The HTTP and WebSocket engine components in the server in Kaazing Gateway 4.0.2 4.0.3 and 4.0.4 and Gateway - JMS Edition 4.0.2 4.0.3 and 4.0.4 allow remote attackers to obtain sensitive information via vectors related to HTTP request handling.


IBM Rational ClearCase 8.0.0 before 8.0.0.14 and 8.0.1 before 8.0.1.7 when Installation Manager before 1.8.2 is used retains cleartext server passwords in process memory throughout the installation procedure which might allow local users to obtain sensitive information by leveraging access to the installation account.


IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1 and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1 place credentials in URLs which allows remote attackers to obtain sensitive information by reading (1) web-server access logs (2) web-server Referer logs or (3) the browser history.


IBM Tivoli Identity Manager 5.1.x before 5.1.0.15-ISS-TIM-IF0057 and Security Identity Manager 6.0.x before 6.0.0.4-ISS-SIM-IF0001 and 7.0.x before 7.0.0.0-ISS-SIM-IF0003 allow remote authenticated users to bypass intended access restrictions and obtain sensitive information via vectors related to server side LDAP queries. IBM X-Force ID: 96173.


IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 make it easier for remote attackers to obtain sensitive information by sniffing the network during use of a weak SSL cipher.


IBM WebSphere Service Registry and Repository (WSRR) 7.0.x before 7.0.0.5 and 7.5.x before 7.5.0.3 does not perform access-control checks for depth-0 retrieve operations which allows remote authenticated users to obtain sensitive information via unspecified vectors.


IBM Flex System Manager (FSM) 1.1.x.x 1.2.0.x 1.2.1.x 1.3.0.0 1.3.1.0 and 1.3.2.0 allows local users to obtain sensitive information and consequently gain privileges or conduct impersonation attacks via unspecified vectors.


IBM WebSphere Process Server 7.0 WebSphere Enterprise Service Bus 7.0 and Business Process Manager Advanced 7.5.x through 7.5.1.2 8.0.x through 8.0.1.3 and 8.5.x through 8.5.5 disregard the SSL setting in the SCA module HTTP import binding and unconditionally select the SSLv3 protocol which makes it easier for remote attackers to hijack sessions or obtain sensitive information by leveraging the use of a weak cipher.


IBM Records Manager (RM) 4.5.x before 4.5.1.1-IER-FP001 transmits passwords in cleartext which allows remote attackers to obtain sensitive information by sniffing the network.


The FTP authentication module in Synology Disk Station 2.x logs passwords to the web application interface in cases of incorrect login attempts which allows local users to obtain sensitive information by reading a log a different vulnerability than CVE-2010-2453.


SSL_Cipher.cpp in EncFS before 1.7.0 uses an improper combination of an AES cipher and a CBC cipher mode for encrypted filesystems which allows local users to obtain sensitive information via a watermark attack.


The engine installer in Novell Identity Manager (aka IDM) 3.6.1 stores admin tree credentials in /tmp/idmInstall.log which allows local users to obtain sensitive information by reading this file.


The autosuggest feature in the Omnibox implementation in Google Chrome before 5.0.375.127 does not anticipate entry of passwords which might allow remote attackers to obtain sensitive information by reading the network traffic generated by this feature.


Google Chrome before 3.0 does not properly handle XML documents which allows remote attackers to obtain sensitive information via a crafted web site.


The automated-backup functionality in Blackboard Transact Suite (formerly Blackboard Commerce Suite) stores the (1) database username and (2) database password in cleartext in (a) script and (b) batch (.bat) files which allows local users to obtain sensitive information by reading a file.


Google Chrome before 6.0.472.59 does not prompt the user before granting access to the extension history which allows attackers to obtain potentially sensitive information via unspecified vectors.


Safari RSS in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 does not block Java applets in an RSS feed which allows remote attackers to obtain sensitive information via a feed: URL containing an applet that performs DOM modifications.


The xfs_ioc_fsgetxattr function in fs/xfs/linux-2.6/xfs_ioctl.c in the Linux kernel before 2.6.36-rc4 does not initialize a certain structure member which allows local users to obtain potentially sensitive information from kernel stack memory via an ioctl call.


The get_name function in net/tipc/socket.c in the Linux kernel before 2.6.37-rc2 does not initialize a certain structure which allows local users to obtain potentially sensitive information from kernel stack memory by reading a copy of this structure.


IBM DB2 9.7 before FP2 does not perform the expected access control on the monitor administrative views in the SYSIBMADM schema which allows remote attackers to obtain sensitive information via unspecified vectors.


The

CTimeoutEventList::InsertIntoTimeoutList

function

in

Microsoft

mshtml.dll

uses

a

certain

pointer

value

as

part

of

producing

Timer

ID

values

for

the

setTimeout

and

setInterval

methods

in

VBScript

and

JScript

which

allows

remote

attackers

to

obtain

sensitive

information

about

the

heap

memory

addresses

used

by

an

application

as

demonstrated

by

the

Internet

Explorer

application.


net/packet/af_packet.c in the Linux kernel before 2.6.37-rc2 does not properly initialize certain structure members which allows local users to obtain potentially sensitive information from kernel stack memory by leveraging the CAP_NET_RAW capability to read copies of the applicable structures.


The hso_get_count function in drivers/net/usb/hso.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure member which allows local users to obtain potentially sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call.


IBM Records Manager (RM) 4.5.x before 4.5.1.1-IER-FP001 places a session token in the URI which might allow remote attackers to obtain sensitive information by reading a Referer log file.


EncFS before 1.7.0 encrypts multiple blocks by means of the CFB cipher mode with the same initialization vector which makes it easier for local users to obtain sensitive information via calculations involving recovery of XORed data as demonstrated by an attack on encrypted data in which the last block contains only one byte.


Spree 0.11.x before 0.11.2 and 0.30.x before 0.30.0 exchanges data using JavaScript Object Notation (JSON) without a mechanism for validating requests which allows remote attackers to obtain sensitive information via vectors involving (1) admin/products.json (2) admin/users.json or (3) admin/overview/get_report_data related to a \JSON hijacking\ issue.


OpenConnect before 2.26 places the webvpn cookie value in the debugging output which might allow remote attackers to obtain sensitive information by reading this output as demonstrated by output posted to the public openconnect-devel mailing list.


ESSearchApplication/palette.do in IBM OmniFind Enterprise Edition 8.x and 9.x includes the administrator password in the HTML source code which might allow remote attackers to obtain sensitive information by leveraging read access to this file.


Contents-Mall before 15 does not properly handle passwords which allows remote attackers to discover the administrative password and consequently obtain sensitive information or modify data via unspecified vectors.


arch/x86/kvm/x86.c in the Linux kernel before 2.6.36.2 does not initialize certain structure members which allows local users to obtain potentially sensitive information from kernel stack memory via read operations on the /dev/kvm device.


389 Directory Server before 1.2.7.1 (aka Red Hat Directory Server 8.2) and HP-UX Directory Server before B.08.10.03 when audit logging is enabled logs the Directory Manager password (nsslapd-rootpw) in cleartext when changing cn=config:nsslapd-rootpw which might allow local users to obtain sensitive information by reading the log.


The Old Charts implementation in Bugzilla 2.12 through 3.2.8 3.4.8 3.6.2 3.7.3 and 4.1 creates graph files with predictable names in graphs/ which allows remote attackers to obtain sensitive information via a modified URL.


