P-News 1.16 and 1.17 store sensitive information under the web root with insufficient access control which allows remote attackers to obtain the administrative account name and password hash via a direct request for db/user.dat.


Web services in Xerox WorkCentre and WorkCentre Pro before 12.060.17.000 13.x before 13.060.17.000 and 14.x before 14.060.17.000 do not require HTTPS which allows remote attackers to obtain sensitive information by sniffing the unencrypted HTTP traffic.


Cahier de texte 2.0 stores sensitive information under the web root possibly with insufficient access control which might allow remote attackers to obtain all users' passwords via a direct request for administration/dump.sql.


Unspecified vulnerability in Citrix Access Gateway 4.5 Advanced Edition and 4.2 with Advanced Access Control (AAC) 4.2 when deployed on the Access Gateway appliance 4.2 through 4.2.2 allows remote authenticated users to \gain access to data\ and obtain sensitive information via unspecified vectors.


Rediff Bol Downloader ActiveX (OCX) control allows remote attackers to execute arbitrary files and obtain sensitive information (usernames and pathnames) via a URL in the url vbscript parameter.


admin/admin_membre/fiche_membre.php in AnnonceScriptHP 2.0 allows remote attackers to obtain sensitive information via the idmembre parameter which discloses the passwords for arbitrary users.


phpwcms 1.2.5-DEV allows remote attackers to obtain sensitive information via a direct request for (1) files.public-userroot.inc.php or (2) files.private.additions.inc.php in include/inc_lib/ which reveals the path in various error messages.


Kile before 1.9.3 does not assign a backup file the same permissions as the original file which might allow local users to obtain sensitive information.


Inktomi Search 4.1.4 allows remote attackers to obtain sensitive information via direct requests with missing parameters to (1) help/header.html (2) thesaurus.html and (3) topics.html which leak the installation path in the resulting error message a related issue to CVE-2006-5970.


The Chatroom Module before 4.7.x.-1.0 for Drupal displays private messages in a chatroom's last messages overview which allows remote attackers to obtain sensitive information by reading the overview.


MailEnable Professional before 1.78 provides a cleartext user password when an administrator edits the user's settings which allows remote authenticated administrators to obtain sensitive information by viewing the HTML source.


Ozeki

HTTP-SMS

Gateway

and

possibly

earlier

stores

usernames

and

passwords

in

plaintext

in

the

HKLM\\Software\\Ozeki\\SMSServer\\CurrentVersion\\Plugins\\httpsmsgate

registry

key

which

allows

local

users

to

obtain

sensitive

information.


Yourfreeworld.com Short Url & Url Tracker Script allows remote attackers to obtain sensitive information via an invalid id parameter to login.php which leaks the path in an error message. NOTE: this issue might be resultant from CVE-2006-2509.


index.php in @lex Guestbook 4.0.1 allows remote attackers to obtain sensitive information via a skin parameter referencing a nonexistent skin which reveals the installation path in an error message.


index.php in GPhotos 1.5 allows remote attackers to obtain sensitive information via an invalid rep parameter which reveals the full path in an error message.


STphp EasyNews PRO 4.0 stores sensitive information under the web root with insufficient access control which allows remote attackers to obtain usernames email addresses and password hashes via a direct request for data/users.txt.


Conti FTPServer 1.0 Build 2.8 stores user passwords in cleartext in MyServerSettings.ini which allows local users to obtain sensitive information by reading this file.


The Servlet Engine and Web Container in IBM WebSphere Application Server (WAS) before 6.0.2.17 when ibm-web-ext.xmi sets fileServingEnabled to true and servlet caching is enabled allows remote attackers to obtain JSP source code and other sensitive information via \specific requests.\


Headstart Solutions DeskPRO stores sensitive information under the web root with insufficient access control which allows remote attackers to (1) list files in the includes/ directory; obtain the SQL username and password via a direct request for (2) config.php and (3) config.php.bak in includes/; read files in (4) email/ (5) admin/graphs/ (6) includes/javascript/ and (7) certain other includes/ directories via direct requests; and download SQL database data via direct requests for (8) data.sql (9) install.sql (10) settings.sql and possibly other files in install/v2data/.


PhpMyAdmin 2.7.0-pl2 allows remote attackers to obtain sensitive information via a direct request for libraries/common.lib.php which reveals the path in an error message.


ScriptMate User Manager 2.1 and earlier allow remote attackers to obtain sensitive information via unspecified vectors related to (1) the Logins box and (2) the Search box.


index.php in FreeWebshop 2.2.2 and earlier allows remote attackers to obtain sensitive information via an invalid action parameter in an info operation which discloses the path in an error message.


P-News 2.0 stores db/user.txt under the web document root with insufficient access control which allows remote attackers to obtain sensitive information such as usernames and password hashes via a direct request. NOTE: this might be the same issue as CVE-2006-6888.


edit_user.php in Call Center Software 0.93 and earlier allows remote attackers to obtain sensitive information such as account passwords via a modified user_id parameter.


SimpleFileServlet in IBM WebSphere Application Server 5.0.1 through 5.0.2.7 on Linux and UNIX does not block certain invalid URIs and does not issue a security challenge which allows remote attackers to read secure files and obtain sensitive information via certain requests.


The (1) dlback.php and (2) dlback.cgi scripts in Hot Links allow remote attackers to obtain sensitive information and download the database via a direct request with a modified dl parameter.


Webridge PX Application Suite allows remote attackers to obtain sensitive information via a malformed request that generates a server error message which includes full pathname or internal IP address information in the variables (1) APPL_PHYSICAL_PATH (2) PATH_TRANSLATED and (3) LOCAL_ADDR.


WebID in RSA Security SecurID 5.0 as used by ACE/Agent for Windows Windows NT and Windows 2000 allows attackers to cause the WebID agent to enter debug mode via a URL containing null characters which may allow attackers to obtain sensitive information.


netscript before 1.6.3 parses dynamic variables which could allow remote attackers to alter program behavior or obtain sensitive information.


Basilix Webmail 0.9.7beta and possibly other versions stores *.class and *.inc files under the document root and does not restrict access which could allows remote attackers to obtain sensitive information such as MySQL passwords and usernames from the mysql.class file.


SQLQHit.asp sample file in Microsoft Index Server 2.0 allows remote attackers to obtain sensitive information such as the physical path file attributes or portions of source code by directly calling sqlqhit.asp with a CiScope parameter set to (1) webinfo (2) extended_fileinfo (3) extended_webinfo or (4) fileinfo.


The default permissions for the SNMP Parameters registry key in Windows NT 4.0 allows remote attackers to read and possibly modify the SNMP community strings to obtain sensitive information or modify network configuration aka one of the \Registry Permissions\ vulnerabilities.


The clustmon service in Sun Cluster 2.x does not require authentication which allows remote attackers to obtain sensitive information such as system logs and cluster configurations.


HTTP server in Alchemy Eye and Alchemy Network Monitor 1.9x through 2.6.18 is enabled without authentication by default which allows remote attackers to obtain network monitoring logs with potentially sensitive information by directly requesting the eye.ini file.


The pre-login mode in the System Administrator interface of Lightwave ConsoleServer 3200 allows remote attackers to obtain sensitive information such as system status configuration and users.


Computer Associates ARCserve for NT 6.61 SP2a and ARCserve 2000 7.0 creates a hidden share named ARCSERVE$ which allows remote attackers to obtain sensitive information and overwrite critical files.


Cisco CBOS 2.3.0.053 sends output of the \sh nat\ (aka \show nat\) command to the terminal of the next user who attempts to connect to the router via telnet which could allow that user to obtain sensitive information.


Arkeia backup server 4.2.8-2 and earlier creates its database files with world-writable permissions which could allow local users to overwrite the files or obtain sensitive information.


Sendmail before 8.12.1 without the RestrictQueueRun option enabled allows local users to obtain potentially sensitive information about the mail queue by setting debugging flags to enable debug mode.


TurboTax saves passwords in a temporary file when a user imports investment tax information from a financial institution which could allow local users to obtain sensitive information.


The System Utilities (sysutils) extension 1.0.3 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unspecified vectors related to improper \protection\ of the \backup output directory.\


Unspecified

vulnerability

in

the

com.sap.aii.mdt.amt.web.AMTPageProcessor

servlet

in

SAP

NetWeaver

allows

remote

attackers

to

obtain

sensitive

information

about

the

Adapter

Monitor

via

unspecified

vectors

possibly

related

to

the

EnableInvokerServletGlobally

property

in

the

service.


Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not properly consider trust levels during construction of output data which allows remote attackers to obtain sensitive information via (1) a crafted XAML browser application (aka XBAP) or (2) a crafted .NET Framework application aka \Code Access Security Info Disclosure Vulnerability.\


show_config_errors.php in phpMyAdmin 3.4.x before 3.4.10.2 when a configuration file does not exist allows remote attackers to obtain sensitive information via a direct request which reveals the installation path in an error message about this missing file.


RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x store passwords in cleartext under adm_b_db\\users\\ which allows local users to obtain sensitive information by reading a database.


Mozilla Firefox 4.x through 12.0 Firefox ESR 10.x before 10.0.5 Thunderbird 5.0 through 12.0 Thunderbird ESR 10.x before 10.0.5 and SeaMonkey before 2.10 allow local users to obtain sensitive information via an HTML document that loads a shortcut (aka .lnk) file for display within an IFRAME element as demonstrated by a network share implemented by (1) Microsoft Windows or (2) Samba.


The (1) webreports (2) post/create-role and (3) post/update-role programs in IBM Tivoli Endpoint Manager (TEM) before 8.2 do not include the HTTPOnly flag in a Set-Cookie header for a cookie which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.


Coppermine Photo Gallery before 1.5.20 allows remote attackers to obtain sensitive information via (1) a direct request to plugins/visiblehookpoints/index.php an invalid (2) page or (3) cat parameter to thumbnails.php an invalid (4) page parameter to usermgr.php or an invalid (5) newer_than or (6) older_than parameter to search.inc.php which reveals the installation path in an error message.


