Network Preferences in Apple Mac OS X 10.4.11 stores PPP passwords in cleartext in a world-readable file which allows local users to obtain sensitive information by reading this file.


Microsoft Internet Explorer 7 can save encrypted pages in the cache even when the DisableCachingOfSSLPages registry setting is enabled which might allow local users to obtain sensitive information.


The POP3 server (EPSTPOP3S.EXE) 4.22 in E-Post Mail Server 4.10 allows remote attackers to obtain sensitive information via multiple crafted APOP commands for a known POP3 account which displays the password in a POP3 error message.


News Manager 2.0 allows remote attackers to bypass restrictions and obtain sensitive information via a direct request to (1) db/connect_str.php and (2) login/info.php.


The WOHyperlink implementation in WebObjects in Apple Xcode tools before 3.1 appends local session IDs to generated non-local URLs which allows remote attackers to obtain potentially sensitive information by reading the requests for these URLs.


No-IP Dynamic Update Client (DUC) 2.2.1 on Windows uses weak permissions for the HKLM\\SOFTWARE\\Vitalwerks\\DUC registry key which allows local users to obtain obfuscated passwords and other sensitive information by reading the (1) TrayPassword (2) Username (3) Password and (4) Hosts registry values.


Realm CMS 2.3 and earlier allows remote attackers to obtain sensitive information via a direct request to _db/compact.asp which reveals the database path in an error message.


AlstraSoft AskMe Pro 2.1 and earlier stores passwords in cleartext in a MySQL database which allows context-dependent attackers to obtain sensitive information.


arch/x86_64/lib/copy_user.S in the Linux kernel before 2.6.19 on some AMD64 systems does not erase destination memory locations after an exception during kernel memory copy which allows local users to obtain sensitive information.


The VMware Consolidated Backup (VCB) command-line utilities in VMware ESX 3.0.1 through 3.0.3 and ESX 3.5 place a password on the command line which allows local users to obtain sensitive information by listing the process.


IBM WebSphere Application Server (WAS) before 6.0.2 Fix Pack 25 (6.0.2.25) and 6.1 before Fix Pack 15 (6.1.0.15) writes unspecified cleartext information to http_plugin.log which might allow local users to obtain sensitive information by reading this file.


Spyce - Python Server Pages (PSP) 2.1.3 allows remote attackers to obtain sensitive information via a direct request for spyce/examples/automaton.spy which reveals the path in an error message.


WordPress 2.2.x and 2.3.x allows remote attackers to obtain sensitive information via an invalid p parameter in an rss2 action to the default URI which reveals the full path and the SQL database structure.


The Kerberos 4 support in KDC in MIT Kerberos 5 (krb5kdc) does not properly clear the unused portion of a buffer when generating an error message which might allow remote attackers to obtain sensitive information aka \Uninitialized stack values.\


Snitz Forums 2000 3.4.05 allows remote attackers to obtain sensitive information via a direct request to forum/whereami.asp which reveals the database path.


ManageEngine Applications Manager 8.1 build 8100 does not check authentication for monitorType.do and unspecified other pages which allows remote attackers to obtain sensitive information and change settings via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


The ps program in bos.rte.control in IBM AIX 5.2 5.3 and 6.1 allows local users to obtain sensitive information via unspecified vectors.


IBM Tivoli Business Service Manager (TBSM) 4.1.1 stores passwords in cleartext (1) after external authentication which triggers writing the password to SM_server.log; and (2) after a reconfig action; which allows local users to obtain sensitive information.


StatCounteX 3.0 and 3.1 allows remote attackers to obtain sensitive information and edit configuration scripts via a direct request to admin.asp.


Double-Take 5.0.0.2865 and earlier distributed under the HP StorageWorks Storage Mirroring name and other names allows remote attackers to obtain sensitive information via a packet of type (1) 0x2728 which provides operating system and path information; (2) 0x274e which lists Ethernet adapters; (3) 0x2726 which provides filesystem information; (4) 0x274f which specifies the printer driver; or (5) 0x2757 which provides recent log entries.


SQL Server 7.0 SP4 2000 SP4 2005 SP1 and SP2 2000 Desktop Engine (MSDE 2000) SP4 2005 Express Edition SP1 and SP2 and 2000 Desktop Engine (WMSDE); Microsoft Data Engine (MSDE) 1.0 SP4; and Internal Database (WYukon) SP2 does not initialize memory pages when reallocating memory which allows database operators to obtain sensitive information (database contents) via unknown vectors related to memory page reuse.


Apache Tomcat 6.0.0 through 6.0.15 processes parameters in the context of the wrong request when an exception occurs during parameter processing which might allow remote attackers to obtain sensitive information as demonstrated by disconnecting during this processing in order to trigger the exception.


common.py in Paramiko 1.7.1 and earlier when using threads or forked processes does not properly use RandomPool which allows one session to obtain sensitive information from another session by predicting the state of the pool.


ManageEngine Applications Manager 8.1 build 8100 allows remote attackers to obtain sensitive information ( Home->Summary) via an invalid URI as demonstrated by the \/-\ URI. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Level Platforms Inc. (LPI) Managed Workplace Service Center 4.x 5.x and 6.x allows remote attackers to obtain sensitive information via a direct request to About/SC_About.htm which provides version and patch information.


Absolute path traversal vulnerability in dload.php in the my_gallery 2.3 plugin for e107 allows remote attackers to obtain sensitive information via a full pathname in the file parameter. NOTE: some of these details are obtained from third party information.


admin/sauvBase.php in Blog Pixel Motion (aka Blog PixelMotion) does not require authentication which allows remote attackers to trigger a database backup dump and obtain the resulting blogPM.sql file that contains sensitive information.


ViewVC before 1.0.5 provides revision metadata without properly checking whether access was intended which allows remote attackers to obtain sensitive information by reading (1) forbidden pathnames in the revision view (2) log history that can only be reached by traversing a forbidden object or (3) forbidden diff view path parameters.


The proc filesystem in the kernel in IBM AIX 5.2 and 5.3 does not properly enforce directory permissions when a file executing from a directory has weaker permissions than the directory itself which allows local users to obtain sensitive information.


The Linksys WRT54G router stores passwords and keys in cleartext in the Config.bin file which might allow remote authenticated users to obtain sensitive information via an HTTP request for the top-level Config.bin URI.


The sso_util program in Single Sign-On in Apple Mac OS X before 10.5.3 places passwords on the command line which allows local users to obtain sensitive information by listing the process.


Apple QuickTime before 7.4.5 does not properly handle external URLs in movies which allows remote attackers to obtain sensitive information.


Juniper Networks Secure Access 2000 5.5 R1 (build 11711) allows remote attackers to obtain sensitive information via a direct request for remediate.cgi without certain parameters which reveals the path in an \Execute failed\ error message.


The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 5.01 6 and 7 does not block dangerous HTTP request headers when certain 8-bit character sequences are appended to a header name which allows remote attackers to (1) conduct HTTP request splitting and HTTP request smuggling attacks via an incorrect Content-Length header (2) access arbitrary virtual hosts via a modified Host header (3) bypass referrer restrictions via an incorrect Referer header and (4) bypass the same-origin policy and obtain sensitive information via a crafted request header.


Sony Mylo COM-2 Japanese model firmware before 1.002 does not properly verify web server SSL certificates which allows remote attackers to obtain sensitive information and conduct spoofing attacks.


Symantec Altiris Deployment Solution before 6.9.164 stores the Deployment Solution Agent (aka AClient) password in cleartext in memory which allows local users to obtain sensitive information by dumping the AClient.exe process memory.


CFNetwork in Safari in Apple Mac OS X before 10.5.3 automatically sends an SSL client certificate in response to a web server's certificate request which allows remote web sites to obtain sensitive information (Subject data) from personally identifiable certificates and use arbitrary certificates to track user activities across domains a related issue to CVE-2007-4879.


The kernel in IBM AIX 6.1 allows local users with ProbeVue privileges to read arbitrary kernel memory and obtain sensitive information via unspecified vectors.


phpMyAdmin before 2.11.5.1 stores the MySQL (1) username and (2) password and the (3) Blowfish secret key in cleartext in a Session file under /tmp which allows local users to obtain sensitive information.


Terong PHP Photo Gallery (aka Advanced Web Photo Gallery) 1.0 stores passwords in cleartext in a MySQL database which allows context-dependent attackers to obtain sensitive information.


The scheduler in CUPS in Apple Mac OS X 10.5 before 10.5.3 when debug logging is enabled and a printer requires a password allows attackers to obtain sensitive information (credentials) by reading the log data related to \authentication environment variables.\


ezRADIUS 0.1 stores sensitive information under the web root with insufficient access control which allows remote attackers to obtain credentials via a direct request for (1) config.ini or (2) database.ini. NOTE: some of these details are obtained from third party information.


The menu system in Drupal 6 before 6.2 has incorrect menu settings which allows remote attackers to (1) edit the profile pages of arbitrary users and obtain sensitive information from (2) tracker and (3) blog pages related to a missing check for the \access content\ permission; and (4) allows remote authenticated users with administration page view access to edit content types.


ViewVC before 1.0.5 includes \all-forbidden\ files within search results that list CVS or Subversion (SVN) commits which allows remote attackers to obtain sensitive information.