IcedTea 1.7.x before 1.7.6 1.8.x before 1.8.3 and 1.9.x before 1.9.2 as based on OpenJDK 6 declares multiple sensitive variables as public which allows remote attackers to obtain sensitive information including (1) user.name (2) user.home and (3) java.home system properties and other sensitive information such as installation directories.


The cxgb_extension_ioctl function in drivers/net/cxgb3/cxgb3_main.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure member which allows local users to obtain potentially sensitive information from kernel stack memory via a CHELSIO_GET_QSET_NUM ioctl call.


The (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) before 1.1.2 use root privileges during read access to files and directories that belong to arbitrary user accounts which might allow local users to obtain sensitive information by leveraging this filesystem activity as demonstrated by a symlink attack on the .pam_environment file in a user's home directory.


The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not check the return value of the setfsuid system call which might allow local users to obtain sensitive information by leveraging an unintended uid as demonstrated by a symlink attack on the .pam_environment file in a user's home directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-3435.


SSL_Cipher.cpp in EncFS before 1.7.0 does not properly handle integer data sizes when constructing headers intended for randomization of initialization vectors which makes it easier for local users to obtain sensitive information by defeating cryptographic protection mechanisms.


The ethtool_get_rxnfc function in net/core/ethtool.c in the Linux kernel before 2.6.36 does not initialize a certain block of heap memory which allows local users to obtain potentially sensitive information via an ETHTOOL_GRXCLSRLALL ethtool command with a large info.rule_cnt value a different vulnerability than CVE-2010-2478.


The eql_g_master_cfg function in drivers/net/eql.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure member which allows local users to obtain potentially sensitive information from kernel stack memory via an EQL_GETMASTRCFG ioctl call.


The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not perform the required setfsgid and setgroups system calls which might allow local users to obtain sensitive information by leveraging unintended group permissions as demonstrated by a symlink attack on the .pam_environment file in a user's home directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-3435.


The tcf_act_police_dump function in net/sched/act_police.c in the actions implementation in the network queueing functionality in the Linux kernel before 2.6.36-rc4 does not properly initialize certain structure members which allows local users to obtain potentially sensitive information from kernel memory via vectors involving a dump operation. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-2942.


SAP BusinessObjects Enterprise XI 3.2 allows remote attackers to trigger TCP connections to arbitrary intranet hosts on any port and obtain potentially sensitive information about open ports via the apstoken parameter to the CrystalReports/viewrpt.cwr URI related to an \internal port scanning\ issue.


The ax25_getname function in net/ax25/af_ax25.c in the Linux kernel before 2.6.37-rc2 does not initialize a certain structure which allows local users to obtain potentially sensitive information from kernel stack memory by reading a copy of this structure.


RSA Access Manager Server 5.5.3 before 5.5.3.172 6.0.4 before 6.0.4.53 and 6.1 before 6.1.2.01 does not properly perform cache updates which allows remote attackers to obtain sensitive information via unspecified vectors.


The (1) setup-ds.pl and (2) setup-ds-admin.pl setup scripts for Red Hat Directory Server 8 before 8.2 use world-readable permissions when creating cache files which allows local users to obtain sensitive information including passwords for Directory and Administration Server administrative accounts.


The Citibank Citi Mobile app before 2.0.3 for iOS stores account data in a file which allows local users to obtain sensitive information via vectors involving (1) the mobile device or (2) a synchronized computer.


Opera before 10.54 on Windows and Mac OS X and before 10.60 on UNIX platforms does not properly restrict access to the full pathname of a file selected for upload which allows remote attackers to obtain potentially sensitive information via unspecified DOM manipulations.


Unspecified vulnerability on the HP ProCurve 1800-24G switch with software PB.03.02 and earlier and the ProCurve 1800-8G switch with software PA.03.02 and earlier when SNMP is enabled allows remote attackers to obtain sensitive information via unknown vectors.


Virtual Desktop Server Manager (VDSM) in Red Hat Enterprise Virtualization Hypervisor (aka RHEV-H or rhev-hypervisor) before 5.5-2.2 does not properly perform VM post-zeroing after the removal of a virtual machine's data which allows guest OS users to obtain sensitive information by examining the disk blocks associated with a deleted virtual machine.


The (1) htmlentities (2) htmlspecialchars (3) str_getcsv (4) http_build_query (5) strpbrk and (6) strtr functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function related to the call time pass by reference feature.


The Cascading Style Sheets (CSS) implementation in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows and before 4.1 on Mac OS X 10.4 does not properly handle the :visited pseudo-class which allows remote attackers to obtain sensitive information about visited web pages via a crafted HTML document.


Opera before 10.50 on Windows before 10.52 on Mac OS X and before 10.60 on UNIX platforms makes widget properties accessible to third-party domains which allows remote attackers to obtain potentially sensitive information via a crafted web site.


nessusd_www_server.nbin in the Nessus Web Server plugin 1.2.4 for Nessus allows remote attackers to obtain sensitive information via a request to the /feed method which reveals the version in a response.


Splunk 4.0 through 4.0.10 and 4.1 through 4.1.1 allows remote authenticated users to obtain sensitive information via HTTP header injection aka SPL-31066.


api.php in MediaWiki before 1.15.5 does not prevent use of public caching headers for private data which allows remote attackers to bypass intended access restrictions and obtain sensitive information by retrieving documents from an HTTP proxy cache that has been used by a victim.


The cfg80211_wext_giwessid function in net/wireless/wext-compat.c in the Linux kernel before 2.6.36-rc3-next-20100831 does not properly initialize certain structure members which allows local users to leverage an off-by-one error in the ioctl_standard_iw_point function in net/wireless/wext-core.c and obtain potentially sensitive information from kernel heap memory via vectors involving an SIOCGIWESSID ioctl call that specifies a large buffer size.


The var_export function in PHP 5.2 before 5.2.14 and 5.3 before 5.3.3 flushes the output buffer to the user when certain fatal errors occur even if display_errors is off which allows remote attackers to obtain sensitive information by causing the application to exceed limits for memory execution time or recursion.


IBM WebSphere MQ 6.0 before 6.0.2.9 and 7.0 before 7.0.1.1 does not encrypt the username and password in the security parameters field which allows remote attackers to obtain sensitive information by sniffing the network traffic from a .NET client application.


The (1) strip_tags (2) setcookie (3) strtok (4) wordwrap (5) str_word_count and (6) str_pad functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function related to the call time pass by reference feature.


Microsoft Dynamics GP uses a substitution cipher to encrypt the system password field and unspecified other fields which makes it easier for remote authenticated users to obtain sensitive information by decrypting a field's contents.


The S2 Security NetBox possibly 2.x and 3.x as used in the Linear eMerge 50 and 5000 and the Sonitrol eAccess does not properly prevent downloading of database backups which allows remote attackers to obtain sensitive information via requests for full_*.dar files with predictable filenames.


The (1) trim (2) ltrim (3) rtrim and (4) substr_replace functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function related to the call time pass by reference feature.


news.php in SimpNews 2.47.3 and earlier allows remote attackers to obtain sensitive information via an invalid lang parameter which reveals the installation path in an error message.


The snapshot merging functionality in Red Hat Enterprise Virtualization Manager (aka RHEV-M) before 2.2 does not properly pass the postzero parameter during operations on deleted volumes which allows guest OS users to obtain sensitive information by examining the disk blocks associated with a deleted virtual machine.