Cisco Wide Area Application Services (WAAS) appliances with software 4.4 5.0 and 5.1 include a one-way hash of a password within output text which might allow remote attackers to obtain sensitive information via a brute-force attack on the hash string aka Bug ID CSCty17279.


The hook_node_access function in the revisioning module 7.x-1.x before 7.x-1.3 for Drupal checks the permissions of the current user even when it is called to check permissions of other users which allows remote attackers to bypass intended access restrictions as demonstrated when using the XML sitemap module to obtain sensitive information about unpublished content.


The TwitRocker2 application before 1.0.23 for Android does not properly implement the WebView class which allows remote attackers to obtain sensitive information via a crafted application.


The C handler plug-in in Automatic Bug Reporting Tool (ABRT) possibly 2.0.8 and earlier does not properly set the group (GID) permissions on core dump files for setuid programs when the sysctl fs.suid_dumpable option is set to 2 which allows local users to obtain sensitive information.


The Web Configuration tool in VMware vCenter Orchestrator (vCO) 4.0 before Update 4 4.1 before Update 2 and 4.2 before Update 1 places the vCenter Server password in an HTML document which allows remote authenticated administrators to obtain sensitive information by reading this document.


WellinTech KingSCADA 3.0 uses a cleartext base64 format for storage of passwords in user.db which allows context-dependent attackers to obtain sensitive information by reading this file.


Opera before 11.62 on UNIX uses world-readable permissions for temporary files during printing which allows local users to obtain sensitive information by reading these files.


includes/linkchecker.pages.inc in the Link checker module 6.x-2.x before 6.x-2.5 for Drupal does not properly enforce access permissions on broken links which allows remote attackers to obtain sensitive information via unspecified vectors.


The forum list in Drupal 7.x before 7.14 does not properly check user permissions for unpublished forum posts which allows remote authenticated users to obtain sensitive information such as the post title via the forum overview page.


The resource loader in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 includes private data such as CSRF tokens in a JavaScript file which allows remote attackers to obtain sensitive information.


Pidgin 2.10.0 uses DBUS for certain cleartext communication which allows local users to obtain sensitive information via a dbus session monitor.


The override_release function in kernel/sys.c in the Linux kernel before 3.4.16 allows local users to obtain sensitive information from kernel stack memory via a uname system call in conjunction with a UNAME26 personality.


TIBCO ActiveMatrix Runtime Platform in Service Grid and Service Bus 2.x before 2.3.2 and BusinessWorks Service Engine before 5.8.2; TIBCO ActiveMatrix Platform in TIBCO Silver Fabric ActiveMatrix Service Grid Distribution 3.1.3 Service Grid and Service Bus 3.x before 3.1.5 BusinessWorks Service Engine 5.9.x before 5.9.3 and BPM before 1.3.0; TIBCO BusinessEvents Runtime in Enterprise and Inference Editions 3.x before 3.0.3 Standard Edition 4.x before 4.0.2 and Standard Edition and Express 5.0.0; and TIBCO BusinessWorks Engine in TIBCO Silver Fabric ActiveMatrix BusinessWorks Distribution 5.9.2 and ActiveMatrix BusinessWorks before 5.9.3 allow remote attackers to obtain sensitive information via a crafted URL.


monitor/index.php in op5 Monitor and op5 Appliance before 5.5.1 allows remote authenticated users to obtain sensitive information such as database and user credentials via error messages that are triggered by (1) a malformed hoststatustypes parameter to status/service/all or (2) a crafted request to config.


LanItems.ycp in save_y2logs in yast2-network before 2.24.4 in SUSE YaST writes cleartext Wi-Fi credentials to the y2log log file which allows context-dependent attackers to obtain sensitive information by reading the (1) WIRELESS_WPA_PASSWORD or (2) WIRELESS_CLIENT_KEY_PASSWORD field.


The NonManagedConnectionFactory in JBoss Enterprise Application Platform (EAP) 5.1.2 and 5.2.0 Web Platform (EWP) 5.1.2 and 5.2.0 and BRMS Platform before 5.3.1 logs the username and password in cleartext when an exception is thrown which allows local users to obtain sensitive information by reading the log file.


Mozilla Firefox 4.x through 9.0 Thunderbird 5.0 through 9.0 and SeaMonkey before 2.7 do not properly initialize data for image/vnd.microsoft.icon images which allows remote attackers to obtain potentially sensitive information by reading a PNG image that was created through conversion from an ICO image.


Wicd before 1.7.1 saves sensitive information in log files in /var/log/wicd which allows context-dependent attackers to obtain passwords and other sensitive information.


The Cookpad 1.5.16 and earlier and Cookpad Noseru 1.1.1 and earlier applications for Android do not properly implement the WebView class which allows remote attackers to obtain sensitive information via a crafted application.


The WebGLBuffer::FindMaxUshortElement function in Mozilla Firefox 4.x through 11.0 Firefox ESR 10.x before 10.0.4 Thunderbird 5.0 through 11.0 Thunderbird ESR 10.x before 10.0.4 and SeaMonkey before 2.9 calls the FindMaxElementInSubArray function with incorrect template arguments which allows remote attackers to obtain sensitive information from video memory via a crafted WebGL.drawElements call.


Login Window in Apple Mac OS X 10.7.3 when Legacy File Vault or networked home directories are enabled does not properly restrict what is written to the system log for network logins which allows local users to obtain sensitive information by reading the log.


Adobe Flash Player before 10.3.183.16 and 11.x before 11.1.102.63 on Windows Mac OS X Linux and Solaris; before 11.1.111.7 on Android 2.x and 3.x; and before 11.1.115.7 on Android 4.x does not properly handle integers which allows attackers to obtain sensitive information via unspecified vectors.


IBM

Rational

ClearQuest

through

and

through

allows

remote

attackers

to

obtain

potentially

sensitive

information

via

a

request

to

a

snoop

hello

ivt/

hitcount

HitCount.jsp

HelloHTMLError.jsp

HelloHTML.jsp

HelloVXMLError.jsp

HelloVXML.jsp

HelloWMLError.jsp

HelloWML.jsp

or

sample

script.


Windows Firewall in tcpip.sys in Microsoft Windows Vista SP2 Windows Server 2008 SP2 R2 and R2 SP1 and Windows 7 Gold and SP1 does not properly enforce firewall rules for outbound broadcast packets which allows remote attackers to obtain potentially sensitive information by observing broadcast traffic on a local network aka \Windows Firewall Bypass Vulnerability.\


TIBCO Spotfire Web Application Web Player Application Automation Services Application and Analytics Client Application in Spotfire Analytics Server before 10.1.2; Server before 3.3.3; and Web Player Automation Services and Professional before 4.0.2 allow remote attackers to obtain sensitive information via a crafted URL.


content/unity-api.js in the unity-firefox-extension extension 2.4.1 for Firefox exposes the toDataURL function in an API call which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted webpage.


IBM Tivoli Event Pump 4.2.2 when the LOG_REQUESTS and VALIDATE_SOAP_USERS options are enabled places credentials into the AOPSCLOG (aka AOPLOG) data set which allows local users to obtain sensitive information by reading the data.


Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 7.2 through 8.4 do not properly perform proxy authentication during attempts to cut through a firewall which allows remote attackers to obtain sensitive information via a connection attempt aka Bug ID CSCtx42746.


The transform_save function in transform.c in Augeas before 1.0.0 allows local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on a .augnew file.


Microsoft Forefront Unified Access Gateway (UAG) 2010 SP1 and SP1 Update 1 does not properly configure the default web site which allows remote attackers to obtain sensitive information via a crafted HTTPS request aka \Unfiltered Access to UAG Default Website Vulnerability.\


Advantech/BroadWin WebAccess 7.0 and earlier allows remote attackers to obtain sensitive information via a direct request to a URL. NOTE: the vendor reportedly \does not consider it to be a security risk.\


The clone_file function in transfer.c in Augeas before 1.0.0 when copy_if_rename_fails is set and EXDEV or EBUSY is returned by the rename function allows local users to overwrite arbitrary files and obtain sensitive information via a bind mount on the (1) .augsave or (2) destination file when using the backup save option or (3) .augnew file when using the newfile save option.


HP Onboard Administrator (OA) before 3.50 allows remote attackers to obtain sensitive information via unspecified vectors.


The auth_parse_options function in auth-options.c in sshd in OpenSSH before 5.7 provides debug messages containing authorized_keys command options which allows remote authenticated users to obtain potentially sensitive information by reading these messages as demonstrated by the shared user account required by Gitolite. NOTE: this can cross privilege boundaries because a user account may intentionally have no shell or filesystem access and therefore may have no supported way to read an authorized_keys file in its own home directory.


The directory server in Directory Service in Apple Mac OS X 10.6.8 allows remote attackers to obtain sensitive information from process memory via a crafted message.


The Dolphin Browser HD application before 7.6 and Dolphin for Pad application before 1.0.1 for Android do not properly implement the WebView class which allows remote attackers to obtain sensitive information via a crafted application.


xfs_metadump in xfsprogs before 3.2.4 does not properly obfuscate file data which allows remote attackers to obtain sensitive information by reading a generated image.


The Slidebox module before 7.x-1.4 for Drupal does not properly check permissions which allows remote attackers to obtain sensitive information via unspecified vectors.


The Spaces module 6.x-3.x before 6.x-3.4 for Drupal does not enforce permissions on non-object pages which allows remote attackers to obtain sensitive information and possibly have other impacts via unspecified vectors to the (1) Spaces or (2) Spaces OG module.


The IPC implementation in Google Chrome before 22.0.1229.79 allows attackers to obtain potentially sensitive information about memory addresses via unspecified vectors.


The Janrain Engage (formerly RPX) module for Drupal 6.x-1.x. 6.x-2.x before 6.x-2.2 and 7.x-2.x before 7.x-2.2 stores user profile data from Engage in session tables which might allow remote attackers to obtain sensitive information by leveraging a separate vulnerability.


Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x and Adobe AIR before 3.3.0.3610 allows attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors.


