified vulnerability in Apache Wicket 1.4.x before 1.4.23 1.5.x before 1.5.11 and 6.x before 6.8.0 allows remote attackers to obtain sensitive information via vectors that cause raw HTML templates to be rendered without being processed and reading the information that is outside of wicket:panel markup.


Cisco Linksys E4200 1.0.05 Build 7 devices store passwords in cleartext allowing remote attackers to obtain sensitive information.


The HP Smart Array controller disk-array driver and Compaq SMART2 controller disk-array driver in the Linux kernel through 3.9.4 do not initialize certain data structures which allows local users to obtain sensitive information from kernel memory via (1) a crafted IDAGETPCIINFO command for a /dev/ida device related to the ida_locked_ioctl function in drivers/block/cpqarray.c or (2) a crafted CCISS_PASSTHRU32 command for a /dev/cciss device related to the cciss_ioctl32_passthru function in drivers/block/cciss.c.


The FlickWnn (aka OpenWnn/Flick support) application 2.02 and earlier for Android uses weak permissions for unspecified files which allows attackers to obtain sensitive information via an application that accesses the local filesystem.


Brother MFC-9970CDW 1.10 devices with Firmware L contain a Frameable response (Clickjacking) vulnerability which could allow remote attackers to obtain sensitive information.


The key_notify_policy_flush function in net/key/af_key.c in the Linux kernel before 3.9 does not initialize a certain structure member which allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notify_policy interface of an IPSec key_socket.


The Angel Browser application 1.47b and earlier for Android 1.6 through 2.1 1.62b and earlier for Android 2.2 through 2.3.4 1.68b and earlier for Android 3.0 through 4.0.3 and 1.76b and earlier for Android 4.1 through 4.2 does not properly implement the WebView class which allows attackers to obtain sensitive information via a crafted application.


The llc_ui_recvmsg function in net/llc/af_llc.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.


The web interface in Cisco Secure Access Control System (ACS) does not properly suppress error-condition details which allows remote authenticated users to obtain sensitive information via an unspecified request that triggers an error aka Bug ID CSCue65957.


The NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to obtain sensitive information via a direct request for (1) a configuration file (2) a database dump or (3) the Tomcat status context.


The iucv_sock_recvmsg function in net/iucv/af_iucv.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.


The image creation configuration in aaa_base before 16.26.1 for openSUSE 13.1 KDE adds the root user to the \users\ group when installing from a live image which allows local users to obtain sensitive information and possibly have other unspecified impacts as demonstrated by reading /etc/shadow.


net/tipc/socket.c in the Linux kernel before 3.9-rc7 does not initialize a certain data structure and a certain length variable which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.


The OS deployment feature in Baramundi Management Suite 7.5 through 8.9 stores credentials in cleartext on deployed machines which allows remote attackers to obtain sensitive information by reading a file. NOTE: this ID was also incorrectly mapped to a separate issue in Oracle Outside In but the correct ID for that issue is CVE-2013-5763.


The crypto API in the Linux kernel through 3.9-rc8 does not initialize certain length variables which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call related to the hash_recvmsg function in crypto/algif_hash.c and the skcipher_recvmsg function in crypto/algif_skcipher.c.


Unspecified vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 when using the Apache::Session::File session store allows remote attackers to obtain sensitive information (user preferences and caches) via unknown vectors related to a \limited session re-use.\


Opera before 12.15 does not properly block top-level domains in Set-Cookie headers which allows remote attackers to obtain sensitive information by leveraging control of a different web site in the same top-level domain.


The portal in Cisco Prime Central for Hosted Collaboration Solution (HCS) places cleartext credentials in temporary files which allows local users to obtain sensitive information by leveraging weak file permissions to read these files aka Bug IDs CSCuh33735 and CSCuh34230.


EMC Replication Manager (RM) before 5.4.4 places encoded passwords in application log files which makes it easier for local users to obtain sensitive information by reading a file and conducting an unspecified decoding attack.


Microsoft FrontPage 2003 SP3 does not properly parse DTDs which allows remote attackers to obtain sensitive information via crafted XML data in a FrontPage document aka \XML Disclosure Vulnerability.\


The rfcomm_sock_recvmsg function in net/bluetooth/rfcomm/sock.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.


Linksys EA6500 with firmware 1.1.28.147876 does not properly restrict access which allows remote attackers to obtain sensitive information (clients and router configuration) via a request to /JNAP/.


Samsung Web Viewer for Samsung DVR devices stores credentials in cleartext which allows context-dependent attackers to obtain sensitive information via vectors involving (1) direct access to a file or (2) the user-setup web page.


EMC RSA Authentication Manager 8.0 before P2 and 7.1 before SP4 P26 as used in Appliance 3.0 does not omit the cleartext administrative password from trace logging in custom SDK applications which allows local users to obtain sensitive information by reading the trace log file.


ajax.cgi in the web interface on the Choice Wireless Green Packet WIXFMR-111 4G WiMax modem allows remote attackers to obtain sensitive information via an Ajax (1) wmxState or (2) netState request.


The bt_sock_recvmsg function in net/bluetooth/af_bluetooth.c in the Linux kernel before 3.9-rc7 does not properly initialize a certain length variable which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.


The administrative web interface in the Access Control Server in Cisco Secure Access Control System (ACS) does not properly restrict the report view page which allows remote authenticated users to obtain sensitive information via a direct request aka Bug ID CSCue79279.


The l2tp_ip6_recvmsg function in net/l2tp/l2tp_ip6.c in the Linux kernel before 3.9-rc7 does not initialize a certain structure member which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.


The Galapagos Browser application for Android does not properly implement the WebView class which allows attackers to obtain sensitive information via a crafted application.


IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to obtain sensitive information about application implementation via unspecified vectors a different vulnerability than CVE-2013-0463 CVE-2013-2985 CVE-2013-2987 CVE-2013-0568 CVE-2013-0475 and CVE-2013-0567.


The irda_recvmsg_dgram function in net/irda/af_irda.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.


The mach_port_space_info function in osfmk/ipc/mach_debug.c in the XNU kernel in Apple Mac OS X 10.8.x does not initialize a certain structure member which allows local users to obtain sensitive information from kernel heap memory via a crafted call.


The rose_recvmsg function in net/rose/af_rose.c in the Linux kernel before 3.9-rc7 does not initialize a certain data structure which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.


The WebView class in the Cybozu Live application before 2.0.1 for Android allows attackers to execute arbitrary JavaScript code and obtain sensitive information via a crafted application that places this code into a local file associated with a file: URL. NOTE: this vulnerability exists because of a CVE-2012-4009 regression.


AirLive POE2600HD POE250HD POE200HD OD-325HD OD-2025HD OD-2060HD POE100HD and possibly other camera models use cleartext to store sensitive information which allows attackers to obtain passwords user names and other sensitive information by reading an unspecified backup file.


The vcc_recvmsg function in net/atm/common.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.


Brickcom FB-100Ap WCB-100Ap MD-100Ap WFB-100Ap OB-100Ae OSD-040E and possibly other camera models with firmware 3.0.6.16C1 and earlier do not properly restrict access to configfile.dump which allow remote attackers to obtain sensitive information (user names passwords and configurations) via a get action.


The sco_sock_recvmsg function in net/bluetooth/sco.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.


EMC Avamar Server and Avamar Virtual Edition before 7.0 on Data Store Gen3 Gen4 and Gen4s platforms do not properly restrict use of FRAME elements which makes it easier for remote attackers to obtain sensitive information via a crafted web site related to \cross frame scripting vulnerabilities.\


The Meeting Server in IBM Sametime 8.5.2 through 8.5.2.1 and 9.x through 9.0.0.1 does not send the appropriate HTTP response headers to prevent unwanted caching by a web browser which allows remote attackers to obtain sensitive information by leveraging an unattended workstation.


The nr_recvmsg function in net/netrom/af_netrom.c in the Linux kernel before 3.9-rc7 does not initialize a certain data structure which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.


The NTT DOCOMO overseas usage application 2.0.0 through 2.0.4 for Android does not properly connect to Wi-Fi access points which allows remote attackers to obtain sensitive information by leveraging presence in an 802.11 network's coverage area.


Baramundi Management Suite 7.5 through 8.9 uses cleartext for (1) client-server communication and (2) data storage which allows remote attackers to obtain sensitive information by sniffing the network and allows context-dependent attackers to obtain sensitive information by reading a file.


Cisco Finesse allows remote attackers to obtain sensitive information by sniffing the network for HTTP query data aka Bug ID CSCug16732.


The vmci_transport_dgram_dequeue function in net/vmw_vsock/vmci_transport.c in the Linux kernel before 3.9-rc7 does not properly initialize a certain length variable which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.


The GetComputerSystem method in the HostControl service in SAP Netweaver 7.03 allows remote attackers to obtain sensitive information via a crafted SOAP request to TCP port 1128.


The llcp_sock_recvmsg function in net/nfc/llcp/sock.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable and a certain data structure which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.


EMC VPLEX before VPLEX GeoSynchrony 5.2 SP1 uses cleartext for storage of the LDAP/AD bind password which allows local users to obtain sensitive information by reading the management-server configuration file.