The actions implementation in the network queueing functionality in the Linux kernel before 2.6.36-rc2 does not properly initialize certain structure members when performing dump operations which allows local users to obtain potentially sensitive information from kernel memory via vectors related to (1) the tcf_gact_dump function in net/sched/act_gact.c (2) the tcf_mirred_dump function in net/sched/act_mirred.c (3) the tcf_nat_dump function in net/sched/act_nat.c (4) the tcf_simp_dump function in net/sched/act_simple.c and (5) the tcf_skbedit_dump function in net/sched/act_skbedit.c.


dom/base/nsJSEnvironment.cpp in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7 Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1 and SeaMonkey before 2.0.6 does not properly suppress a script's URL in certain circumstances involving a redirect and an error message which allows remote attackers to obtain sensitive information about script parameters via a crafted HTML document related to the window.onerror handler.


The (1) iconv_mime_decode (2) iconv_substr and (3) iconv_mime_encode functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function related to the call time pass by reference feature.


The drm_ioctl function in drivers/gpu/drm/drm_drv.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 2.6.27.53 2.6.32.x before 2.6.32.21 2.6.34.x before 2.6.34.6 and 2.6.35.x before 2.6.35.4 allows local users to obtain potentially sensitive information from kernel memory by requesting a large memory-allocation amount.


Bournal before 1.4.1 on FreeBSD 8.0 when the -K option is used places a ccrypt key on the command line which allows local users to obtain sensitive information by listing the process and its arguments related to \echoing.\


Server Admin in Apple Mac OS X Server before 10.6.3 does not properly enforce authentication for directory binding which allows remote attackers to obtain potentially sensitive information from Open Directory via unspecified LDAP requests.


WebKit before r52784 as used in Google Chrome before 4.0.249.78 and Apple Safari before 4.0.5 permits cross-origin loading of CSS stylesheets even when the stylesheet download has an incorrect MIME type and the stylesheet document is malformed which allows remote attackers to obtain sensitive information via a crafted document.


Mail in Apple Mac OS X before 10.6.3 does not properly enforce the key usage extension during processing of a keychain that specifies multiple certificates for an e-mail recipient which might make it easier for remote attackers to obtain sensitive information via a brute-force attack on a weakly encrypted e-mail message.


Google Chrome before 4.0.249.78 sends an https URL in the Referer header of an http request in certain circumstances involving https to http redirection which allows remote HTTP servers to obtain potentially sensitive information via standard HTTP logging.


The Cisco RVS4000 4-port Gigabit Security Router before 1.3.2.0 PVC2300 Business Internet Video Camera before 1.1.2.6 WVC200 Wireless-G PTZ Internet Video Camera before 1.1.1.15 WVC210 Wireless-G PTZ Internet Video Camera before 1.1.1.15 and WVC2300 Wireless-G Business Internet Video Camera before 1.1.2.6 do not properly restrict read access to passwords which allows context-dependent attackers to obtain sensitive information related to (1) access by remote authenticated users to a PVC2300 or WVC2300 via a crafted URL (2) leveraging setup privileges on a WVC200 or WVC210 and (3) leveraging administrative privileges on an RVS4000 aka Bug ID CSCte64726.


Employee Timeclock Software 0.99 places the database password on the mysqldump command line which allows local users to obtain sensitive information by listing the process.


Apple QuickTime before 7.6.9 on Windows sets weak permissions for the Apple Computer directory in the profile of a user account which allows local users to obtain sensitive information by reading files in this directory.


Google Chrome before 4.0.249.89 when a SOCKS 5 proxy server is configured sends DNS queries directly which allows remote DNS servers to obtain potentially sensitive information about the identity of a client user via request logging as demonstrated by a proxy server that was configured for the purpose of anonymity.


The Single Sign-on (SSO) functionality in IBM WebSphere Application Server (WAS) 7.0.0.0 through 7.0.0.8 does not recognize the Requires SSL configuration option which might allow remote attackers to obtain sensitive information by sniffing network sessions that were expected to be encrypted.


The Client/Server Run-time Subsystem (CSRSS) in Microsoft Windows 2000 SP4 XP SP2 and SP3 and Server 2003 SP2 does not properly kill processes after a logout which allows local users to obtain sensitive information or gain privileges via a crafted application that continues to execute throughout the logout of one user and the login session of the next user aka \CSRSS Local Privilege Elevation Vulnerability.\


The Web Container in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.43 6.1 before 6.1.0.31 and 7.0 before 7.0.0.11 does not properly handle long filenames and consequently sends an incorrect file in some responses which allows remote attackers to obtain sensitive information by reading the retrieved file.


ImageIO in Apple Safari before 4.0.5 and iTunes before 9.1 on Windows does not ensure that memory access is associated with initialized memory which allows remote attackers to obtain potentially sensitive information from process memory via a crafted BMP image.


browser/login/login_prompt.cc in Google Chrome before 4.0.249.89 populates an authentication dialog with credentials that were stored by Password Manager for a different web site which allows user-assisted remote HTTP servers to obtain sensitive information via a URL that requires authentication as demonstrated by a URL in the SRC attribute of an IMG element.


JAG (Just Another Guestbook) 1.14 stores sensitive information under the web root with insufficient access control which allows remote attackers to obtain sensitive information via a direct request for jag/database.sql.


Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7 Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1 and SeaMonkey before 2.0.6 permit cross-origin loading of CSS stylesheets even when the stylesheet download has an incorrect MIME type and the stylesheet document is malformed which allows remote attackers to obtain sensitive information via a crafted document.


The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15 when a multithreaded MPM is used does not properly handle headers in subrequests in certain circumstances involving a parent request that has a body which might allow remote attackers to obtain sensitive information via a crafted request that triggers access to memory locations associated with an earlier request.


ISC BIND 9.7.2 through 9.7.2-P1 uses an incorrect ACL to restrict the ability of Recursion Desired (RD) queries to access the cache which allows remote attackers to obtain potentially sensitive information via a DNS query.


MoinMoin 1.9 before 1.9.1 does not perform the expected clearing of the sys.argv array in situations where the GATEWAY_INTERFACE environment variable is set which allows remote attackers to obtain sensitive information via unspecified vectors.


The administrative interface on the PolyVision RoomWizard with firmware 3.2.3 places the Sync Connector Active Directory (AD) credentials in a web form that is accessed over HTTP on port 80 which allows remote attackers to obtain sensitive information by reading the HTML source code corresponding to the /admin/sign/DeviceSynch URI.


WebKit before r51295 as used in Google Chrome before 4.0.249.78 presents a directory-listing page in response to an XMLHttpRequest for a file:/// URL that corresponds to a directory which allows attackers to obtain sensitive information or possibly have unspecified other impact via a crafted local HTML document.


Microsoft Internet Explorer permits cross-origin loading of CSS stylesheets even when the stylesheet download has an incorrect MIME type and the stylesheet document is malformed which allows remote HTTP servers to obtain sensitive information via a crafted document.


The ParamTraits<SkBitmap>::Read function in common/common_param_traits.cc in Google Chrome before 4.0.249.78 does not initialize the memory locations that will hold bitmap data which might allow remote attackers to obtain potentially sensitive information from process memory by providing insufficient data related to use of a (1) thumbnail database or (2) HTML canvas.