Site Documentation (Sitedoc) module for Drupal 6.x-1.x before 6.x-1.4 does not properly check the save location when archiving which allows remote attackers to obtain sensitive information via unspecified vectors.


The Sleipnir Mobile application before 2.1.0 and Sleipnir Mobile Black Edition application before 2.1.0 for Android do not properly implement the WebView class which allows remote attackers to obtain sensitive information via a crafted application.


Artiphp CMS 5.5.0 Neo (r422) stores database backups with predictable names under the web root with insufficient access control which allows remote attackers to obtain sensitive information via a direct request.


The administrative interface in the embedded web server on the BreakingPoint Storm appliance before 3.0 does not require authentication for the gwt/BugReport script which allows remote attackers to obtain sensitive information by downloading a .tgz file.


IBM Maximo Asset Management 6.2 through 7.5 as used in SmartCloud Control Desk Tivoli Asset Management for IT Tivoli Service Request Manager Maximo Service Desk and Change and Configuration Management Database (CCMDB) allows remote authenticated users to obtain sensitive information via unspecified vectors.


Google Chrome before 21.0.1180.57 on Mac OS X and Linux and before 21.0.1180.60 on Windows and Chrome Frame allows remote attackers to obtain potentially sensitive information about pointer values by leveraging access to a WebUI renderer process.


An XML eXternal Entity (XXE) issue exists in Restlet 1.1.10 in an endpoint using XML transport which lets a remote attacker obtain sensitive information.


The Puella Magi Madoka Magica iP application 1.05 and earlier for Android places cleartext Twitter credentials in a log file which allows remote attackers to obtain sensitive information via a crafted application.


Unspecified vulnerability in certain default views in the Ubercart Views module 6.x before 6.x-3.2 for Drupal allows remote attackers to obtain sensitive information via unknown attack vectors.


Cumin before 0.1.5444 as used in Red Hat Enterprise Messaging Realtime and Grid (MRG) 2.0 does not properly restrict access to resources which allows remote attackers to obtain sensitive information via unspecified vectors related to (1) \web pages \ (2) \export functionality \ and (3) \image viewing.\


Gateway Geomatics MapServer for Windows before 3.0.6 contains a Local File Include Vulnerability which allows remote attackers to execute local PHP code and obtain sensitive information.


The Xelex MobileTrack application 2.3.7 and earlier for Android uses hardcoded credentials which allows remote attackers to obtain sensitive information via an unencrypted (1) FTP or (2) HTTP session.


The Linkit module 7.x-2.x before 7.x-2.3 for Drupal when using an entity access module does not check permissions when searching for entities which allows remote attackers to obtain sensitive information via unspecified vectors.


The Simplenews module 6.x-1.x before 6.x-1.4 6.x-2.x before 6.x-2.0-alpha4 and 7.x-1.x before 7.x-1.0-rc1 for Drupal reveals the email addresses of new mailing list subscribers when confirmation is required which allows remote attackers to obtain sensitive information via the confirmation page.


Red Hat Network (RHN) Configuration Client (rhncfg-client) in rhncfg before 5.10.27-8 uses weak permissions (world-readable) for /var/log/rhncfg-actions which allows local users to obtain sensitive information about the rhncfg-client actions by reading the file.


virt-edit in libguestfs before 1.18.0 does not preserve the permissions from the original file and saves the new file with world-readable permissions when editing which might allow local guest users to obtain sensitive information.


The Ubercart module 6.x-2.x before 6.x-2.8 and 7.x-3.x before 7.x-3.1 for Drupal stores passwords for new customers in plaintext during checkout which allows local users to obtain sensitive information by reading from the database.


Google Chrome before 20.0.1132.43 allows remote attackers to obtain potentially sensitive information from a fragment identifier by leveraging access to an IFRAME element associated with a different domain.


The server in CollabNet ScrumWorks Pro before 6.0 allows remote authenticated users to gain privileges and obtain sensitive information via a modified desktop client.


The Samsung and HTC onTouchEvent method implementation for Android on the T-Mobile myTouch 3G Slide HTC Merge Sprint EVO Shift 4G HTC ChaCha AT&T Status HTC Desire Z T-Mobile G2 T-Mobile myTouch 4G Slide and Samsung Galaxy S stores touch coordinates in the dmesg buffer which allows remote attackers to obtain sensitive information via a crafted application as demonstrated by PIN numbers telephone numbers and text messages.


The request_path function in includes/bootstrap.inc in Drupal 7.14 and earlier allows remote attackers to obtain sensitive information via the q parameter to index.php which reveals the installation path in an error message.


The Ubercart AJAX Cart 6.x-2.x before 6.x-2.1 for Drupal stores the PHP session id in the JavaScript settings array in page loads which might allow remote attackers to obtain sensitive information by sniffing or reading the cache of the HTML of a webpage.


The intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012 when Internet Explorer is used provide different responses to remote requests depending on whether a ZIP pathname is valid which allows remote attackers to obtain potentially sensitive information about the installation path and product version via a series of requests involving the Msxml2.XMLHTTP object.


The BreakingPoint Storm appliance before 3.0 requires cleartext credentials for establishing a session from a GUI administrative client which allows remote attackers to obtain sensitive information by sniffing the network for XML documents.


The Update method in src/node_http_parser.cc in Node.js before 0.6.17 and 0.7 before 0.7.8 does not properly check the length of a string which allows remote attackers to obtain sensitive information (request header contents) and possibly spoof HTTP headers via a zero length string.


The ODBC driver in IBM Security AppScan Source 7.x and 8.x before 8.6 sends an SHA-1 hash of the connection password during connections to a solidDB database which allows remote attackers to obtain sensitive information by sniffing the network.


The Yahoo! Japan Yahoo! Browser application 1.2.0 and earlier for Android does not properly implement the WebView class which allows remote attackers to obtain sensitive information via a crafted application.


libraries/libldap/tls_m.c in OpenLDAP possibly 2.4.31 and earlier when using the Mozilla NSS backend always uses the default cipher suite even when TLSCipherSuite is set which might cause OpenLDAP to use weaker ciphers than intended and make it easier for remote attackers to obtain sensitive information.


Elixir 0.8.0 uses Blowfish in CFB mode without constructing a unique initialization vector (IV) which makes it easier for context-dependent users to obtain sensitive information and decrypt the database.


The VPN downloader in the download_install component in Cisco AnyConnect Secure Mobility Client 3.1.x before 3.1.00495 on Linux accepts arbitrary X.509 server certificates without user interaction which allows remote attackers to obtain sensitive information via vectors involving an invalid certificate aka Bug ID CSCua11967.


The

comments

API

in

in

the

Ushahidi

Platform

before

allows

remote

attackers

to

obtain

sensitive

information

about

the

e-mail

address

IP

address

and

other

attributes

of

the

author

of

a

comment

via

an

API

function

call.


The Berkeley Packet Filter (BPF) interpreter implementation in the kernel in Apple iOS before 6 accesses uninitialized memory locations which allows local users to obtain sensitive information about the layout of kernel memory via a crafted program that uses a BPF interface.


The Java servlets in the management console in IBM Tivoli Federated Identity Manager (TFIM) through 6.2.2 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) before 6.2.2 do not require authentication for all resource downloads which allows remote attackers to bypass intended J2EE security constraints and obtain sensitive information related to (1) federation metadata or (2) a web plugin configuration template via a crafted request.


AirDroid before 1.0.7 beta uses a cleartext base64 format for data transfer that is documented as an \Encrypted Transmission\ feature which allows remote attackers to obtain sensitive information by sniffing the local wireless network as demonstrated by the SMS message content sent to the sdctl/sms/send/single/ URI.


The fpm exporter in Revelation 0.4.13-2 and earlier encrypts the version number but not the password when exporting a file which might allow local users to obtain sensitive information.


IBM Rational Business Developer 8.x before 8.0.1.4 allows remote attackers to obtain potentially sensitive information via a connection to a web service created with the Rational Business Developer product.


The System Logs implementation in Apple iOS before 6 does not restrict /var/log access by sandboxed apps which allows remote attackers to obtain sensitive information via a crafted app that reads log files.


The DNAv4 protocol implementation in the DHCP component in Apple iOS before 6 sends Wi-Fi packets containing a MAC address of a host on a previously used network which might allow remote attackers to obtain sensitive information about previous device locations by sniffing an unencrypted Wi-Fi network for these packets.


HP Fortify Software Security Center 3.1 3.3 3.4 and 3.5 allows remote attackers to obtain sensitive information via unspecified vectors.


Opera before 11.65 does not properly restrict the reading of JSON strings which allows remote attackers to perform cross-domain loading of JSON resources and consequently obtain sensitive information via a crafted web site.


IBM Sametime allows remote attackers to obtain sensitive information from the Sametime Log database via a direct request to STLOG.NSF. IBM X-Force ID: 78048.


routerlist.c in Tor before 0.2.2.38 uses a different amount of time for relay-list iteration depending on which relay is chosen which might allow remote attackers to obtain sensitive information about relay selection via a timing side-channel attack.


The SVN revision view (lib/vclib/svn/svn_repos.py) in ViewVC before 1.1.15 does not properly handle log messages when a readable path is copied from an unreadable path which allows remote attackers to obtain sensitive information related to a \log msg leak.\


The libxslt support in contrib/xml2 in PostgreSQL 8.3 before 8.3.20 8.4 before 8.4.13 9.0 before 9.0.9 and 9.1 before 9.1.5 does not properly restrict access to files and URLs which allows remote authenticated users to modify data obtain sensitive information or trigger outbound traffic to arbitrary external hosts by leveraging (1) stylesheet commands that are permitted by the libxslt security options or (2) an xslt_process feature related to an XML External Entity (aka XXE) issue.


HP Fortify Software Security Center 3.1 3.3 3.4 and 3.5 allows remote authenticated users to obtain sensitive information via unspecified vectors.


Apple Safari before 6.0.1 makes http requests for https URIs in certain circumstances involving a paste into the address bar which allows user-assisted remote attackers to obtain sensitive information by sniffing the network.