IBM Rational ClearQuest 7.0.1.1 and 7.0.0.2 might allow local or remote attackers to obtain sensitive information about users by reading user cookies.


mod_cgi in lighttpd 1.4.18 sends the source code of CGI scripts instead of a 500 error when a fork failure occurs which might allow remote attackers to obtain sensitive information.


iScripts SocialWare stores passwords in cleartext in a database which allows context-dependent attackers to obtain sensitive information.


login.aspx in the SmarterTools SmarterStats 6.0 web server does not include the HTTPOnly flag in a Set-Cookie header for the loginsettings cookie which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.


The (1) templatewrap/templatefoot.php (2) cmsjs/plugin.js.php and (3) cmsincludes/cms_plugin_api_link.inc.php scripts in Tribal Tribiq CMS before 5.2.7c allow remote attackers to obtain sensitive information via a direct request which reveals the full path in an error message.


Adobe Flash Player before 10.3.183.10 on Windows Mac OS X Linux and Solaris and before 10.3.186.7 on Android allows attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors related to a \security control bypass.\


The Sybase SQL Anywhere database component in Cisco CiscoWorks Common Services 3.x and 4.x before 4.1 allows remote attackers to obtain potentially sensitive information about the engine name and database port via an unspecified request to UDP port 2638 aka Bug ID CSCsk35018.


templates/system/error.php in Joomla! before 1.5.23 might allow remote attackers to obtain sensitive information via unspecified vectors that trigger an undefined value of a certain error field leading to disclosure of the installation path. NOTE: this might overlap CVE-2011-2488.


Joomla! 1.6.x before 1.6.2 allows remote attackers to obtain sensitive information via an empty Itemid array parameter to index.php which reveals the installation path in an error message a different vulnerability than CVE-2011-2488.


Google Chrome before 13.0.782.107 allows remote attackers to obtain sensitive information via a request for the GL program log which reveals a local path in an unspecified log entry.


The bluetooth subsystem in the Linux kernel before 3.0-rc4 does not properly initialize certain data structures which allows local users to obtain potentially sensitive information from kernel memory via a crafted getsockopt system call related to (1) the l2cap_sock_getsockopt_old function in net/bluetooth/l2cap_sock.c and (2) the rfcomm_sock_getsockopt_old function in net/bluetooth/rfcomm/sock.c.


IDSWebApp in the Web Administration Tool in IBM Tivoli Directory Server (TDS) 6.2 before 6.2.0.3-TIV-ITDS-IF0004 does not require authentication for access to LDAP Server log files which allows remote attackers to obtain sensitive information via a crafted URL.


Apache Tomcat 5.5.x before 5.5.34 6.x before 6.0.33 and 7.x before 7.0.17 when the MemoryUserDatabase is used creates log entries containing passwords upon encountering errors in JMX user creation which allows local users to obtain sensitive information by reading a log file.


The

MediaViewMedia

class

in

in

Joomla!

and

earlier

allows

remote

attackers

to

obtain

sensitive

information

via

vectors

involving

the

base

variable

leading

to

disclosure

of

the

installation

path

a

different

vulnerability

than


The ptrace_setxregs function in arch/xtensa/kernel/ptrace.c in the Linux kernel before 3.1 does not validate user-space pointers which allows local users to obtain sensitive information from kernel memory locations via a crafted PTRACE_SETXTREGS request.


The osf_getsysinfo function in arch/alpha/kernel/osf_sys.c in the Linux kernel before 2.6.39.4 on the Alpha platform does not properly restrict the data size for GSI_GET_HWRPB operations which allows local users to obtain sensitive information from kernel memory via a crafted call.


RSA enVision 4.x before 4 SP4 P3 places cleartext administrative credentials in Task Escalation e-mail messages which allows remote attackers to obtain sensitive information by sniffing the network or leveraging access to a recipient mailbox.


The do_devinfo_ioctl function in drivers/staging/comedi/comedi_fops.c in the Linux kernel before 3.1 allows local users to obtain sensitive information from kernel memory via a copy of a short string.


net/packet/af_packet.c in the Linux kernel before 2.6.39.3 does not properly restrict user-space access to certain packet data structures associated with VLAN Tag Control Information which allows local users to obtain potentially sensitive information via a crafted application.


The (1) Admin/frmEmailReportSettings.aspx (2) Admin/frmGeneralSettings.aspx (3) Admin/frmSite.aspx (4) Client/frmUser.aspx and (5) Login.aspx components in the SmarterTools SmarterStats 6.0 web server accept cleartext passwords which makes it easier for remote attackers to obtain sensitive information by sniffing the network.


Bugzilla 3.6.x before 3.6.6 3.7.x 4.0.x before 4.0.2 and 4.1.x before 4.1.3 on Windows does not delete the temporary files associated with uploaded attachments which allows local users to obtain sensitive information by reading these files. NOTE: this issue exists because of a regression in 3.6.


The ipv6 component in Cisco IOS before 15.1(4)M1.3 allows remote attackers to conduct fingerprinting attacks and obtain potentially sensitive information about the presence of the IOS operating system via an ICMPv6 Echo Request packet containing a Hop-by-Hop (HBH) extension header (EH) with a 0x0c01050c value in the PadN option data aka Bug ID CSCtq02219.


Joomla! before 1.5.23 does not properly check for errors which allows remote attackers to obtain sensitive information via unspecified vectors.


The implementation of Content Security Policy (CSP) violation reports in Mozilla Firefox 4.x through 5 SeaMonkey 2.x before 2.3 and possibly other products does not remove proxy-authorization credentials from the listed request headers which allows attackers to obtain sensitive information by reading a report related to incorrect host resolution that occurs with certain redirects.


Adobe Flash Player before 10.3.183.5 on Windows Mac OS X Linux and Solaris and before 10.3.186.3 on Android and Adobe AIR before 2.7.1 on Windows and Mac OS X and before 2.7.1.1961 on Android allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via unspecified vectors.


The autocompletion functionality in GLPI before 0.80.2 does not blacklist certain username and password fields which allows remote attackers to obtain sensitive information via a crafted POST request.


The (1) Admin/frmEmailReportSettings.aspx and (2) Admin/frmGeneralSettings.aspx components in the SmarterTools SmarterStats 6.0 web server generate web pages containing e-mail addresses which allows remote attackers to obtain potentially sensitive information by reading the default values of form fields.


The Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 sends the Admin LDAP password in cleartext which allows remote attackers to obtain sensitive information by sniffing the network.


VMware SpringSource Spring Framework before 2.5.6.SEC03 2.5.7.SR023 and 3.x before 3.0.6 when a container supports Expression Language (EL) evaluates EL expressions in tags twice which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments (4) code (5) text (6) var (7) scope or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var (10) scope or (11) value attribute in a (f) spring:transform tag aka \Expression Language Injection.\


XWork 2.2.1 in Apache Struts 2.2.1 and OpenSymphony XWork in OpenSymphony WebWork allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method a different vulnerability than CVE-2011-1772.3.


The SmarterTools SmarterStats 6.0 web server generates web pages containing external links in response to GET requests with query strings for (1) Client/frmViewReports.aspx or (2) UserControls/Popups/frmHelp.aspx which makes it easier for remote attackers to obtain sensitive information by reading (a) web-server access logs or (b) web-server Referer logs related to a \cross-domain Referer leakage\ issue.


Google Chrome before 13.0.782.107 allows remote attackers to obtain potentially sensitive information about client-side redirect targets via a crafted web site.


WSN Software 6.0.6 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by includes/prestart.php and certain other files.


LimeSurvey 1.90+ build9642-20101214 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by admin/statistics.php and certain other files.


The Keyboards component in Apple iOS before 5 displays the final character of an entered password during a subsequent use of a keyboard which allows physically proximate attackers to obtain sensitive information by reading this character.


A certain HTC update for Android 2.3.4 build GRJ22 when the Sense interface is used on the HTC EVO 3D EVO 4G ThunderBolt and unspecified other devices provides the HtcLoggers.apk application which allows user-assisted remote attackers to obtain a list of telephone numbers from a log and other sensitive information by leveraging the android.permission.INTERNET application permission and establishing TCP sessions to 127.0.0.1 on port 65511 and a second port.


TheHostingTool (THT) 1.2.3 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by includes/pear/Mail/smtp.php and certain other files.


Drupal

allows

remote

attackers

to

obtain

sensitive

information

via

a

direct

request

to

a

.php

file

which

reveals

the

installation

path

in

an

error

message

as

demonstrated

by

and

certain

other

files.


osCommerce 3.0a5 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by redirect.php.


Your Own URL Shortener (YOURLS) 1.5 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by includes/auth.php and certain other files.


CoreStorage in Apple Mac OS X 10.7 before 10.7.2 does not ensure that all disk data is encrypted during the enabling of FileVault which makes it easier for physically proximate attackers to obtain sensitive information by reading directly from the disk device.


Arctic Fox CMS 0.9.4 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by acp/includes/edit.inc.php and certain other files.


b2evolution 3.3.3 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by locales/ru_RU/ru-RU.locale.php and certain other files.


HelpCenter Live 2.1.7 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by modules/HelpCenter/index.php and certain other files.


PHPDevShell 3.0.0-Beta-4b allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by gzip.php.


Feng Office 1.7.2 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by public/upgrade/templates/layout.php and certain other files.


