An information disclosure vulnerability in kernel components including the ION subsystem Binder USB driver and networking subsystem could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10. Android ID: A-31495348.


The kernel in Microsoft Windows 10 Gold 1511 and 1607 and Windows Server 2016 mishandles page-fault system calls which allows local users to obtain sensitive information from arbitrary processes via a crafted application aka \Windows Kernel Memory Address Information Disclosure Vulnerability.\


An information disclosure vulnerability was found in JBoss Enterprise Application Platform before 7.0.4. It was discovered that when configuring RBAC and marking information as sensitive users with a Monitor role are able to view the sensitive information.


The Common Log File System (CLFS) driver in Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 and 1607 and Windows Server 2016 allows local users to obtain sensitive information from process memory via a crafted application aka \Windows Common Log File System Driver Information Disclosure Vulnerability.\


The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to determine the existence of local files via unspecified vectors aka \Microsoft Browser Information Disclosure Vulnerability.\


The Data Provider for SQL Server in Microsoft .NET Framework 4.6.2 mishandles a developer-supplied key which allows remote attackers to bypass the Always Encrypted protection mechanism and obtain sensitive cleartext information by leveraging key guessability aka \.NET Information Disclosure Vulnerability.\


The GDI component in Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Office for Mac 2011 and Office 2016 for Mac allows remote attackers to obtain sensitive information from process memory via a crafted web site aka \GDI Information Disclosure Vulnerability.\


Bowser.sys in the kernel-mode drivers in Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 and 1607 and Windows Server 2016 allows local users to obtain sensitive information via a crafted application aka \Windows Bowser.sys Information Disclosure Vulnerability.\


The kernel-mode drivers in Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 and 1607 and Windows Server 2016 allow local users to bypass the ASLR protection mechanism via a crafted application aka \Win32k Information Disclosure Vulnerability.\


atmfd.dll in Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 and 1607 and Windows Server 2016 allows remote attackers to obtain sensitive information from process memory via a crafted Open Type font on a web site aka \Open Type Font Information Disclosure Vulnerability.\


Virtual Secure Mode in Microsoft Windows 10 allows local users to obtain sensitive information via a crafted application aka \Virtual Secure Mode Information Disclosure Vulnerability.\


The Crypto driver in Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 and 1607 and Windows Server 2016 allows local users to obtain sensitive information via a crafted application aka \Windows Crypto Driver Information Disclosure Vulnerability.\


Microsoft SQL Server 2016 mishandles the FILESTREAM path which allows remote authenticated users to gain privileges via unspecified vectors aka \SQL Analysis Services Information Disclosure Vulnerability.\


An information disclosure vulnerability in the Qualcomm power driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10 Kernel-3.18. Android ID: A-33621829. References: QC-CR#1105481.


An information disclosure vulnerability in the Qualcomm LED driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-33781694. References: QC-CR#1109326.


An information disclosure vulnerability in the Qualcomm video driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10. Android ID: A-33352393. References: QC-CR#1101943.


An information disclosure vulnerability in the Qualcomm shared memory driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10 Kernel-3.18. Android ID: A-33845464. References: QC-CR#1109782.


An information disclosure vulnerability in Qualcomm components including the camera driver and video driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10 Kernel-3.18. Android ID: A-30148242. References: QC-CR#1052821.


An information disclosure vulnerability in kernel components including the process-grouping subsystem and the networking subsystem in Android before 2016-11-05 could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Android ID: A-30149174.


An information disclosure vulnerability in the download manager in Android 5.0.x before 5.0.2 5.1.x before 5.1.1 6.x before 2016-11-01 and 7.0 before 2016-11-01 could enable a local malicious application to bypass operating system protections that isolate application data from other applications. This issue is rated as High because it could be used to gain access to data that the application does not have access to. Android ID: A-30537115.


An information disclosure vulnerability in Mediaserver in Android 6.x before 2016-11-01 and 7.0 before 2016-11-01 could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Android ID: A-30875060.


An information disclosure vulnerability in the NVIDIA GPU driver in Android before 2016-11-05 could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission. Android ID: A-30955105. References: NVIDIA N-CVE-2016-6746.


An information disclosure vulnerability in Qualcomm components including the GPU driver power driver SMSM Point-to-Point driver and sound driver in Android before 2016-11-05 could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Android ID: A-30741851. References: Qualcomm QC-CR#1058826.


An information disclosure vulnerability in the ih264d decoder in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 6.0 6.0.1 7.0. Android ID: A-30481714.


An information disclosure vulnerability in libstagefright in Mediaserver in Android 4.x before 4.4.4 5.0.x before 5.0.2 5.1.x before 5.1.1 6.x before 2016-11-01 and 7.0 before 2016-11-01 could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Android ID: A-29422020.


EMC RecoverPoint versions before 4.4.1.1 and EMC RecoverPoint for Virtual Machines versions before 5.0 are affected by sensitive information disclosure vulnerability as a result of incorrect permissions set on a sensitive system file. A malicious administrator with configuration privileges may access this sensitive system file and compromise the affected system.


An information disclosure vulnerability in Qualcomm components including the camera driver and video driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10 Kernel-3.18. Android ID: A-29464815. References: QC-CR#1042068.


An information disclosure vulnerability in Qualcomm components including the GPU driver power driver SMSM Point-to-Point driver and sound driver in Android before 2016-11-05 could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Android ID: A-31498159. References: Qualcomm QC-CR#987051.


An information disclosure vulnerability in libstagefright in Mediaserver in Android 4.x before 4.4.4 5.0.x before 5.0.2 5.1.x before 5.1.1 6.x before 2016-11-01 and 7.0 before 2016-11-01 could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Android ID: A-31091777.


An information disclosure vulnerability in Qualcomm components including the GPU driver power driver SMSM Point-to-Point driver and sound driver in Android before 2016-11-05 could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Android ID: A-30312054. References: Qualcomm QC-CR#1052825.


An information disclosure vulnerability in Qualcomm components including the GPU driver power driver SMSM Point-to-Point driver and sound driver in Android before 2016-11-05 could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Android ID: A-30076504. References: Qualcomm QC-CR#987018.


Information Disclosure vulnerability in the Dashboard and Error Pages in Trend Micro Control Manager SP3 6.0.


An information disclosure vulnerability in Qualcomm components including the GPU driver power driver SMSM Point-to-Point driver and sound driver in Android before 2016-11-05 could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Android ID: A-30902162. References: Qualcomm QC-CR#1062271.


An information disclosure vulnerability in Qualcomm components including the GPU driver power driver SMSM Point-to-Point driver and sound driver in Android before 2016-11-05 could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Android ID: A-30228438. References: Qualcomm QC-CR#1052818.


An information disclosure vulnerability in Package Manager could enable a local malicious application to bypass operating system protections that isolate application data from other applications. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: 7.0. Android ID: A-31251489.


This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of HDFS. A local user on an HDFS DataNode may be able to craft a block token that grants unauthorized read access to random files by guessing certain fields in the token.


IBM WebSphere Commerce Enterprise Professional Express and Developer 7.0 and 8.0 is vulnerable to information disclosure vulnerability. A local user could view a plain text password in a Unix console. IBM Reference #: 1997408.


The ServiceNow driver in NetIQ Identity Manager versions prior to 4.6 are susceptible to an information disclosure vulnerability.


Volume Manager Driver in Microsoft Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT 8.1 does not properly check whether RemoteFX RDP USB disk accesses originate from the user who mounted a disk which allows local users to read arbitrary files on these disks via RemoteFX requests aka \Remote Desktop Protocol Drive Redirection Information Disclosure Vulnerability.\


Outlook Web Access (OWA) in Microsoft Exchange Server 2013 SP1 Cumulative Update 11 and Cumulative Update 12 and 2016 Gold and Cumulative Update 1 does not properly restrict loading of IMG elements which makes it easier for remote attackers to track users via a crafted HTML e-mail message aka \Microsoft Exchange Information Disclosure Vulnerability.\


GDI in Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 and Windows 10 Gold and 1511 allows remote attackers to obtain sensitive information via a crafted document aka \Windows Graphics Component Information Disclosure Vulnerability \ a different vulnerability than CVE-2016-0168.


The kernel-mode drivers in Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 and Windows 10 Gold and 1511 allow local users to obtain sensitive information about kernel-object addresses and consequently bypass the KASLR protection mechanism via a crafted application aka \Win32k Information Disclosure Vulnerability.\


The Visual Basic macros in Microsoft Office 2007 SP3 2010 SP2 2013 SP1 and 2016 export a certificate-store private key during a document-save operation which allows attackers to obtain sensitive information via unspecified vectors aka \Microsoft Information Disclosure Vulnerability.\


EMC PowerPath Virtual (Management) Appliance 2.0 EMC PowerPath Virtual (Management) Appliance 2.0 SP1 is affected by a sensitive information disclosure vulnerability that may potentially be exploited by malicious users to compromise the affected system.


GDI in Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 and Windows 10 Gold and 1511 allows remote attackers to obtain sensitive information via a crafted document aka \Windows Graphics Component Information Disclosure Vulnerability \ a different vulnerability than CVE-2016-0169.