The DOMParser component in Mozilla Firefox before 15.0 Thunderbird before 15.0 and SeaMonkey before 2.12 loads subresources during parsing of text/html data within an extension which allows remote attackers to obtain sensitive information by providing crafted data to privileged extension code.


Pro-face WinGP PC Runtime 3.1.00 and earlier and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier allows remote attackers to obtain sensitive information from daemon memory via a crafted packet with a certain opcode.


Unspecified vulnerability in IBRIX 6.1.196 through 6.1.251 on HP IBRIX X9000 Storage allows remote attackers to obtain sensitive information via unknown vectors.


Performance Co-Pilot (PCP) before 3.6.5 exports some of the /proc file system which allows attackers to obtain sensitive information such as proc/pid/maps and command line arguments.


The rds_recvmsg function in net/rds/recv.c in the Linux kernel before 3.0.44 does not initialize a certain structure member which allows local users to obtain potentially sensitive information from kernel stack memory via a (1) recvfrom or (2) recvmsg system call on an RDS socket.


Integer signedness error in attach.c in dtach 0.8 allows remote attackers to obtain sensitive information from daemon stack memory in opportunistic circumstances by reading application data after an improper connection-close request as demonstrated by running an IRC client in dtach.


The datasource definition editor in IBM InfoSphere Guardium 8.2 and earlier when the save-password setting is enabled transmits cleartext database credentials which allows remote attackers to obtain sensitive information by sniffing the network.


WordPress before 3.4.1 does not properly restrict access to post contents such as private or draft posts which allows remote authors or contributors to obtain sensitive information via unknown vectors.


Symantec Messaging Gateway (SMG) before 10.0 allows remote attackers to obtain potentially sensitive information about component versions via unspecified vectors.


Messages in Apple iOS before 6 when multiple iMessage e-mail addresses are configured does not ensure that a reply's sender address matches the recipient address of the original message which allows remote attackers to obtain potentially sensitive information about alternate e-mail addresses in opportunistic circumstances by reading a reply.


Multiple unspecified vulnerabilities on the HP LaserJet Pro 400 MFP M425 with firmware 20120625 and LaserJet 400 M401 with firmware 20120621 allow remote attackers to obtain sensitive information via unknown vectors.


The proxy functionality in (1) mod_proxy_ajp.c in the mod_proxy_ajp module and (2) mod_proxy_http.c in the mod_proxy_http module in the Apache HTTP Server 2.4.x before 2.4.3 does not properly determine the situations that require closing a back-end connection which allows remote attackers to obtain sensitive information in opportunistic circumstances by reading a response that was intended for a different client.


lib/filelib.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 does not properly restrict file access after a block has been hidden which allows remote authenticated users to obtain sensitive information by reading a file that is embedded in a block.


doku.php in DokuWiki as used in Fedora 16 17 and 18 when certain PHP error levels are set allows remote attackers to obtain sensitive information via the prefix parameter which reveals the installation path in an error message.


The command_give_request_ad function in condor_startd.V6/command.cpp Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 allows remote attackers to obtain sensitive information and possibly control or start arbitrary jobs via a ClassAd request to the condor_startd port which leaks the ClaimId.


auth/ldap/ntlmsso_attempt.php in Moodle 2.0.x before 2.0.10 2.1.x before 2.1.7 2.2.x before 2.2.4 and 2.3.x before 2.3.1 redirects users from an https LDAP login URL to an http URL which allows remote attackers to obtain sensitive information by sniffing the network.


The transform_save function in transform.c in Augeas before 1.0.0 allows local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on a .augsave file in a backup save action a different vector than CVE-2012-0786.


The llc_ui_getname function in net/llc/af_llc.c in the Linux kernel before 3.6 has an incorrect return value in certain circumstances which allows local users to obtain sensitive information from kernel stack memory via a crafted application that leverages an uninitialized pointer argument.


The copy_to_user_auth function in net/xfrm/xfrm_user.c in the Linux kernel before 3.6 uses an incorrect C library function for copying a string which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability.


eFront 3.6.10 3.6.11 build 15059 and earlier allows remote attackers to obtain sensitive information via invalid courses_ID parameter in the lesson_info module to index.php which reveals the installation path in an error message.


Open Solution Quick.Cart 5.0 allows remote attackers to obtain sensitive information via (1) a long string or (2) invalid characters in a cookie which reveals the installation path in an error message.


blog/rsslib.php in Moodle 2.2.x before 2.2.7 2.3.x before 2.3.4 and 2.4.x before 2.4.1 allows remote attackers to obtain sensitive information from site-level blogs by leveraging the guest role and reading an RSS feed.


The ATM implementation in the Linux kernel before 3.6 does not initialize certain structures which allows local users to obtain sensitive information from kernel stack memory via a crafted application.


Red Hat OpenStack Essex and Folsom creates the /var/log/puppet directory with world-readable permissions which allows local users to obtain sensitive information such as Puppet log files.


The domain management tool (rhevm-manage-domains) in Red Hat Enterprise Virtualization Manager (RHEV-M) 3.1 and earlier when the validate action is enabled logs the administrative password to a world-readable log file which allows local users to obtain sensitive information by reading this file.


The l2tp_ip6_getname function in net/l2tp/l2tp_ip6.c in the Linux kernel before 3.6 does not initialize a certain structure member which allows local users to obtain sensitive information from kernel stack memory via a crafted application.


The dev_ifconf function in net/socket.c in the Linux kernel before 3.6 does not initialize a certain structure which allows local users to obtain sensitive information from kernel stack memory via a crafted application.


Rockwell Automation EtherNet/IP products; 1756-ENBT 1756-EWEB 1768-ENBT and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400 allow remote attackers to obtain sensitive information via a crafted CIP packet.


ConnMan 1.3 on Tizen continues to list the bluetooth service after offline mode has been enabled which might allow remote attackers to obtain sensitive information via Bluetooth packets.


blog/rsslib.php in Moodle 2.1.x before 2.1.10 2.2.x before 2.2.7 2.3.x before 2.3.4 and 2.4.x before 2.4.1 continues to provide a blog RSS feed after blogging is disabled which allows remote attackers to obtain sensitive information by reading this feed.


The __tun_chr_ioctl function in drivers/net/tun.c in the Linux kernel before 3.6 does not initialize a certain structure which allows local users to obtain sensitive information from kernel stack memory via a crafted application.


The isofs_export_encode_fh function in fs/isofs/export.c in the Linux kernel before 3.6 does not initialize a certain structure member which allows local users to obtain sensitive information from kernel heap memory via a crafted application.


Microsoft Internet Explorer before 10 allows remote attackers to obtain sensitive information about the existence of files and read certain data from files via a UNC share pathname in the SRC attribute of a SCRIPT element as demonstrated by reading a name-value pair from a local file via a \\\\127.0.0.1\\C$\\ sequence.


Opera before 12.10 does not properly handle incorrect size data in a WebP image which allows remote attackers to obtain potentially sensitive information from process memory by using a crafted image as the fill pattern for a canvas.


The openssl_encrypt function in ext/openssl/openssl.c in PHP 5.3.9 through 5.3.13 does not initialize a certain variable which allows remote attackers to obtain sensitive information from process memory by providing zero bytes of input data.


net/xfrm/xfrm_user.c in the Linux kernel before 3.6 does not initialize certain structures which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability.


The ccid3_hc_tx_getsockopt function in net/dccp/ccids/ccid3.c in the Linux kernel before 3.6 does not initialize a certain structure which allows local users to obtain sensitive information from kernel stack memory via a crafted application.


simple-gmail-login.php in the Simple Gmail Login plugin before 1.1.4 for WordPress allows remote attackers to obtain sensitive information via a request that lacks a timezone leading to disclosure of the installation path in a stack trace.


in

WordPress

before

does

not

properly

restrict

excerpt-view

access

which

allows

remote

authenticated

users

to

obtain

sensitive

information

by

visiting

a

draft.


Opera before 12.12 on UNIX uses weak permissions for the profile directory which allows local users to obtain sensitive information by reading a (1) cache file (2) password file or (3) configuration file or (4) possibly gain privileges by modifying or overwriting a configuration file.


The Bluetooth RFCOMM implementation in the Linux kernel before 3.6 does not properly initialize certain structures which allows local users to obtain sensitive information from kernel memory via a crafted application.


The do_ip_vs_get_ctl function in net/netfilter/ipvs/ip_vs_ctl.c in the Linux kernel before 3.6 does not initialize a certain structure for IP_VS_SO_GET_TIMEOUT commands which allows local users to obtain sensitive information from kernel stack memory via a crafted application.


wp-admin/media-upload.php in WordPress before 3.3.3 allows remote attackers to obtain sensitive information or bypass intended media-attachment restrictions via a post_id value.


The Bluetooth protocol stack in the Linux kernel before 3.6 does not properly initialize certain structures which allows local users to obtain sensitive information from kernel stack memory via a crafted application that targets the (1) L2CAP or (2) HCI implementation.


The udf_encode_fh function in fs/udf/namei.c in the Linux kernel before 3.6 does not initialize a certain structure member which allows local users to obtain sensitive information from kernel heap memory via a crafted application.


Inkscape before 0.48.4 reads .eps files from /tmp instead of the current directory which might cause Inkspace to process unintended files allow local users to obtain sensitive information and possibly have other unspecified impacts.


net/xfrm/xfrm_user.c in the Linux kernel before 3.6 does not verify that the actual Netlink message length is consistent with a certain header field which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability and providing a (1) new or (2) updated state.


Drupal 7.x before 7.16 allows remote attackers to obtain sensitive information and possibly re-install Drupal and execute arbitrary PHP code via an external database server related to \transient conditions.\


Google Chrome before 18.0.1025308 on Android does not properly restrict access to file: URLs which allows remote attackers to obtain sensitive information via unspecified vectors as demonstrated by obtaining credential data a different vulnerability than CVE-2012-4903.