The Free Software Foundation (FSF) Berkeley DB NSS module (aka libnss-db) 2.2.3pre1 reads the DB_CONFIG file in the current working directory which allows local users to obtain sensitive information via a symlink attack involving a setgid or setuid application that uses this module.


Tor before 0.2.1.22 and 0.2.2.x before 0.2.2.7-alpha when functioning as a bridge directory authority allows remote attackers to obtain sensitive information about bridge identities and bridge descriptors via a dbg-stability.txt directory query.


Google Chrome before 4.0.249.78 on Windows does not perform the expected encoding escaping and quoting for the URL in the --app argument in a desktop shortcut which allows user-assisted remote attackers to execute arbitrary programs or obtain sensitive information by tricking a user into creating a crafted shortcut.


Opera before 10.10 permits cross-origin loading of CSS stylesheets even when the stylesheet download has an incorrect MIME type and the stylesheet document is malformed which allows remote attackers to obtain sensitive information via a crafted document.


The Symantec Norton Mobile Security application 1.0 Beta for Android records setup details possibly including wipe/lock credentials in the device logs which allows user-assisted remote attackers to obtain potentially sensitive information by leveraging the ability of a separate crafted application to read these logs.


Google Chrome before 4.0.249.89 attempts to make direct connections to web sites when all configured proxy servers are unavailable which allows remote HTTP servers to obtain potentially sensitive information about the identity of a client user via standard HTTP logging as demonstrated by a proxy server that was configured for the purpose of anonymity.


Apache CouchDB 0.8.0 through 0.10.1 allows remote attackers to obtain sensitive information by measuring the completion time of operations that verify (1) hashes or (2) passwords.


ImageIO in Apple Safari before 4.0.5 and iTunes before 9.1 on Windows does not ensure that memory access is associated with initialized memory which allows remote attackers to obtain potentially sensitive information from process memory via a crafted TIFF image.


WebKit in Apple iOS before 4 on the iPhone and iPod touch does not properly implement the history.replaceState method in certain situations involving IFRAME elements which allows remote attackers to obtain sensitive information via a crafted HTML document.


Apple Safari 4.0.5 on Windows sends the \Authorization: Basic\ header appropriate for one web site to a different web site named in a Location header received from the first site which allows remote web servers to obtain sensitive information by logging HTTP requests. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


IBM WebSphere Application Server (WAS) 6.0.x before 6.0.2.41 6.1.x before 6.1.0.31 and 7.0.x before 7.0.0.11 when the -trace option (aka debugging mode) is enabled executes debugging statements that print string representations of unspecified objects which allows attackers to obtain sensitive information by reading the trace output.


RSA verification recovery in the EVP_PKEY_verify_recover function in OpenSSL 1.x before 1.0.0a as used by pkeyutl and possibly other applications returns uninitialized memory upon failure which might allow context-dependent attackers to bypass intended key requirements or obtain sensitive information via unspecified vectors. NOTE: some of these details are obtained from third party information.


The importScripts Web Worker method in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7 Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1 and SeaMonkey before 2.0.6 does not verify that content is valid JavaScript code which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted HTML document.


Microsoft Internet Explorer 6 7 and 8 does not properly determine the origin of script code which allows remote attackers to execute script in an unintended domain or security zone and obtain sensitive information via unspecified vectors aka \Event Handler Cross-Domain Vulnerability.\


IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.31 and 7.0.x before 7.0.0.11 when Basic authentication and SIP tracing (aka full trace logging for SIP) are enabled logs the entirety of all inbound and outbound SIP messages which allows local users to obtain sensitive information by reading the trace log.


CA XOsoft r12.5 does not properly perform authentication which allows remote attackers to obtain potentially sensitive information via a SOAP request.


WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows and before 4.1 on Mac OS X 10.4 sends an https URL in the Referer header of an http request in certain circumstances involving https to http redirection which allows remote HTTP servers to obtain potentially sensitive information via standard HTTP logging a related issue to CVE-2010-0660.


The virtual networking stack in VMware Workstation 7.0 before 7.0.1 build 227600 VMware Workstation 6.5.x before 6.5.4 build 246459 on Windows VMware Player 3.0 before 3.0.1 build 227600 VMware Player 2.5.x before 2.5.4 build 246459 on Windows VMware ACE 2.6 before 2.6.1 build 227600 and 2.5.x before 2.5.4 build 246459 VMware Server 2.x and VMware Fusion 3.0 before 3.0.1 build 232708 and 2.x before 2.0.7 build 246742 allows remote attackers to obtain sensitive information from memory on the host OS by examining received network packets related to interaction between the guest OS and the host vmware-vmx process.


The chunk_split function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function related to the call time pass by reference feature.


The Zend Engine in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information by interrupting the handler for the (1) ZEND_BW_XOR opcode (shift_left_function) (2) ZEND_SL opcode (bitwise_xor_function) or (3) ZEND_SR opcode (shift_right_function) related to the convert_to_long_base function.


IOS 12.2(52)SE and 12.2(52)SE1 on Cisco Industrial Ethernet (IE) 3000 series switches has (1) a community name of public for RO access and (2) a community name of private for RW access which makes it easier for remote attackers to modify the configuration or obtain potentially sensitive information via SNMP requests aka Bug ID CSCtf25589.


The addcslashes function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function related to the call time pass by reference feature.


Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 allows remote attackers to obtain sensitive information about \deployed web contexts\ via a request to the status servlet as demonstrated by a full=true query string. NOTE: this issue exists because of a CVE-2008-3273 regression.


Time Machine in Apple Mac OS X 10.6.x before 10.6.5 does not verify the unique identifier of its remote AFP volume which allows remote attackers to obtain sensitive information by spoofing this volume.


The processcompl_compat function in drivers/usb/core/devio.c in Linux kernel 2.6.x through 2.6.32 and possibly other versions does not clear the transfer buffer before returning to userspace when a USB command fails which might make it easier for physically proximate attackers to obtain sensitive information (kernel memory).


The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods which allows remote attackers to obtain sensitive information via an unspecified request that uses a different method.


The cgi_initialize_string function in cgi-bin/var.c in the web interface in CUPS before 1.4.4 as used on Apple Mac OS X 10.5.8 Mac OS X 10.6 before 10.6.4 and other platforms does not properly handle parameter values containing a % (percent) character without two subsequent hex characters which allows context-dependent attackers to obtain sensitive information from cupsd process memory via a crafted request as demonstrated by the (1) /admin?OP=redirect&URL=% and (2) /admin?URL=/admin/&OP=% URIs.


The preg_quote function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function related to the call time pass by reference feature modification of ZVALs whose values are not updated in the associated local variables and access of previously-freed memory.


Unspecified vulnerability in the Servlet service in Fujitsu Limited Interstage Application Server 3.0 through 7.0 as used in Interstage Application Framework Suite Interstage Business Application Server and Interstage List Manager allows attackers to obtain sensitive information or force invalid requests to be processed via unknown vectors related to unspecified invalid requests and settings on the load balancing device.


Unspecified vulnerability in the Auditing subsystem in HP OpenVMS 8.3 8.2 7.3-2 and earlier on the ALPHA platform and 8.3-1H1 8.3 8.2-1 and earlier on the Itanium platform allows local users to gain privileges or obtain sensitive information via unknown vectors.


SilverStripe before 2.4.2 does not properly restrict access to pages in draft mode which allows remote attackers to obtain sensitive information.