WinForms in Microsoft .NET Framework 2.0 SP2 3.5 3.5.1 4.5.2 4.6 and 4.6.1 allows remote attackers to obtain sensitive information from process memory via crafted icon data aka \Windows Forms Information Disclosure Vulnerability.\


The Hyperlink Object Library in Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from process memory via a crafted URL in a (1) e-mail message or (2) Office document aka \Internet Explorer Information Disclosure Vulnerability.\


Microsoft Edge mishandles the Referer policy which allows remote attackers to obtain sensitive browser-history and request information via a crafted HTTPS web site aka \Microsoft Edge Information Disclosure Vulnerability.\


Hyper-V in Microsoft Windows 8.1 Windows Server 2012 Gold and R2 and Windows 10 allows guest OS users to obtain sensitive information from host OS memory via a crafted application aka \Hyper-V Information Disclosure Vulnerability.\


Hyper-V in Microsoft Windows 8.1 Windows Server 2012 R2 and Windows 10 allows guest OS users to obtain sensitive information from host OS memory via a crafted application aka \Hyper-V Information Disclosure Vulnerability.\


Microsoft Exchange Server 2007 SP3 2010 SP3 2013 SP1 2013 Cumulative Update 12 2013 Cumulative Update 13 2016 Cumulative Update 1 and 2016 Cumulative Update 2 misparses e-mail messages which allows remote authenticated users to obtain sensitive Outlook application information by leveraging the Send As right aka \Microsoft Exchange Information Disclosure Vulnerability.\


Microsoft Internet Explorer 10 and 11 load different files for attempts to open a file:// URL depending on whether the file exists which allows local users to enumerate files via vectors involving a file:// URL and an HTML5 sandbox iframe aka \Internet Explorer Information Disclosure Vulnerability.\


GDI32.dll in the Graphics component in Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 and Windows 10 Gold and 1511 allows remote attackers to bypass the ASLR protection mechanism via unspecified vectors aka \Windows Graphics Component Information Disclosure Vulnerability.\


The GDI component in the kernel-mode drivers in Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 and Windows 10 Gold and 1511 allows local users to obtain sensitive kernel-address information via a crafted application aka \Win32k Information Disclosure Vulnerability.\


Microsoft .NET Framework 2.0 SP2 3.5 3.5.1 4.5.2 4.6 and 4.6.1 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference related to an XML External Entity (XXE) issue aka \.NET Information Disclosure Vulnerability.\


An information disclosure vulnerability in Qualcomm components including the GPU driver power driver SMSM Point-to-Point driver and sound driver in Android before 2016-11-05 could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Android ID: A-30593266. References: Qualcomm QC-CR#1054352.


The Virtual PCI (VPCI) virtual service provider in Microsoft Windows Server 2012 Gold and R2 allows local users to obtain sensitive information from uninitialized memory locations via a crafted application aka \Windows Virtual PCI Information Disclosure Vulnerability.\


An information disclosure vulnerability in Qualcomm components including the GPU driver power driver SMSM Point-to-Point driver and sound driver in Android before 2016-11-05 could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Android ID: A-30445973. References: Qualcomm QC-CR#1054344.


Microsoft Windows 8.1 Windows RT 8.1 and Windows 10 Gold 1511 and 1607 do not properly check NTLM SSO requests for MSA logins which makes it easier for remote attackers to determine passwords via a brute-force attack on NTLM password hashes aka \Microsoft Information Disclosure Vulnerability.\


Microsoft Internet Explorer 9 through 11 and the Internet Messaging API in Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 and Windows 7 SP1 allow remote attackers to determine the existence of arbitrary files via a crafted web site aka \Internet Explorer Information Disclosure Vulnerability.\


The VBScript engine in Microsoft Edge allows remote attackers to obtain sensitive information from process memory via a crafted web site aka \Scripting Engine Information Disclosure Vulnerability.\


An information disclosure vulnerability in the Core and Management Console in BlackBerry Enterprise Server (BES) 12 through 12.5.2 allows remote attackers to obtain local or domain credentials of an administrator or user account by sniffing traffic between the two elements during a login attempt.


Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold 1511 and 1607; Office 2007 SP3; Office 2010 SP2; Word Viewer; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Lync 2010 Attendee; and Live Meeting 2007 Console allows remote attackers to bypass the ASLR protection mechanism via unspecified vectors aka \GDI+ Information Disclosure Vulnerability \ a different vulnerability than CVE-2016-3262.


The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 and Windows 10 Gold 1511 and 1607 allows local users to bypass the ASLR protection mechanism via a crafted application aka \GDI Information Disclosure Vulnerability.\


Microsoft Windows 8.1 Windows Server 2012 Gold and R2 Windows 10 Gold and 1511 and Microsoft Edge allow remote attackers to obtain sensitive information from process memory via a crafted PDF document aka \Windows PDF Information Disclosure Vulnerability \ a different vulnerability than CVE-2016-3215.


Microsoft Windows 10 Gold and 1511 allows local users to bypass the Secure Kernel Mode protection mechanism and obtain sensitive information via a crafted application aka \Windows Secure Kernel Mode Information Disclosure Vulnerability.\


Microsoft Word 2007 SP3 Office 2010 SP2 Word 2010 SP2 Office Compatibility Pack SP3 Word Viewer Word Automation Services on SharePoint Server 2010 SP2 Word Automation Services on SharePoint Server 2013 SP1 Office Web Apps 2010 SP2 and Office Web Apps Server 2013 SP1 allow remote attackers to obtain sensitive information from process memory via a crafted Office document aka \Microsoft Office Information Disclosure Vulnerability.\


The XSS Filter in Microsoft Internet Explorer 9 through 11 and Microsoft Edge does not properly restrict JavaScript code which allows remote attackers to obtain sensitive information via a crafted web site aka \Microsoft Browser Information Disclosure Vulnerability.\


Graphics

Device

Interface

(aka

GDI

or

GDI+)

in

Microsoft

Windows

Vista

Windows

Server

and

Windows

Windows

Windows

Server

Gold

and

Windows

RT

Windows

Gold

and

Office

Office

Word

Viewer;

Skype

for

Business

Lync

Lync

Lync

Attendee;

Live

Meeting

Console;

.NET

Framework

and

and

Silverlight

allows

remote

attackers

to

bypass

the

ASLR

protection

mechanism

via

unspecified

vectors

aka

\True

Type

Font

Parsing

Information

Disclosure

Vulnerability.\


The Secure Kernel Mode feature in Microsoft Windows 10 Gold and 1511 allows local users to obtain sensitive information via a crafted application aka \Windows Secure Kernel Mode Information Disclosure Vulnerability.\


Microsoft Windows 8.1 Windows Server 2012 Gold and R2 Windows 10 1511 and Microsoft Edge allow remote attackers to obtain sensitive information from process memory via a crafted PDF document aka \Windows PDF Information Disclosure Vulnerability \ a different vulnerability than CVE-2016-3201.


The kernel in Microsoft Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 and Windows 10 Gold and 1511 mishandles page-fault system calls which allows local users to obtain sensitive information from an arbitrary process via a crafted application aka \Windows Kernel Information Disclosure Vulnerability.\


The PDF library in Microsoft Edge Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 and Windows 10 Gold 1511 and 1607 allows remote attackers to obtain sensitive information via a crafted web site aka \PDF Library Information Disclosure Vulnerability \ a different vulnerability than CVE-2016-3370.


The PDF library in Microsoft Edge Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 and Windows 10 Gold 1511 and 1607 allows remote attackers to obtain sensitive information via a crafted web site aka \PDF Library Information Disclosure Vulnerability \ a different vulnerability than CVE-2016-3374.


An information disclosure vulnerability in the logging implementation of BlackBerry Good Control Server versions earlier than 2.3.53.62 allows remote attackers to gain and use logged encryption keys to access certain resources within a customer's Good deployment by gaining access to certain diagnostic log files through either a valid logon or an unrelated compromise of the server.


Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold 1511 and 1607; Office 2007 SP3; Office 2010 SP2; Word Viewer; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Lync 2010 Attendee; and Live Meeting 2007 Console allows remote attackers to bypass the ASLR protection mechanism via unspecified vectors aka \GDI+ Information Disclosure Vulnerability \ a different vulnerability than CVE-2016-3263.


Microsoft Internet Explorer allows remote attackers to bypass cross-domain security restrictions and obtain sensitive information by using the @import directive to download files from other domains that are not valid Cascading Style Sheets (CSS) files as demonstrated using Google Desktop aka \CSSXSS\ and \CSS Cross-Domain Information Disclosure Vulnerability.\


Microsoft Internet Explorer 6 and 7 does not properly determine the domain or security zone of origin of web script which allows remote attackers to bypass the intended cross-domain security policy and obtain sensitive information via a crafted HTML document aka \Cross-Domain Information Disclosure Vulnerability.\


The MHTML protocol handler in a component of Microsoft Outlook Express 5.5 SP2 and 6 through SP1 and Windows Mail does not assign the correct Internet Explorer Security Zone to UNC share pathnames which allows remote attackers to bypass intended access restrictions and read arbitrary files via an mhtml: URI in conjunction with a redirection aka \URL Parsing Cross-Domain Information Disclosure Vulnerability.\


Information Disclosure vulnerability in the 802.11 stack as used in FreeBSD before 8.2 and NetBSD when using certain non-x86 architectures. A signedness error in the IEEE80211_IOC_CHANINFO ioctl allows a local unprivileged user to cause the kernel to copy large amounts of kernel memory back to the user disclosing potentially sensitive information.