AdvancePro Advanceware allows remote authenticated users to obtain sensitive information about arbitrary customers' orders via a modified id parameter.


IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.2 and 7.2.0 through 7.2.1.4 might allow remote attackers to obtain sensitive information about Tomcat credentials by sniffing the network for a session in which HTTP is used. IBM X-Force ID: 84361.


The Web Client in IBM Rational ClearQuest 7.1 before 7.1.2.12 8.0 before 8.0.0.8 and 8.0.1 before 8.0.1.1 allows remote attackers to obtain sensitive information from the client-server data stream via unspecified vectors associated with a \JSON hijacking attack.\


Microsoft Silverlight 5 before 5.1.20913.0 does not properly validate pointers during access to Silverlight elements which allows remote attackers to obtain sensitive information via a crafted Silverlight application aka \Silverlight Vulnerability.\


The vsock_stream_sendmsg function in net/vmw_vsock/af_vsock.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.


The JsonParser class in json/JsonParser.scala in Lift before 2.5 interprets a certain end-index value as a length value which allows remote authenticated users to obtain sensitive information from other users' sessions via invalid input data containing a < (less than) character.


The ax25_recvmsg function in net/ax25/af_ax25.c in the Linux kernel before 3.9-rc7 does not initialize a certain data structure which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.


Cisco Mobility Services Engine does not properly set up the Oracle SSL service which allows remote attackers to obtain an unauthenticated session to the database-replication port and consequently obtain sensitive information via an SSL connection aka Bug ID CSCue50794.


The caif_seqpkt_recvmsg function in net/caif/caif_socket.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.


The Fancy Product Designer WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the ID parameter found in the ~/inc/api/class-view.php file which allows attackers with administrative level permissions to inject arbitrary SQL queries to obtain sensitive information in versions up to and including 4.7.4.


IBM Guardium Data Encryption (GDE) 5.0.0.2 and 5.0.0.3 could allow a remote attacker to obtain sensitive information caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 213964.


IBM Guardium Data Encryption (GDE) 4.0.0 and 5.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 213860.


IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5 and 6.1.0.0 through 6.1.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 213963.


IBM Security Guardium 11.3 could allow a remote attacker to obtain sensitive information caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 215581.


IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to obtain sensitive information caused by the improper handling of requests for Spectrum Copy Data Management Admin Console. By sending a specially-crafted request a remote attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 214524.


IBM Tivoli Key Lifecycle Manager 3.0 3.0.1 4.0 and 4.1 could allow a remote attacker to obtain sensitive information caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 212783.


IBM OPENBMC OP920 OP930 and OP940 could allow an unauthenticated user to obtain sensitive information. IBM X-Force ID: 212047.


IBM Tivoli Key Lifecycle Manager 3.0 3.0.1 4.0 and 4.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 212788.


IBM MQ Appliance could allow a local attacker to obtain sensitive information by inclusion of sensitive data within trace.


IBM Tivoli Key Lifecycle Manager (IBM Security Guardium Key Lifecycle Manager) 3.0 3.0.1 4.0 and 4.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 212786.


IBM System Storage DS8000 Management Console (HMC) R8.5 88.5x.x.x R9.1 89.1x.0.0 and R9.2 89.2x.0.0 could allow a remote attacker to obtain sensitive information through unpublished URLs. IBM X-Force ID: 210331.


IBM Spectrum Protect Operations Center 7.1 under special configurations could allow a local user to obtain highly sensitive information. IBM X-Force ID: 209610.


IBM Security Verify 10.0.0 10.0.1.0 and 10.0.2.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 209515.


IBM System Storage DS8000 Management Console (HMC) R8.5 88.5x.x.x R9.1 89.1x.0.0 and R9.2 89.2x.0.0 could allow a remote attacker to obtain sensitive information through unpublished URLs. IBM X-Force ID: 210330.


iKuaiOS 3.4.8 Build 202012291059 has an arbitrary file download vulnerability which can be exploited by attackers to obtain sensitive information.


Plixer Scrutinizer 19.0.2 is affected by: SQL Injection. The impact is: obtain sensitive information (remote).


IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 199997


IBM i2 Analyze 4.3.0 4.3.1 and 4.3.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 203168.


BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information caused by failure to set the HTTPOnly flag for a cookie.


IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 200253.


An issue was discovered in the Linux kernel through 5.11.x. kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory. Specifically for sequences of pointer arithmetic operations the pointer modification performed by the first operation is not correctly accounted for when restricting subsequent operations.


IBM i2 iBase 8.9.13 and 9.0.0 could allow a local attacker to obtain sensitive information due to insufficient session expiration. IBM X-Force ID: 206213.


IBM ICP4A - User Management System Component (IBM Cloud Pak for Business Automation V21.0.3 through V21.0.3-IF008 V21.0.2 through V21.0.2-IF009 and V21.0.1 through V21.0.1-IF007) could allow a user with physical access to the system to perform unauthorized actions or obtain sensitive information due to insufficient validation and recvocation another user logouting out. IBM X-Force ID: 206081.


Exposure of sensitive information to an unauthorized actor vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to obtain sensitive information via unspecified vectors.


IBM App Connect Enterprise Certified Container 1.0 1.1 1.2 and 1.3 could allow a privileged user to obtain sensitive information from internal log files. IBM X-Force ID: 202212.


An issue was discovered in the Linux kernel before 5.11.11. qrtr_recvmsg in net/qrtr/qrtr.c allows attackers to obtain sensitive information from kernel memory because of a partially uninitialized data structure aka CID-50535249f624.


IBM Security SOAR V42 and V43could allow a remote attacker to obtain sensitive information caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 203169.


IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0 4.3.1 and 4.3.2) could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 202680.


BMC firmware (IBM Power System S821LC Server (8001-12C) OP825.50) configuration changed to allow an authenticated user to open an insecure communication channel which could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 205267.


IBM Planning Analytics Local 2.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser. X-Force ID: 198846.


BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information caused by failure to set the Secure flag for a cookie.


IBM Security Guardium 10.6 and 11.3 could allow a remote authenticated attacker to obtain sensitive information or modify user details caused by an insecure direct object vulnerability (IDOR). IBM X-Force ID: 202865.


IBM Engineering Workflow Management 7.0 7.0.1 and 7.0.2 as well as IBM Rational Team Concert 6.0.6 and 6.0.6.1 could allow an authneticated attacker to obtain sensitive information from build definitions that could aid in further attacks against the system. IBM X-Force ID: 200657.


IBM Security Guardium Insights 3.0 could allow a remote attacker to obtain sensitive information caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.


IBM i2 Analyst's Notebook Premium 9.2.0 9.2.1 and 9.2.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 202681.


IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 200102.


MK-AUTH through 19.01 K4.9 allows remote attackers to obtain sensitive information (e.g. a CPF number) via a modified titulo (aka invoice number) value to the central/recibo.php URI.


Disclosure of sensitive information to an unauthorized user vulnerability in Buffalo broadband routers (BHR-4GRV firmware Ver.1.99 and prior DWR-HP-G300NH firmware Ver.1.83 and prior HW-450HP-ZWE firmware Ver.1.99 and prior WHR-300HP firmware Ver.1.99 and prior WHR-300 firmware Ver.1.99 and prior WHR-G301N firmware Ver.1.86 and prior WHR-HP-G300N firmware Ver.1.99 and prior WHR-HP-GN firmware Ver.1.86 and prior WPL-05G300 firmware Ver.1.87 and prior WZR-450HP-CWT firmware Ver.1.99 and prior WZR-450HP-UB firmware Ver.1.99 and prior WZR-HP-AG300H firmware Ver.1.75 and prior WZR-HP-G300NH firmware Ver.1.83 and prior WZR-HP-G301NH firmware Ver.1.83 and prior WZR-HP-G302H firmware Ver.1.85 and prior WZR-HP-G450H firmware Ver.1.89 and prior WZR-300HP firmware Ver.1.99 and prior WZR-450HP firmware Ver.1.99 and prior WZR-600DHP firmware Ver.1.99 and prior WZR-D1100H firmware Ver.1.99 and prior FS-HP-G300N firmware Ver.3.32 and prior FS-600DHP firmware Ver.3.38 and prior FS-R600DHP firmware Ver.3.39 and prior and FS-G300N firmware Ver.3.13 and prior) allows remote unauthenticated attackers to obtain information such as configuration via unspecified vectors.


Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100 300 and 500 Series Wireless Access Points could allow an authenticated remote attacker to obtain sensitive information from or inject arbitrary commands on an affected device. For more information about these vulnerabilities see the Details section of this advisory.


A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA) Cisco Email Security Appliance (ESA) and Cisco Web Security Appliance (WSA) could allow an authenticated remote attacker to access sensitive information on an affected device. The vulnerability exists because confidential information is included in HTTP requests that are exchanged between the user and the device. An attacker could exploit this vulnerability by looking at the raw HTTP requests that are sent to the interface. A successful exploit could allow the attacker to obtain some of the passwords that are configured throughout the interface.