The escapeStrForLike method in TYPO3 4.2.x before 4.2.16 4.3.x before 4.3.9 and 4.4.x before 4.4.5 does not properly escape input when the MySQL database is set to sql_mode NO_BACKSLASH_ESCAPES which allows remote attackers to obtain sensitive information via wildcard characters in a LIKE query.


SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 stores sensitive information under the web root with insufficient access control which allows remote attackers to obtain version information via a direct request to (1) apphire/silverstripe_version or (2) cms/silverstripe_version.


The layout engine in Mozilla Firefox before 4.0 Thunderbird before 3.3 and SeaMonkey before 2.1 executes different code for visited and unvisited links during the processing of Cascading Style Sheets (CSS) token sequences which makes it easier for remote attackers to obtain sensitive information about visited web pages via a timing attack.


SilverStripe 2.3.x before 2.3.8 and 2.4.x before 2.4.1 when running on servers with certain configurations allows remote attackers to obtain sensitive information via a direct request to PHP files in the (1) sapphire (2) cms or (3) mysite folders which reveals the installation path in an error message.


The JavaScript implementation in Apple Safari 4 does not properly restrict the set of values contained in the object returned by the getComputedStyle method which allows remote attackers to obtain sensitive information about visited web pages by calling this method a different vulnerability than CVE-2010-2264. NOTE: this may overlap CVE-2010-5073.


The Cascading Style Sheets (CSS) implementation in Opera 10.5 does not properly handle the :visited pseudo-class which allows remote attackers to obtain sensitive information about visited web pages via a crafted HTML document a related issue to CVE-2010-2264.


The JavaScript implementation in Microsoft Internet Explorer 8.0 and earlier does not properly restrict the set of values contained in the object returned by the getComputedStyle method which allows remote attackers to obtain sensitive information about visited web pages by calling this method.


The Cascading Style Sheets (CSS) implementation in Google Chrome 4 does not properly handle the :visited pseudo-class which allows remote attackers to obtain sensitive information about visited web pages via a crafted HTML document. NOTE: this may overlap CVE-2010-2264.


The JavaScript implementation in Google Chrome 4 does not properly restrict the set of values contained in the object returned by the getComputedStyle method which allows remote attackers to obtain sensitive information about visited web pages by calling this method. NOTE: this may overlap CVE-2010-5070.


Amberdms Billing System (ABS) before 1.4.1 when a multi-instance installation is configured might allow local users to obtain sensitive information by reading the cache in between runs of the include/cron/services_usage.php cron job.


SilverStripe 2.3.x before 2.3.6 allows remote attackers to obtain sensitive information via the (1) debug_memory parameter to core/control/Director.php or (2) debug_profile parameter to main.php.


The Add Member dialog in the Security admin page in SilverStripe 2.4.0 saves user passwords in plaintext which allows local users to obtain sensitive information by reading a database.


The JavaScript implementation in Opera 10.5 does not properly restrict the set of values contained in the object returned by the getComputedStyle method which allows remote attackers to obtain sensitive information about visited web pages by calling this method.


The customer-interface ticket-print dialog in Open Ticket Request System (OTRS) before 3.0.0-beta3 does not properly restrict customer-visible data which allows remote authenticated users to obtain potentially sensitive information from the (1) responsible (2) owner (3) accounted time (4) pending until and (5) lock fields by reading this dialog.


The Wells Fargo Mobile application 1.1 for Android stores a username and password along with account balances in cleartext which might allow physically proximate attackers to obtain sensitive information by reading application data.


Opera before 11.00 does not clear WAP WML form fields after manual navigation to a new web site which allows remote attackers to obtain sensitive information via an input field that has the same name as an input field on a previously visited web site.


The copy_shmid_to_user function in ipc/shm.c in the Linux kernel before 2.6.37-rc1 does not initialize a certain structure which allows local users to obtain potentially sensitive information from kernel stack memory via vectors related to the shmctl system call and the \old shm interface.\


languages.inc.php in DynPG CMS 4.2.0 allows remote attackers to obtain sensitive information via a direct request which reveals the installation path in an error message.


The bcm_connect function in net/can/bcm.c (aka the Broadcast Manager) in the Controller Area Network (CAN) implementation in the Linux kernel 2.6.36 and earlier creates a publicly accessible file with a filename containing a kernel memory address which allows local users to obtain potentially sensitive information about kernel memory use by listing this filename.


Opera before 10.63 does not prevent interpretation of a cross-origin document as a CSS stylesheet when the document lacks a CSS token sequence which allows remote attackers to obtain sensitive information via a crafted document.


Html-edit

CMS

allows

remote

attackers

to

obtain

sensitive

information

via

a

direct

request

to

pages.php

and

menu.php

in

and

which

reveals

the

installation

path

in

an

error

message.


The copy_semid_to_user function in ipc/sem.c in the Linux kernel before 2.6.36 does not initialize a certain structure which allows local users to obtain potentially sensitive information from kernel stack memory via a (1) IPC_INFO (2) SEM_INFO (3) IPC_STAT or (4) SEM_STAT command in a semctl system call.


admin/upgrade_unattended.php in MantisBT before 1.2.4 allows remote attackers to obtain sensitive information via an invalid db_type parameter which reveals the installation path in an error message related to an unsafe call by MantisBT to a function in the ADOdb Library for PHP.


in

Cisco

Unified

Videoconferencing

(UVC)

System

and

when

the

Linux

operating

system

is

used

uses

a

weak

hashing

algorithm

for

the

administrator

and

operator

passwords

which

makes

it

easier

for

local

users

to

obtain

sensitive

information

by

recovering

the

cleartext

values

aka

Bug

ID


The rs_ioctl function in drivers/char/amiserial.c in the Linux kernel 2.6.36.1 and earlier does not properly initialize a certain structure member which allows local users to obtain potentially sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call.


HP Insight Management Agents before 8.6 allows remote attackers to obtain sensitive information via an unspecified request that triggers disclosure of the full path.


The ipc subsystem in the Linux kernel before 2.6.37-rc1 does not initialize certain structures which allows local users to obtain potentially sensitive information from kernel stack memory via vectors related to the (1) compat_sys_semctl (2) compat_sys_msgctl and (3) compat_sys_shmctl functions in ipc/compat.c; and the (4) compat_sys_mq_open and (5) compat_sys_mq_getsetattr functions in ipc/compat_mq.c.


NetSupport Manager (NSM) before 11.00.0005 sends HTTP headers with cleartext fields containing details about client machines which allows remote attackers to obtain potentially sensitive information by sniffing the network.


The viafb_ioctl_get_viafb_info function in drivers/video/via/ioctl.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure member which allows local users to obtain potentially sensitive information from kernel stack memory via a VIAFB_GET_INFO ioctl call.


Opera before 10.63 does not properly verify the origin of video content which allows remote attackers to obtain sensitive information by using a video stream as HTML5 canvas content.


The ntty_ioctl_tiocgicount function in drivers/char/nozomi.c in the Linux kernel 2.6.36.1 and earlier does not properly initialize a certain structure member which allows local users to obtain potentially sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call.


The sk_run_filter function in net/core/filter.c in the Linux kernel before 2.6.36.2 does not check whether a certain memory location has been initialized before executing a (1) BPF_S_LD_MEM or (2) BPF_S_LDX_MEM instruction which allows local users to obtain potentially sensitive information from kernel stack memory via a crafted socket filter.


index.php in Enano CMS 1.1.7pl1 and possibly other versions before 1.1.8 1.0.6pl3 and 1.1.7pl2 allows remote attackers to obtain sensitive information via a crafted title parameter which reveals the installation path in an error message.