Microsoft Internet Explorer 9 and earlier does not properly restrict cross-zone drag-and-drop actions which allows user-assisted remote attackers to read cookie files via vectors involving an IFRAME element with a SRC attribute containing an http: URL that redirects to a file: URL as demonstrated by a Facebook game related to a \cookiejacking\ issue aka \Drag and Drop Information Disclosure Vulnerability.\ NOTE: this vulnerability exists because of an incomplete fix in the Internet Explorer 9 release.


Microsoft Internet Explorer 6 through 9 does not properly use the Content-Disposition HTTP header to control rendering of the HTTP response body which allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site aka \Content-Disposition Information Disclosure Vulnerability.\


Android SQLite Journal before 4.0.1 has an information disclosure vulnerability.


Microsoft Internet Explorer 6 7 and 8 does not enforce intended domain restrictions on content access which allows remote attackers to obtain sensitive information or conduct clickjacking attacks via a crafted web site aka \Frame Tag Information Disclosure Vulnerability.\


Microsoft Internet Explorer 6 through 8 does not properly restrict web script which allows user-assisted remote attackers to obtain sensitive information from a different (1) domain or (2) zone via vectors involving a drag-and-drop operation aka \Drag and Drop Information Disclosure Vulnerability.\


Microsoft Internet Explorer 6 through 9 does not properly implement JavaScript event handlers which allows remote attackers to access content from a different (1) domain or (2) zone via unspecified script code aka \Event Handlers Information Disclosure Vulnerability.\


Microsoft Internet Explorer 6 and 7 does not properly restrict script access to content from a (1) different domain or (2) different zone which allows remote attackers to obtain sensitive information via a crafted web site aka \Javascript Information Disclosure Vulnerability.\


The XSS Filter in Microsoft Internet Explorer 8 allows remote attackers to read content from a different (1) domain or (2) zone via a \trial and error\ attack aka \XSS Filter Information Disclosure Vulnerability.\


The ASP.NET Chart controls in Microsoft .NET Framework 4 and Chart Control for Microsoft .NET Framework 3.5 SP1 do not properly verify functions in URIs which allows remote attackers to read arbitrary files via special characters in a URI in an HTTP request aka \Chart Control Information Disclosure Vulnerability.\


Microsoft Internet Explorer 8 does not properly handle content settings in HTTP responses which allows remote web servers to obtain sensitive information from a different (1) domain or (2) zone via a crafted response aka \MIME Sniffing Information Disclosure Vulnerability.\


Microsoft Internet Explorer 10 and 11 allows remote attackers to read local files on the client via a crafted web site aka \Internet Explorer Information Disclosure Vulnerability.\


Microsoft Internet Explorer 10 and 11 allows remote attackers to read arbitrary local files via a crafted pathname aka \Internet Explorer Information Disclosure Vulnerability.\


Microsoft Internet Explorer 10 and 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site aka \Information Disclosure Vulnerability.\


Microsoft Internet Explorer 10 and 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site aka \Internet Explorer Information Disclosure Vulnerability.\


Microsoft Internet Explorer 10 and 11 allows remote attackers to bypass file permissions and obtain sensitive information via a crafted web site aka \Internet Explorer Information Disclosure Vulnerability.\


Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site aka \Microsoft Browser Information Disclosure Vulnerability.\


Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow context-dependent attackers to discover credentials by leveraging access to a memory dump aka \Microsoft Browser Information Disclosure Vulnerability.\


Microsoft Internet Explorer 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site aka \Internet Explorer Information Disclosure Vulnerability.\


Microsoft Internet Explorer 11 allows remote attackers to obtain sensitive information from process memory via crafted parameters in an ArrayBuffer.slice call aka \Internet Explorer Information Disclosure Vulnerability.\


Microsoft Internet Explorer 11 allows remote attackers to obtain sensitive information via a crafted web site aka \Internet Explorer Information Disclosure Vulnerability.\


Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site aka \Microsoft Browser Information Disclosure Vulnerability.\


Microsoft Internet Explorer 11 and Microsoft Edge mishandle cross-origin requests which allows remote attackers to obtain sensitive information via a crafted web site aka \Microsoft Browser Information Disclosure Vulnerability.\


Microsoft Internet Explorer 6 through 8 does not properly restrict data access by VBScript which allows remote attackers to perform cross-domain reading of JSON files via a crafted web site aka \JSON Array Information Disclosure Vulnerability.\


Microsoft Internet Explorer 6 through 8 allows remote attackers to read content from a different (1) domain or (2) zone via crafted characters in Cascading Style Sheets (CSS) token sequences aka \Internet Explorer Information Disclosure Vulnerability.\


Microsoft Internet Explorer 6 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site aka \Internet Explorer Cross-domain Information Disclosure Vulnerability.\


Microsoft Internet Explorer 6 through 11 allows remote attackers to determine the existence of local files via a crafted module-resource request aka \Internet Explorer Information Disclosure Vulnerability.\


Microsoft Internet Explorer 6 through 11 allows remote attackers to determine the existence of local files via a crafted stylesheet aka \Internet Explorer Information Disclosure Vulnerability.\


Microsoft Internet Explorer 7 through 11 allows remote attackers to obtain sensitive clipboard information via a crafted web site aka \Internet Explorer Clipboard Information Disclosure Vulnerability.\


Microsoft Internet Explorer 7 through 11 allows user-assisted remote attackers to read the clipboard contents via crafted web script aka \Internet Explorer Clipboard Information Disclosure Vulnerability.\


Microsoft Internet Explorer 8 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site aka \Internet Explorer Cross-domain Information Disclosure Vulnerability.\


Microsoft Internet Explorer 8 through 11 allows remote attackers to obtain sensitive browsing-history information via vectors related to image caching aka \Internet Explorer Information Disclosure Vulnerability.\


Microsoft Internet Explorer 9 and 10 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site aka \Internet Explorer Cross-domain Information Disclosure Vulnerability.\


Microsoft Internet Explorer 9 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site aka \Internet Explorer Cross-domain Information Disclosure Vulnerability.\


Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site aka \Internet Explorer Information Disclosure Vulnerability.\


Microsoft Internet Explorer 9 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site aka \Internet Explorer Information Disclosure Vulnerability.\


Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site aka \Windows Hyperlink Object Library Information Disclosure Vulnerability.\


Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to bypass the Same Origin Policy and obtain sensitive window-state information via a crafted web site aka \Microsoft Browser Information Disclosure Vulnerability.\


Microsoft Internet Explorer 9 through 11 allows remote attackers to determine the existence of files via crafted JavaScript code aka \Internet Explorer Information Disclosure Vulnerability.\


Microsoft Internet Explorer 9 through 11 and Edge allow remote attackers to determine the existence of files via a crafted webpage aka \Internet Explorer Information Disclosure Vulnerability.\


Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to determine the existence of unspecified files via a crafted web site aka \Microsoft Browser Information Disclosure Vulnerability.\


Microsoft Internet Explorer 9 through 11 and Edge allow remote attackers to obtain sensitive information via a crafted web page aka \Microsoft Browser Information Disclosure Vulnerability \ a different vulnerability than CVE-2016-3327.


Microsoft Internet Explorer 9 through 11 and Edge allow remote attackers to obtain sensitive information via a crafted web page aka \Microsoft Browser Information Disclosure Vulnerability \ a different vulnerability than CVE-2016-3326.


Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site aka \Microsoft Browser Information Disclosure Vulnerability.\


The kernel in Microsoft Windows 10 Gold 1511 1607 1703 and Windows Server 2016 allows an authenticated attacker to obtain information via a specially crafted application aka \Microsoft Graphics Component Information Disclosure Vulnerability.\


Windows Remote Access Connection Manager Information Disclosure Vulnerability This CVE ID is unique from CVE-2021-33763 CVE-2021-34457.


Windows Remote Access Connection Manager Information Disclosure Vulnerability This CVE ID is unique from CVE-2021-33763 CVE-2021-34454.


Windows Remote Access Connection Manager Information Disclosure Vulnerability This CVE ID is unique from CVE-2021-34454 CVE-2021-34457.


Windows Remote Access Connection Manager Information Disclosure Vulnerability.


Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability This CVE ID is unique from CVE-2021-41371.


Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability This CVE ID is unique from CVE-2021-38631.


Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability


Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability.


Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability This CVE ID is unique from CVE-2021-26433 CVE-2021-36926 CVE-2021-36932.


Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability This CVE ID is unique from CVE-2021-26433 CVE-2021-36932 CVE-2021-36933.


Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability This CVE ID is unique from CVE-2021-26433 CVE-2021-36926 CVE-2021-36933.


Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability This CVE ID is unique from CVE-2021-36926 CVE-2021-36932 CVE-2021-36933.


Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability.


The vCenter Server contains a local information disclosure vulnerability in the Analytics service. An authenticated user with non-administrative privilege may exploit this issue to gain access to sensitive information.


The vCenter Server contains an information disclosure vulnerability due to an unauthenticated appliance management API. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information.


The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information.


Affected versions of Atlassian Fisheye allow remote attackers to view the HTTP password of a repository via an Information Disclosure vulnerability in the logging feature. The affected versions are before version 4.8.3.