The Host Connect emulator in IBM Rational Developer for System z 7.1 through 8.5.1 does not properly store the SSL certificate password which allows local users to obtain sensitive information via unspecified vectors.


The jigbrowser+ application before 1.5.0 for Android does not properly implement the WebView class which allows remote attackers to obtain sensitive information via a crafted application.


The WebView class in the Cybozu KUNAI Browser for Remote Service application beta for Android allows remote attackers to execute arbitrary JavaScript code and obtain sensitive information via a crafted application that places this code into a local file associated with a file: URL.


The rtrlet web application in the Web Console in Novell ZENworks Asset Management (ZAM) 7.5 uses a hard-coded username of Ivanhoe and a hard-coded password of Scott for the (1) GetFile_Password and (2) GetConfigInfo_Password operations which allows remote attackers to obtain sensitive information via a crafted rtrlet/rtr request for the HandleMaintenanceCalls function.


lib/filelib.php in Moodle 2.1.x before 2.1.8 2.2.x before 2.2.5 and 2.3.x before 2.3.2 does not properly check the publication state of blog files which allows remote attackers to obtain sensitive information by reading a blog entry that references a non-public file.


The load_script function in fs/binfmt_script.c in the Linux kernel before 3.7.2 does not properly handle recursion which allows local users to obtain sensitive information from kernel stack memory via a crafted application.


The WebView class in the Cybozu KUNAI application before 2.0.6 for Android allows remote attackers to execute arbitrary JavaScript code and obtain sensitive information via a crafted application that places this code into a local file associated with a file: URL.


Google Chrome before 18.0.1025308 on Android does not properly restrict access to file: URLs which allows remote attackers to obtain sensitive information via unspecified vectors as demonstrated by obtaining credential data a different vulnerability than CVE-2012-4906.


The TripAdvisor app 6.6 for iOS sends cleartext credentials which allows remote attackers to obtain sensitive information by sniffing the network.


IBM Flex System Chassis Management Module (CMM) and Integrated Management Module 2 (IMM2) allow local users to obtain sensitive information about (1) local accounts (2) SSH private keys (3) SSL/TLS private keys (4) SNMPv3 communities and (5) LDAP credentials by leveraging unspecified side effects of service or maintenance activity.


Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote authenticated users with ModifySelf or AdminUser privileges to inject arbitrary email headers and conduct phishing attacks or obtain sensitive information via unknown vectors.


The GREE application before 1.4.0 GREE Tanken Dorirando application before 1.0.7 GREE Tsurisuta application before 1.5.0 GREE Monpura application before 1.1.1 GREE Kaizokuoukoku Columbus application before 1.3.5 GREE haconiwa application before 1.1.0 GREE Seisen Cerberus application before 1.1.0 and KDDI&GREE GREE Market application before 2.1.2 for Android do not properly implement the WebView class which allows remote attackers to obtain sensitive information via a crafted application.


IBM Lotus Notes 8.5.x before 8.5.3 FP3 does not include the HTTPOnly flag in a Set-Cookie header for a web-application cookie which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie aka SPRs JMAS7TRNLN and SRAO8U3Q68.


Yaqas (Yet Another Question & Answer System) 1.0 Alpha 1 allows remote attackers to obtain sensitive information via an invalid character in the PHPSESSID which reveals the installation path in an error message.


EMC Smarts Network Configuration Manager (NCM) before 9.1 uses a hardcoded encryption key for the storage of credentials which allows local users to obtain sensitive information via unspecified vectors.


in

Bugzilla

before

and

before

and

before

and

and

before

generates

JavaScript

function

calls

containing

private

product

names

or

private

component

names

in

certain

circumstances

involving

custom-field

visibility

control

which

allows

remote

attackers

to

obtain

sensitive

information

by

reading

HTML

source

code.


cmdmon.c in Chrony before 1.29 allows remote attackers to obtain potentially sensitive information from stack memory via vectors related to (1) an invalid subnet in a RPY_SUBNETS_ACCESSED command to the handle_subnets_accessed function or (2) a RPY_CLIENT_ACCESSES command to the handle_client_accesses function when client logging is disabled which causes uninitialized data to be included in a reply.


Henry Schein Dentrix G5 before 15.1.294 has a single internal-database password that is shared across different customers' installations which allows remote attackers to obtain sensitive information about patients by leveraging knowledge of this password from another installation.


The fabric-interconnect component in Cisco Unified Computing System (UCS) does not encrypt KVM media traffic which allows remote attackers to obtain sensitive information and consequently complete the authentication process for a server connection by sniffing the network aka Bug ID CSCtr72970.


MosP kintai kanri before 4.1.0 does not properly perform authentication which allows remote authenticated users to impersonate arbitrary user accounts and consequently obtain sensitive information or modify settings via unspecified vectors.


McAfee ePolicy Orchestrator (ePO) 4.6.1 and earlier allows remote authenticated users to bypass intended access restrictions and obtain sensitive information from arbitrary reporting panels via a modified ID value in a console URL.


Agile FleetCommander and FleetCommander Kiosk before 4.08 use an XOR format for password encryption which makes it easier for context-dependent attackers to obtain sensitive information by reading a key file and the encrypted strings.


The default configuration of the SMTP component in Websense Email Security 6.1 through 7.3 enables weak SSL ciphers in the \SurfControl plc\\SuperScout Email Filter\\SMTP\ registry key which makes it easier for remote attackers to obtain sensitive information by sniffing the network and then conducting a brute-force attack against encrypted session data.


McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3 and McAfee Email Gateway (MEG) 7.0 before Patch 1 does not properly encrypt system-backup data which makes it easier for remote authenticated users to obtain sensitive information by reading a backup file as demonstrated by obtaining password hashes.


Agile FleetCommander and FleetCommander Kiosk before 4.08 store database credentials in cleartext which allows remote attackers to obtain sensitive information via requests to unspecified pages.


The

function

in

in

the

Drupal

Commons

module

before

for

Drupal

does

not

properly

enforce

intended

node

access

restrictions

which

might

allow

remote

attackers

to

obtain

sensitive

information

via

the

recent

comments

listing.


The jNews (com_jnews) component 7.5.1 for Joomla! allows remote attackers to obtain sensitive information via the emailsearch parameter which reveals the installation path in an error message.


About.aspx in the Portal in McAfee Enterprise Mobility Manager (EMM) before 10.0 discloses the name of the user account for an IIS worker process which allows remote attackers to obtain potentially sensitive information by visiting this page.


The WebView class in the Cybozu Live application 1.0.4 and earlier for Android allows remote attackers to execute arbitrary JavaScript code and obtain sensitive information via a crafted application that places this code into a local file associated with a file: URL.


EMC Avamar Client for VMware 6.1 stores the cleartext server root password on the proxy client which might allow remote attackers to obtain sensitive information by leveraging \network access\ to the proxy client.


show_config_errors.php in phpMyAdmin 3.5.x before 3.5.2.1 allows remote attackers to obtain sensitive information via a direct request which reveals the installation path in an error message related to lack of inclusion of the common.inc.php library file.


dracut.sh in dracut as used in Red Hat Enterprise Linux 6 Fedora 16 and 17 and possibly other products creates initramfs images with world-readable permissions which might allow local users to obtain sensitive information.


Drupal 6.x before 6.27 and 7.x before 7.18 displays information for blocked users which might allow remote attackers to obtain sensitive information by reading the search results.


HP Service Manager Web Tier 9.31 before 9.31.2004 p2 allows remote attackers to obtain sensitive information via unspecified vectors.


The Context module 6.x-3.x before 6.x-3.1 and 7.x-3.x before 7.x-3.0-beta6 for Drupal does not properly restrict access to block content which allows remote attackers to obtain sensitive information via a crafted request.


Neocrome

Seditio

build

allows

remote

attackers

to

obtain

sensitive

information

via

a

direct

request

to

or


The Loctouch application 3.4.6 and earlier for Android does not properly handle implicit intents which allows attackers to obtain sensitive information about logged locations via a crafted application.


The default configuration of Cerberus FTP Server before 5.0.4.0 supports the DES cipher for SSH sessions which makes it easier for remote attackers to obtain sensitive information by sniffing the network and performing a brute-force attack on the encrypted data.


Apache CloudStack 4.0.0-incubating and Citrix CloudPlatform (formerly Citrix CloudStack) before 3.0.6 stores sensitive information in the log4j.conf log file which allows local users to obtain (1) the SSH private key as recorded by the createSSHKeyPair API (2) the password of an added host as recorded by the AddHost API or the password of an added VM as recorded by the (3) DeployVM or (4) ResetPasswordForVM API.


rhc-chk.rb in Red Hat OpenShift Origin before 1.1 when -d (debug mode) is used outputs the password and other sensitive information in cleartext which allows context-dependent attackers to obtain sensitive information as demonstrated by including log files or Bugzilla reports in support channels.


The Weathernews Touch application 2.3.2 and earlier for Android allows attackers to obtain sensitive information about logged locations via a crafted application that leverages read permission for system log files.


The Loctouch application 3.4.6 and earlier for Android allows attackers to obtain sensitive information about logged locations via a crafted application that leverages read permission for system log files.


The Nodewords: D6 Meta Tags module before 6.x-1.14 for Drupal when configured to automatically generate description meta tags from node text does not properly filter node content when creating tags which might allow remote attackers to obtain sensitive information by reading the (1) description (2) dc.description or (3) og:description meta tags.


A certain Red Hat build of the pam_ssh_agent_auth module on Red Hat Enterprise Linux (RHEL) 6 and Fedora Rawhide calls the glibc error function instead of the error function in the OpenSSH codebase which allows local users to obtain sensitive information from process memory or possibly gain privileges via crafted use of an application that relies on this module as demonstrated by su and sudo.


The server in TIBCO Formvine 3.1.x and 3.2.x before 3.2.1 does not properly implement access control which allows remote attackers to obtain sensitive information or modify data via unspecified vectors.


Drupal 6.x before 6.27 allows remote attackers to obtain sensitive information about uploaded files via a (1) RSS feed or (2) search result.