A vulnerability in a diagnostic command for the Plug-and-Play (PnP) subsystem of Cisco IOS XE Software could allow an authenticated local attacker to elevate privileges to the level of an Administrator user (level 15) on an affected device. The vulnerability is due to insufficient protection of sensitive information. An attacker with low privileges could exploit this vulnerability by issuing the diagnostic CLI show pnp profile when a specific PnP listener is enabled on the device. A successful exploit could allow the attacker to obtain a privileged authentication token. This token can be used to send crafted PnP messages and execute privileged commands on the targeted system.


A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated remote attacker to access sensitive information on an affected device. The vulnerability is due to improper inclusion of sensitive information in downloadable files. An attacker could exploit this vulnerability by authenticating to an affected device and issuing a specific set of commands. A successful exploit could allow the attacker to obtain hashed credentials of system users. To exploit this vulnerability an attacker would need to have valid user credentials with elevated privileges.


Multiple vulnerabilities in the Admin portal of Cisco Identity Services Engine (ISE) could allow an authenticated remote attacker to obtain sensitive information. These vulnerabilities are due to improper enforcement of administrator privilege levels for sensitive data. An attacker with read-only administrator access to the Admin portal could exploit these vulnerabilities by browsing to one of the pages that contains sensitive data. A successful exploit could allow the attacker to collect sensitive information regarding the configuration of the system. For more information about these vulnerabilities see the Details section of this advisory.


A vulnerability in the CLI parser of Cisco IOS XR Software could allow an authenticated local attacker to view more information than their privileges allow. The vulnerability is due to insufficient application of restrictions during the execution of a specific command. An attacker could exploit this vulnerability by using a specific command at the command line. A successful exploit could allow the attacker to obtain sensitive information within the configuration that otherwise might not have been accessible beyond the privileges of the invoking user.


Single Connect does not perform an authorization check when using the \sc-diagnostic-ui\ module. A remote attacker could exploit this vulnerability to access the device information page. The exploitation of this vulnerability might allow a remote attacker to obtain sensitive information.


Single Connect does not perform an authorization check when using the sc-reports-ui\ module. A remote attacker could exploit this vulnerability to access the device configuration page and export the data to an external file. The exploitation of this vulnerability might allow a remote attacker to obtain sensitive information including the database credentials. Since the database runs with high privileges it is possible to execute commands with the attained credentials.


Single Connect does not perform an authorization check when using the \log-monitor\ module. A remote attacker could exploit this vulnerability to access the logging interface. The exploitation of this vulnerability might allow a remote attacker to obtain sensitive information.


In the Linux kernel through 5.13.7 an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because the protection mechanism neglects the possibility of uninitialized memory locations on the BPF stack.


A vulnerability in the REST API of Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated remote attacker to access sensitive data on an affected system. This vulnerability exists because the application does not sufficiently protect sensitive data when responding to an API request. An attacker could exploit the vulnerability by sending a specific API request to the affected application. A successful exploit could allow the attacker to obtain sensitive information about the application.


A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated remote attacker to obtain sensitive information. This vulnerability is due to improper enforcement of administrator privilege levels for low-value sensitive data. An attacker with read-only administrator access to the web-based management interface could exploit this vulnerability by browsing to the page that contains the sensitive data. A successful exploit could allow the attacker to collect sensitive information regarding the configuration of the system.


DISPUTED

in

Accela

Civic

Platform

through

allows

remote

attackers

to

obtain

sensitive

information

via

a

modified

contactSeqNumber

value.

NOTE:

the

vendor

states

\the

information

that

is

being

queried

is

authorized

for

an

authenticated

user

of

that

application

so

we

consider

this

not

applicable.\


Use of hard-coded credentials vulnerability in php component in Synology Calendar before 2.4.0-0761 allows remote attackers to obtain sensitive information via unspecified vectors.


net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized.


A vulnerability in the web-based management interface of Cisco Common Services Platform Collector (CSPC) could allow an authenticated remote attacker to access sensitive data on an affected system. This vulnerability exists because the application does not sufficiently protect sensitive data when responding to a specific API request. An attacker could exploit the vulnerability by sending a crafted HTTP request to the affected application. A successful exploit could allow the attacker to obtain sensitive information about the users of the application including security questions and answers. To exploit this vulnerability an attacker would need valid Administrator credentials. Cisco expects to release software updates that address this vulnerability.


A cleartext storage of sensitive information vulnerability in the Zyxel NBG6604 firmware could allow a remote authenticated attacker to obtain sensitive information from the configuration file.


In the Linux kernel through 5.13.7 an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because a certain preempting store operation does not necessarily occur before a store operation that has an attacker-controlled value.


Incorrect Access Control for linked Tickets in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information.


A Memory Leak vulnerabilty exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File) it is possible to query a record and leak subsequent bytes of memory that extend beyond the record which could let a malicous user obtain sensitive information..


An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password it's trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.


All versions of GitLab CE/EE starting from 9.5 before 13.10.5 all versions starting from 13.11 before 13.11.5 and all versions starting from 13.12 before 13.12.2 allow a high privilege user to obtain sensitive information from log files because the sensitive information was not correctly registered for log masking.


There is an information leak vulnerability in eCNS280_TD versions V100R005C00 and V100R005C10. A command does not have timeout exit mechanism. Temporary file contains sensitive information. This allows attackers to obtain information by inter-process access that requires other methods.


IBM Security Guardium 11.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 195569.


Path traversal vulnerability in GroupSession Free edition ver5.1.1 and earlier GroupSession byCloud ver5.1.1 and earlier and GroupSession ZION ver5.1.1 and earlier allows an attacker with an administrative privilege to obtain sensitive information stored in the hierarchy above the directory on the published site's server via unspecified vectors.


IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 197973


IBM Maximo for Civil Infrastructure 7.6.2 could allow a user to obtain sensitive information due to insecure storeage of authentication credentials. IBM X-Force ID: 196621.


IBM Sterling File Gateway 2.2.0.0 through 6.1.0.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 197667.


IBM Security Secret Server up to 11.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 199322.


IBM Guardium Data Encryption (GDE) 3.0.0.3 and 4.0.0.4 could allow a remote attacker to obtain sensitive information caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM X-Force ID: 196218.


IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196076.


IBM Security Guardium 11.3 could allow a an authenticated user to obtain sensitive information that could be used in further attacks against the system. IBM X-Force ID: 196345.


IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially crafted Web site a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 198814


IBM Sterling File Gateway 6.0.0.0 through 6.1.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 199170.


WRC-1167FS-W WRC-1167FS-B and WRC-1167FSA all versions allow an unauthenticated network-adjacent attacker to obtain sensitive information via unspecified vectors.


IBM Sterling File Gateway 2.2.0.0 through 6.1.0.3 could allow a remote authenciated user to obtain sensitive information. By sending a specially crafted request the user could disclose a valid filepath on the server which could be used in further attacks against the system. IBM X-Force ID: 199234.


IBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196001.


IBM Guardium Data Encryption (GDE) 4.0.0.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196212.


IBM Guardium Data Encryption (GDE) 4.0.0.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196219


IBM Security Guardium 11.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196315.


IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0 4.3.1 and 4.3.2) could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196341.


IBM Db2 for Linux UNIX and Windows (includes Db2 Connect Server) 9.7 10.1 10.5 11.1 and 11.5 could allow a user who can create a view or inline SQL function to obtain sensitive information when AUTO_REVAL is set to DEFFERED_FORCE. IBM X-Force ID: 199283.


IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM X-Force ID: 198755.


IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a remote attacker to obtain sensitive information caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 198188.


Improper neutralization of HTTP request headers for scripting syntax vulnerability in the Web GUI of RTX830 Rev.15.02.17 and earlier NVR510 Rev.15.01.18 and earlier NVR700W Rev.15.00.19 and earlier and RTX1210 Rev.14.01.38 and earlier allows a remote authenticated attacker to obtain sensitive information via a specially crafted web page.


Exposure of sensitive information to an unauthorized actor vulnerability in KONICA MINOLTA bizhub series (bizhub C750i G00-35 and earlier bizhub C650i/C550i/C450i G00-B6 and earlier bizhub C360i/C300i/C250i G00-B6 and earlier bizhub 750i/650i/550i/450i G00-37 and earlier bizhub 360i/300i G00-33 and earlier bizhub C287i/C257i/C227i G00-19 and earlier bizhub 306i/266i/246i/226i G00-B6 and earlier bizhub C759/C659 GC7-X8 and earlier bizhub C658/C558/C458 GC7-X8 and earlier bizhub 958/808/758 GC7-X8 and earlier bizhub 658e/558e/458e GC7-X8 and earlier bizhub C287/C227 GC7-X8 and earlier bizhub 287/227 GC7-X8 and earlier bizhub 368e/308e GC7-X8 and earlier bizhub C368/C308/C258 GC9-X4 and earlier bizhub 558/458/368/308 GC9-X4 and earlier bizhub C754e/C654e GDQ-M0 and earlier bizhub 754e/654e GDQ-M0 and earlier bizhub C554e/C454e GDQ-M1 and earlier bizhub C364e/C284e/C224e GDQ-M1 and earlier bizhub 554e/454e/364e/284e/224e GDQ-M1 and earlier bizhub C754/C654 C554/C454 GR1-M0 and earlier bizhub C364/C284/C224 GR1-M0 and earlier bizhub 754/654 GR1-M0 and earlier bizhub C4050i/C3350i/C4000i/C3300i G00-B6 and earlier bizhub C3320i G00-B6 and earlier bizhub 4750i/4050i G00-22 and earlier bizhub 4700i G00-22 and earlier bizhub C3851FS/C3851/C3351 GC9-X4 and earlier and bizhub 4752/4052 GC9-X4 and earlier) allows an attacker on the adjacent network to obtain the credentials if the destination information including credentials are registered in the address book via a specific SOAP message.