Cisco Unified Videoconferencing (UVC) System 3545 5110 5115 and 5230; Unified Videoconferencing 3527 Primary Rate Interface (PRI) Gateway; Unified Videoconferencing 3522 Basic Rate Interfaces (BRI) Gateway; and Unified Videoconferencing 3515 Multipoint Control Unit (MCU) improperly use cookies for web-interface credentials which allows remote attackers to obtain sensitive information by reading a (1) cleartext or (2) base64-encoded cleartext cookie aka Bug ID CSCti54052.


The snd_hdsp_hwdep_ioctl function in sound/pci/rme9652/hdsp.c in the Linux kernel before 2.6.36-rc6 does not initialize a certain structure which allows local users to obtain potentially sensitive information from kernel stack memory via an SNDRV_HDSP_IOCTL_GET_CONFIG_INFO ioctl call.


The uart_get_count function in drivers/serial/serial_core.c in the Linux kernel before 2.6.37-rc1 does not properly initialize a certain structure member which allows local users to obtain potentially sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call.


Integer underflow in the irda_getsockopt function in net/irda/af_irda.c in the Linux kernel before 2.6.37 on platforms other than x86 allows local users to obtain potentially sensitive information from kernel heap memory via an IRLMP_ENUMDEVICES getsockopt call.


Linux kernel 2.6.33 and 2.6.34.y does not initialize the kvm_vcpu_events->interrupt.pad structure member which allows local users to obtain potentially sensitive information from kernel stack memory via unspecified vectors.


The ivtvfb_ioctl function in drivers/media/video/ivtv/ivtvfb.c in the Linux kernel before 2.6.36-rc8 does not properly initialize a certain structure member which allows local users to obtain potentially sensitive information from kernel stack memory via an FBIOGET_VBLANK ioctl call.


The mb_strcut function in Libmbfl 1.1.0 as used in PHP 5.3.x through 5.3.3 allows context-dependent attackers to obtain potentially sensitive information via a large value of the third parameter (aka the length parameter).


The Bank of America application 2.12 for Android stores a security question's answer in cleartext which might allow physically proximate attackers to obtain sensitive information by reading application data.


Free Simple Software 1.0 stores passwords in cleartext which allows context-dependent attackers to obtain sensitive information.


net/core/ethtool.c in the Linux kernel before 2.6.36 does not initialize certain data structures which allows local users to obtain potentially sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability for an ethtool ioctl call.


The Mobile User Security (MUS) service on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software before 8.3(2) does not properly authenticate HTTP requests from a Web Security appliance (WSA) which might allow remote attackers to obtain sensitive information via a HEAD request aka Bug ID CSCte53635.


The sisfb_ioctl function in drivers/video/sis/sis_main.c in the Linux kernel before 2.6.36-rc6 does not properly initialize a certain structure member which allows local users to obtain potentially sensitive information from kernel stack memory via an FBIOGET_VBLANK ioctl call.


Unspecified vulnerability in Collaborative Information Manager server as used in TIBCO Collaborative Information Manager before 8.1.0 and ActiveCatalog before 1.0.1 allows remote attackers to modify data or obtain sensitive information via a crafted URL.


The Register Plus plugin 3.5.1 and earlier for WordPress allows remote attackers to obtain sensitive information via a direct request to (1) dash_widget.php and (2) register-plus.php which reveals the installation path in an error message.


The snd_hdspm_hwdep_ioctl function in sound/pci/rme9652/hdspm.c in the Linux kernel before 2.6.36-rc6 does not initialize a certain structure which allows local users to obtain potentially sensitive information from kernel stack memory via an SNDRV_HDSPM_IOCTL_GET_CONFIG_INFO ioctl call.


The administrative interface in django.contrib.admin in Django before 1.1.3 1.2.x before 1.2.4 and 1.3.x before 1.3 beta 1 does not properly restrict use of the query string to perform certain object filtering which allows remote authenticated users to obtain sensitive information via a series of requests containing regular expressions as demonstrated by a created_by__password__regex parameter.


The USB subsystem in the Linux kernel before 2.6.36-rc5 does not properly initialize certain structure members which allows local users to obtain potentially sensitive information from kernel stack memory via vectors related to TIOCGICOUNT ioctl calls and the (1) mos7720_ioctl function in drivers/usb/serial/mos7720.c and (2) mos7840_ioctl function in drivers/usb/serial/mos7840.c.


relan exFAT 1.3.0 allows local users to obtain sensitive information (data from deleted files in the filesystem) in certain situations involving offsets beyond ValidDataLength.


The

WP

Statistics

WordPress

plugin

is

vulnerable

to

SQL

Injection

due

to

insufficient

escaping

and

parameterization

of

the

parameter

found

in

the

file

which

allows

attackers

without

authentication

to

inject

arbitrary

SQL

queries

to

obtain

sensitive

information

in

versions

up

to

and

including

This

requires

the

\Record

Exclusions\

option

to

be

enabled

on

the

vulnerable

site.


Inappropriate implementation in Autofill in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to obtain potentially sensitive information via a crafted HTML page.


The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_type parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information in versions up to and including 13.1.5.


Automox Agent prior to version 37 on Windows and Linux and Version 36 on OSX could allow for a non privileged user to obtain sensitive information during the install process.


Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information. This issue affects: GateManager all versions prior to 9.7.


An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory.


The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_id parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information in versions up to and including 13.1.5.


The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information in versions up to and including 13.1.5.


The UNISOC chipset through 2022-03-15 allows attackers to obtain remote control of a mobile phone e.g. to obtain sensitive information from text messages or the device's screen record video of the device's physical environment or modify data.


TPCMS v3.2 allows attackers to access the ThinkPHP log directory and obtain sensitive information such as the administrator's user name and password.


An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to obtain sensitive information from heap memory via crafted frame lengths from a device.


Xerox ColorQube 8580 was discovered to contain an access control issue which allows attackers to print view the status and obtain sensitive information.


A Protection Mechanism Failure vulnerability in the REST API of Juniper Networks Contrail Service Orchestration allows one tenant on the system to view confidential configuration details of another tenant on the same system. By utilizing the REST API one tenant is able to obtain information on another tenant's firewall configuration and access control policies as well as other sensitive information exposing the tenant to reduced defense against malicious attacks or exploitation via additional undetermined vulnerabilities. This issue affects Juniper Networks Contrail Service Orchestration versions prior to 6.1.0 Patch 3.


IBM Spectrum Protect Operations Center 8.1.12 and 8.1.13 could allow a local attacker to obtain sensitive information caused by plain text user account passwords potentially being stored in the browser's application command history. By accessing browser history an attacker could exploit this vulnerability to obtain other user accounts' passwords. IBM X-Force ID: 226322.


IBM WebSphere Application Server Liberty 21.0.0.10 through 21.0.0.12 could provide weaker than expected security. A remote attacker could exploit this weakness to obtain sensitive information and gain unauthorized access to JAX-WS applications. IBM X-Force ID: 217224.


IBM Big SQL on IBM Cloud Pak for Data 7.1.0 7.1.1 7.2.0 and 7.2.3 could allow an authenticated user with appropriate permissions to obtain sensitive information by bypassing data masking rules using a CREATE TABLE SELECT statement. IBM X-Force ID: 220480.