The User.get method in Bugzilla/WebService/User.pm in Bugzilla 4.3.2 allows remote attackers to obtain sensitive information about the saved searches of arbitrary users via an XMLRPC request or a JSONRPC request a different vulnerability than CVE-2012-4198.


The Web Client (aka CQ Web) in IBM Rational ClearQuest 7.1.2.x before 7.1.2.9 and 8.0.0.x before 8.0.0.5 allows remote attackers to obtain sensitive information via unspecified vectors that trigger a SQL error message.


Neocrome

Seditio

build

and

earlier

allows

remote

attackers

to

obtain

sensitive

information

via

direct

request

to

view.php

or

which

reveals

the

installation

path

in

an

error

message.


Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1 when moving disks between storage domains does not properly wipe-after-delete which prevents disks from being securely deleted and might allow local users to obtain sensitive information via unspecified vectors.


core/email_api.php in MantisBT before 1.2.12 does not properly manage the sending of e-mail notifications about restricted bugs which might allow remote authenticated users to obtain sensitive information by adding a note to a bug before losing permission to view that bug.


The Boat Browser application before 4.2 and Boat Browser Mini application before 3.9 for Android do not properly implement the WebView class which allows attackers to obtain sensitive information via a crafted application.


The btinstall installation script in Bulb Security Smartphone Pentest Framework (SPF) before 0.1.3 uses weak permissions (777) for all files in the frameworkgui/ directory which allows local users to obtain sensitive information or inject arbitrary Perl code via direct access to these files.


The Opera Mobile application before 12.1 and Opera Mini application before 7.5 for Android do not properly implement the WebView class which allows attackers to obtain sensitive information via a crafted application.


OpenStack Compute (Nova) Folsom before 2012.2.2 and Grizzly when using libvirt and LVM backed instances does not properly clear physical volume (PV) content when reallocating for instances which allows attackers to obtain sensitive information by reading the memory of the previous logical volume (LV).


An exposure of sensitive information vulnerability exists in Jenkins meliora-testlab Plugin 1.14 and earlier in TestlabNotifier.java that allows attackers with file system access to the Jenkins master to obtain the API key stored in this plugin's configuration.


An exposure of sensitive information vulnerability exists in Jenkins Tinfoil Security Plugin 1.6.1 and earlier in TinfoilScanRecorder.java that allows attackers with file system access to the Jenkins master to obtain the API secret key stored in this plugin's configuration.


An exposure of sensitive information vulnerability exists in Jenkins Anchore Container Image Scanner Plugin 10.16 and earlier in AnchoreBuilder.java that allows attackers with Item/ExtendedRead permission or file system access to the Jenkins master to obtain the password stored in this plugin's configuration.


The WP Backup+ (aka WPbackupplus) plugin through 2018-11-22 for WordPress allows remote attackers to obtain sensitive information from server folders and files as demonstrated by download.sql.


Roundcube

before

mishandles

GnuPG

MDC

integrity-protection

warnings

which

makes

it

easier

for

attackers

to

obtain

sensitive

information

a

related

issue

to

This

is

associated

with


Google Monorail before 2018-05-04 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF and calculations of download times (for requests with an unsupported axis) can be used to obtain sensitive information about the content of bug reports.


The debug_mode function in web/web.py in OnionShare through 1.3.1 when --debug is enabled uses the /tmp/onionshare_server.log pathname for logging which might allow local users to overwrite files or obtain sensitive information by using this pathname.


Google Monorail before 2018-06-07 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF and calculations of download times (for requests with a crafted groupby value) can be used to obtain sensitive information about the content of bug reports.


Honeywell MatrikonOPC OPC Controller before 5.1.0.0 allows local users to transfer arbitrary files from a host computer and consequently obtain sensitive information via vectors related to MSXML libraries.


set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file which allows local users to obtain sensitive information (e.g. credentials contained in the URL) by reading this attribute as demonstrated by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog user.xdg.origin.url was partially based on the behavior of fwrite_xattr in tool_xattr.c in curl.


Open-Xchange OX App Suite before 7.6.3-rev37 7.8.x before 7.8.2-rev40 7.8.3 before 7.8.3-rev48 and 7.8.4 before 7.8.4-rev28 include folder names in API error responses which allows remote attackers to obtain sensitive information via the folder parameter in an \all\ action to api/tasks.


CyberArk Password Vault before 9.7 allows remote attackers to obtain sensitive information from process memory by replaying a logon message.


A

web-accessible

backdoor

with

resultant

SSRF

exists

in

Tp-shop

through

which

allows

remote

attackers

to

obtain

sensitive

information

attack

intranet

hosts

or

possibly

trigger

remote

command

execution

because

writes

data

from

the

URL

into

the

\bddlj\

local

file

if

the

attacker

knows

the

backdoor

\jmmy\

parameter.


A vulnerability exists in the file reading procedure in Open Design Alliance Drawings SDK 2019Update1 on non-Windows platforms in which attackers could perform read operations past the end or before the beginning of the intended buffer. This can allow attackers to obtain sensitive information from process memory or cause a crash.


The Sky Go Desktop application 1.0.19-1 through 1.0.23-1 for Windows performs several requests over cleartext HTTP. This makes the data submitted in these requests prone to Man in The Middle (MiTM) attacks whereby an attacker would be able to obtain the data sent in these requests. Some of the requests contain potentially sensitive information that could be useful to an attacker such as the victim's Sky username.


Topvision CC8800 CMTS C-E devices allow remote attackers to obtain sensitive information via a direct request for /WebContent/startup.tar.gz with userName=admin in a cookie.


Open Design Alliance Drawings SDK 2019Update1 has a vulnerability during the reading of malformed files allowing attackers to obtain sensitive information from process memory or cause a crash.


An issue was discovered in the Daimler Mercedes-Benz Me app 2.11.0-846 for iOS. The encrypted Connected Vehicle API data exchange between the app and a server might be intercepted. The app can be used to operate the Remote Parking Pilot unlock the vehicle or obtain sensitive information such as latitude longitude and direction of travel.


A vulnerability in the Private Browser of Trend Micro Dr. Safety for Android (Consumer) versions below 3.0.1478 could allow an remote attacker to bypass the Same Origin Policy (SOP) and obtain sensitive information via crafted JavaScript code on vulnerable installations.


Brickstream 2300 devices allow remote attackers to obtain potentially sensitive information via a direct request for the basic.html#ipsettings or basic.html#datadelivery URI.


CirCarLife Scada before 4.3 allows remote attackers to obtain sensitive information via a direct request for the html/log or services/system/info.html URI.


Reliable Controls MACH-ProWebCom 7.80 devices allow remote attackers to obtain sensitive information via a direct request for the data/fileinfo.xml or job/job.json file as demonstrated the Master Password field.


Electro Industries GaugeTech Nexus devices allow remote attackers to obtain potentially sensitive information via a direct request for the meter_information.htm diag_system.htm or diag_dnp_lan_wan.htm URI.


Brynamics \Online Trade - Online trading and cryptocurrency investment system\ allows remote attackers to obtain sensitive information via a direct request for the /dashboard/deposit URI as demonstrated by discovering database credentials.


BWS Systems HA-Bridge devices allow remote attackers to obtain potentially sensitive information via a direct request for the #!/system URI.


SAJ Solar Inverter allows remote attackers to obtain potentially sensitive information via a direct request for the inverter_info.htm or english_main.htm URI.


Northern Electric & Power (NEP) inverter devices allow remote attackers to obtain potentially sensitive information via a direct request for the nep/status/index/1 URI.


Avast Free Antivirus prior to 19.1.2360 stores user credentials in memory upon login which allows local users to obtain sensitive information by dumping AvastUI.exe application memory and parsing the data.


Pharos Controls devices allow remote attackers to obtain potentially sensitive information via a direct request for the default/index.lsp or default/log.lsp URI.


MusicCenter / Trivum Multiroom Setup Tool V8.76 - SNR 8604.26 - C4 Professional before V9.34 build 13381 - 12.07.18 allows unauthorized remote attackers to obtain sensitive information via the \/xml/menu/getObjectEditor.xml\ URL using a \?oid=systemSetup&id=_0\ or \?oid=systemUsers&id=_0\ GET request.


Incorrect default permissions vulnerability in synouser.conf in Synology Diskstation Manager (DSM) before 6.2-23739-1 allows remote authenticated users to obtain sensitive information via the world readable configuration.


Incorrect default permissions vulnerability in synouser.conf in Synology Router Manager (SRM) before 1.1.7-6941-1 allows remote authenticated users to obtain sensitive information via the world readable configuration.


IBM API Connect 2018.1 through 2018.4.1.5 could allow an attacker to obtain sensitive information from a specially crafted HTTP request that could aid an attacker in further attacks against the system. IBM X-Force ID: 155150.


A vulnerability in Cisco WebEx Meetings Server could allow an authenticated remote attacker to access sensitive data about the application. An attacker could exploit this vulnerability to obtain information to conduct additional reconnaissance attacks. The vulnerability is due to a design flaw in Cisco WebEx Meetings Server that could allow an attacker who is authenticated as root to gain shared secrets. An attacker could exploit the vulnerability by accessing the root account and viewing sensitive information. Successful exploitation could allow the attacker to discover sensitive information about the application. Cisco Bug IDs: CSCvg42664.


Shibboleth XMLTooling-C before 1.6.4 as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products mishandles digital signatures of user data which allows remote attackers to obtain sensitive information or conduct impersonation attacks via crafted XML data. NOTE: this issue exists because of an incomplete fix for CVE-2018-0486.


Shibboleth XMLTooling-C before 1.6.3 as used in Shibboleth Service Provider before 2.6.0 on Windows and other products mishandles digital signatures of user attribute data which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD.


The compat_get_timex function in kernel/compat.c in the Linux kernel before 4.16.9 allows local users to obtain sensitive information from kernel memory via adjtimex.