Exposure of sensitive information to an unauthorized actor vulnerability in KONICA MINOLTA bizhub series (bizhub C750i G00-35 and earlier bizhub C650i/C550i/C450i G00-B6 and earlier bizhub C360i/C300i/C250i G00-B6 and earlier bizhub 750i/650i/550i/450i G00-37 and earlier bizhub 360i/300i G00-33 and earlier bizhub C287i/C257i/C227i G00-19 and earlier bizhub 306i/266i/246i/226i G00-B6 and earlier bizhub C759/C659 GC7-X8 and earlier bizhub C658/C558/C458 GC7-X8 and earlier bizhub 958/808/758 GC7-X8 and earlier bizhub 658e/558e/458e GC7-X8 and earlier bizhub C287/C227 GC7-X8 and earlier bizhub 287/227 GC7-X8 and earlier bizhub 368e/308e GC7-X8 and earlier bizhub C368/C308/C258 GC9-X4 and earlier bizhub 558/458/368/308 GC9-X4 and earlier bizhub C754e/C654e GDQ-M0 and earlier bizhub 754e/654e GDQ-M0 and earlier bizhub C554e/C454e GDQ-M1 and earlier bizhub C364e/C284e/C224e GDQ-M1 and earlier bizhub 554e/454e/364e/284e/224e GDQ-M1 and earlier bizhub C754/C654 C554/C454 GR1-M0 and earlier bizhub C364/C284/C224 GR1-M0 and earlier bizhub 754/654 GR1-M0 and earlier bizhub C4050i/C3350i/C4000i/C3300i G00-B6 and earlier bizhub C3320i G00-B6 and earlier bizhub 4750i/4050i G00-22 and earlier bizhub 4700i G00-22 and earlier bizhub C3851FS/C3851/C3351 GC9-X4 and earlier and bizhub 4752/4052 GC9-X4 and earlier) allows an attacker on the adjacent network to obtain some of user credentials if LDAP server authentication is enabled via a specific SOAP message.


Incorrect permission assignment for critical resource vulnerability in GroupSession Free edition ver5.1.1 and earlier GroupSession byCloud ver5.1.1 and earlier and GroupSession ZION ver5.1.1 and earlier allows a remote unauthenticated attacker to access arbitrary files on the server and obtain sensitive information via unspecified vectors.


A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache perform an XSS attack or obtain sensitive information from request other than their own. The highest threat from this vulnerability is to data confidentiality and integrity.


IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 198660


IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to obtain sensitive information when an error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 195516.


IBM QRadar Advisor With Watson App 1.1 through 2.5 as used on IBM QRadar SIEM 7.4 could allow a remote user to obtain sensitive information from HTTP requests that could aid in further attacks against the system. IBM X-Force ID: 195712.


IBM Cloud Pak for Security (CP4S) 1.4.0.0 1.5.0.0 1.5.0.1 1.6.0.0 and 1.6.0.1 could allow a remote attacker to obtain sensitive information caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 199235.


A flaw was found in the Ansible Engine 2.9.18 where sensitive info is not masked by default and is not protected by the no_log feature when using the sub-option feature of the basic.py module. This flaw allows an attacker to obtain sensitive information. The highest threat from this vulnerability is to confidentiality.


IBM i2 Analyst's Notebook Premium 9.2.0 9.2.1 and 9.2.2 does not invalidate session after logout which could allow an an attacker to obtain sensitive information from the system. IBM X-Force ID: 196342.


Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.


muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins members owners and banned entities of a Multi-User chat room) in some common configurations.


Amazon Echo Dot devices through 2021-07-02 sometimes allow attackers who have physical access to a device after a factory reset to obtain sensitive information via a series of complex hardware and software attacks. NOTE: reportedly there were vendor marketing statements about safely removing personal content via a factory reset. Also the vendor has reportedly indicated that they are working on mitigations.


Uninitialized data in PDFium in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted PDF file.


Some

PON

MDU

devices

of

ZTE

stored

sensitive

information

in

plaintext

and

users

with

login

authority

can

obtain

it

by

inputing

command.

This

affects:

ZTE

PON

MDU

device


There is an information leak vulnerability in the message service app of a ZTE mobile phone. Due to improper parameter settings attackers could use this vulnerability to obtain some sensitive information of users by accessing specific pages.


Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to obtain potentially sensitive information from disk via a crafted HTML page.


Uninitialized data in PDFium in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted PDF file.


The management system of ZXCDN is impacted by the information leak vulnerability. Attackers can make further analysis according to the information returned by the program and then obtain some sensitive information. This affects ZXCDN V7.01 all versions up to IAMV7.01.01.02.


HashiCorp vault-action (aka Vault GitHub Action) before 2.2.0 allows attackers to obtain sensitive information from log files because a multi-line secret was not correctly registered with GitHub Actions for log masking.


A Cleartext Transmission of Sensitive Information vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote attacker to obtain sensitive information by snooping on the network traffic. The exposed data includes critical values for a pump's internal configuration.


Luca through 1.7.4 on Android allows remote attackers to obtain sensitive information about COVID-19 tracking because the QR code of a Public Location can be intentionally confused with the QR code of a Private Meeting.


SAP Business One version - 10.0 allows a local attacker with access to the victim's browser under certain circumstances to login as the victim without knowing his/her password. The attacker could so obtain highly sensitive information which the attacker could use to take substantial control of the vulnerable application.


Luca through 1.7.4 on Android allows remote attackers to obtain sensitive information about COVID-19 tracking because requests related to Check-In State occur shortly after requests for Phone Number Registration.


An unauthorized access vulnerabiitly exists in all versions of Portainer which could let a malicious user obtain sensitive information.


The Magic CMS MSVOD v10 video system has a SQL injection vulnerability. Attackers can use vulnerabilities to obtain sensitive information in the database.


A configuration weakness in the JBoss Application Server (AppSvr) component of Juniper Networks SRC Series allows a remote attacker to send a specially crafted query to cause the web server to disclose sensitive information in the HTTP response which allows the attacker to obtain sensitive information.


GAEN (aka Google/Apple Exposure Notifications) through 2021-04-27 on Android allows attackers to obtain sensitive information such as a user's location history in-person social graph and (sometimes) COVID-19 infection status because Rolling Proximity Identifiers and MAC addresses are written to the Android system log and many Android devices have applications (preinstalled by the hardware manufacturer or network operator) that read system log data and send it to third parties. NOTE: a news outlet (The Markup) states that they received a vendor response indicating that fix deployment \began several weeks ago and will be complete in the coming days.\


In Stormshield 1.1.0 and 2.1.0 through 2.9.0 an attacker can block a client from accessing the VPN and can obtain sensitive information through the SN VPN SSL Client.


A remote authenticated sql injection vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Multiple vulnerabilities in the API of AirWave could allow an authenticated remote attacker to conduct SQL injection attacks against the AirWave instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database.


A remote authenticated SQL Injection vulnerabilitiy was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5 6.8.8-HF1 6.7.14-HF1. A vulnerability in the web-based management interface API of ClearPass could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass instance. An attacker could exploit this vulnerability to obtain and modify sensitive information in the underlying database.


An issue was discovered in the postscript crate before 0.14.0 for Rust. It might allow attackers to obtain sensitive information from uninitialized memory locations via a user-provided Read implementation.


An issue was discovered in the ms3d crate before 0.1.3 for Rust. It might allow attackers to obtain sensitive information from uninitialized memory locations via IoReader::read.


The affected product allows attackers to obtain sensitive information from the WISE-PaaS dashboard. The system contains a hard-coded administrator username and password that can be used to query Grafana APIs. Authentication is not required for exploitation on the WISE-PaaS/RMM (versions prior to 9.0.1).


Ivanti Avalanche (Premise) 6.3.2 allows remote unauthenticated users to read arbitrary files via Absolute Path Traversal. The imageFilePath parameter processed by the /AvalancheWeb/image endpoint is not verified to be within the scope of the image folder e.g. the attacker can obtain sensitive information via the C:/Windows/system32/config/system.sav value.


Authenticated Blind & Error-based SQL injection vulnerability was discovered in Online Enrollment Management System in PHP and PayPal Free Source Code 1.0 that allows attackers to obtain sensitive information and execute arbitrary SQL commands via IDNO parameter.


The on-line help system options in Cisco routers allows non-privileged users without \enabled\ access to obtain sensitive information via the show command.


PCCS MySQLDatabase Admin Tool Manager 1.2.4 and earlier installs the file dbconnect.inc within the web root which allows remote attackers to obtain sensitive information such as the administrative password.