Affected versions of Atlassian Fisheye and Crucible allow remote attackers to view a product's SEN via an Information Disclosure vulnerability in the x-asen response header from Atlassian Analytics. The affected versions are before version 4.8.4.


A vulnerability exists in the way the Windows Diagnostics & feedback settings app handles objects in memory aka 'Windows Diagnostics & feedback Information Disclosure Vulnerability'.


A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). The affected software has an information disclosure vulnerability that could allow an attacker to retrieve VPN connection for a known user.


A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). The affected software has an information disclosure vulnerability that could allow an attacker to retrieve a list of network devices a known user can manage.


Microsoft XML Core Services 3.0 5.0 and 6.0 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site aka \MSXML Information Disclosure Vulnerability.\


An information disclosure vulnerability exists in GitLab CE/EE <v12.3.2 <v12.2.6 and <v12.1.12 that allowed project milestones to be disclosed via groups browsing.


An information disclosure vulnerability exists in GitLab CE/EE <v12.3.2 <v12.2.6 and <v12.1.12 that allowed an attacker to view private system notes from a GraphQL endpoint.


An Information Disclosure vulnerability exists via a GET request in Vivotek PT7135 IP Camera 0300a and 0400a due to wireless keys and 3rd party credentials stored in clear text.


An Information Disclosure vulnerability exists in Netgear WNDR4700 running firmware 1.0.0.34 in the management web interface which discloses the PSK of the wireless LAN.


An information disclosure vulnerability in GitLab CE/EE versions 12.0 to 14.3.6 14.4 to 14.4.4 and 14.5 to 14.5.2 allowed non-project members to see the default branch name for projects that restrict access to the repository to project members


An information disclosure vulnerability in the GitLab CE/EE API since version 8.9.6 allows a user to see basic information on private groups that a public project has been shared with


An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with physical access to obtain the encryption key used to decrypt firmware update packages.


An information disclosure vulnerability was reported in the Time Weather system widget on Legion Phone Pro (L79031) and Legion Phone2 Pro (L70081) that could allow other applications to access device GPS data.


An Information Disclosure vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and earlier could allow an attacker to potentially gain access to a victim's web history.


An information disclosure vulnerability in GitLab EE versions 13.11 and later allowed a project owner to leak information about the members' on-call rotations in other projects


An information disclosure vulnerability in GitLab EE versions 13.10 and later allowed a user to read project details


An information disclosure vulnerability exists in the Rocket.Chat server fixed v3.13 v3.12.2 & v3.11.3 that allowed email addresses to be disclosed by enumeration and validation checks.


An information disclosure vulnerability exists in Draytek VigorConnect 1.6.0-B3 allowing an unauthenticated attacker to export system logs.


An information disclosure vulnerability CWE-200 in FortiAnalyzerVM and FortiManagerVM versions 7.0.0 and 6.4.6 and below may allow an authenticated attacker to read the FortiCloud credentials which were used to activate the trial license in cleartext.


An information disclosure vulnerability exists in the WiFi Smart Mesh functionality of D-LINK DIR-3040 1.13B03. A specially-crafted network request can lead to command execution. An attacker can connect to the MQTT service to trigger this vulnerability.


An information disclosure vulnerability exists in the Friend finder functionality of GmbH Komoot version 10.26.9 up to 11.1.11. A specially crafted series of network requests can lead to the disclosure of sensitive information.


An information disclosure vulnerability in Widevine TA log prior to SMR Oct-2021 Release 1 allows attackers to bypass the ASLR protection mechanism in TEE.


An information disclosure vulnerability in OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to retrieve the full list of participants of a non-public OnionShare node via the --chat feature.


An information disclosure vulnerability was discovered in /index.class.php (via port 8181) on NetWave System 1.0 which allows unauthenticated attackers to exfiltrate sensitive information from the system.


An information disclosure vulnerability exists in the Web Application functionality of Moxa MXView Series 3.2.4. Network sniffing can lead to a disclosure of sensitive information. An attacker can sniff network traffic to exploit this vulnerability.


An Information Disclosure vulnerability for JT files in Autodesk Inventor 2022 2021 2020 2019 may lead to code execution through maliciously crafted JT files.


An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET_RESTRICT control message which could let a malicious user obtain sensitive information.


An information disclosure vulnerability in Webadmin allows an unauthenticated remote attacker to read the device serial number in Sophos Firewall version v18.5 MR2 and older.


An

information

disclosure

vulnerability

in

the

Android

system

(activitymanagerservice).

Product:

Android.

Versions:

Android

ID


An information disclosure vulnerability in the Android media framework (libavc). Product: Android. Versions: 7.0 7.1.1 7.1.2 8.0 8.1. Android ID: A-64380237.


A

information

disclosure

vulnerability

in

the

Android

media

framework

(libhevc).

Product:

Android.

Versions:

Android

ID:


An information disclosure vulnerability in the Android media framework (libhevc). Product: Android. Versions: 7.0 7.1.1 7.1.2 8.0. Android ID: A-65123471.


An information disclosure vulnerability in the Android media framework (av) related to id3 unsynchronization. Product: Android. Versions: 7.0 7.1.1 7.1.2 8.0 8.1. Android ID: A-63100526.


An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0 7.1.1 7.1.2 8.0. Android ID A-65719872.


A information disclosure vulnerability in the Android framework (ui framework). Product: Android. Versions: 8.0. ID: A-66244132.


A

information

disclosure

vulnerability

in

the

Android

system

(ui).

Product:

Android.

Versions:

ID:


An information disclosure vulnerability in the kernel binder driver. Product: Android. Versions: Android kernel. Android ID A-36007193.


A information disclosure vulnerability in the Upstream kernel network driver. Product: Android. Versions: Android kernel. ID: A-36279469.


An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0 7.1.1 7.1.2 8.0. Android ID A-38328132.


An information disclosure vulnerability in the Android media framework (aac). Product: Android. Versions: 7.0 7.1.1 7.1.2 8.0 8.1. Android ID: A-65280786.


A

information

disclosure

vulnerability

in

the

Android

system

(bluetooth).

Product:

Android.

Versions:

ID:


A information disclosure vulnerability in the Broadcom bcmdhd driver. Product: Android. Versions: Android kernel. Android ID: A-71359108. References: B-V2018010501.


An information disclosure vulnerability in the kernel camera server. Product: Android. Versions: Android kernel. Android ID A-37512375.


An information disclosure vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 7.0 7.1.1 7.1.2 8.0 8.1. Android ID: A-64550583.


A

information

disclosure

vulnerability

in

the

Android

media

framework

(libavc).

Product:

Android.

Versions:

Android

ID:


An information disclosure vulnerability in the NVIDIA libwilhelm. Product: Android. Versions: Android kernel. Android ID A-64339309. References: N-CVE-2017-13175.


An

information

disclosure

vulnerability

in

the

Android

media

framework

(mediadrm).

Product:

Android.

Versions:

Android

ID:


An information disclosure vulnerability in the Android media framework (libmedia drm). Product: Android. Versions: 5.1.1 6.0 6.0.1 7.0 7.1.1 7.1.2 8.0. Android ID A-62872384.


A

information

disclosure

vulnerability

in

the

Android

media

framework

(libhavc).

Product:

Android.

Versions:

Android

ID:


A information disclosure vulnerability in the Android framework (crypto framework). Product: Android. Versions: 8.0 8.1. ID: A-68694819.


An information disclosure vulnerability in the Upstream kernel kernel. Product: Android. Versions: Android kernel. Android ID: A-38159576.


A

information

disclosure

vulnerability

in

the

Android

system

(bluetooth).

Product:

Android.

Versions:

Android

ID:


An information disclosure vulnerability in the Android media framework (stagefright mpeg4writer). Product: Android. Versions: 7.0 7.1.1 7.1.2 8.0. Android ID: A-37564426.


A information disclosure vulnerability in the Android framework (aosp email application). Product: Android. Versions: 6.0 6.0.1 7.0 7.1.1 7.1.2 8.0 8.1. Android ID: A-71814449.


A information disclosure vulnerability in the Upstream kernel encrypted-keys. Product: Android. Versions: Android kernel. Android ID: A-70526974.


An information disclosure vulnerability in the Android media framework (libavc). Product: Android. Versions: 7.0 7.1.1 7.1.2 8.0 8.1. Android ID: A-63122634.


An

information

disclosure

vulnerability

in

the

Android

media

framework

(aacdec).

Product:

Android.

Versions:

Android

ID:


An information disclosure vulnerability in the Android media framework (libhevc). Product: Android. Versions: 7.0 7.1.1 7.1.2 8.0 8.1. Android ID: A-65034175.


A information disclosure vulnerability in the Upstream kernel mnh_sm driver. Product: Android. Versions: Android kernel. Android ID: A-70576999.


An

information

disclosure

vulnerability

in

the

Android

media

framework

(libeffects).

Product:

Android.

Versions:

Android

ID:


A

information

disclosure

vulnerability

in

the

Android

media

framework

Product:

Android.

Versions:

ID:


An

information

disclosure

vulnerability

in

the

Android

system

(activitymanagerservice).

Product:

Android.

Versions:

Android

ID


An information disclosure vulnerability in the Android framework (file system). Product: Android. Versions: 7.0 7.1.1 7.1.2 8.0. Android ID: A-62301183.


A information disclosure vulnerability in the N/A memory subsystem. Product: Android. Versions: Android kernel. Android ID: A-35764946.