Ruckus SmartZone (formerly Virtual SmartCell Gateway or vSCG) 3.5.0 3.5.1 3.6.0 and 3.6.1 (Essentials and High Scale) on vSZ SZ-100 SZ-300 and SCG-200 devices allows remote attackers to obtain sensitive information or modify data.


SimpliSafe Original has Unencrypted Sensor Transmissions which allows physically proximate attackers to obtain potentially sensitive information about the specific times when alarm-system events occur.


joyplus-cms 1.6.0 allows remote attackers to obtain sensitive information via a direct request to the install/ or log/ URI.


An issue was discovered in PHP before 5.6.35 7.0.x before 7.0.29 7.1.x before 7.1.16 and 7.2.x before 7.2.4. Dumpable FPM child processes allow bypassing opcache access controls because fpm_unix.c makes a PR_SET_DUMPABLE prctl call allowing one user (in a multiuser environment) to obtain sensitive information from the process memory of a second user's PHP applications by running gcore on the PID of the PHP-FPM worker process.


This vulnerability allows local attackers to disclose sensitive information on vulnerable installations of Samsung Email Fixed in version 5.0.02.16. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of file:/// URIs. The issue lies in the lack of proper validation of user-supplied data which can allow for reading arbitrary files. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges. Was ZDI-CAN-5329.


Google Monorail before 2018-04-04 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF and calculations of download times (for requests with duplicated columns) can be used to obtain sensitive information about the content of bug reports.


IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information caused by incorrect transport being used when Liberty is configured to use Java Authentication SPI for Containers (JASPIC). This can happen when the Application Server is configured to permit access on non-secure (http) port and using JASPIC or JSR375 authentication.


IBM Cloud Private 3.1.1 could allow a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web site a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 153319.


IBM Connections 5.0 5.5 and 6.0 could allow an authenticated user to obtain sensitive information from invalid request error messages. IBM X-Force ID: 153315.


The Report Builder of Jazz Reporting Service 5.0 through 5.0.2 and 6.0 through 6.0.6 could allow an authenticated user to obtain sensitive information beyond its assigned privileges. IBM X-Force ID: 144579.


IBM WebSphere Application Server 7.0 8.0 8.5 and 9.0 could provide weaker than expected security caused by the improper TLS configuration. A remote attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 154650.


The PortletV3AnnotatedDemo Multipart Portlet war file code provided in Apache Pluto version 3.0.0 could allow a remote attacker to obtain sensitive information caused by the failure to restrict path information provided during a file upload. An attacker could exploit this vulnerability to obtain configuration data and other sensitive information.


IBM DataPower Gateways 7.5 7.5.1 7.5.2 7.6 and 2018.4 could allow a remote attacker to obtain sensitive information caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 144889.


IBM InfoSphere Information Governance Catalog 11.3 11.5 and 11.7 could allow a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web site a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 151639.


IBM WebSphere Portal 7.0 8.0 8.5 and 9.0 could allow a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web site a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 147906.


IBM

WebSphere

Commerce

Enterprise

Professional

Express

and

Developer

and

Feature

Pack

could

allow

an

authenticated

user

to

obtain

sensitive

information

about

another

user.


IBM InfoSphere Information Server 11.3 11.5 and 11.7 could allow a remote attacker to obtain sensitive information caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 140089.


IBM Curam Social Program Management 6.0.5 6.1.1 6.2.0 7.0.1 and 7.0.3 could allow a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web site a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 144747.


IBM Jazz applications (IBM Rational Collaborative Lifecycle Management 5.0 through 5.02 and 6.0 through 6.0.6 IBM Rational DOORS Next Generation 5.0 through 5.02 and 6.0 through 6.0.6 IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 IBM Rational Quality Manager 5.0 through 5.02 and 6.0 through 6.0.6 IBM Rational Rhapsody Design Manager 5.0 through 5.02 and 6.0 through 6.0.6 IBM Rational Software Architect Design Manager 5.0 through 5.02 and 6.0 through 6.0.1 IBM Rational Team Concert 5.0 through 5.02 and 6.0 through 6.0.6) could allow a remote attacker to obtain sensitive information caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 145609.


IBM API Connect 5.0.0.0 through 5.0.8.3 could allow a remote attacker to obtain sensitive information caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 142650.


IBM WebSphere MQ 8.0 and 9.0 could allow a remote attacker to obtain sensitive information caused by the failure to properly validate the SSL certificate. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 142598.


IBM Jazz based applications (IBM Rational Collaborative Lifecycle Management 5.0 through 5.02 and 6.0 through 6.0.6 IBM Rational DOORS Next Generation 5.0 through 5.02 and 6.0 through 6.0.6 IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 IBM Rational Quality Manager 5.0 through 5.02 and 6.0 through 6.0.6 IBM Rational Rhapsody Design Manager 5.0 through 5.02 and 6.0 through 6.0.6 IBM Rational Software Architect Design Manager 5.0 through 5.02 and 6.0 through 6.0.1 IBM Rational Team Concert 5.0 through 5.02 and 6.0 through 6.0.6) could allow an authenticated user to obtain sensitive information from an error message that could be used in further attacks against the system. IBM X-Force ID: 143796.


IBM i2 Enterprise Insight Analysis 2.1.7 could allow a remote attacker to obtain sensitive information caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 142117.


IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 could allow a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web site a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 146339.


IBM

SAN

Volume

Controller

IBM

Storwize

IBM

Spectrum

Virtualize

and

IBM

FlashSystem

products

and

could

allow

an

authenticated

user

to

obtain

sensitive

information

that

they

should

not

have

authorization

to

read.

IBM

X-Force

ID:


IBM DataPower Gateway 7.5.0.0 through 7.5.0.19 7.5.1.0 through 7.5.1.18 7.5.2.0 through 7.5.2.18 and 7.6.0.0 through 7.6.0.11 appliances allows \null\ logins which could give read access to IPMI data to obtain sensitive information. IBM X-Force ID: 144894.


IBM Security Access Manager Appliance 9.0.1.0 9.0.2.0 9.0.3.0 9.0.4.0 and 9.0.5.0 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 149703.


An exposure of sensitive information vulnerability exists in Jenkins Perforce Plugin version 1.3.36 and older in PerforcePasswordEncryptor.java that allows attackers with insufficient permission to obtain Perforce passwords configured in jobs to obtain them


Battelle V2I Hub 2.5.1 could allow a remote attacker to obtain sensitive information caused by the failure to restrict access to the API key file. An attacker could exploit this vulnerability to obtain the current API key to gain unauthorized access to the system.


A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in DataBoundConfigurator.java Attribute.java BaseConfigurator.java ExtensionConfigurator.java that allows attackers with access to Jenkins log files to obtain the passwords configured using Configuration as Code Plugin.


LICA miniCMTS E8K(u/i/...) devices allow remote attackers to obtain sensitive information via a direct POST request for the inc/user.ini file leading to discovery of a password hash.


TeamViewer through 13.1.1548 stores a password in Unicode format within TeamViewer.exe process memory between \00 88 and \00 00 00\ delimiters which might make it easier for attackers to obtain sensitive information by leveraging an unattended workstation on which TeamViewer has disconnected but remains running.


CMS ISWEB 3.5.3 is vulnerable to multiple SQL injection flaws. An attacker can inject malicious queries into the application and obtain sensitive information.


GolemCMS through 2008-12-24 if the install/ directory remains active after an installation allows remote attackers to execute arbitrary PHP code by inserting this code into the \Database Information\ \Table prefix\ form field or obtain sensitive information via a direct request for install/install.sql.


Brynamics \Online Trade - Online trading and cryptocurrency investment system\ allows remote attackers to obtain sensitive information via a direct request for /dashboard/addplan /dashboard/paywithcard/charge /dashboard/withdrawal or /privacy&terms as demonstrated by reading database username database password database_name and IP address fields related to CVE-2018-12908.


The demo feature in Oracle GlassFish Open Source Edition 5.0 has TCP port 7676 open by default with a password of admin for the admin account. This allows remote attackers to obtain potentially sensitive information perform database operations or manipulate the demo via a JMX RMI session aka a \jmx_rmi remote monitoring and control problem.\ NOTE: this is not an Oracle supported product.


Wi2be SMART HP WMT R1.2.20_201400922 allows unauthorized remote attackers to obtain sensitive information via /Status/SystemStatusRpm.esp.


Cobham Sea Tel 121 build 222701 devices allow remote attackers to obtain potentially sensitive information via a /cgi-bin/getSysStatus request as demonstrated by the Latitude/Longitude of the ship or satellite details.


The Neon app 1.6.14 iOS does not verify X.509 certificates from SSL servers which allows remote attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Quest Kace K1000 Appliance versions prior to 9.0.270 allows an authenticated remote attacker with least privileges ('User Console Only' role) to potentially exploit multiple Blind SQL Injection vulnerabilities to retrieve sensitive information from the database or copy the entire database. An authenticated remote attacker could leverage Blind SQL injections to obtain sensitive data.


The backend component in Open-Xchange OX App Suite before 7.6.3-rev36 7.8.x before 7.8.2-rev39 7.8.3 before 7.8.3-rev44 and 7.8.4 before 7.8.4-rev22 allows remote authenticated users to obtain sensitive information about external guest users via vectors related to the \groups\ and \users\ APIs.


Cobham Sea Tel 121 build 222701 devices allow remote attackers to obtain potentially sensitive information about valid usernames by reading the loginName lines at the js/userLogin.js URI. NOTE: default passwords for the standard usernames are listed in the product's documentation: Dealer with password seatel3 SysAdmin with password seatel2 and User with password seatel1.


MASTER IPCAMERA01 3.3.4.2103 devices allow remote attackers to obtain sensitive information via a crafted HTTP request as demonstrated by the username password and configuration settings.


An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. watchOS before 4.3 is affected. The issue involves the fetch API in the \WebKit\ component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.


An issue was discovered in certain Apple products. macOS before 10.13.4 is affected. The issue involves the \ATS\ component. It allows attackers to obtain sensitive information by leveraging symlink mishandling.