Some telnet clients allow remote telnet servers to request environment variables from the client that may contain sensitive information or remote web servers to obtain the information via a telnet: URL.


ICQwebmail client for ICQ 2000A creates a world readable temporary file during login and does not delete it which allows local users to obtain sensitive information.


Servlet examples in Allaire JRun 2.3.x allow remote attackers to obtain sensitive information e.g. listing HttpSession ID's via the SessionServlet servlet.


The Aladdin Knowledge Systems eToken device allows attackers with physical access to the device to obtain sensitive information without knowing the PIN of the owner by resetting the PIN in the EEPROM.


Microsys CyberPatrol uses weak encryption (trivial encoding) for credit card numbers and uses no encryption for the remainder of the information during registration which could allow attackers to sniff network traffic and obtain this sensitive information.


Unspecified vulnerability in siteman.php3 in AnyPortal(php) before 22 APR 00 allows remote attackers to obtain sensitive information via unknown attack vectors which reveal the absolute path. NOTE: the provenance of this information is unknown; the details are obtained from third party information.


Real Networks RealServer 7 and earlier allows remote attackers to obtain portions of RealServer's memory contents possibly including sensitive information by accessing the /admin/includes/ URL.


The Visionsoft Audit on Demand Service (VSAOD) in Visionsoft Audit 12.4.0.0 uses weak cryptography (XOR) when (1) transmitting passwords which allows remote attackers to obtain sensitive information by sniffing the network; and (2) storing passwords in the configuration file which allows local users to obtain sensitive information by reading this file.


RemoteDocs R-Viewer before 1.6.3768 stores encrypted RDZ file data in unencrypted temporary files which allows local users to obtain sensitive information by reading the temporary files.


The Visionsoft Audit on Demand Service (VSAOD) in Visionsoft Audit 12.4.0.0 allows remote attackers to obtain sensitive information via (1) a LOG.ON command which reveals the logging pathname in the server response; (2) a VER command which reveals the version number in the server response; and (3) a connection which reveals the version number in the banner.


Tor before 0.1.2.15 sends \destroy cells\ containing the reason for tearing down a circuit which allows remote attackers to obtain sensitive information contrary to specifications.


Unspecified vulnerability in the Multiwiki plugin in XWiki before 1.1 Enterprise RC2 allows remote authenticated users with administrative access to one wiki in a multiwiki environment to obtain sensitive information via unknown attack vectors. NOTE: Some of these details are obtained from third party information.


backup-manager-upload in Backup Manager before 0.6.3 provides the FTP server hostname username and password as plaintext command line arguments during FTP uploads which allows local users to obtain sensitive information by listing the process and its arguments a different vulnerability than CVE-2007-2766.


The snd_mem_proc_read function in sound/core/memalloc.c in the Advanced Linux Sound Architecture (ALSA) in the Linux kernel before 2.6.22.8 does not return the correct write size which allows local users to obtain sensitive information (kernel memory contents) via a small count argument as demonstrated by multiple reads of /proc/driver/snd-page-alloc.


The Client Login Extension (CLE) in Novell Identity Manager before 3.5.1 20070730 stores the username and password in a local file which allows local users to obtain sensitive information by reading this file.


AlstraSoft Video Share Enterprise allows remote attackers to obtain sensitive information (the full path) via (1) a ' (quote) character in the category parameter to view_video.php or (2) an XSS sequence in the UID parameter to (a) uprofile.php (b) channel_detail.php (c) uvideos.php (d) groups_home.php or (e) ufriends.php.


Hitachi Groupmax Collaboration - Schedule as used in Groupmax Collaboration Portal 07-32 through 07-32-/B uCosminexus Collaboration Portal 06-32 through 06-32-/B and Groupmax Collaboration Web Client - Mail/Schedule 07-32 through 07-32-/A can assign schedule data to the wrong user under unspecified conditions which might allow remote authenticated users to obtain sensitive information.


SAXON 5.4 with display_errors enabled allows remote attackers to obtain sensitive information via (1) a direct request for news.php (2) an invalid use of a newsid array parameter to admin/edit-item.php and possibly unspecified vectors related to additional scripts in (3) admin/ (4) rss/ and (5) the root directory of the installation which reveal the path in various error messages.


Joomla! 1.5 before RC2 (aka Endeleo) allows remote attackers to obtain sensitive information (the full path) via unspecified vectors probably involving direct requests to certain PHP scripts in tmpl/ directories.


index.html in the HTTP administration interface in certain daemons in TIBCO Rendezvous (RV) 7.5.2 allows remote attackers to obtain sensitive information such as a user name and IP addresses via a direct request.


The Groupmax Scheduler_Facilities management tool in Hitachi Groupmax Groupware Server 07-00-/F through 07-32-/A before 20070731 does not properly manage schedule server configuration data which might allow attackers to obtain sensitive information via unspecified vectors.


Joomla!

allows

remote

attackers

to

obtain

sensitive

information

via

a

direct

request

for

Stat.php

OutputFilter.php

OutputCache.php

Modifier.php

Reader.php

and

TemplateCache.php

in

includes/patTemplate/patTemplate/;

and

other

unspecified

components

which

reveal

the

path

in

various

error

messages.


The AXIS 207W camera stores a WEP or WPA key in cleartext in the configuration file which might allow local users to obtain sensitive information.


Webbler CMS before 3.1.6 provides the full installation path within HTML comments in certain documents which allows remote attackers to obtain sensitive information by viewing the HTML source as demonstrated by viewing the source generated from index.php.


The AXIS 207W camera uses a base64-encoded cleartext username and password for authentication which allows remote attackers to obtain sensitive information by sniffing the wireless network or by leveraging unspecified other vectors.


The canvas.createPattern function in Opera 9.x before 9.22 for Linux FreeBSD and Solaris does not clear memory before using it to process a new pattern which allows remote attackers to obtain sensitive information (memory contents) via JavaScript.


Unspecified vulnerability in PassphraseRequester in SSHKeychain before 0.8.2 beta allows attackers to obtain sensitive information (passwords) via unknown vectors related to \poor protection.\


Claroline before 1.8.6 allows remote authenticated administrators to obtain sensitive information via an invalid value in the sort parameter to admin/adminusers.php which reveals the path in an error message in some circumstances as demonstrated by a parameter value containing an XSS sequence.


The Drupal Project module before 5.x-1.0 4.7.x-2.3 and 4.7.x-1.3 and Project issue tracking module before 5.x-1.0 4.7.x-2.4 and 4.7.x-1.4 do not properly enforce permissions which allows remote attackers to (1) obtain sensitive via the Tracker Module and the Recent posts page; (2) obtain project names via unspecified vectors; (3) obtain sensitive information via the statistics pages; and (4) read CVS project activity.


Cisco Adaptive Security Appliance (ASA) running PIX 7.0 before 7.0.7.1 7.1 before 7.1.2.61 7.2 before 7.2.2.34 and 8.0 before 8.0.2.11 when AAA is enabled composes %ASA-5-111008 messages from the \test aaa\ command with cleartext passwords and sends them over the network to a remote syslog server or places them in a local logging buffer which allows context-dependent attackers to obtain sensitive information.


Tor before 0.1.2.15 can select a guard node beyond the first listed never-before-connected-to guard node which allows remote attackers with control of certain guard nodes to obtain sensitive information and possibly leverage further attacks.


CS Guestbook stores sensitive information under the web root with insufficient access control which allows remote attackers to obtain the admin name and MD5 password hash via a direct request for base/usr/0.php.


Microsoft Internet Explorer 6 and 7 embeds FTP credentials in HTML files that are retrieved during an FTP session which allows context-dependent attackers to obtain sensitive information by reading the HTML source as demonstrated by a (1) .htm (2) .html or (3) .mht file.


The SOCKS4 Proxy in Microsoft Internet Security and Acceleration (ISA) Server 2004 SP1 and SP2 allows remote attackers to obtain potentially sensitive information (the destination IP address of another user's session) via an empty packet.


The session failover function in Cosminexus Component Container in Cosminexus 6 6.7 and 7 before 20070731 as used in multiple Hitachi products can use session data for the wrong user under unspecified conditions which might allow remote authenticated users to obtain sensitive information corrupt another user's session data and possibly gain privileges.


Argument injection vulnerability in the Linden Lab Second Life secondlife:// protocol handler as used in Internet Explorer and possibly Firefox allows remote attackers to obtain sensitive information via a '\ ' (double-quote space) sequence followed by the -autologin and -loginuri arguments which cause the handler to post login credentials and software installation details to an arbitrary URL.


SimpNews 2.41.03 allows remote attackers to obtain sensitive information via (1) an invalid lang parameter to admin/index.php; or a direct request to (2) admin/dbg_infos.php (3) admin/heading.php or (4) evsearch.php; which reveals the path in various error messages.


The WebService (XML-RPC) interface in Bugzilla 2.23.3 through 3.0.0 does not enforce permissions for the time-tracking fields of bugs which allows remote attackers to obtain sensitive information via certain XML-RPC requests as demonstrated by the (1) Deadline and (2) Estimated Time fields.