Zabbix before 1.8.6 allows remote attackers to obtain sensitive information via an invalid srcfld2 parameter to popup.php which reveals the installation path in an error message.


conceptcms 5.3.1 5.3.3 and possibly other versions allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by sys_libs/umlib/um_authserver.inc.php and certain other files.


WoW Server Status 4.1 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by status.php and certain other files.


TaskFreak! multi-mysql-0.6 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by include/language/zh/register_info.php and certain other files.


AdaptCMS 2.0.2 Beta allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by inc/poll_vote.php and certain other files.


Tembria Server Monitor before 6.0.5 Build 2252 uses a substitution cipher to encrypt application credentials which allows local users to obtain sensitive information by leveraging read access to (1) authentication.dat or (2) XML files in the Exports directory.


Freeway

Alpha

allows

remote

attackers

to

obtain

sensitive

information

via

a

direct

request

to

a

.php

file

which

reveals

the

installation

path

in

an

error

message

as

demonstrated

by

and

certain

other

files.


ftp_upload_file.php in Support Incident Tracker (aka SiT!) 3.65 allows remote authenticated users to obtain sensitive information via the file name which reveals the installation path in an error message.


concrete 5.4.0.5 5.4.1 and 5.4.1.1 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by tools/spellchecker_service.php and certain other files.


WordPress 2.9.2 and 3.0.4 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by wp-admin/includes/user.php and certain other files.


translate/translate_manager.cc in Google Chrome before 17.0.963.56 and 19.x before 19.0.1036.7 uses an HTTP session to exchange data for translation which allows remote attackers to obtain sensitive information by sniffing the network.


John Lim ADOdb Library for PHP 5.11 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by tests/test-active-record.php and certain other files.


Mozilla Firefox before 3.6.26 and 4.x through 6.0 Thunderbird before 3.1.18 and 5.0 through 6.0 and SeaMonkey before 2.4 do not properly enforce the IPv6 literal address syntax which allows remote attackers to obtain sensitive information by making XMLHttpRequest calls through a proxy and reading the error messages.


xajax

allows

remote

attackers

to

obtain

sensitive

information

via

a

direct

request

to

a

.php

file

which

reveals

the

installation

path

in

an

error

message

as

demonstrated

by

and

certain

other

files.


CMS Made Simple (CMSMS) 1.9.2 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by modules/TinyMCE/TinyMCE.module.php and certain other files. NOTE: this might overlap CVE-2007-5444.


TinyWebGallery (TWG) 1.8.3 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by i_frames/i_register.php.


Advanced Electron Forum (AEF) 1.0.8 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by languages/english/deletetopic_lang.php.


The Bug Genie 2.1.2 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by modules/svn_integration/config.inc.php and certain other files.


Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 8.2 through 8.4 process IKE requests despite a vpnclient mode configuration which allows remote attackers to obtain potentially sensitive information by reading IKE responder traffic aka Bug ID CSCtt07749.


WebCalendar 1.2.3 and other versions before 1.2.5 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by ws/user_mod.php and certain other files.


Unspecified vulnerability in TIBCO Spotfire Server 3.0.x before 3.0.2 3.1.x before 3.1.2 3.2.x before 3.2.1 and 3.3.x before 3.3.1 and Spotfire Analytics Server before 10.1.1 allows remote attackers to modify data or obtain sensitive information via a crafted URL.


Zend Framework 1.11.3 in Zend Server CE 5.1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by Validate.php and certain other files.


Escort Agency CMS (aka escort-agency-cms) allows remote attackers to obtain sensitive information via crafted array parameters in a request to a .php file which reveals the installation path in an error message as demonstrated by makethumb.php and certain other files.


Lexmark X W T E C 6500e and 25xxN devices before 2011-11-15 allow attackers to obtain sensitive information via a hidden email address in a Scan To Email shortcut.


The Red Hat mkdumprd script for kexec-tools as distributed in the kexec-tools 1.x before 1.102pre-154 and 2.x before 2.0.0-209 packages in Red Hat Enterprise Linux uses world-readable permissions for vmcore files which allows local users to obtain sensitive information by inspecting the file content as demonstrated by a search for a root SSH key.


MyBB (aka MyBulletinBoard) 1.6 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by inc/3rdparty/diff/Diff/ThreeWay.php and certain other files.


Crafty Syntax 3.0.2 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by README_FILES/livehelp.php and certain other files.


Phorum 5.2.15a allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by css.php and certain other files.


php Easy Survey Package (phpESP) 2.1.1 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by public/landing.php and certain other files.


Time Machine in Apple Mac OS X before 10.7.3 does not verify the unique identifier of its remote AFP volume or Time Capsule which allows remote attackers to obtain sensitive information contained in new backups by spoofing this storage object a different vulnerability than CVE-2010-1803.


The Settings component in Apple iOS before 5 stores a cleartext parental-restrictions passcode in an unspecified file which might allow physically proximate attackers to obtain sensitive information by reading this file.


PHP Point Of Sale (POS) 10.7 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by system/scaffolding/views/view.php and certain other files.


DokuWiki 2009-12-25c allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by lib/tpl/index.php and certain other files.


phpwcms

allows

remote

attackers

to

obtain

sensitive

information

via

a

direct

request

to

a

.php

file

which

reveals

the

installation

path

in

an

error

message

as

demonstrated

by

and

certain

other

files.


Ananta Gazelle 1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by modules/template.php and certain other files.


ka-Map 1.0-20070205 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by test.php and certain other files.


WEBinsta mailing list manager 1.3e allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by install/install3.php and certain other files.


OpenDocMan 1.2.6-svn-2011-01-21 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by User_Perms_class.php and certain other files.


Podcast Generator 1.3 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by core/themes.php and certain other files.


Virtual War (aka VWar) 1.5.0r15 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by includes/language/dutch.inc.php and certain other files.


Kamads Classifieds 2_B3 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by V2A_XHTML/style/view.php and certain other files.


eggBlog

allows

remote

attackers

to

obtain

sensitive

information

via

a

direct

request

to

a

.php

file

which

reveals

the

installation

path

in

an

error

message

as

demonstrated

by

and

certain

other

files.


Website Baker 2.8.1 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by admin/media/parameters.php and certain other files. NOTE: this might overlap CVE-2005-2436.


Open-Realty 2.5.8 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by install/versions/upgrade_115.inc.php and certain other files.


NetSaro Enterprise Messenger Server 2.0 stores cleartext console credentials in configuration.xml which allows local users to obtain sensitive information by reading this file and performing a base64 decoding step.


Pligg CMS 1.1.3 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by widgets/statistics/init.php and certain other files.


JanRain PHP OpenID library (aka php-openid) 2.2.2 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by Auth/Yadis/Yadis.php and certain other files.


FrontAccounting

allows

remote

attackers

to

obtain

sensitive

information

via

a

direct

request

to

a

.php

file

which

reveals

the

installation

path

in

an

error

message

as

demonstrated

by

and

certain

other

files.


Rapid Leech 2.3-v42-svn322 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by classes/pear.php and certain other files.


The WiFi component in Apple iOS before 5 stores WiFi credentials in an unspecified file which makes it easier for remote attackers to obtain sensitive information via a crafted application.


cFTP r80 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by templates/session_check.php and certain other files.


::mound::

allows

remote

attackers

to

obtain

sensitive

information

via

a

direct

request

to

a

.php

file

which

reveals

the

installation

path

in

an

error

message

as

demonstrated

by

and

certain

other

files.


The Red Hat mkdumprd script for kexec-tools as distributed in the kexec-tools 1.x before 1.102pre-154 and 2.x before 2.0.0-209 packages in Red Hat Enterprise Linux includes all of root's SSH private keys within a vmcore file which allows context-dependent attackers to obtain sensitive information by inspecting the file content.


The Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 does not properly restrict caching of HTTPS responses which makes it easier for remote attackers to obtain sensitive information by leveraging an unattended workstation.


PHP iCalendar 2.4 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by rss/rss_common.php and certain other files.


Coppermine Photo Gallery (CPG) 1.5.12 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by include/inspekt.php and certain other files.


phpmyadmin.css.php in phpMyAdmin 3.4.x before 3.4.6 allows remote attackers to obtain sensitive information via an array-typed js_frame parameter to phpmyadmin.css.php which reveals the installation path in an error message.


The default configuration of Avaya Secure Access Link (SAL) Gateway 1.5 1.8 and 2.0 contains certain domain names in the Secondary Core Server URL and Secondary Remote Server URL fields which allows remote attackers to obtain sensitive information by leveraging administrative access to these domain names as demonstrated by alarm and log information.


HTML Purifier 4.2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by tests/PHPT/Reporter/SimpleTest.php and certain other files.


Francisco Burzi PHP-Nuke 8.0 allows remote attackers to obtain sensitive information via a direct request to a .php file which reveals the installation path in an error message as demonstrated by themes/Odyssey/theme.php and certain other files.


Internet Sharing in Apple Mac OS X before 10.7.3 does not preserve the Wi-Fi configuration across software updates which allows remote attackers to obtain sensitive information by leveraging the lack of a WEP password for a Wi-Fi network.


The osf_partition function in fs/partitions/osf.c in the Linux kernel before 2.6.38 does not properly handle an invalid number of partitions which might allow local users to obtain potentially sensitive information from kernel heap memory via vectors related to partition-table parsing.