An information disclosure vulnerability in Microsoft scripting engine allows remote attackers to obtain sensitive information from process memory via a crafted web site aka \Microsoft Browser Information Disclosure Vulnerability.\


An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0 7.1.1 7.1.2 8.0. Android ID: A-62800140.


An information disclosure vulnerability in the Broadcom wifi driver. Product: Android. Versions: Android kernel. Android ID: A-37305633. References: B-V2017063002.


A information disclosure vulnerability in the HTC sound driver. Product: Android. Versions: Android kernel. Android ID: A-35384879.


A

information

disclosure

vulnerability

in

the

Android

media

framework

(libhevc).

Product:

Android.

Versions:

Android

ID:


An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0 7.1.1 7.1.2 8.0. Android ID: A-63121644.


A

information

disclosure

vulnerability

in

the

Android

system

(bluetooth).

Product:

Android.

Versions:

Android

ID:


A information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0 7.1.1 7.1.2 8.0. Android ID: A-38496660.


A

information

disclosure

vulnerability

in

the

Android

framework.

Product:

Android.

Versions:

Android

ID:


A information disclosure vulnerability in the Android media framework. Product: Android. Versions: 6.0 6.0.1 7.0 7.1.1 7.1.2. Android ID: A-36490809.


A information disclosure vulnerability in the HTC sensor hub driver. Product: Android. Versions: Android kernel. Android ID: A-35468048.


A

information

disclosure

vulnerability

in

the

Android

media

framework

(audioserver).

Product:

Android.

Versions:

Android

ID:


A information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0 7.1.1 7.1.2. Android ID: A-38342499.


A information disclosure vulnerability in the Android framework. Product: Android. Versions: 6.0 6.0.1 7.0 7.1.1 7.1.2. Android ID: A-34114752.


A information disclosure vulnerability in the Android media framework. Product: Android. Versions: 6.0 6.0.1 7.0 7.1.1 7.1.2. Android ID: A-35467458.


A information disclosure vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: Android kernel. Android ID: A-37305578. References: B-V2017052301.


An

information

disclosure

vulnerability

in

the

Android

media

framework

(libeffects).

Product:

Android.

Versions:

Android

ID:


An

information

disclosure

vulnerability

in

the

Android

framework

(clipboardservice).

Product:

Android.

Versions:

Android

ID:


An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0 7.1.1 7.1.2 8.0. Android ID A-65025028.


An information disclosure vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 7.0 7.1.1 7.1.2. Android ID: A-64836941.


An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0 7.1.1 7.1.2 8.0. Android ID: A-63873837.


An information disclosure vulnerability in the Qualcomm audio driver. Product: Android. Versions: Android Kernel. Android ID: A-35764875. References: QC-CR#2029798.


A

information

disclosure

vulnerability

in

the

Android

media

framework

(audioflinger).

Product:

Android.

Versions:

Android

ID:


An

information

disclosure

vulnerability

in

the

Android

media

framework

(libstagefright).

Product:

Android.

Versions:

Android

ID:


An

information

disclosure

vulnerability

in

the

Android

system

(rild).

Product:

Android.

Versions:

Android

ID:


A information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0 7.1.1 7.1.2. Android ID: A-62133227.


An information disclosure vulnerability exists in the way some ActiveX objects are instantiated aka \Microsoft ActiveX Information Disclosure Vulnerability.\


An information disclosure vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0 6.0.1 7.0 7.1.1 7.1.2 8.0. Android ID: A-62688399.


An

information

disclosure

vulnerability

in

the

Android

media

framework

(libhevc).

Product:

Android.

Versions:

Android

ID:


A

information

disclosure

vulnerability

in

the

Android

system

(bluetooth).

Product:

Android.

Versions:

Android

ID:


An information disclosure vulnerability in Fortinet FortiOS 5.6.0 5.4.4 and below versions allows attacker to get FortiOS version info by inspecting FortiOS IKE VendorID packets.


An information disclosure vulnerability in Fortinet FortiWeb 5.8.2 and below versions allows logged-in admin user to view SNMPv3 user password in cleartext in webui via the HTML source code.


An information disclosure vulnerability in the Qualcomm SPMI driver. Product: Android. Versions: Android kernel. Android ID: A-33644474. References: QC-CR#1106842.


An information disclosure vulnerability in the Qualcomm video driver. Product: Android. Versions: Android kernel. Android ID: A-32577085. References: QC-CR#1103689.


An information disclosure vulnerability exists in Schneider Electric's IGSS Mobile application version 3.01 and prior. Passwords are stored in clear text in the configuration which can result in exposure of sensitive information.


An information disclosure vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the system response to error provides more information than should be available to an unauthenticated user.


An information disclosure vulnerability in the BlackBerry Workspaces Server could result in an attacker gaining access to source code for server-side applications by crafting a request for specific files.


An information disclosure vulnerability exists when Microsoft SharePoint software fails to properly sanitize a specially crafted requests aka \Microsoft SharePoint Reflective XSS Vulnerability\.


An Information Disclosure vulnerability exists in the Jasig Project php-pear-CAS 1.2.2 package in the /tmp directory. The Central Authentication Service client library archives the debug logging file in an insecure manner.


An information disclosure vulnerability exists when Windows Audio Service fails to properly handle objects in memory aka \Windows Audio Service Information Disclosure Vulnerability.\ This affects Windows 10 Servers Windows 10 Windows Server 2019.


An information disclosure vulnerability exists when the Microsoft Edge Fetch API incorrectly handles a filtered response type aka \Microsoft Edge Information Disclosure Vulnerability.\ This affects Microsoft Edge.


An information disclosure vulnerability exists in Windows Mail Client when a message is opened aka \Windows Mail Client Information Disclosure Vulnerability.\ This affects Mail Calendar and People in Windows 8.1 App Store.


An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory aka \Microsoft Excel Information Disclosure Vulnerability.\ This affects Microsoft Office Microsoft Excel.


An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory aka \Microsoft Excel Information Disclosure Vulnerability.\ This affects Microsoft Excel Viewer Microsoft Office Microsoft Excel.


An information disclosure vulnerability exists in the way that Microsoft Edge handles cross-origin requests aka \Microsoft Edge Information Disclosure Vulnerability.\ This affects Microsoft Edge.


An information disclosure vulnerability exists in Outlook when a message is opened aka \Microsoft Outlook Information Disclosure Vulnerability.\ This affects Word Microsoft Office.


A information disclosure vulnerability exists when WebAudio Library improperly handles audio requests aka \Microsoft Edge Information Disclosure Vulnerability.\ This affects Microsoft Edge.


An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory aka \Windows GDI Information Disclosure Vulnerability.\ This affects Windows Server 2016 Windows 10 Windows 10 Servers.


An information disclosure vulnerability exists when attaching files to Outlook messages aka \Microsoft Outlook Information Disclosure Vulnerability.\ This affects Office 365 ProPlus Microsoft Office. This CVE ID is unique from CVE-2018-8558.


An information disclosure vulnerability in the Management Console of BlackBerry UEM 12.8.0 and 12.8.1 could allow an attacker to take over a UEM user's session and perform administrative actions in the context of the user.


An information disclosure vulnerability in Fortinet FortiOS 6.0.0 and below versions reveals user's web portal login credentials in a Javascript file sent to client-side when pages bookmarked in web portal use the Single Sign-On feature.


An information disclosure vulnerability in Fortinet FortiOS 6.0.1 5.6.7 and below allows attacker to reveals serial number of FortiGate via hostname field defined in connection control setup packets of PPTP protocol.


An information disclosure vulnerability in Fortinet FortiSIEM 5.2.0 and below versions exposes the LDAP server plaintext password via the HTML source code.


An information disclosure vulnerability exists when Edge improperly marks files aka \Microsoft Edge Information Disclosure Vulnerability.\ This affects Microsoft Edge. This CVE ID is unique from CVE-2018-8234.


An information disclosure vulnerability was discovered in glusterfs server. An attacker could issue a xattr request via glusterfs FUSE to determine the existence of any file.


An information disclosure vulnerability exists when affected Microsoft browsers improperly handle objects in memory aka \Microsoft Browser Information Disclosure Vulnerability.\ This affects Internet Explorer 11 Microsoft Edge.


An information disclosure vulnerability in Fortinet FortiManager 6.0.1 and below versions allows a standard user with adom assignment read the interface settings of vdoms unrelated to the assigned adom.


An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory aka \Microsoft Office Information Disclosure Vulnerability.\ This affects Microsoft Office. This CVE ID is unique from CVE-2018-0950.


An information disclosure vulnerability in ILIAS before 5.3.19 5.4.12 and 6.0 allows remote authenticated attackers to get the upload data path via a workspace upload.


An information disclosure vulnerability in upload.php of PopojiCMS 1.2 leads to physical path disclosure of the host when 'name = \file\ is deleted during file uploads.


An information disclosure vulnerability exists in EdgeMax EdgeSwitch firmware v1.9.0 that allowed read only users could obtain unauthorized information through SNMP community pages.


An information disclosure vulnerability in meeting of Pulse Connect Secure <9.1R8 allowed an authenticated end-users to find meeting details if they know the Meeting ID.


An Information Disclosure vulnerability exists in dhcms 2017-09-18 when entering invalid characters after the normal interface which causes an error that will leak the physical path.