Unreal Commander 0.92 build 565 and 573 writes portions of heap memory into local files when extracting from an archive with malformed size information in a file header which might allow user-assisted attackers to obtain sensitive information (memory contents) by reading the extracted files. NOTE: this issue is only a vulnerability if Unreal is run with privileges or if the extracted files are made accessible to other users.


ActionScript 3 (AS3) in Adobe Flash Player 9.0.47.0 and other versions and other 9.0.124.0 and earlier versions allows remote attackers to bypass the Security Sandbox Model obtain sensitive information and port scan arbitrary hosts via a Flash (SWF) movie that specifies a connection to make then uses timing discrepancies from the SecurityErrorEvent error to determine whether a port is open or not. NOTE: 9.0.115.0 introduces support for a workaround but does not fix the vulnerability.


SimpGB 1.46.02 stores sensitive information under the web root with insufficient access control which allows remote attackers to (1) obtain sensitive configuration information via a direct request for admin/cfginfo.php; and (2) download arbitrary .inc files via a direct request as demonstrated by admin/includes/dbtables.inc.


Incomplete blacklist vulnerability in the Certificate Authority (CA) in IBM Lotus Domino before 7.0.3 allows local users or attackers with physical access to obtain sensitive information (passwords) when an administrator enters a \ca activate\ or \ca unlock\ command with any uppercase character which bypasses a blacklist designed to suppress password logging resulting in cleartext password disclosure in the console log and Admin panel.


The default configuration for twiki 4.1.2 on Debian GNU/Linux and possibly other operating systems specifies the work area directory (cfg{RCS}{WorkAreaDir}) under the web document root which might allow remote attackers to obtain sensitive information when .htaccess restrictions are not applied.


The Tomcat 4.1-based Servlet Service in Fujitsu Interstage Application Server 7.0 through 9.0.0 and Interstage Apworks/Studio 7.0 through 9.0.0 allows remote attackers to obtain sensitive information (web root path) via unspecified vectors that trigger an error message probably related to enabling the useCanonCaches Java Virtual Machine (JVM) option.


Quick Look Apple Mac OS X 10.5.1 when previewing an HTML file does not prevent plug-ins from making network requests which might allow remote attackers to obtain sensitive information.


dvips in teTeX and TeXlive 2007 and earlier allows local users to obtain sensitive information and modify certain data by creating certain temporary files before they are processed by dviljk which can then be read or modified in place.


Quicksilver Forums before 1.4.1 allows remote attackers to obtain sensitive information by causing unspecified connection errors which reveals the database password in the resulting error message.


Quick Look in Apple Mac OS X 10.5.1 does not prevent a movie from accessing URLs when the movie file is previewed or if an icon is created which might allow remote attackers to obtain sensitive information via HREFTrack.


Microsoft Expression Media stores the catalog password in cleartext in the catalog IVC file which allows local users to obtain sensitive information and gain access to the catalog by reading the IVC file.


BEA Tuxedo 8.0 before RP392 and 8.1 before RP293 and WebLogic Enterprise 5.1 before RP174 echo the password in cleartext which allows physically proximate attackers to obtain sensitive information via the (1) cnsbind (2) cnsunbind or (3) cnsls commands.


SimpNews 2.41.03 on Windows when PHP before 5.0.0 is used allows remote attackers to obtain sensitive information via an certain link_date parameter to events.php which reveals the path in an error message due to an unsupported argument type for the mktime function on Windows.


Unspecified vulnerability in the Groupmax Collaboration - Schedule component in Hitachi Groupmax Collaboration Portal 07-30 through 07-30-/F and 07-32 through 07-32-/C uCosminexus Collaboration Portal 06-30 through 06-30-/F and 06-32 through 06-32-/C and Groupmax Collaboration Web Client - Mail/Schedule 07-30 through 07-30-/F and 07-32 through 07-32-/B might allow remote attackers to obtain sensitive information via unspecified vectors related to schedule portlets.


JSPWiki 2.4.103 and 2.5.139-beta allows remote attackers to obtain sensitive information (full path) via an invalid integer in the version parameter to the default URI under attach/Main/.


The Evaluate LotusScript method in IBM Lotus Domino before 7.0.3 uses an incorrect security context for @ formula commands in some circumstances which might allow remote authenticated users to gain privileges and obtain sensitive information.


webbatch.exe in WebBatch allows remote attackers to obtain sensitive information via the dumpinputdata parameter.


Unspecified vulnerability in Really Simple CalDAV Store (RSCDS) before 0.9.0 allows attackers to obtain sensitive information via unspecified vectors.


The Globe7 soft phone client 7.3 sends username and password information in cleartext which allows remote attackers to obtain sensitive information by sniffing the HTTP traffic.


Unspecified vulnerability in Command EXEC in Cisco IOS allows local users to bypass command restrictions and obtain sensitive information via an unspecified \variation of an IOS command\ involving \two different methods\ aka CSCsk16129. NOTE: as of 20071016 the only disclosure is a vague pre-advisory with no actionable information. However since it is from a well-known researcher it is being assigned a CVE identifier for tracking purposes.


EMC VMware Server before 1.0.4 Build 56528 writes passwords in cleartext to unspecified log files which allows local users to obtain sensitive information by reading these files a different vulnerability than CVE-2005-3620.


Java Web Start in Sun JDK and JRE 6 Update 2 and earlier JDK and JRE 5.0 Update 12 and earlier and SDK and JRE 1.4.2_15 and earlier does not properly enforce access restrictions for untrusted applications which allows user-assisted remote attackers to obtain sensitive information (the Java Web Start cache location) via an untrusted application aka \three vulnerabilities.\


Mobile Spy (1) stores login credentials in cleartext under the RetinaxStudios registry key and (2) sends login credentials and log data over a cleartext HTTP connection which allows attackers to obtain sensitive information by reading the registry or sniffing the network.


The output_add_rewrite_var function in PHP before 5.2.5 rewrites local forms in which the ACTION attribute references a non-local URL which allows remote attackers to obtain potentially sensitive information by reading the requests for this URL as demonstrated by a rewritten form containing a local session ID.


Bandersnatch 0.4 allows remote attackers to obtain sensitive information via a malformed request for index.php with (1) a certain func parameter value; or (2) certain func jid page and limit parameter values; which reveals the path in various error messages.


IBM Lotus Notes before 6.5.6 and 7.x before 7.0.3; and Domino before 6.5.5 FP3 and 7.x before 7.0.2 FP1; uses weak permissions (Everyone:Full Control) for memory mapped files (shared memory) in IPC which allows local users to obtain sensitive information or inject Lotus Script or other character sequences into a session.


The Globe7 soft phone client 7.3 uses weak cryptography (reversed sequence of binary values) for the password which might allow local users to obtain sensitive information.


MyWebFTP possibly 5.3.2 stores sensitive information under the web root with insufficient access control which allows remote attackers to obtain an MD5 password hash via a direct request for pass/pass.txt.


ELSEIF CMS Beta 0.6 allows remote attackers to obtain sensitive information (full path) via unspecified vectors to utilisateurs/votesresultats.php.


The LOB functionality in PEAR MDB2 before 2.5.0a1 interprets a request to store a URL string as a request to retrieve and store the contents of the URL which might allow remote attackers to use MDB2 as an indirect proxy or obtain sensitive information via a URL into a form field in an MDB2 application as demonstrated by a file:// URL or a URL for an intranet web site.


initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events this also prevents sshd from logging failed authentication attempts by remote attackers.


etc-update in Portage before 2.1.3.11 on Gentoo Linux relies on the umask to set permissions for the merge file often resulting in permissions weaker than those of the original files which might allow local users to obtain sensitive information by reading the merge file.


pyftpdlib before 0.1.1 does not choose a random value for the port associated with the PASV command which makes it easier for remote attackers to obtain potentially sensitive information about the number of in-progress data connections by reading the response to this command.


The do_coredump function in fs/exec.c in Linux kernel 2.4.x and 2.6.x up to 2.6.24-rc3 and possibly other versions does not change the UID of a core dump file if it exists before a root process creates a core dump in the same location which might allow local users to obtain sensitive information.


OpenBiblio 0.5.2-pre4 and earlier allows remote attackers to obtain sensitive information via a direct request for (1) shared/footer.php (2) circ/mbr_fields.php or (3) admin/custom_marc_form_fields.php which reveals the path in various error messages.


Absolute News Manager.NET 5.1 allows remote attackers to obtain sensitive information via a direct request to getpath.aspx which reveals the installation path in an error message.


2z project 0.9.6.1 allows remote attackers to obtain sensitive information via (1) a request to index.php with an invalid template or (2) a request to the default URI with certain year and month parameters which reveals the path in various error messages.


PHP MySQL Banner Exchange 2.2.1 stores sensitive information under the web root with insufficient access control which allows remote attackers to obtain database information via a direct request to inc/lib.inc.


index.php in Tilde CMS 4.x and earlier allows remote attackers to obtain sensitive information via a certain search parameter value in a search action which reveals the path.


BadBlue 2.72b and earlier allows remote attackers to obtain sensitive information via an invalid browse parameter which reveals the installation path in an error message.