The Cascading Style Sheets (CSS) implementation in Google Chrome before 12.0.742.91 does not properly restrict access to the visit history which allows remote attackers to obtain sensitive information via unspecified vectors.


The econet_sendmsg function in net/econet/af_econet.c in the Linux kernel before 2.6.39 on the x86_64 platform allows remote attackers to obtain potentially sensitive information from kernel stack memory by reading uninitialized data in the ah field of an Acorn Universal Networking (AUN) packet.


The ib_uverbs_poll_cq function in drivers/infiniband/core/uverbs_cmd.c in the Linux kernel before 2.6.37 does not initialize a certain response buffer which allows local users to obtain potentially sensitive information from kernel memory via vectors that cause this buffer to be only partially filled a different vulnerability than CVE-2010-4649.


Microsoft .NET Framework 2.0 SP2 3.5.1 and 4 does not properly validate the System.Net.Sockets trust level which allows remote attackers to obtain sensitive information or trigger arbitrary outbound network traffic via (1) a crafted XAML browser application (aka XBAP) (2) a crafted ASP.NET application or (3) a crafted .NET Framework application aka \Socket Restriction Bypass Vulnerability.\


The do_replace function in net/bridge/netfilter/ebtables.c in the Linux kernel before 2.6.39 does not ensure that a certain name field ends with a '\\0' character which allows local users to obtain potentially sensitive information from kernel stack memory by leveraging the CAP_NET_ADMIN capability to replace a table and then reading a modprobe command line.


The (1) AgentInterface and (2) CustomerInterface components in Open Ticket Request System (OTRS) before 3.0.6 place cleartext credentials into the session data in the database which makes it easier for context-dependent attackers to obtain sensitive information by reading the _UserLogin and _UserPW fields.


The login form in Roundcube Webmail before 0.5.1 does not properly handle a correctly authenticated but unintended login attempt which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account and then compose an e-mail message related to a \login CSRF\ issue.


net/ipv6/netfilter/ip6_tables.c in the IPv6 implementation in the Linux kernel before 2.6.39 does not place the expected '\\0' character at the end of string data in the values of certain structure members which allows local users to obtain potentially sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability to issue a crafted request and then reading the argument to the resulting modprobe process.


EMC Data Protection Advisor before 5.8.1 places cleartext account credentials in the DPA configuration file in unspecified circumstances which might allow local users to obtain sensitive information by reading this file.


Microsoft Windows Azure Software Development Kit (SDK) 1.3.x before 1.3.20121.1237 when Full IIS and a Web Role are used with an ASP.NET application does not properly support the use of cookies for maintaining state which allows remote attackers to obtain potentially sensitive information by reading an encrypted cookie and performing unspecified other steps.


The xsltGenerateIdFunction function in functions.c in libxslt 1.1.26 and earlier as used in Google Chrome before 10.0.648.127 and other products allows remote attackers to obtain potentially sensitive information about heap memory addresses via an XML document containing a call to the XSLT generate-id XPath function.


The default configuration of the server console in IBM Lotus Domino does not require a password (aka Server_Console_Password) which allows physically proximate attackers to perform administrative changes or obtain sensitive information via a (1) Load (2) Tell or (3) Set Configuration command.


IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-IF0010 6.0 before 6.0.0.67 (aka 6.0.0.8-TIV-ITDS-IF0009) 6.1 before 6.1.0.40 (aka 6.1.0.5-TIV-ITDS-IF0003) 6.2 before 6.2.0.16 (aka 6.2.0.3-TIV-ITDS-IF0002) and 6.3 before 6.3.0.3 (aka 6.3.0.0-TIV-ITDS-IF0003) does not properly handle the ibm-auditAttributesOnGroupEvalOp setting for auditing of extended operations which might allow attackers to obtain sensitive information by reading the audit log.


The Administrative Scripting Tools component in IBM WebSphere Application Server (WAS) 6.1.0.x before 6.1.0.35 and 7.x before 7.0.0.15 when tracing is enabled places wsadmin command parameters into the (1) wsadmin.traceout and (2) trace.log files which allows local users to obtain potentially sensitive information by reading these files.


The encryptPassword function in Login.js in ManageEngine ServiceDesk Plus (SDP) 8012 and earlier uses a Caesar cipher for encryption of passwords in cookies which makes it easier for remote attackers to obtain sensitive information by sniffing the network.


The PlushSearch2 function in Search.php in Simple Machines Forum (SMF) before 1.1.13 and 2.x before 2.0 RC5 uses certain cached data in a situation where a temporary table has been created even though this cached data is intended only for situations where a temporary table has not been created which might allow remote attackers to obtain sensitive information via a search.


Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents when used with an authenticating proxy server sends the Proxy-Authorization header to the origin server which allows remote web servers to obtain sensitive information by logging this header.


The sco_sock_getsockopt_old function in net/bluetooth/sco.c in the Linux kernel before 2.6.39 does not initialize a certain structure which allows local users to obtain potentially sensitive information from kernel stack memory via the SCO_CONNINFO option.


Microsoft msxml.dll as used in Internet Explorer 8 on Windows 7 allows remote attackers to obtain potentially sensitive information about heap memory addresses via an XML document containing a call to the XSLT generate-id XPath function. NOTE: this might overlap CVE-2011-1202.


Unspecified vulnerability in the SNMP component on the HP Photosmart D110 and B110; Photosmart Plus B210; Photosmart Premium C310 Fax All-in-One and C510; and ENVY 100 D410 printers allows remote attackers to obtain sensitive information or modify data via vectors related to the Embedded Web Server (EWS).


net/ipv4/netfilter/arp_tables.c in the IPv4 implementation in the Linux kernel before 2.6.39 does not place the expected '\\0' character at the end of string data in the values of certain structure members which allows local users to obtain potentially sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability to issue a crafted request and then reading the argument to the resulting modprobe process.


EMC Avamar 4.x 5.0.x and 6.0.x before 6.0.0-592 allows remote authenticated users to modify client data or obtain sensitive information about product activities by leveraging privileged access to a different domain.


steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets (CSS) stylesheet which allows remote authenticated users to trigger arbitrary outbound TCP connections from the server and possibly obtain sensitive information via a crafted request.


Scrips_Overlay.pm in Best Practical Solutions RT before 3.8.9 does not properly restrict access to a TicketObj in a Scrip after a CurrentUser change which allows remote authenticated users to obtain sensitive information via unspecified vectors as demonstrated by custom-field value information related to SQL logging.


The MartiniCreations PassmanLite Password Manager application before 1.48 for Android stores the master password and unspecified other account information in cleartext which allows local users to obtain sensitive information by leveraging shell access.


The tpm_open function in drivers/char/tpm/tpm.c in the Linux kernel before 2.6.39 does not initialize a certain buffer which allows local users to obtain potentially sensitive information from kernel memory via unspecified vectors.


The LDAP_ADD implementation in IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-IF0009 stores a cleartext SHA password in the change log which might allow local users to obtain sensitive information by reading this log.


The default configuration of ExShortcut\\Web.config in EMC SourceOne Email Management before 6.6 SP1 when the Mobile Services component is used does not properly set the localOnly attribute of the trace element which allows remote authenticated users to obtain sensitive information via ASP.NET Application Tracing.


The Keystroke Encryption feature in Trend Micro Internet Security 2009 (aka Virus Buster 2009 and PC-cillin 2009) does not completely encrypt passwords which allows local users to obtain sensitive information by leveraging a keylogger.


Metaways Tine 2.0 allows remote attackers to obtain sensitive information via unknown vectors in (1) Crm/Controller.php (2) Crm/Export/Csv.php or (3) Calendar/Model/Attender.php which reveal the full installation path.


The WebReporting module in F-Secure Policy Manager 7.x 8.00 before hotfix 2 8.1x before hotfix 3 on Windows and hotfix 2 on Linux and 9.00 before hotfix 4 on Windows and hotfix 2 on Linux allows remote attackers to obtain sensitive information via a request to an invalid report which reveals the installation path in an error message as demonstrated with requests to (1) report/infection-table.html or (2) report/productsummary-table.html.


The mod_dav_svn module for the Apache HTTP Server as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17 when the SVNPathAuthz short_circuit option is disabled does not properly enforce permissions for files that had been publicly readable in the past which allows remote attackers to obtain sensitive information via a replay REPORT operation.


The destroy_one_secret function in nm-setting-vpn.c in libnm-util in the NetworkManager package 0.8.999-3.git20110526 in Fedora 15 creates a log entry containing a certificate password which allows local users to obtain sensitive information by reading a log file.


The txXPathNodeUtils::getXSLTId function in txMozillaXPathTreeWalker.cpp and txStandaloneXPathTreeWalker.cpp in Mozilla Firefox before 3.5.19 3.6.x before 3.6.17 and 4.x before 4.0.1 and SeaMonkey before 2.0.14 allows remote attackers to obtain potentially sensitive information about heap memory addresses via an XML document containing a call to the XSLT generate-id XPath function.


net/ipv4/netfilter/ip_tables.c in the IPv4 implementation in the Linux kernel before 2.6.39 does not place the expected '\\0' character at the end of string data in the values of certain structure members which allows local users to obtain potentially sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability to issue a crafted request and then reading the argument to the resulting modprobe process.