An information disclosure vulnerability exists within Dut Computer Control Engineering Co.'s PLC MAC1100.


An information disclosure vulnerability exists in the EPA protocol of Dut Computer Control Engineering Co.'s PLC MAC1100.


An information disclosure vulnerability in rConfig 3.9.5 has been fixed for version 3.9.6. This vulnerability allowed remote authenticated attackers to read files on the system via a crafted request sent to to the /lib/crud/configcompare.crud.php script.


An information disclosure vulnerability exists when a Windows Projected Filesystem improperly handles file redirections aka 'Projected Filesystem Information Disclosure Vulnerability'.


An information disclosure vulnerability exists when the Windows Enterprise App Management Service improperly handles certain file operations aka 'Windows Enterprise App Management Service Information Disclosure Vulnerability'.


An information disclosure vulnerability exists in Text Services Framework when it fails to properly handle objects in memory aka 'Windows Text Services Framework Information Disclosure Vulnerability'.


An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable which could disclose the contents of memory aka 'Microsoft Office Information Disclosure Vulnerability'.


An information disclosure vulnerability exists when NetBIOS over TCP (NBT) Extensions (NetBT) improperly handle objects in memory aka 'NetBT Information Disclosure Vulnerability'.


An information disclosure vulnerability exists in how Microsoft Exchange validates tokens when handling certain messages aka 'Microsoft Exchange Information Disclosure Vulnerability'.


The information disclosure vulnerability present in B&R GateManager 4260 and 9250 versions <9.0.20262 and GateManager 8250 versions <9.2.620236042 allows authenticated users to generate fake audit log messages.


An information disclosure vulnerability in B&R GateManager 4260 and 9250 versions <9.0.20262 and GateManager 8250 versions <9.2.620236042 allows authenticated users to view information of devices belonging to foreign domains.


An information disclosure vulnerability exists when Active Directory integrated DNS (ADIDNS) mishandles objects in memory aka 'Active Directory Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-0664.


An information disclosure vulnerability exists when the Telephony Service improperly discloses the contents of its memory aka 'Windows Information Disclosure Vulnerability'.


An information disclosure vulnerability exists in the Windows Common Log File System (CLFS) driver when it fails to properly handle objects in memory aka 'Windows Common Log File System Driver Information Disclosure Vulnerability'.


An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory aka 'Microsoft Graphics Components Information Disclosure Vulnerability'.


An information disclosure vulnerability exists when Active Directory integrated DNS (ADIDNS) mishandles objects in memory aka 'Active Directory Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-0856.


An information disclosure vulnerability exists when Remote Desktop Web Access improperly handles credential information aka 'Remote Desktop Web Access Information Disclosure Vulnerability'.


An information disclosure vulnerability exists when the win32k component improperly provides kernel information aka 'Win32k Information Disclosure Vulnerability'.


An information disclosure vulnerability exists when the win32k component improperly provides kernel information aka 'Win32k Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-1250.


An information disclosure vulnerability exists in Windows when the Windows Imaging Component fails to properly handle objects in memory aka 'Windows Imaging Component Information Disclosure Vulnerability'.


An information disclosure vulnerability exists when certain central processing units (CPU) speculatively access memory aka 'Windows Kernel Information Disclosure in CPU Memory Access'.


An information disclosure vulnerability exists when the win32k component improperly provides kernel information aka 'Win32k Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-0962.


An information disclosure vulnerability exists when Windows Mobile Device Management (MDM) Diagnostics improperly handles junctions aka 'Windows Mobile Device Management Diagnostics Information Disclosure Vulnerability'.


An information disclosure vulnerability exists in the way that affected Microsoft browsers handle cross-origin requests aka 'Microsoft Browser Information Disclosure Vulnerability'.


An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory aka 'Windows Graphics Component Information Disclosure Vulnerability'.


An information disclosure vulnerability exists when the win32k component improperly provides kernel information aka 'Win32k Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-0717.


An information disclosure vulnerability exists when the win32k component improperly provides kernel information aka 'Win32k Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-0699.


An information disclosure vulnerability exists when the win32k component improperly provides kernel information aka 'Win32k Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-0716.


An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-1141 CVE-2020-1145 CVE-2020-1179.


An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory aka 'Windows GDI Information Disclosure Vulnerability'.


An information disclosure vulnerability exists when Windows Network Connections Service fails to properly handle objects in memory aka 'Windows Network Connections Service Information Disclosure Vulnerability'.


An information disclosure vulnerability exists in how splwow64.exe handles certain calls aka 'Microsoft splwow64 Information Disclosure Vulnerability'.


An information disclosure vulnerability exists in the way that the WalletService handles memory.To exploit the vulnerability an attacker would first need code execution on a victim system aka 'Windows WalletService Information Disclosure Vulnerability'.


An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory aka 'Microsoft Word Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-1503 CVE-2020-1583.


An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory aka 'Microsoft Excel Information Disclosure Vulnerability'.


An information disclosure vulnerability exists when Skype for Business is accessed via Microsoft Edge (EdgeHTML-based) aka 'Skype for Business via Microsoft Edge (EdgeHTML-based) Information Disclosure Vulnerability'.


An information disclosure vulnerability exists when attaching files to Outlook messages aka 'Microsoft Outlook Information Disclosure Vulnerability'.


An information disclosure vulnerability exists in the way Windows Error Reporting (WER) handles objects in memory aka 'Windows Error Reporting Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-1261.


An information disclosure vulnerability exists when Microsoft Project reads out of bound memory due to an uninitialized variable aka 'Microsoft Project Information Disclosure Vulnerability'.


An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-0963 CVE-2020-1141 CVE-2020-1145.


An information disclosure vulnerability exists in the way that Microsoft Edge handles cross-origin requests aka 'Microsoft Edge Information Disclosure Vulnerability'.


An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory aka 'Windows Graphics Component Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-1091.


An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-1367 CVE-2020-1419 CVE-2020-1426.


An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory aka 'Microsoft Word Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-1502 CVE-2020-1583.


An information disclosure vulnerability exists when the Windows Agent Activation Runtime (AarSvc) fails to properly handle objects in memory aka 'Windows Agent Activation Runtime Information Disclosure Vulnerability'.


An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-1367 CVE-2020-1389 CVE-2020-1426.


An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a sensitive property when no parameter was present.


An information disclosure vulnerability exists when the Windows Client Server Run-Time Subsystem (CSRSS) fails to properly handle objects in memory aka 'Windows CSRSS Information Disclosure Vulnerability'.


An information disclosure vulnerability exists in Visual Studio Code Live Share Extension when it exposes tokens in plain text aka 'Visual Studio Code Live Share Information Disclosure Vulnerability'.


An information disclosure vulnerability exists in RPC if the server has Routing and Remote Access enabled aka 'Windows RRAS Service Information Disclosure Vulnerability'.


An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory aka 'Windows Graphics Component Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-1097.


An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory aka 'DirectWrite Information Disclosure Vulnerability'.


An information disclosure vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests aka 'Windows SMBv3 Client/Server Information Disclosure Vulnerability'.


An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory aka 'Microsoft SharePoint Information Disclosure Vulnerability'.


A information disclosure vulnerability exists when TLS components use weak hash algorithms aka 'TLS Information Disclosure Vulnerability'.


An information disclosure vulnerability exists when Skype for Business is accessed via Internet Explorer aka 'Skype for Business via Internet Explorer Information Disclosure Vulnerability'.


An information disclosure vulnerability exists in Windows when the Windows Imaging Component fails to properly handle objects in memory aka 'Windows Imaging Component Information Disclosure Vulnerability'.


An information disclosure vulnerability exists when Windows Mobile Device Management (MDM) Diagnostics improperly handles junctions aka 'Windows Mobile Device Management Diagnostics Information Disclosure Vulnerability'.


An information disclosure vulnerability exists when the win32k component improperly provides kernel information aka 'Win32k Information Disclosure Vulnerability'.


An information disclosure vulnerability exists in the way Windows Error Reporting (WER) handles objects in memory aka 'Windows Error Reporting Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-1263.


An information disclosure vulnerability exists when the win32k component improperly provides kernel information aka 'Win32k Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-0941.


An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory aka 'Microsoft Word Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-1502 CVE-2020-1503.


An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory aka 'Microsoft Office Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-1342.


An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory aka 'Windows GDI Information Disclosure Vulnerability'.


An information disclosure vulnerability exists on ARM implementations that use speculative execution in control flow via a side-channel analysis aka "straight-line speculation aka 'Windows ARM Information Disclosure Vulnerability'.


An information disclosure vulnerability has been identified in FlexNet Publisher lmadmin.exe 11.14.0.2. The web portal link can be used to access to system files or other important files on the system.


An information disclosure vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-28823691.


An information disclosure vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-28823681.


An information disclosure vulnerability in the Qualcomm USB driver. Product: Android. Versions: Android kernel. Android ID: A-33280689. References: QC-CR#1102418.


An information disclosure vulnerability in the Qualcomm IPA driver. Product: Android. Versions: Android kernel. Android ID: A-34390017. References: QC-CR#1069060.


An Information Disclosure vulnerability exists in the mid.dat file stored on the SD card in Symantec Norton Mobile Security for Android before 3.16 which could let a local malicious user obtain sensitive information.