Citrix EdgeSight 4.2 and 4.5 for Presentation Server EdgeSight 4.2 and 4.5 for Endpoints and EdgeSight for NetScaler 1.0 and 1.1 do not properly store database credentials in configuration files which allows local users to obtain sensitive information.


Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to obtain sensitive information via (1) the AdminName and AdminLevel parameters to fp2000/NEWSRVR.asp which discloses usernames; and (2) certain XML HTTP requests to hosting/css.asp using Microsoft.XMLHTTP or MSXML2.XMLHTTP objects which trigger a response with the setup directory pathname in the HTML source; and (3) might allow remote attackers to obtain sensitive information via a request for /admin/forum/ which reveals the path in an error message when a forum is not found.


Flexera Macrovision InstallShield before 2008 sends a digital-signature password to an unintended application during certain signature operations involving .spc and .pvk files which might allow local users to obtain sensitive information via unspecified vectors related to an incorrect interaction between InstallShield and Signcode.exe.


Flat PHP Board 1.2 and earlier stores sensitive information under the web root with insufficient access control which allows remote attackers to obtain credentials via a direct request for the username php file for any user account in users/.


March Networks DVR 3204 stores sensitive information under the web root with insufficient access control which allows remote attackers to obtain usernames passwords device names and IP addresses via a direct request for scripts/logfiles.tar.gz.


Progress Webspeed Messenger allows remote attackers to obtain sensitive information via a WService parameter containing \wsbroker1/webutil/about.r\ which reveals the operating system and product information.


MySQL before 5.1.18 allows remote authenticated users without SELECT privileges to obtain sensitive information from partitioned tables via an ALTER TABLE statement.


Bradford CampusManager Network Control Application Server 3.1(6) allows remote attackers to obtain sensitive information (backup log and configuration files) via direct request for certain files in (1) /runTime/ or (2) /remediationReports/.


Cross-domain vulnerability in WebCore on Apple Mac OS X 10.3.9 and 10.4.10 allows remote attackers to obtain sensitive information via a popup window which is able to read the current URL of the parent window.


UseBB before 1.0.6 allows remote attackers to obtain sensitive information via a request with unspecified GET or POST parameters to an unspecified script which reveals the path in an error message.


Cisco Wireless Control System (WCS) before 4.0.66.0 stores sensitive information under the web root with insufficient access control which allows remote attackers to obtain network organization data via a direct request for files in certain directories aka Bug ID CSCsg04301.


The substr_count function in PHP 5.2.1 and earlier allows context-dependent attackers to obtain sensitive information via unspecified vectors a different affected function than CVE-2007-1375.


Nokia Intellisync Mobile Suite 6.4.31.2 6.6.0.107 and 6.6.2.2 possibly involving Novell Groupwise Mobile Server and Nokia Intellisync Wireless Email Express allows remote attackers to obtain user names and other sensitive information via a direct request to (1) usrmgr/userList.asp or (2) usrmgr/userStatusList.asp.


PsychoStats 3.0.6b and earlier allows remote attackers to obtain sensitive information via a request for server.php with a missing or invalid newtheme parameter which reveals a path in an error message.


Unspecified vulnerability in BES before 3.5.0 in OPeNDAP 4 (Hydrax) before 1.2.1 allows remote attackers to list filesystem contents and obtain sensitive information via unknown vectors.


Cerulean Studios Trillian Pro before 3.1.5.1 allows remote attackers to obtain potentially sensitive information via long CTCP PING messages that contain UTF-8 characters which generates a malformed response that is not truncated by a newline which can cause portions of a server message to be sent to the attacker.


The viewList function in lib/WebGUI/Asset/Wobject/DataForm.pm in Plain Black WebGUI before 7.3.14 does not properly use data structures containing privilege information which allows remote authenticated users to obtain sensitive information or possibly have other unspecified impact.


Subversion 1.4.3 and earlier does not properly implement the \partial access\ privilege for users who have access to changed paths but not copied paths which allows remote authenticated users to obtain sensitive information (revision properties) via svn (1) propget (2) proplist or (3) propedit.


LibTMCG before 1.1.1 does not perform a range check to avoid \trivial group generators \ which allows attackers to obtain sensitive information about private cards.


Jetbox CMS 2.1 allows remote attackers to obtain sensitive information via (1) a direct request to (a) main_page.php (b) open_tree.php and (c) outputs.php; (2) a malformed view parameter to index.php as demonstrated with an SQL injection manipulation; or (3) the id parameter to admin/cms/opentree.php which reveals the installation path in the resulting error message.


Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file which reveals the installation path in the resulting exception message.


Group-Office before 2.16-13 does not properly validate user IDs which allows remote attackers to obtain sensitive information via certain requests for (1) message.php and (2) messages.php in modules/email/. NOTE: some of these details are obtained from third party information.


QuickTime for Java in Apple Quicktime before 7.2 does not perform sufficient \access control \ which allows remote attackers to obtain sensitive information (screen content) via crafted Java applets.


Adobe Macromedia Flash Player 7 and 9 when used with Opera before 9.20 or Konqueror before 20070613 allows remote attackers to obtain sensitive information (browser keystrokes) which are leaked to the Flash Player applet.


Unspecified vulnerability in drivers/crypto/geode-aes.c in GEODE-AES in the Linux kernel before 2.6.21.3 allows attackers to obtain sensitive information via unspecified vectors.


index.php in eTicket 1.5.5.1 and earlier allows remote attackers to obtain sensitive information via the (1) name (2) email (3) phone or (4) subject parameters which reveals the installation path in the resulting error messages.


The show_files function in RunCms 1.5.2 and earlier allows remote attackers to obtain sensitive information (file existence and file metadata) via unspecified vectors.


Credant Mobile Guardian Shield for Windows 5.2.1.105 and earlier stores account names and passwords in plaintext in memory which allows local users to obtain sensitive information by (1) reading the paging file or (2) dumping and searching the memory image. NOTE: This issue crosses privilege boundaries because the product is intended to protect the data on a stolen computer.


The WLST script generated by the configToScript command in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not encrypt certain attributes in configuration files when creating a new domain which allows remote authenticated users to obtain sensitive information.


Safari in Apple iPhone 1.1.1 and Safari 3 before Beta Update 3.0.4 on Windows and Mac OS X 10.4 through 10.4.10 allows remote attackers to obtain sensitive information via a crafted web page that identifies the URL of the parent window even when the parent window is in a different domain.


PHP JackKnife (PHPJK) allows remote attackers to obtain sensitive information via (1) a request to index.php with an invalid value of the iParentUnq parameter or a request to G_Display.php with an invalid (2) iCategoryUnq or (3) sSort array parameter which reveals the path in various error messages.


myWebland myBloggie 2.1.6 allow remote attackers to obtain sensitive information via (1) an invalid year parameter to calendar.php reached through index.php; (2) a direct request to common.php; and (3) a mode array parameter in the query string to login.php which reveal the installation path in various error messages.


Calendarix 0.7.20070307 allows remote attackers to obtain sensitive information via (1) an invalid month parameter to calendar.php (2) an invalid catview parameter to cal_week.php in a week operation (3) an invalid ycyear parameter to yearcal.php or (4) a direct request to cal_functions.inc.php which reveals the installation path in various error messages.


The web container in IBM WebSphere Application Server (WAS) before 6.0.2.21 and 6.1.x before 6.1.0.9 sends response data intended for a different request in certain circumstances after a closed connection error which might allow remote attackers to obtain sensitive information.


The web interface in Fujitsu-Siemens Computers PRIMERGY BX300 Switch Blade allows remote attackers to obtain sensitive information by canceling the authentication dialog when accessing a sub-page which still displays the form field contents of the sub-page as demonstrated using (1) config/ip_management.htm and (2) config/snmp_config.htm.


Sergey Lyubka Simple HTTPD (shttpd) 1.38 allows remote attackers to obtain sensitive information (script source code) via a URL with a trailing encoded space (%20).


Cisco Unified Communications Manager (CUCM formerly CallManager) and Unified Presence Server (CUPS) allow remote attackers to obtain sensitive information via unspecified vectors that reveal the SNMP community strings and configuration settings aka (1) CSCsj20668 and (2) CSCsj25962.


NetClassifieds Premium Edition allows remote attackers to obtain sensitive information via certain requests that reveal the path in an error message related to the display_errors setting in (1) Common.php and (2) imageresizer.php and (3) the use of __FILE__ in error reporting by imageresizer.php; and (4) via certain requests that reveal the table name and complete query related to the Halt_On_Error setting in Mysql_db.php.


categoria.php in LiveCMS 3.4 and earlier allows remote attackers to obtain sensitive information via a ' (quote) character in the cid parameter which reveals the path in a forced SQL error message.