The PowerVR SGX driver in Android before 2.3.6 allows attackers to obtain potentially sensitive information from kernel stack memory via an application that uses a crafted length parameter in a request to the pvrsrvkm device.


Mahara before 1.3.6 does not properly restrict the data in responses to AJAX calls which allows remote authenticated users to obtain sensitive information via a request associated with (1) blocktype/myfriends/myfriends.json.php (2) json/usersearch.php (3) group/membersearchresults.json.php or (4) json/friendsearch.php as demonstrated by information about friends and e-mail addresses.


The Dell KACE K2000 Systems Deployment Appliance 3.3.36822 and earlier contains a peinst CIFS share which allows remote attackers to obtain sensitive information by reading the (1) unattend.xml or (2) sysprep.inf file as demonstrated by reading a password.


The sandbox implementation in Google Chrome before 9.0.597.84 on Mac OS X might allow remote attackers to obtain potentially sensitive information about local files via vectors related to the stat system call.


Tor before 0.2.1.29 and 0.2.2.x before 0.2.2.21-alpha does not properly manage key data in memory which might allow local users to obtain sensitive information by leveraging the ability to read memory that was previously used by a different process.


The xfs_fs_geometry function in fs/xfs/xfs_fsops.c in the Linux kernel before 2.6.38-rc6-git3 does not initialize a certain structure member which allows local users to obtain potentially sensitive information from kernel stack memory via an FSGEOMETRY_V1 ioctl call.


The register_user function in client/new_account_form.php in Domain Technologie Control (DTC) before 0.32.9 includes a cleartext password in an e-mail message which makes it easier for remote attackers to obtain sensitive information by sniffing the network.


Opera before 11.01 does not properly handle redirections and unspecified other HTTP responses which allows remote web servers to obtain sufficient access to local files to use these files as page resources and consequently obtain potentially sensitive information from the contents of the files via an unknown response manipulation.


The TFTP implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.5.x 1.6.0 and 1.6.1 allows remote attackers to obtain sensitive information via a GET request aka Bug ID CSCte43876.


The HTML5 drag and drop functionality in WebKit in Apple Safari before 5.0.4 allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive information via vectors related to the dragging of content. NOTE: this might overlap CVE-2011-0778.


IBM WebSphere Portal 6.0.1.1 through 7.0.0.0 as used in IBM Lotus Web Content Management (WCM) and IBM Lotus Quickr for WebSphere Portal allows remote attackers to obtain sensitive information via a \modified message.\


App Store in Apple Mac OS X before 10.6.8 creates a log entry containing a user's AppleID password which might allow local users to obtain sensitive information by reading a log file as demonstrated by a log file that has non-default permissions.


HP Discovery & Dependency Mapping Inventory (DDMI) 7.50 7.51 7.60 7.61 7.70 and 9.30 launches the Windows SNMP service with its default configuration which allows remote attackers to obtain potentially sensitive information or have unspecified other impact by leveraging the public read community.


The ocfs2_prepare_page_for_write function in fs/ocfs2/aops.c in the Oracle Cluster File System 2 (OCFS2) subsystem in the Linux kernel before 2.6.39-rc1 does not properly handle holes that cross page boundaries which allows local users to obtain potentially sensitive information from uninitialized disk locations by reading a file.


pivotx/modules/module_image.php in PivotX 2.2.2 allows remote attackers to obtain sensitive information via a non-existent file in the image parameter which reveals the installation path in an error message. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


The FSFindFolder API in CarbonCore in Apple Mac OS X before 10.6.7 provides a world-readable directory in response to a call with the kTemporaryFolderType flag which allows local users to obtain potentially sensitive information by accessing this directory.


The service utility in EMC Avamar 5.x before 5.0.4 uses cleartext to transmit event details in (1) service requests and (2) e-mail messages which might allow remote attackers to obtain sensitive information by sniffing the network.


The generate-id XPath function in libxslt in Apple iOS 4.3.x before 4.3.2 allows remote attackers to obtain potentially sensitive information about heap memory addresses via a crafted web site. NOTE: this may overlap CVE-2011-1202.


CollabNet ScrumWorks Basic 1.8.4 uses cleartext credentials for network communication and the internal database which makes it easier for context-dependent attackers to obtain sensitive information by (1) sniffing the network for transmissions of Java objects or (2) reading the database.


F-Secure Internet Gatekeeper for Linux 3.x before 3.03 does not require authentication for reading access logs which allows remote attackers to obtain potentially sensitive information via a TCP session on the admin UI port.


SUSE Lifecycle Management Server before 1.1 uses world readable postgres credentials which allows local users to obtain sensitive information via unspecified vectors.


PivotX before 2.2.2 allows remote attackers to obtain sensitive information via a direct request to (1) includes/ping.php and (2) includes/spamping.php which reveals the installation path in an error message.


Lexmark X W T E and C devices before 2012-02-09 allow attackers to obtain sensitive information by reading passwords within exported settings.


Parallels Plesk Small Business Panel 10.2.0 does not include the HTTPOnly flag in a Set-Cookie header for a cookie which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie as demonstrated by cookies used by domains/sitebuilder_edit.php and certain other files.


The Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment which allows remote attackers to obtain potentially sensitive information by reading a page as demonstrated by js/Wizard/Status.js and certain other files.


The libobby server in inc/server.hpp in libnet6 (aka net6) before 1.3.14 does not perform authentication before checking the user name which allows remote attackers to obtain sensitive information such as server-usage patterns by a particular user and color preferences.


Siemens WinCC (TIA Portal) 11 uses a reversible algorithm for storing HMI web-application passwords in world-readable and world-writable files which allows local users to obtain sensitive information by leveraging (1) physical access or (2) Sm@rt Server access.


The file_browser component in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 does not properly restrict access to category and course data which allows remote attackers to obtain potentially sensitive information via a request for a file.


The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 does not include the HTTPOnly flag in a Set-Cookie header for a cookie which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie as demonstrated by cookies used by get_password.php and certain other files.


The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment which allows remote attackers to obtain potentially sensitive information by reading a page as demonstrated by smb/user/list and certain other files.


The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 generates web pages containing external links in response to GET requests with query strings for enterprise/mobile-monitor/ and certain other files which makes it easier for remote attackers to obtain sensitive information by reading (1) web-server access logs or (2) web-server Referer logs related to a \cross-domain Referer leakage\ issue.


EMC RSA enVision 4.0 before SP4 P5 and 4.1 before P3 allows remote attackers to obtain sensitive information about environment variables in the web system via unspecified vectors.


Tor before 0.2.2.24-alpha continues to use a reachable bridge that was previously configured but is not currently configured which might allow remote attackers to obtain sensitive information about clients in opportunistic circumstances by monitoring network traffic to the bridge port.


The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 includes an RFC 1918 IP address within a web page which allows remote attackers to obtain potentially sensitive information by reading this page as demonstrated by smb/user/list-data/items-per-page/ and certain other files.


The Web Search feature in EMC SourceOne Email Management 6.5 before 6.5.2.4033 6.6 before 6.6.1.2194 and 6.7 before 6.7.2.2033 places cleartext credentials in log files which allows local users to obtain sensitive information by reading these files.


plugin/npapi/plugin.cpp in Gnash before 0.8.10 uses weak permissions (world readable) for cookie files with predictable names in /tmp which allows local users to obtain sensitive information.


Moodle 2.0.x before 2.0.2 does not use the forceloginforprofiles setting for course-profiles access control which makes it easier for remote attackers to obtain potentially sensitive information via vectors involving use of a search engine as demonstrated by the search functionality of Google Yahoo! Wrensoft Zoom MSN Yandex and AltaVista.


The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 does not include the HTTPOnly flag in a Set-Cookie header for a cookie which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie as demonstrated by cookies used by login_up.php3 and certain other files.


Moodle 2.0.x before 2.0.2 allows remote attackers to obtain sensitive information from a myprofile (aka My profile) block by visiting a user-context page.


The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 includes an RFC 1918 IP address within a web page which allows remote attackers to obtain potentially sensitive information by reading this page as demonstrated by admin/home/admin and certain other files.


The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer.


ABRT might allow attackers to obtain sensitive information from crash reports.


The Dell KACE K2000 System Deployment Appliance has a default username and password for the read-only reporting account which makes it easier for remote attackers to obtain sensitive information from the database by leveraging the default credentials.


The web-server component in the Consolidation and Analysis Engine (CAE) Server in DB2 Query Monitor in IBM DB2 Tools 2.3.0 for z/OS does not prevent directory browsing which allows remote attackers to obtain sensitive information via HTTP requests.


The Dell KACE K2000 System Deployment Appliance stores the recovery account password in cleartext within a PHP script which allows context-dependent attackers to obtain sensitive information by examining script source code.


The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 includes a database connection string within a web page which allows remote attackers to obtain potentially sensitive information by reading this page as demonstrated by client@2/domain@1/hosting/aspdotnet/.


Parallels Plesk Small Business Panel 10.2.0 generates web pages containing external links in response to GET requests with query strings for client@1/domain@1/hosting/file-manager/ and certain other files which makes it easier for remote attackers to obtain sensitive information by reading (1) web-server access logs or (2) web-server Referer logs related to a \cross-domain Referer leakage\ issue.