IBM SterlingPartner Engagement Manager 6.2.0 could allow a remote authenticated attacker to obtain sensitive information or modify user details caused by an insecure direct object vulnerability (IDOR). IBM X-Force ID: 219130.


Exposure of sensitive information to an unauthorized actor vulnerability in Web Server in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to obtain sensitive information via unspecified vectors.


An issue was discovered in Servisnet Tessa 0.0.2. An attacker can obtain sensitive information via a /js/app.js request.


IBM Watson Query with Cloud Pak for Data as a Service could allow an authenticated user to obtain sensitive information that would allow them to examine or alter system configurations or data sources connected to the service. IBM X-Force ID: 222763.


Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to influence mispredicted branches. Then cache allocation can allow the attacker to obtain sensitive information.


MMP: All versions prior to v1.0.3 PTP C-series: Device versions prior to v2.8.6.1 and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not properly sanitize user input which may allow an attacker to perform a SQL injection and obtain sensitive information.


A insecure storage of sensitive information vulnerability exists in Ivanti Workspace Control <2021.2 (10.7.30.0) that could allow an attacker with locally authenticated low privileges to obtain key information due to an unspecified attack vector.


A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated remote attacker to obtain sensitive information from an affected device. This vulnerability is due to improper enforcement of administrative privilege levels for high-value sensitive data. An attacker with read-only Administrator privileges to the web-based management interface on an affected device could exploit this vulnerability by browsing to a page that contains sensitive data. A successful exploit could allow the attacker to collect sensitive information regarding the configuration of the system.


WebKit in Apple Safari before 4.0.3 does not properly restrict the URL scheme of the pluginspage attribute of an EMBED element which allows user-assisted remote attackers to launch arbitrary file: URLs and obtain sensitive information via a crafted HTML document.


OXID eShop 4.x before 4.1.4-21266 3.x and 2.x allows remote attackers to obtain sensitive information (session details and order history of other users) via a crafted cookie.


The CDCServlet component in Sun Java System Access Manager 7.0 2005Q4 and 7.1 when Cross Domain Single Sign On (CDSSO) is enabled does not ensure that \policy advice\ is presented to the correct client which allows remote attackers to obtain sensitive information via unspecified vectors.


The Huawei D100 stores the administrator's account name and password in cleartext in a cookie which allows context-dependent attackers to obtain sensitive information by (1) reading a cookie file by (2) sniffing the network for HTTP headers and possibly by using unspecified other vectors.


The Cisco Security Monitoring Analysis and Response System (CS-MARS) 6.0.4 and earlier stores cleartext passwords in log/sysbacktrace.## files within error-logs.tar.gz archives which allows context-dependent attackers to obtain sensitive information by reading these files.


TorrentTrader Classic 1.09 allows remote attackers to (1) obtain configuration information via a direct request to phpinfo.php which calls the phpinfo function; and allows remote attackers to (2) obtain other potentially sensitive information via a direct request to check.php.


WordPress 2.7.1 places the username of a post's author in an HTML comment which allows remote attackers to obtain sensitive information by reading the HTML source.


CMS Chainuk 1.2 and earlier allows remote attackers to obtain sensitive information via (1) a crafted id parameter to index.php or (2) a nonexistent folder name in the id parameter to admin/admin_delete.php which reveals the installation path in an error message.


index.php in Aardvark Topsites PHP 5.2.1 and earlier allows remote attackers to obtain sensitive information via a negative integer value for the start parameter in a search action which reveals the installation path in an error message.


Vlad Titarenko ASP VT Auth 1.0 stores sensitive information under the web root with insufficient access control which allows remote attackers to download the database file and obtain usernames and passwords via a direct request for zHk8dEes3.txt.


pivot/tb.php in Pivot 1.40.4 and 1.40.7 allows remote attackers to obtain sensitive information via an invalid url parameter which reveals the installation path in an error message.


mt-wizard.cgi in Six Apart Movable Type before 4.261 when global templates are not initialized allows remote attackers to bypass access restrictions and (1) send e-mail to arbitrary addresses or (2) obtain sensitive information via unspecified vectors.


Unspecified vulnerability in Open System Services (OSS) Name Server on HP NonStop G06.27 G06.28 G06.29 G06.30 H06.06 H06.07 H06.08 and J06.03 allows remote attackers to obtain sensitive information via unknown vectors.


The do_sigaltstack function in kernel/signal.c in Linux kernel 2.4 through 2.4.37 and 2.6 before 2.6.31-rc5 when running on 64-bit systems does not clear certain padding bytes from a structure which allows local users to obtain sensitive information from the kernel stack via the sigaltstack function.


The WebKit component in Safari in Apple iPhone OS before 3.1 and iPhone OS before 3.1.1 for iPod touch does not remove usernames and passwords from URLs sent in Referer headers which allows remote attackers to obtain sensitive information by reading Referer logs on a web server.


admin.php in SkyBlueCanvas 1.1 r237 allows remote authenticated administrators to obtain sensitive information via an invalid id parameter which reveals the installation path in an error message.


The Java Naming and Directory Interface (JNDI) implementation in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.39 6.1 before 6.1.0.29 and 7.0 before 7.0.0.7 does not properly restrict access to UserRegistry object methods which allows remote attackers to obtain sensitive information via a crafted method call.


The audio system in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20 does not prevent access to java.lang.System properties by (1) untrusted applets and (2) Java Web Start applications which allows context-dependent attackers to obtain sensitive information by reading these properties.


fipsCMS Light 2.1 stores sensitive information under the web root with insufficient access control which allows remote attackers to download the database file and obtain sensitive information via a direct request for _fipsdb/db.mdb.


IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.27 and 7.0 before 7.0.0.7 does not properly handle an exception occurring after use of wsadmin scripts and configuration of JAAS-J2C Authentication Data which allows local users to obtain sensitive information by reading the First Failure Data Capture (FFDC) log file.


The MobileMail component in Apple iPhone OS 3.0 and 3.0.1 and iPhone OS 3.0 for iPod touch lists deleted e-mail messages in Spotlight search results which might allow local users to obtain sensitive information by reading these messages.


stardict 3.0.1 when Enable Net Dict is configured sends the contents of the clipboard to a dictionary server which allows remote attackers to obtain sensitive information by sniffing the network.


index.php in Aardvark Topsites PHP 5.2.0 and earlier allows remote attackers to obtain sensitive information via a nonexistent account name in the u parameter in a rate action which reveals the installation path in an error message.


WordPress and WordPress MU before 2.8.1 allow remote attackers to obtain sensitive information via a direct request to wp-settings.php which reveals the installation path in an error message.


The zend_restore_ini_entry_cb function in zend_ini.c in PHP 5.3.0 5.2.10 and earlier versions allows context-specific attackers to obtain sensitive information (memory contents) and cause a PHP crash by using the ini_set function to declare a variable then using the ini_restore function to restore the variable.


XScreenSaver in Sun Solaris 9 and 10 OpenSolaris before snv_120 and X11 6.4.1 for Solaris 8 when the Xorg or Xnewt server is used allows physically proximate attackers to obtain sensitive information by reading popup windows which are displayed even when the screen is locked a different vulnerability than CVE-2009-1276.