Simple CGI Wrapper (scgiwrap) in cPanel before 10.9.1 and 11.x before 11.4.19-R14378 allows remote attackers to obtain sensitive information via a direct request which reveals the path in an error message. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


videos.php in PHPDirector 0.21 and earlier allows remote attackers to obtain sensitive information via an empty value of the id parameter which reveals the path in an error message.


class/page.php in Farsi Script (aka FaScript) FaName 1.0 allows remote attackers to obtain sensitive information via a '; (quote semicolon) sequence in the id parameter which reveals the installation path in an error message.


calendar.php in Calendarix 0.7.20070307 allows remote attackers to obtain sensitive information via large values to the (1) year and (2) month parameters which causes negative values to be passed to the mktime library call and reveals the installation path in the error message.


listmembers.php in EQdkp 1.3.2c and earlier allows remote attackers to obtain sensitive information via an invalid compare parameter which reveals the path.


daemon.c in cman (redhat-cluster-suite) before 20070622 does not clear a buffer for reading requests which might allow local users to obtain sensitive information from previous requests.


WordPress before 2.2.2 allows remote attackers to redirect visitors to other websites and potentially obtain sensitive information via (1) the _wp_http_referer parameter to wp-pass.php related to the wp_get_referer function in wp-includes/functions.php; and possibly other vectors related to (2) wp-includes/pluggable.php and (3) the wp_nonce_ays function in wp-includes/functions.php.


Uebimiau Webmail allows remote attackers to obtain sensitive information via a request to demo/pop3/error.php with an invalid value of the (1) smarty or (2) selected_theme parameter which reveals the path in various error messages.


MySQL Community Server before 5.0.45 does not require privileges such as SELECT for the source table in a CREATE TABLE LIKE statement which allows remote authenticated users to obtain sensitive information such as the table structure.


Mail Notification 4.0 when WITH_SSL is set to 0 at compile time uses unencrypted connections for accounts configured with SSL/TLS which allows remote attackers to obtain sensitive information by sniffing the network.


httpsv.exe in HTTP Server 1.6.2 allows remote attackers to obtain sensitive information (script source code) via a URI with a trailing %20 (encoded space).


The Apache Web Server as used in Novell NetWare 6.5 and GroupWise allows remote attackers to obtain sensitive information via a certain directive to Apache that causes the HTTP-Header response to be modified which may reveal the server's internal IP address.


The eSoft InstaGate EX2 UTM device stores the admin password within the settings HTML document which might allow context-dependent attackers to obtain sensitive information by reading this document.


Mozilla Firefox before 1.8.0.13 and 1.8.1.x before 1.8.1.5 does not perform a security zone check when processing a wyciwyg URI which allows remote attackers to obtain sensitive information poison the browser cache and possibly enable further attack vectors via (1) HTTP 302 redirect controls (2) XMLHttpRequest or (3) view-source URIs.


index.php in Singapore Gallery allows remote attackers to obtain sensitive information via a request with a non-directory gallery parameter which reveals the path in an error message.


content.php in WSPortal 1.0 when magic_quotes_gpc is disabled allows remote attackers to obtain sensitive information via a \';\ (quote semicolon) sequence in the page parameter which reveals the installation path in the resulting forced SQL error message.


index.php in Pharmacy System 2 and earlier allows remote attackers to obtain sensitive information via a ' (quote) character in the page parameter which reveals the table prefix in an error message.


Peercast places a cleartext password in a query string which might allow attackers to obtain sensitive information by sniffing the network or obtaining Referer or browser history information.


search.php in w-Agora (Web-Agora) allows remote attackers to obtain potentially sensitive information via a ' (quote) value followed by certain SQL sequences in the (1) search_forum or (2) search_user parameter which force a SQL error.


IBM Tivoli Business Service Manager (TBSM) 4.1 before Interim Fix 1 logs passwords in plaintext which allows local users to obtain sensitive information by reading (1) ncisetup.db or (2) msi.log.


The FTP protocol implementation in Opera 9.10 allows remote attackers to allows remote servers to force the client to connect to other servers perform a proxied port scan or obtain sensitive information by specifying an alternate server address in an FTP PASV response.


DOURAN Software Technologies ISPUtil 3.32.84.1 and possibly earlier versions stores sensitive information under the web root with insufficient access control which allows remote attackers to obtain user and reseller data via a direct request for scripts/activesessions.ini. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


The setsockopt function in the L2CAP and HCI Bluetooth support in the Linux kernel before 2.4.34.3 allows context-dependent attackers to read kernel memory and obtain sensitive information via unspecified vectors involving the copy_from_user function accessing an uninitialized stack buffer.


WebAPP before 0.9.9.5 allows remote authenticated users without admin privileges to obtain sensitive information via (1) the Forum Archive feature and (2) Recent Searches.


Fujitsu FENCE-Pro before V5L01 and Systemwalker Desktop Encryption V12.0L10 V12.0L10A V12.0L10B V12.0L20 and V13.0.0 allows local users to obtain sensitive information by extracting the decoding password from certain \self-decoding\ file types.


The (1) TTLS CHAP (2) TTLS MSCHAP (3) TTLS MSCHAPv2 (4) TTLS PAP (5) MD5 (6) GTC (7) LEAP (8) PEAP MSCHAPv2 (9) PEAP GTC and (10) FAST authentication methods in Cisco Secure Services Client (CSSC) 4.x Trust Agent 1.x and 2.x Cisco Security Agent (CSA) 5.0 and 5.1 (when a vulnerable Trust Agent has been deployed) and the Meetinghouse AEGIS SecureConnect Client store transmitted authentication credentials in plaintext log files which allows local users to obtain sensitive information by reading these files aka CSCsg34423.


download.php in Philex 0.2.3 and earlier allows remote attackers to read arbitrary files and source code and obtain sensitive information via the file parameter.


The FTP protocol implementation in Mozilla Firefox before 1.5.0.11 and 2.x before 2.0.0.3 allows remote attackers to force the client to connect to other servers perform a proxied port scan or obtain sensitive information by specifying an alternate server address in an FTP PASV response.


The recall_headers function in mod_mem_cache in Apache 2.2.4 does not properly copy all levels of header data which can cause Apache to return HTTP headers containing previously used data which could be used by remote attackers to obtain potentially sensitive information.


sitex allows remote attackers to obtain sensitive information via a request with a numerical value for the (1) sxMonth or (2) sxYear parameter to calendar.php or the (3) page parameter to calendar_events.php which reveals the path in various error messages.


Unclassified NewsBoard 1.6.3 stores sensitive information under the web root with insufficient access control which allows remote attackers to obtain (1) the board log via a direct request for logs/board-YYYY-MM-DD.log (2) the mail and private message (PM) log via a direct request for logs/email-YY-MM-DD-HH-MM-SS.log (3) the SQL error message log via a direct request for logs/error-YY-MM.log and (4) the IP log via a direct request for logs/ip.log.


The cpdf_open function in the ClibPDF (cpdf) extension in PHP 4.4.6 allows context-dependent attackers to obtain sensitive information (script source code) via a long string in the second argument.


Moodle 1.5.2 and earlier stores sensitive information under the web root with insufficient access control and provides directory listings which allows remote attackers to obtain user names password hashes and other sensitive information via a direct request for session (sess_*) files in moodledata/sessions/.


The FTP protocol implementation in Konqueror 3.5.5 allows remote servers to force the client to connect to other servers perform a proxied port scan or obtain sensitive information by specifying an alternate server address in an FTP PASV response.


The RFC_START_PROGRAM function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to obtain sensitive information (external RFC server configuration data) via unspecified vectors a different vulnerability than CVE-2006-6010. NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended.


The Linksys WAG200G with firmware 1.01.01 WRT54GC 2 with firmware 1.00.7 and WRT54GC 1 with firmware 1.03.0 and earlier allow remote attackers to obtain sensitive information (passwords and configuration data) via a packet to UDP port 916. NOTE: some of these details are obtained from third party information.


The default SSL cipher configuration in Apache Tomcat 4.1.28 through 4.1.31 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 uses certain insecure ciphers including the anonymous cipher which allows remote attackers to obtain sensitive information or have other unspecified impacts.


w-Agora (Web-Agora) allows remote attackers to obtain sensitive information via a request to rss.php with an invalid (1) site or (2) bn parameter (3) a certain value of the site parameter or (4) an empty value of the bn parameter; a request to index.php with a certain value of the (5) site or (6) sort parameter; (7) a request to profile.php with an empty value of the site parameter; or a request to search.php with (8) an empty value of the bn parameter or a certain value of the (9) pattern or (10) search_date parameter which reveal the path in various error messages probably related to variable type inconsistencies. NOTE: the bn parameter to index.php is already covered by CVE-2007-0606.1.


The Social Bookmarks (del.icio.us) plug-in 8F in Quicksilver writes usernames and passwords in plaintext to the /Library/Logs/Console/UID/Console.log file which allows local users to obtain sensitive information by reading this file.


include/auth/auth.php in Simple Invoices before 2007 03 05 does not use the login system to protect print preview pages for invoices which might allow attackers to obtain sensitive information.


putmail.py in Putmail before 1.4 does not detect when a user attempts to use TLS with a server that does not support it which causes putmail.py to send the username and password in plaintext while the user believes encryption is in use and allows remote attackers to obtain sensitive information.


The CheckLoadURI function in Mozilla Firefox 1.8 lists the about: URI as a ChromeProtocol and can be loaded via JavaScript which allows remote attackers to obtain sensitive information by querying the browser's session history.