MediaWiki before 1.17.1 does not check for read permission before handling action=ajax requests which allows remote attackers to obtain sensitive information by (1) leveraging the SpecialUpload::ajaxGetExistsWarning function or by (2) leveraging an extension as demonstrated by the CategoryTree ExtTab and InlineEditor extensions.


OWASP HTML Sanitizer (aka owasp-java-html-sanitizer) before 88 when JavaScript is disabled allows user-assisted remote attackers to obtain potentially sensitive information via a crafted FORM element within a NOSCRIPT element.


The kdump implementation is missing the host key verification in the kdump and mkdumprd OpenSSH integration of kdump prior to version 2012-01-20. This is similar to CVE-2011-3588 but different in that the kdump implementation is specific to SUSE. A remote malicious kdump server could use this flaw to impersonate the correct kdump server to obtain security sensitive information (kdump core files).


Parallels Plesk Small Business Panel 10.2.0 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment which allows remote attackers to obtain potentially sensitive information by reading a page as demonstrated by smb/email-address/list and certain other files.


SmarterTools SmarterStats 6.2.4100 generates web pages containing external links in response to GET requests with query strings for frmGettingStarted.aspx which makes it easier for remote attackers to obtain sensitive information by reading (1) web-server access logs or (2) web-server Referer logs related to a \cross-domain Referer leakage\ issue.


The

Control

Panel

in

Parallels

Plesk

Panel

build

includes

a

submitted

password

within

an

HTTP

response

body

which

allows

remote

attackers

to

obtain

sensitive

information

by

sniffing

the

network

as

demonstrated

by

password

handling

in

client@2/domain@1/odbc/dsn@1/properties/.


The billing system for Parallels Plesk Panel 10.3.1_build1013110726.09 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment which allows remote attackers to obtain potentially sensitive information by reading a page as demonstrated by js/ajax/core/ajax.inc.js and certain other files.


The

Site

Editor

(aka

SiteBuilder)

feature

in

Parallels

Plesk

Small

Business

Panel

does

not

include

the

HTTPOnly

flag

in

a

Set-Cookie

header

for

a

cookie

which

makes

it

easier

for

remote

attackers

to

obtain

potentially

sensitive

information

via

script

access

to

this

cookie

as

demonstrated

by

cookies

used

by

Wizard/Edit/Modules/ImageGallery/MultiImagesUpload

and

certain

other

files.


The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 receives cleartext password input over HTTP which allows remote attackers to obtain sensitive information by sniffing the network as demonstrated by forms in login_up.php3 and certain other files.


Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2 places an IMS enterprise enrolment file in the course-files area which allows remote attackers to obtain sensitive information via a request for imsenterprise-enrol.xml.


The

Control

Panel

in

Parallels

Plesk

Panel

includes

a

submitted

password

within

an

HTTP

response

body

which

allows

remote

attackers

to

obtain

sensitive

information

by

sniffing

the

network

as

demonstrated

by

password

handling

in

certain

files

under

client@1/domain@1/backup/local-repository/.


The

Control

Panel

in

Parallels

Plesk

Panel

build

generates

web

pages

containing

external

links

in

response

to

GET

requests

with

query

strings

for

smb/app/search-data/catalogId/marketplace

and

certain

other

files

which

makes

it

easier

for

remote

attackers

to

obtain

sensitive

information

by

reading

web-server

access

logs

or

web-server

Referer

logs

related

to

a

\cross-domain

Referer

leakage\

issue.


The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 does not include the HTTPOnly flag in a Set-Cookie header for a cookie which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie as demonstrated by cookies used by help.php and certain other files.


Parallels Plesk Small Business Panel 10.2.0 receives cleartext password input over HTTP which allows remote attackers to obtain sensitive information by sniffing the network as demonstrated by forms in smb/auth and certain other files.


The sosreport utility in the Red Hat sos package before 1.7-9 and 2.x before 2.2-17 includes (1) Certificate-based Red Hat Network private entitlement keys and the (2) private key for the entitlement in an archive of debugging information which might allow remote attackers to obtain sensitive information by reading the archive.


translate.php in Support Incident Tracker (aka SiT!) 3.45 through 3.65 allows remote attackers to obtain sensitive information via a direct request using the save action which reveals the installation path.


templates/default/index.php in Redaxscript 0.3.2 allows remote attackers to obtain sensitive information via a direct request which reveals the full path in an error message.


Akiva WebBoard 8.x stores passwords in plaintext which allows local users to obtain sensitive information by reading from the database.


The SibRaRecoverableSiXaResource class in the Default Messaging Component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.41 does not properly handle a Service Integration Bus (SIB) dump operation involving the First Failure Data Capture (FFDC) introspection code which allows local users to obtain sensitive information by reading the FFDC log file.


move_uploaded_file.php in Support Incident Tracker (aka SiT!) 3.65 allows remote authenticated users to obtain sensitive information via the file name which reveals the installation path in an error message.


The XSS Auditor in Google Chrome before 27.0.1453.93 might allow remote attackers to obtain sensitive information via unspecified vectors.


OpenRat CMS 0.8-beta1 and earlier allows remote attackers to obtain sensitive information via a request containing an XSS sequence in the action parameter to index.php which reveals the path in an error message.


Kibana version 5.4.0 was affected by a Cross Site Scripting (XSS) bug in the Time Series Visual Builder. This bug could allow an attacker to obtain sensitive information from Kibana users.


MatrixSSL before 3.8.3 configured with RSA Cipher Suites allows remote attackers to obtain sensitive information via a Bleichenbacher variant attack.


The XSS auditor in WebKit as used in Apple iOS before 9.3 and Safari before 9.1 does not properly handle redirects in block mode which allows remote attackers to obtain sensitive information via a crafted URL.


IBM i 7.2 7.3 and 7.4 users running complex SQL statements under a specific set of circumstances may allow a local user to obtain sensitive information that they should not have access to. IBM X-Force ID: 178318.


Apache Wicket before 1.5.12 6.x before 6.17.0 and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via vectors involving identifiers for storing page markup for temporary user sessions.


IBM Power9 (AIX 7.1 7.2 and VIOS 3.1) processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances. IBM X-Force ID: 189296.


IBM QRadar SIEM 7.3 7.4 and 7.5 could allow an authenticated user to obtain sensitive information from another user's dashboard providing the dashboard ID of that user. IBM X-Force ID: 203030.


IBM Lotus Notes 7.0 8.0 and 8.5 stores administrative credentials in cleartext in SURunAs.exe which allows local users to obtain sensitive information by examining this file aka SPR JSTN837SEG.


IBM WebSphere MQ 7.5 8.0 and 9.0 through 9.0.4 could allow a local user to obtain highly sensitive information via trace logs in IBM WebSphere MQ Managed File Transfer. IBM X-Force ID: 137042.


BEA WebLogic Server 9.0 9.1 and 9.2 Gold allows remote attackers to obtain sensitive information via malformed HTTP requests which reveal data from previous requests.


IBM Security Guardium 9.0 9.1 9.5 10.0 and 10.1 transmits sensitive data in cleartext in the query of the request. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 110409


Cisco Adaptive Security Appliance (ASA) Software 8.4 allows remote attackers to obtain sensitive information via an AnyConnect authentication attempt aka Bug ID CSCuo65775.


The affected product is vulnerable to an information leak which may allow an attacker to obtain sensitive information on the Ignition 8 (all versions prior to 8.0.13).


MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows might allow remote attackers to obtain sensitive information from ACP backups via vectors involving a short name.


MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to obtain sensitive database information via vectors involving templates.


MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow remote attackers to obtain sensitive information by leveraging missing directory listing protection in upload directories.


aria2c in aria2 1.33.1 when --log is used can store an HTTP Basic Authentication username and password in a file which might allow local users to obtain sensitive information by reading this file.


Exfiltration of Data in McAfee Web Gateway (MWG) 7.8.2.x prior to 7.8.2.12 allows attackers to obtain sensitive data via crafting a complex webpage that will trigger the Web Gateway to block the user accessing an iframe.


Dell EMC iDRAC7 versions prior to 2.65.65.65 iDRAC8 versions prior to 2.70.70.70 and iDRAC9 versions prior to 3.36.36.36 contain an improper authorization vulnerability. A remote authenticated malicious iDRAC user with low privileges may potentially exploit this vulnerability to obtain sensitive information such as password hashes.


MyBB 1.8.19 allows remote attackers to obtain sensitive information because it discloses the username upon receiving a password-reset request that lacks the code parameter.


An issue was discovered in Mattermost Server before 5.9.0 5.8.1 5.7.3 and 4.10.8. It allows attackers to obtain sensitive information during user activation/deactivation.


An issue was discovered in Mattermost Server before 5.9.0 5.8.1 5.7.3 and 4.10.8. It allows attackers to obtain sensitive information about whether someone has 2FA enabled.


An issue was discovered in Mattermost Server before 5.16.1 5.15.2 5.14.5 and 5.9.6. It allows attackers to obtain sensitive information (local files) during legacy attachment migration.


An issue was discovered in Mattermost Server before 5.9.0 5.8.1 5.7.3 and 4.10.8. It allows attackers to obtain sensitive information during a role change.