An information disclosure vulnerability exists in the Ethernet/IP UDP handler functionality of EIP Stack Group OpENer 2.3 and development commit 8c73bf3. A specially crafted network request can lead to an out-of-bounds read.

information disclosure
out of bound read


An information disclosure vulnerability in the Qualcomm bootloader could help to enable a local malicious application to to execute arbitrary code within the context of the bootloader. This issue is rated as High because it is a general bypass for a bootloader level defense in depth or exploit mitigation technology. Product: Android. Versions: Kernel-3.18. Android ID: A-32370952. References: QC-CR#1082755.

information disclosure
arbitrary code execution


ChakraCore allows an attacker to execute arbitrary code in the context of the current user due to how the ChakraCore scripting engine handles objects in memory aka \Scripting Engine Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-11792 CVE-2017-11793 CVE-2017-11796 CVE-2017-11797 CVE-2017-11798 CVE-2017-11799 CVE-2017-11800 CVE-2017-11802 CVE-2017-11804 CVE-2017-11805 CVE-2017-11806 CVE-2017-11807 CVE-2017-11808 CVE-2017-11809 CVE-2017-11810 CVE-2017-11811 CVE-2017-11812 and CVE-2017-11821.


ChakraCore allows an attacker to execute arbitrary code in the context of the current user due to how the ChakraCore scripting engine handles objects in memory aka \Scripting Engine Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2017-11792 CVE-2017-11793 CVE-2017-11796 CVE-2017-11798 CVE-2017-11799 CVE-2017-11800 CVE-2017-11801 CVE-2017-11802 CVE-2017-11804 CVE-2017-11805 CVE-2017-11806 CVE-2017-11807 CVE-2017-11808 CVE-2017-11809 CVE-2017-11810 CVE-2017-11811 CVE-2017-11812 and CVE-2017-11821.


A path traversal information disclosure vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which an unauthenticated user can execute arbitrary code and exfiltrate files.


GraphicsMagick 1.3.26 is vulnerable to a memory information disclosure vulnerability found in the DescribeImage function of the magick/describe.c file because of a heap-based buffer over-read. The portion of the code containing the vulnerability is responsible for printing the IPTC Profile information contained in the image. This vulnerability can be triggered with a specially crafted MIFF file. There is an out-of-bounds buffer dereference because certain increments are never checked.


Fuji Electric Alpha5 Smart Loader Versions 3.7 and prior. A buffer overflow information disclosure vulnerability occurs when parsing certain file types.


Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify various resources via a Cross-Site Request Forgery (CSRF) vulnerability following an Information Disclosure vulnerability in the referrer headers which discloses a user's CSRF token. The affected versions are before version 8.5.10 and from version 8.6.0 before 8.13.1.

information disclosure
cross site request forgery


An information disclosure vulnerability exists where certain modes of the search function in Microsoft SharePoint Server are vulnerable to cross-site search attacks (a variant of cross-site request forgery CSRF) aka \Microsoft SharePoint Information Disclosure Vulnerability.\ This affects Microsoft SharePoint.


An information disclosure vulnerability exists where certain modes of the search function in Microsoft SharePoint Server are vulnerable to cross-site search attacks (a variant of cross-site request forgery CSRF).When users are simultaneously logged in to Microsoft SharePoint Server and visit a malicious web page the attacker can through standard browser functionality induce the browser to invoke search queries as the logged in user aka 'Microsoft SharePoint Information Disclosure Vulnerability'.


win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (system hang) via a crafted application aka \Win32k Information Disclosure Vulnerability.\

information disclosure
denial of service


The kernel-mode drivers in Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 1703 and Windows Server 2016 allow a local authenticated attacker to execute a specially crafted application to obtain information or in Windows 7 and later cause denial of service aka \Win32k Information Disclosure Vulnerability.\


Microsoft Excel 2007 SP3 Excel 2010 SP2 Excel 2013 SP1 Excel 2013 RT SP1 Excel 2016 Office Compatibility Pack SP3 Excel Viewer Excel Services on SharePoint Server 2007 SP3 and Excel Services on SharePoint Server 2010 SP2 allow remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via a crafted document aka \Microsoft Office Information Disclosure Vulnerability.\

information disclosure
denial of service
out of bound read


Microsoft Word 2007 SP3 Office 2010 SP2 Word 2010 SP2 Office Compatibility Pack SP3 Word for Mac 2011 Word Automation Services on SharePoint Server 2010 SP2 and Office Web Apps 2010 SP2 allow remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via a crafted document aka \Microsoft Office Information Disclosure Vulnerability \ a different vulnerability than CVE-2016-7291.


Microsoft Excel 2007 SP3 Office Compatibility Pack SP3 Excel Viewer Excel for Mac 2011 and Excel 2016 for Mac allow remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via a crafted document aka \Microsoft Office Information Disclosure Vulnerability.\


Microsoft Word 2007 Office 2010 SP2 Word 2010 SP2 Word for Mac 2011 Excel for Mac 2011 Word Viewer Office Compatibility Pack SP3 Word Automation Services on SharePoint Server 2013 SP1 and Office Web Apps 2010 SP2 allow remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via a crafted Office document aka \Microsoft Office Information Disclosure Vulnerability.\


Microsoft Word 2007 SP3 Office 2010 SP2 Word 2010 SP2 Office Compatibility Pack SP3 Word for Mac 2011 Word Automation Services on SharePoint Server 2010 SP2 and Office Web Apps 2010 SP2 allow remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via a crafted document aka \Microsoft Office Information Disclosure Vulnerability \ a different vulnerability than CVE-2016-7290.


Microsoft Word 2007 SP3 Office 2010 SP2 Word 2010 SP2 Office Compatibility Pack SP3 Word Viewer Word for Mac 2011 Word Automation Services on SharePoint Server 2010 SP2 and Office Web Apps 2010 SP2 allow remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via a crafted document aka \Microsoft Office Information Disclosure Vulnerability.\


Microsoft Office 2007 SP3 Office 2010 SP2 Office 2013 SP1 Office for Mac 2011 and Office 2016 for Mac allow remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via a crafted document aka \Microsoft Office Information Disclosure Vulnerability.\


An exploitable information disclosure vulnerability exists in the HTTP server functionality of the TP-Link TL-R600VPN. A specially crafted URL can cause a directory traversal resulting in the disclosure of sensitive system files. An attacker can send either an unauthenticated or an authenticated web request to trigger this vulnerability.

information disclosure
directory traversal


In CMS Made Simple (CMSMS) through 2.2.7 the \file rename\ operation in the admin dashboard contains a sensitive information disclosure vulnerability exploitable by an admin user that can cause DoS by moving config.php to the upload/ directory.


An information disclosure vulnerability leading to a potential local escalation of privilege in the procfs service (the /proc filesystem) of BlackBerry QNX Software Development Platform version(s) 6.5.0 SP1 and earlier could allow an attacker to potentially gain unauthorized access to a chosen process address space.

information disclosure
escalated privilege


An improper access control information disclosure vulnerability in Trend Micro Apex One Apex One as a Service OfficeScan XG SP1 and Worry-Free Business Security could allow an unauthenticated user to create a bogus agent on an affected server that could be used then make valid configuration queries.

information disclosure
improper access control


Emmanuel MyDomoAtHome (MDAH) REST API REST API Domoticz ISS Gateway 0.2.40 is affected by an information disclosure vulnerability due to improper access control enforcement. An unauthenticated remote attacker can exploit this via a specially crafted request to gain access to sensitive information.


An exploitable information disclosure vulnerability exists in the Weave MessageLayer parsing of Openweave-core version 4.0.2 and Nest Cam IQ Indoor version 4620002. A specially crafted weave packet can cause an integer overflow to occur resulting in PacketBuffer data reuse. An attacker can send a packet to trigger this vulnerability.


VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an information disclosure vulnerability due to an integer overflow issue in Cortado ThinPrint component. A malicious actor with normal access to a virtual machine may be able to exploit this issue to leak memory from TPView process running on the system where Workstation or Horizon Client for Windows is installed. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon Client.


Sensitive information disclosure vulnerability resulting from a lack of certificate validation during the File-Based Backup and Restore operations of VMware vCenter Server Appliance (6.7 before 6.7u3a and 6.5 before 6.5u3d) may allow a malicious actor to intercept sensitive data in transit over SCP. A malicious actor with man-in-the-middle positioning between vCenter Server Appliance and a backup target may be able to intercept sensitive data in transit during File-Based Backup and Restore operations.

information disclosure
man in the middle


Sensitive information disclosure vulnerability resulting from a lack of certificate validation during the File-Based Backup and Restore operations of VMware vCenter Server Appliance (6.7 before 6.7u3a and 6.5 before 6.5u3d) may allow a malicious actor to intercept sensitive data in transit over FTPS and HTTPS. A malicious actor with man-in-the-middle positioning between vCenter Server Appliance and a backup target may be able to intercept sensitive data in transit during File-Based Backup and Restore operations.


An information disclosure vulnerability exists in the Web Server functionality of Sealevel Systems Inc. SeaConnect 370W v1.3.34. A specially-crafted man-in-the-middle attack can lead to a disclosure of sensitive information. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.


An information disclosure vulnerability exists due to the hardcoded TLS key of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted man-in-the-middle attack can lead to a disclosure of sensitive information. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.