An issue was discovered in certain Apple products. iOS before 11.3 is affected. The issue involves the \Files Widget\ component. It allows physically proximate attackers to obtain sensitive information by leveraging the display of cached data on a locked device.


SynTP.sys in Synaptics Touchpad drivers before 2018-06-06 allows local users to obtain sensitive information about freed kernel addresses.


Lobby Track Desktop could allow a local attacker to obtain sensitive information caused by an error in Reports while in kiosk mode. By visiting the kiosk and clicking on reports an attacker could exploit this vulnerability to gain access to all visitor records and obtain sensitive information.


Lobby Track Desktop could allow a local attacker to obtain sensitive information caused by an error in Reports while in kiosk mode. By visiting the kiosk and viewing the driver's license column an attacker could exploit this vulnerability to view the driver's license number and other personal information.


The web component on ARRIS TG2492LG-NA 061213 devices allows remote attackers to obtain sensitive information via the /snmpGet oids parameter.


The Receptionist for iPad could allow a local attacker to obtain sensitive information caused by an error in the contact.json file. An attacker could exploit this vulnerability to obtain the contact names phone numbers and emails.


Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information caused by the storing of unencrypted data in logs. An attacker could exploit this vulnerability to obtain two API keys a token and other sensitive information.


EasyLobby Solo could allow a local attacker to obtain sensitive information caused by the storing of the social security number in plaintext. By visiting the kiosk and viewing the Visitor table of the database an attacker could exploit this vulnerability to view stored social security numbers.


Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information caused by the storing of hardcoded OAuth Creds in plaintext. An attacker could exploit this vulnerability to obtain sensitive information.


An issue was discovered in DonLinkage 6.6.8. It allows remote attackers to obtain potentially sensitive information via a direct request for files/temporary.txt.


Lobby Track Desktop could allow a local attacker to obtain sensitive information caused by an error in Sample Database.mdb database while in kiosk mode. By using attack vectors outlined in kiosk breakout an attacker could exploit this vulnerability to view and edit the database.


cipher/elgamal.c in Libgcrypt through 1.8.2 when used to encrypt messages directly improperly encodes plaintexts which allows attackers to obtain sensitive information by reading ciphertext data (i.e. it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.


totemomail Encryption Gateway before 6.0_b567 allows remote attackers to obtain sensitive information about user sessions and encryption key material via a JSONP hijacking attack.


Lack of secure text entry mode in Browser UI in Google Chrome on Mac prior to 67.0.3396.62 allowed a local attacker to obtain potentially sensitive information from process memory via a local process.


lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters which allows attackers to obtain sensitive information by reading ciphertext data (i.e. it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto's ElGamal implementation.


In Yii Framework 2.x before 2.0.14 remote attackers could obtain potentially sensitive information from exception messages or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php log/Dispatcher.php and views/errorHandler/exception.php.


Information leak in media engine in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.


django.contrib.auth.forms.AuthenticationForm

in

Django

before

and

and

allows

remote

attackers

to

obtain

potentially

sensitive

information

by

leveraging

data

exposure

from

the

method

as

demonstrated

by

discovering

whether

a

user

account

is

inactive.


Uninitialized data in WebRTC in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file.


An

issue

was

discovered

on

Orbic

Wonder

Orbic/RC555L/RC555L:7.1.2/N2G47H/329100b:user/release-keys

devices

allowing

attackers

to

obtain

sensitive

information

(such

as

text-message

content)

by

reading

a

copy

of

the

Android

log

on

the

SD

card.

The

system-wide

Android

logs

are

not

directly

available

to

third-party

apps

since

they

tend

to

contain

sensitive

data.

Third-party

apps

can

read

from

the

log

but

only

the

log

messages

that

the

app

itself

has

written.

Certain

apps

can

leak

data

to

the

Android

log

due

to

not

sanitizing

log

messages

which

is

in

an

insecure

programming

practice.

Pre-installed

system

apps

and

apps

that

are

signed

with

the

framework

key

can

read

from

the

system-wide

Android

log.

We

found

a

pre-installed

app

on

the

Orbic

Wonder

that

when

started

via

an

Intent

will

write

the

Android

log

to

the

SD

card

also

known

as

external

storage

via

com.ckt.mmitest.MmiMainActivity.

Any

app

that

requests

the

permission

can

read

from

the

SD

card.

Therefore

a

local

app

on

the

device

can

quickly

start

a

specific

component

in

the

pre-installed

system

app

to

have

the

Android

log

written

to

the

SD

card.

Therefore

any

app

co-located

on

the

device

with

the

permission

can

obtain

the

data

contained

within

the

Android

log

and

continually

monitor

it

and

mine

the

log

for

relevant

data.

In

addition

the

default

messaging

app

(com.android.mms)

writes

the

body

of

sent

and

received

text

messages

to

the

Android

log

as

well

as

the

recipient

phone

number

for

sent

text

messages

and

the

sending

phone

number

for

received

text

messages.

In

addition

any

call

data

contains

phone

numbers

for

sent

and

received

calls.


Confusing settings in Autofill in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.


Converse.js and Inverse.js through 3.3 allow remote attackers to obtain sensitive information because it is too difficult to determine whether safe publication of private data was configured or even intended. For example users might have an expectation that chatroom bookmarks are private but the various interacting software components do not necessarily make that happen.


The

FSX

installer

for

Flight

Sim

Labs

sends

a

user's

Google

account

credentials

to

if

a

pirated

serial

number

has

been

entered

which

allows

remote

attackers

to

obtain

sensitive

information

e.g.

by

sniffing

the

network

for

cleartext

HTTP

traffic.

This

behavior

was

removed

in


An issue was discovered in iDashboards 9.6b. It allows remote attackers to obtain sensitive information via a direct request for the idashboards/config.xml URI as demonstrated by intranet URLs for reports.


RoomWizard before 4.4.x allows remote attackers to obtain potentially sensitive information about IP addresses via /getGroupTimeLineJSON.action.


The REST APIs in ForgeRock AM before 5.5.0 include SSOToken IDs as part of the URL which allows attackers to obtain sensitive information by finding an ID value in a log file.


An issue was discovered in iDashboards 9.6b. It allows remote attackers to obtain sensitive information via a direct request for the idb/config?CMD=installLicense URI as demonstrated by intranet IP addresses and names of guest accounts.


An issue was discovered on Lutron Quantum BACnet Integration 2.0 (firmware 3.2.243) devices. Remote attackers can obtain potentially sensitive information via a /DbXmlInfo.xml request as demonstrated by the Latitude/Longitude of the device.


Mitsubishi Electric SmartRTU devices allow remote attackers to obtain sensitive information (directory listing and source code) via a direct request to the /web URI.


Unsafe handling of credit card details in Autofill in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.


Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. The legacy channels.http.AsgiHandler class used for handling HTTP type requests in an ASGI environment prior to Django 3.0 did not correctly separate request scopes in Channels 3.0. In many cases this would result in a crash but with correct timing responses could be sent to the wrong client resulting in potential leakage of session identifiers and other sensitive data. Note that this affects only the legacy Channels provided class and not Django's similar ASGIHandler available from Django 3.0.


Tenda N300 F3 12.01.01.48 devices allow remote attackers to obtain sensitive information (possibly including an http_passwd line) via a direct request for cgi-bin/DownloadCfg/RouterCfm.cfg a related issue to CVE-2017-14942. NOTE: the vulnerability report may suggest that either a ? character must be placed after the RouterCfm.cfg filename or that the HTTP request headers must be unusual but it is not known why these are relevant to the device's HTTP response behavior.


rainrocka xinhu 2.1.9 allows remote attackers to obtain sensitive information via an index.php?a=gettotal request in which the ajaxbool value is manipulated to be true.


The userLogin parameter in ldap/login.php of rConfig 3.9.5 is unsanitized allowing attackers to perform a LDAP injection and obtain sensitive information via a crafted POST request.


AppCMS 2.0.101 in /admin/template/tpl_app.php has a cross site scripting attack vulnerability which allows the attacker to obtain sensitive information of other users.


This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.1-47117. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the xHCI component. The issue results from the lack of proper validation of user-supplied data which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the hypervisor. Was ZDI-CAN-9428.


In Electric Coin Company Zcashd before 2.1.1-1 the time offset between messages could be leveraged to obtain sensitive information about the relationship between a suspected victim's address and an IP address aka a timing side channel.


SQL Injection in Wuzhi CMS v4.1.0 allows remote attackers to obtain sensitive information via the 'flag' parameter in the component '/coreframe/app/order/admin/index.php'.


Open Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive information via the \redirect\ parameter in the component \zb_system/cmd.php.\


SQL Injection in Xinhu OA System v1.8.3 allows remote attackers to obtain sensitive information by injecting arbitrary commands into the \typeid\ variable of the \createfolderAjax\ function in the \mode_worcAction.php\ component.


Weak Encoding for Password in DoraCMS v2.1.1 and earlier allows attackers to obtain sensitive information as it does not use a random salt or IV for its AES-CBC encryption causes password encrypted for users to be susceptible to dictionary attacks.


IBL Online Weather before 4.3.5a allows attackers to obtain sensitive information by reading the IWEBSERVICE_JSONRPC_COOKIE cookie.


White Shark System (WSS) 1.3.2 has a SQL injection vulnerability. The vulnerability stems from the default_task_edituser.php files failing to filter the csa_to_user parameter. Remote attackers can exploit the vulnerability to obtain database sensitive information.


White Shark System (WSS) 1.3.2 has a SQL injection vulnerability. The vulnerability stems from the control_task.php control_project.php default_user.php files failing to filter the sort parameter. Remote attackers can exploit the vulnerability to obtain database sensitive information.


INTELBRAS TELEFONE IP TIP200 version 60.61.75.22 allows an attacker to obtain sensitive information through /cgi-bin/cgiServer.exx.


A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client users to obtain the server's potentially sensitive information when the server got WebApplicationException from the RESTEasy client call. The highest threat from this vulnerability is to data confidentiality.


An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. The CMC service allows attackers to obtain sensitive information. The Samsung ID is SVE-2020-17288 (August 2020).