A vulnerability in SonicWall SonicOS and SonicOSv TLS CBC Cipher allow remote attackers to obtain sensitive plaintext data when CBC cipher suites are enabled. This vulnerability affected SonicOS Gen 5 version 5.9.1.10 and earlier Gen 6 version 6.2.7.3 6.5.1.3 6.5.2.2 6.5.3.1 6.2.7.8 6.4.0.0 6.5.1.8 6.0.5.3-86o and SonicOSv 6.5.0.2-8v_RC363 (VMWARE) 6.5.0.2.8v_RC367 (AZURE) SonicOSv 6.5.0.2.8v_RC368 (AWS) SonicOSv 6.5.0.2.8v_RC366 (HYPER_V).


IBM OpenPages GRC Platform 7.2 7.3 7.4 and 8.0 could allow an attacker to obtain sensitive information from error log files. IBM X-Force ID: 134001.


The web management interface in 3Com TippingPoint SMS Server before 2.2.1.4478 does not restrict access to certain directories which might allow remote attackers to obtain potentially sensitive information such as configuration settings.


Adobe Experience Manager 6.0 6.1 and 6.2 allow attackers to obtain sensitive audit log event information via unspecified vectors.


NetworkExtension in the kernel in Apple iOS before 9 does not properly initialize an unspecified data structure which allows attackers to obtain sensitive memory-layout information via a crafted app.


In all android releases(Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel Out of bound mask range access caused by using possible old value of msg mask table count while copying masks to userspace.


In all android releases (Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel improper check In the WMA API for the inputs received from the firmware and then fills the same to the host structure will lead to OOB write.


Optergy Proton/Enterprise devices allow Open Redirect.


Drupal 6.x before 6.38 7.x before 7.43 and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging (1) custom code or (2) a form shown on a 404 error page related to path manipulation.


Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a parameter using the (1) redirect: or (2) redirectAction: prefix.


Multiple open redirect vulnerabilities in Cisco Emergency Responder (ER) 8.6 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified parameters aka Bug ID CSCun37909.


Multiple open redirect vulnerabilities in the Unified Task List (UTL) Portlet for IBM WebSphere Portal 7.x and 8.x through 8.0.0.1 CF12 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.


Multiple open redirect vulnerabilities in Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge before 2015-01-08 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the referrer parameter.


Multiple open redirect vulnerabilities in the Aurora starter store in IBM WebSphere Commerce 7.0 through Feature Pack 8 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the referrer parameter.


Multiple open redirect vulnerabilities in u5CMS before 3.9.4 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) pidvesa cookie to u5admin/pidvesa.php or (2) uri parameter to u5admin/meta2.php.


Multiple open redirect vulnerabilities in CubeCart 3.0.20 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) r parameter to switch.php or (2) goto parameter to admin/login.php.


Multiple open redirect vulnerabilities in Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.30 and 1.7.x before 1.7.8 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.


Multiple open redirect vulnerabilities in Jenkins before 2.3 and LTS before 1.651.2 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors related to \scheme-relative\ URLs.


Multiple open redirect vulnerabilities in Joomla! 1.5 before 1.5.7 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a \passed in\ URL.


An open redirect vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 via the /__r1/ returnURL parameter allows an unauthenticated remote attacker to redirect users to arbitrary web sites.


An open redirect vulnerability was discovered in Zoho ManageEngine ADSelfService Plus 5.x before 5809 that allows attackers to force users who click on a crafted link to be sent to a specified external site.


An open redirect vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows attackers to redirect users to a URL outside Jenkins after successful login.


An open redirect vulnerability exists in Nagios XI before version 5.8.5 that could lead to spoofing. To exploit the vulnerability an attacker could send a link that has a specially crafted URL and convince the user to click the link.


An open redirect vulnerability exists in BF-630 BF-450M BF-430 BF-431 BF631-W BF830-W Webpass and SEMAC devices from CHIYU Technology that can be exploited by sending a link that has a specially crafted URL to convince the user to click on it.


An open redirect vulnerability in Ilch CMS version 2.1.42 allows attackers to redirect users to an attacker's site after a successful login.


An open redirect vulnerability in Fortinet FortiPortal 4.0.0 and below allows attacker to execute unauthorized code or commands via the url parameter.


An open redirect vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows attackers to redirect users to an arbitrary URL after successful login.


An open redirect vulnerability exists in the Access Manager Identity Provider prior to 4.4 SP3.


An open redirect vulnerability in the administrative interface of the B. Braun Melsungen AG SpaceCom device Version L81/U61 and earlier and the Data module compactplus Versions A10 and A11 allows attackers to redirect users to malicious websites.


Philips Holter 2010 Plus all versions. A vulnerability has been identified that may allow system options that were not purchased to be enabled.


Possible out of bound memory access while playing a crafted clip in media player in Snapdragon Auto Snapdragon Compute Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables in SM8150


Possible out of bound read due to lack of length check of FT sub-elements in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music


Possible out of bound memory access due to improper boundary check while creating HSYNC fence in Snapdragon Auto Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Wearables


Possible out of bound read due to improper validation of packet length while handling data transfer in VR service in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Wearables


Possible out of bound read or write in VR service due to lack of validation of DSP selection values in Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT


Possible out of bound read due to lack of domain input validation while processing APK close session request in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Industrial IOT Snapdragon Wearables


Possible out of bound access due to lack of validation of page offset before page is inserted in Snapdragon Auto Snapdragon Connectivity Snapdragon Industrial IOT Snapdragon Mobile


In all Android releases from CAF using the Linux kernel an out of bounds access can potentially occur in a camera function.


In all android releases (Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel while relocating kernel images with a specially crafted boot image an out of bounds access can occur.


In all android releases(Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel A use after free condition and an out-of-bounds access can occur in the DIAG driver.


In all android releases (Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel improper length check can lead to out-of-bounds access in WLAN function.


In all Qualcomm products with Android releases from CAF using the Linux kernel array out of bounds access can occur if userspace sends more than 16 multicast addresses.


Out of bound access due to lack of check of whiltelist array size while reading the image elf segments. in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Wired Infrastructure and Networking in MDM9205 QCS404 QCS605 SDA845 SDM670 SDM710 SDM845 SDM850 SDX24 SDX55 SM6150 SM7150 SM8150 SXR1130 SXR2130


Out

of

bound

access

when

reason

code

is

extracted

from

frame

data

without

validating

the

frame

length

in

Snapdragon

Auto

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

in

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


When ADSP is compromised the audio port index that`s returned from ADSP might be out of the valid range and leads to out of boundary access in Snapdragon Auto Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon IoT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables in MDM9150 MDM9206 MDM9607 MDM9615 MDM9640 MDM9650 MSM8909W SD 210/SD 212/SD 205 SD 425 SD 427 SD 430 SD 435 SD 450 SD 600 SD 615/16/SD 415 SD 625 SD 665 SD 675 SD 712 / SD 710 / SD 670 SD 730 SD 820 SD 820A SD 845 / SD 850 SD 855 SDX20 SDX24


Out

of

bound

access

can

occur

due

to

buffer

copy

without

checking

size

of

input

received

from

WLAN

firmware

in

Snapdragon

Auto

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

in

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


Data

token

is

received

from

ADSP

and

is

used

without

validation

as

an

index

into

the

array

leads

to

out

of

bound

access

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Qualcomm

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


In the Lustre file system before 2.12.3 the mdt module has an out-of-bounds access and panic due to the lack of validation for specific fields of packets sent by a client. mdt_file_secctx_unpack does not validate the value of name_size derived from req_capsule_get_size.


In the Lustre file system before 2.12.3 the ptlrpc module has an osd_map_remote_to_local out-of-bounds access and panic due to the lack of validation for specific fields of packets sent by a client. osd_bufs_get in the osd_ldiskfs module does not validate a certain length value.


In all android releases(Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel Possibility of accessing out of bound vector index When updating some GNSS configurations.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 425 SD 430 SD 450 and SD 625 in a QTEE API function an array out-of-bounds index can occur.


In all android releases (Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel while processing a gpt update an out of bounds memory access may potentially occur.


In all Android releases from CAF using the Linux kernel while processing a voice SVC request which is nonstandard by specifying a payload size that will overflow its own declared size an out of bounds memory copy occurs.


In radare 2.0.1 an out-of-bounds read vulnerability exists in string_scan_range() in libr/bin/bin.c when doing a string search.


In ImageMagick 7.0.9 an out-of-bounds read vulnerability exists within the ReadHEICImageByID function in coders\\heic.c. It can be triggered via an image with a width or height value that exceeds the actual size of the image.


In libsndfile version 1.0.28 an error in the \aiff_read_chanmap()\ function (aiff.c) can be exploited to cause an out-of-bounds read memory access via a specially crafted AIFF file.


In uClibc 0.9.33.2 there is an out-of-bounds read in the get_subexp function in misc/regex/regexec.c when processing a crafted regular expression.


In JerryScript 2.3.0 there is an out-of-bounds read in main_print_unhandled_exception in the main-utils.c file.


njs through 0.4.3 used in NGINX has an out-of-bounds read in njs_lvlhsh_level_find in njs_lvlhsh.c.


njs through 0.4.3 used in NGINX has an out-of-bounds read in njs_json_stringify_iterator in njs_json.c.


Processing a maliciously crafted font may result in the disclosure of process memory. This issue is fixed in macOS Big Sur 11.4 tvOS 14.6 watchOS 7.5. An out-of-bounds read was addressed with improved input validation.