An information disclosure vulnerability in Conscrypt and BoringSSL in Android 6.x before 2016-11-01 and 7.0 before 2016-11-01 could enable a man-in-the-middle attacker to gain access to sensitive information if a non-standard cipher suite is used by an application. This issue is rated as High because it could be used to access data without permission. Android ID: A-31081987.


Microsoft .NET Framework 2.0 SP2 3.0 SP2 3.5 3.5.1 4.5.2 4.6 and 4.6.1 allows man-in-the-middle attackers to obtain sensitive cleartext information via vectors involving injection of cleartext data into the client-server data stream aka \TLS/SSL Information Disclosure Vulnerability.\


The (1) JScript 5.8 and (2) VBScript 5.8 scripting engines in Microsoft Windows Server 2008 R2 and Windows 7 do not properly load decoded scripts obtained from web pages which allows remote attackers to trigger memory corruption and consequently obtain sensitive information via a crafted web site aka \Scripting Engines Information Disclosure Vulnerability.\

information disclosure
memory corruption


An Information Disclosure vulnerability exists in the Google Pixel/Pixel SL Qualcomm Avtimer Driver due to a NULL pointer dereference when processing an accept system call by the user process on AF_MSM_IPC sockets which could let a local malicious user obtain sensitive information (Android Bug ID A-32551280).

information disclosure
null pointer dereference


win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP3 does not properly validate the arguments to functions which allows local users to read arbitrary data from kernel memory via a crafted application that triggers a NULL pointer dereference aka \Win32k Incorrect Parameter Validation Allows Information Disclosure Vulnerability.\


An exploitable information disclosure vulnerability exists in the DICOM packet-parsing functionality of LEADTOOLS libltdic.so version 20.0.2019.3.15. A specially crafted packet can cause an out-of-bounds read resulting in information disclosure. An attacker can send a packet to trigger this vulnerability.


An out-of-bounds read information disclosure vulnerability in Trend Micro Apex One (on-prem and SaaS) OfficeScan XG SP1 and Worry-Free Business Security (10.0 SP1 and Services) could allow an attacker to disclose sensitive information about a named pipe. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.


A security out-of-bounds read information disclosure vulnerability in Trend Micro Worry-Free Business Security Server could allow a local attacker to send garbage data to a specific named pipe and crash the server. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.


An information disclosure vulnerability in the NVIDIA Video Driver due to an out-of-bounds read function in the Tegra Display Controller driver could result in possible information disclosure. This issue is rated as Moderate. Product: Android. Version: N/A. Android ID: A-33718700. References: N-CVE-2017-0326.


An exploitable information disclosure vulnerability exists in the PCX image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2. A specially crafted PCX image can cause an out-of-bounds read on the heap resulting in information disclosure . An attacker can display a specially crafted image to trigger this vulnerability.


A out-of-bounds read information disclosure vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow a local attacker to disclose sensitive information on vulnerable installations due to a flaw within the processing of IOCTL 0x220004 by the TMWFP driver. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.


A Named Pipe Request Processing Out-of-Bounds Read Information Disclosure vulnerability in Trend Micro OfficeScan XG (12.0) could allow a local attacker to disclose sensitive information on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit the vulnerability.


An Out-of-Bounds Read Information Disclosure vulnerability in Trend Micro Maximum Security (Consumer) 2018 could allow a local attacker to disclose sensitive information on vulnerable installations due to a flaw within processing of IOCTL 0x222814 by the tmnciesc.sys driver. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.


Race condition in Microsoft Internet Explorer 6 SP1; 6 and 7 for Windows XP SP2 and SP3; 6 and 7 for Server 2003 SP2; 7 for Vista Gold SP1 and SP2; and 7 for Server 2008 SP2 allows remote attackers to execute arbitrary code or perform other actions upon a page transition with the permissions of the old page and the content of the new page as demonstrated by setInterval functions that set location.href within a try/catch expression aka the \bait & switch vulnerability\ or \Race Condition Cross-Domain Information Disclosure Vulnerability.\

information disclosure
race condition
arbitrary code execution


NVIDIA GeForce Experience all versions prior to 3.20.5.70 contains a vulnerability in the ShadowPlay component which may lead to local privilege escalation code execution denial of service or information disclosure.


Double free in Intel(R) SGX SDK for Linux before version 2.2 and Intel(R) SGX SDK for Windows before version 2.1 may allow an authenticated user to potentially enable information disclosure or denial of service via local access.


NVIDIA CUDA Toolkit all versions prior to 11.1.1 contains a vulnerability in the NVJPEG library in which an out-of-bounds read or write operation may lead to code execution denial of service or information disclosure.


An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0977 CVE-2019-1009 CVE-2019-1010 CVE-2019-1011 CVE-2019-1012 CVE-2019-1013 CVE-2019-1015 CVE-2019-1016 CVE-2019-1046 CVE-2019-1047 CVE-2019-1048 CVE-2019-1049 CVE-2019-1050.

information disclosure
improper disclosure of memory content


Adobe Acrobat and Reader versions 2018.011.20063 and earlier 2017.011.30102 and earlier and 2015.006.30452 and earlier have an integer overflow vulnerability. Successful exploitation could lead to information disclosure.


In Paramiko before 2.10.1 a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure.


Adobe Digital Editions versions 4.5.3 and earlier have an exploitable buffer over-read vulnerability. Successful exploitation could lead to information disclosure.


A heap-based buffer over-read in Service_SetParamStringValue in cosa_x_cisco_com_ddns_dml.c of the RDK RDKB-20181217-1 CcspPandM module may allow attackers with login credentials to achieve information disclosure and code execution by crafting an AJAX call responsible for DDNS configuration with an exactly 64-byte username password or domain for which the buffer size is insufficient for the final '\\0' character. This is related to the CcspCommonLibrary and WebUI modules.


In Xpdf 4.01.01 there is a heap-based buffer over-read in the function DCTStream::readScan() located at Stream.cc. It can for example be triggered by sending a crafted PDF document to the pdftops tool. It might allow an attacker to cause Information Disclosure.


In Xpdf 4.01.01 there is a heap-based buffer over-read in the function JBIG2Stream::readTextRegionSeg() located at JBIG2Stream.cc. It can for example be triggered by sending a crafted PDF document to the pdftoppm tool. It might allow an attacker to cause Information Disclosure.


In the pcfGetProperties function in bitmap/pcfread.c in libXfont through 1.5.2 and 2.x before 2.0.2 a missing boundary check (for PCF files) could be used by local attackers authenticated to an Xserver for a buffer over-read for information disclosure or a crash of the X server.


The pe_ILF_object_p function in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.28 is vulnerable to a heap-based buffer over-read of size 4049 because it uses the strlen function instead of strnlen leading to program crashes in several utilities such as addr2line size and strings. It could lead to information disclosure as well.


** DISPUTED ** The liblnk_location_information_read_data function in liblnk_location_information.c in liblnk through 2018-04-19 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted lnk file. NOTE: the vendor has disputed this as described in libyal/liblnk issue 33 on GitHub.


** DISPUTED ** The liblnk_data_string_get_utf8_string_size function in liblnk_data_string.c in liblnk through 2018-04-19 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted lnk file. NOTE: the vendor has disputed this as described in libyal/liblnk issue 33 on GitHub.


** DISPUTED ** The liblnk_data_block_read function in liblnk_data_block.c in liblnk through 2018-04-19 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted lnk file. NOTE: the vendor has disputed this as described in libyal/liblnk issue 33 on GitHub.


DISPUTED

The

libfsntfs_reparse_point_values_read_data

function

in

in

libfsntfs

through

allows

remote

attackers

to

cause

an

information

disclosure

(heap-based

buffer

over-read)

via

a

crafted

ntfs

file.

NOTE:

the

vendor

has

disputed

this

as

described

in

libyal/libfsntfs

issue

on

GitHub.


The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause information disclosure (heap-based buffer over-read) via a crafted vcf file.


The mobi_parse_mobiheader function in read.c in Libmobi 0.3 allows remote attackers to cause information disclosure (heap-based buffer over-read) via a crafted mobi file.


The buffer_addraw function in buffer.c in Libmobi 0.3 allows remote attackers to cause information disclosure (heap-based buffer over-read) via a crafted mobi file.


The mobi_get_kf8boundary_seqnumber function in util.c in Libmobi 0.3 allows remote attackers to cause information disclosure (heap-based buffer over-read) via a crafted mobi file.


The mobi_parse_index_entry function in index.c in Libmobi 0.3 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted mobi file.


** DISPUTED ** The libfsntfs_mft_entry_read_header function in libfsntfs_mft_entry.c in libfsntfs through 2018-04-20 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted ntfs file. NOTE: the vendor has disputed this as described in libyal/libfsntfs issue 8 on GitHub.


** DISPUTED ** The libfsntfs_mft_entry_read_attributes function in libfsntfs_mft_entry.c in libfsntfs through 2018-04-20 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted ntfs file. NOTE: the vendor has disputed this as described in libyal/libfsntfs issue 8 on GitHub.


** DISPUTED ** The libfsntfs_attribute_read_from_mft function in libfsntfs_attribute.c in libfsntfs through 2018-04-20 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted ntfs file. NOTE: the vendor has disputed this as described in libyal/libfsntfs issue 8 on GitHub.