The affected product is vulnerable to an out-of-bounds read which may result in code execution


The affected product is vulnerable to an out-of-bounds read which may result in disclosure of sensitive information.


The affected product is vulnerable to an out-of-bounds read while processing project files which allows an attacker to craft a project file that would allow arbitrary code execution.


The affected product is vulnerable to an out-of-bounds read which may allow an attacker to obtain and disclose sensitive data information or cause the device to crash on the OPC UA Tunneller (versions prior to 6.3.0.8233).


Adobe After Effects versions 17.1 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to arbitrary code execution .


Ming (aka libming) 0.4.8 has an out of bounds read vulnerability in the function OpCode() in the decompile.c file in libutil.a.


In all android releases(Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel while processing the boot image header an out of bounds read can occur in boot.


In all android releases (Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel while processing diag event after associating to a network out of bounds read occurs if ssid of the network joined is greater than max limit.


In all android releases (Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel while processing start bss request from upper layer out of bounds read occurs if ssid length is greater than maximum.


In all Qualcomm products with Android releases from CAF using the Linux kernel the length of the MAC address is not checked which may cause out of bounds read.


In all Qualcomm products with Android releases from CAF using the Linux kernel due to an off-by-one error in a camera driver an out-of-bounds read/write can occur.


OpenJPEG 1.5.1 allows remote attackers to obtain sensitive information via unspecified vectors that trigger a heap-based out-of-bounds read.


** DISPUTED ** An issue was discovered in Jansson through 2.13.1. Due to a parsing error in json_loads there's an out-of-bounds read-access bug. NOTE: the vendor reports that this only occurs when a programmer fails to follow the API specification.


In BlueZ 5.42 an out-of-bounds read was observed in \le_meta_ev_dump\ function in \tools/parser/hci.c\ source file. This issue exists because 'subevent' (which is used to read correct element from 'ev_le_meta_str' array) is overflowed.


In BlueZ 5.42 an out-of-bounds read was identified in \packet_hexdump\ function in \monitor/packet.c\ source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.


Off-by-one error in the gst_h264_parse_set_caps function in GStreamer before 1.10.2 allows remote attackers to have unspecified impact via a crafted file which triggers an out-of-bounds read.


A component of the HarmonyOS has a Out-of-bounds Read vulnerability. Local attackers may exploit this vulnerability to cause system Soft Restart.


A component of the HarmonyOS has a Out-of-bounds Read vulnerability. Local attackers may exploit this vulnerability to cause kernel out-of-bounds read.


Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an out-of-bounds read which may allow an attacker to read sensitive information from other memory locations or cause a crash.


An error within the \nikon_coolscan_load_raw()\ function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.9 can be exploited to cause an out-of-bounds read memory access and subsequently cause a crash.


An error within the \kodak_radc_load_raw()\ function (internal/dcraw_common.cpp) related to the \buf\ variable in LibRaw versions prior to 0.18.7 can be exploited to cause an out-of-bounds read memory access and subsequently cause a crash.


An error within the \samsung_load_raw()\ function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.9 can be exploited to cause an out-of-bounds read memory access and subsequently cause a crash.


In Exiv2 0.26 an out-of-bounds read in IptcData::printStructure in iptc.c could result in a crash or information leak related to the \== 0x1c\ case.


A flaw was found in RPM's hdrblobInit() in lib/header.c. This flaw allows an attacker who can modify the rpmdb to cause an out-of-bounds read. The highest threat from this vulnerability is to system availability.


A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ShiftBytes. The highest threat from this vulnerability is to data confidentiality and to the service availability.


A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function WebPMuxCreateInternal. The highest threat from this vulnerability is to data confidentiality and to the service availability.


A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ApplyFilter. The highest threat from this vulnerability is to data confidentiality and to the service availability.


A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkVerifyAndAssign. The highest threat from this vulnerability is to data confidentiality and to the service availability.


A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkAssignData. The highest threat from this vulnerability is to data confidentiality and to the service availability.


In FreeRDP less than or equal to 2.0.0 there is an out-of-bounds read in rfx_process_message_tileset. Invalid data fed to RFX decoder results in garbage on screen (as colors). This has been patched in 2.1.0.


In GNU Libextractor 1.4 there is an out-of-bounds read in the EXTRACTOR_dvi_extract_method function in plugins/dvi_extractor.c.


OpenCV 4.1.1 has an out-of-bounds read in hal_baseline::v_load in core/hal/intrin_sse.hpp when called from computeSSDMeanNorm in modules/video/src/dis_flow.cpp.


Ming 0.4.8 has an out-of-bounds read vulnerability in the function newVar_N() in decompile.c which causes a huge information leak.


LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field.


ImageMagick 7.0.6-1 has an out-of-bounds read vulnerability in ReadOneMNGImage in coders/png.c.


There is a Out-of-bounds Read vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash.


There is a Out-of-bounds Read vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to availability affected.


There is a Out-of-bounds Read vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to process crash.


There is an Improper verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause out-of-bounds read.


There is an Out-of-bounds read in Smartphones.Successful exploitation of this vulnerability may affect service confidentiality.


There is an Out-of-bounds read vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may affect service availability.


There is an Out-of-bounds read vulnerability in Smartphone.Successful exploitation of this vulnerability may affect service confidentiality.


There is an Out-of-bounds read vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause out-of-bounds memory access.


vim is vulnerable to Out-of-bounds Read


libmobi is vulnerable to Out-of-bounds Read


radare2 is vulnerable to Out-of-bounds Read


In macOS High Sierra before 10.13.5 an out-of-bounds read was addressed with improved input validation.


In macOS High Sierra before 10.13.3 Security Update 2018-001 Sierra and Security Update 2018-001 El Capitan an out-of-bounds read was addressed with improved input validation.


MediaTek microchips as used in NETGEAR devices through 2021-11-11 and other devices mishandle IEEE 1905 protocols. (Affected Chipsets MT7603E MT7613 MT7615 MT7622 MT7628 MT7629 MT7915; Affected Software Versions 2.0.2; Out-of-bounds read).


OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds read error in the function icvCvt_BGRA2BGR_8u_C4C3R when reading an image file by using cv::imread.


In avrc_pars_browse_rsp of avrc_pars_ct.cc there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-8.0 Android-8.1 Android-9. Android ID: A-111451066.


Possibility of out-of-bound read if id received from SPI is not in range of FIFO in Snapdragon Auto Snapdragon Compute Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Wearables Snapdragon Wired Infrastructure and Networking in IPQ4019 IPQ8064 MSM8909W MSM8996AU QCA9980 QCS605 Qualcomm 215 SD 425 SD 439 / SD 429 SD 450 SD 625 SD 632 SD 636 SD 712 / SD 710 / SD 670 SD 820A SD 845 / SD 850 SD 855 SDM439 SDM660 SDX24


Out of bound read can happen due to lack of NULL termination on user controlled data in WLAN in Snapdragon Auto Snapdragon Compute Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music in MSM8996AU QCS405 QCS605 SD 210/SD 212/SD 205 SD 425 SD 427 SD 430 SD 435 SD 450 SD 625 SD 636 SD 665 SD 675 SD 712 / SD 710 / SD 670 SD 730 SD 820A SD 835 SD 845 / SD 850 SD 855 SDA660 SDM630 SDM660 SDX24


Possible out of bound read occurs while processing beaconing request due to lack of check on action frames received from user controlled space in Snapdragon Auto Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Mobile Snapdragon Voice & Music in MDM9607 MSM8996AU QCA6174A QCA6574AU QCA9377 QCA9379 QCS405 QCS605 SD 636 SD 665 SD 675 SD 712 / SD 710 / SD 670 SD 730 SD 820A SD 845 / SD 850 SD 855 SDM630 SDM660 SDX24


LibreSSL 2.9.1 through 3.2.1 has an out-of-bounds read in asn1_item_print_ctx (called from asn1_template_print_ctx).


** DISPUTED ** Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable a running Unbound installation cannot be remotely or locally exploited.


The implementations of streams for bz2 and php://output improperly implemented their readImpl functions returning -1 consistently. This behavior caused some stream functions such as stream_get_line to trigger an out-of-bounds read when operating on such malformed streams. The implementations were updated to return valid values consistently. This affects all supported versions of HHVM (3.30 and 3.27.4 and below).


libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number and `len` is set to 5 then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller.


QEMU through version 2.10 and through version 3.1.0 is vulnerable to an out-of-bounds read of up to 128 bytes in the hw/i2c/i2c-ddc.c:i2c_ddc() function. A local attacker with permission to execute i2c commands could exploit this to read stack memory of the qemu process on the host.


An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \\X is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications that use PCRE to parse untrusted input may be vulnerable to this flaw which would allow an attacker to crash the application. The flaw occurs in do_extuni_no_utf in pcre2_jit_compile.c.


An issue was discovered on Samsung mobile devices with P(9.0) (Exynos chipsets) software. The Wi-Fi kernel drivers have an out-of-bounds Read. The Samsung IDs are SVE-2019-15692 SVE-2019-15693 (December 2019).


nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab).


An issue was discovered on Samsung mobile devices with N(7.x) O(8.x) and P(9.0) (Broadcom chipsets) software. An out-of-bounds Read in the Wi-Fi vendor command leads to an information leak. The Samsung ID is SVE-2019-14869 (November 2019).