KerviNet

Forum

and

earlier

allows

remote

attackers

to

obtain

sensitive

information

via

a

direct

request

to

admin/head.php

or

voting.php

menu.php

head.php

or

birthday.php

in

which

reveals

the

installation

path

in

an

error

message.


The Migration component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5 when tracing is enabled and a 6.1 to 7.0 migration has occurred allows remote authenticated users to obtain sensitive information by reading a Migration Trace file.


The encoder in Sun Java SE 6 before Update 15 and OpenJDK grants read access to private variables with unspecified names which allows context-dependent attackers to obtain sensitive information via an untrusted (1) applet or (2) application.


The System Management/Repository component in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.5 on z/OS uses weak file permissions for new applications which allows remote attackers to obtain sensitive information via unspecified vectors.


IBM WebSphere Commerce 7.0 does not properly encrypt data in a database which makes it easier for local users to obtain sensitive information by defeating cryptographic protection mechanisms.


The Huawei D100 allows remote attackers to obtain sensitive information via a direct request to (1) lan_status_adv.asp (2) wlan_basic_cfg.asp or (3) lancfg.asp in en/ related to use of JavaScript to protect against reading file contents.


Sun

Java

SE

before

Update

and

before

Update

and

OpenJDK

might

allow

context-dependent

attackers

to

obtain

sensitive

information

via

vectors

involving

static

variables

that

are

declared

without

the

final

keyword

related

to

LayoutQueue

Cursor.predefined

AccessibleResourceBundle.getContents

the

imageio

plugins

DnsContext.debug

RmfFileReader/StandardMidiFileWriter.types

AbstractSaslImpl.logger

Synth.Region.uiToRegionMap/lowerCaseNameMap

the

Introspector

class

and

a

cache

of

BeanInfo

and

JAX-WS

a

different

vulnerability

than


The QNAP TS-239 Pro and TS-639 Pro with firmware 2.1.7 0613 3.1.0 0627 and 3.1.1 0815 create a LUKS partition by using the AES-256 cipher in plain CBC mode which allows local users to obtain sensitive information via a watermark attack.


Unspecified vulnerability in BlazeDS 3.2 and earlier as used in LiveCycle 8.0.1 8.2.1 and 9.0 LiveCycle Data Services 2.5.1 2.6.1 and 3.0 Flex Data Services 2.0.1 and ColdFusion 7.0.2 8.0 8.0.1 and 9.0 allows remote attackers to obtain sensitive information via vectors that are associated with a request and related to injected tags and external entity references in XML documents.


The tcf_fill_node function in net/sched/cls_api.c in the netlink subsystem in the Linux kernel 2.6.x before 2.6.32-rc5 and 2.4.37.6 and earlier does not initialize a certain tcm__pad2 structure member which might allow local users to obtain sensitive information from kernel memory via unspecified vectors. NOTE: this issue exists because of an incomplete fix for CVE-2005-4881.


Bugzilla before 3.0.11 3.2.x before 3.2.6 3.4.x before 3.4.5 and 3.5.x before 3.5.3 does not block access to files and directories that are used by custom installations which allows remote attackers to obtain sensitive information via requests for (1) CVS/ (2) contrib/ (3) docs/en/xml/ (4) t/ or (5) old-params.txt.


XScreenSaver in Sun Solaris 10 when the accessibility feature is enabled allows physically proximate attackers to obtain sensitive information by reading popup windows which are displayed even when the screen is locked a different vulnerability than CVE-2009-1276 and CVE-2009-2711.


Bugzilla 3.3.1 through 3.4.4 3.5.1 and 3.5.2 does not allow group restrictions to be preserved throughout the process of moving a bug to a different product category which allows remote attackers to obtain sensitive information via a request for a bug in opportunistic circumstances.


RunCMS 2M1 when running with certain error_reporting levels allows remote attackers to obtain sensitive information via (1) the op parameter to modules/contact/index.php or (2) uid parameter to userinfo.php which leaks the installation path in an error message when these parameters are used in a call to the preg_match function.


WebCoreModule.ashx in RADactive I-Load before 2008.2.5.0 allows remote attackers to obtain sensitive information via unspecified requests that trigger responses containing the saved-image folder pathname.


common/snapshots.py in Back In Time (aka backintime) 0.9.26 changes certain permissions to 0777 before deleting the files in an old backup snapshot which allows local users to obtain sensitive information by reading these files or interfere with backup integrity by modifying files that are shared across snapshots.


Twiddle in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 writes the JMX password and other command-line arguments to the twiddle.log file which allows local users to obtain sensitive information by reading this file.


The Meta tags (aka Nodewords) module before 6.x-1.1 for Drupal does not properly follow permissions during assignment of node meta tags which allows remote attackers to obtain sensitive information via unspecified vectors.


The Servlet Engine/Web Container component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.37 does not properly implement security constraints on the (1) doGet and (2) doTrace methods which allows remote attackers to bypass intended access restrictions and obtain sensitive information via a crafted HTTP HEAD request to a Web Application.


The mail component in Mozilla SeaMonkey before 1.1.19 does not properly restrict execution of scriptable plugin content which allows user-assisted remote attackers to obtain sensitive information via crafted content in an IFRAME element in an HTML e-mail message as demonstrated by a Flash object that sends arbitrary local files during a reply or forward operation.


Multiple unspecified vulnerabilities in HP Performance Insight 5.3 on Windows allow attackers to obtain sensitive information via unknown vectors as demonstrated by certain modules in VulnDisco Pack Professional 8.11. NOTE: as of 20090903 this disclosure has no actionable information. However because the VulnDisco Pack author is a reliable researcher the issue is being assigned a CVE identifier for tracking purposes.


The Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE 5.0 before Update 22 and 6 before Update 17 and OpenJDK does not properly restrict the objects that may be sent to loggers which allows attackers to obtain sensitive information via vectors related to the implementation of Component KeyboardFocusManager and DefaultKeyboardFocusManager aka Bug Id 6664512.


The GeckoActiveXObject function in Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6 and SeaMonkey before 2.0.1 generates different exception messages depending on whether the referenced COM object is listed in the registry which allows remote attackers to obtain potentially sensitive information about installed software by making multiple calls that specify the ProgID values of different COM objects.


The tc_fill_tclass function in net/sched/sch_api.c in the tc subsystem in the Linux kernel 2.4.x before 2.4.37.6 and 2.6.x before 2.6.31-rc9 does not initialize certain (1) tcm__pad1 and (2) tcm__pad2 structure members which might allow local users to obtain sensitive information from kernel memory via unspecified vectors.


Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall (WAF) before 6.1 allow remote attackers to obtain sensitive information via an HTTP request that lacks a handler as demonstrated by (1) an OPTIONS request or (2) a crafted GET request leading to a Message-handling Errors message containing a certain client intranet IP address aka Bug ID CSCtb82159.


Amiro.CMS 5.4.0.0 and earlier allows remote attackers to obtain sensitive information via an invalid loginname (\%%%\) to _admin/index.php which reveals the installation path and other information in an error message.


The Mailer component in Evolution 2.26.1 and earlier uses world-readable permissions for the .evolution directory and certain directories and files under .evolution/ related to local mail which allows local users to obtain sensitive information by reading these files.


moziloCMS 1.11 allows remote attackers to obtain sensitive information via the (1) gal parameter to gallery.php (2) page and (3) cat parameter to index.php or (4) file parameter to download.php which reveals the installation path in an error message.


Unspecified vulnerability in the Administrative Configservice API in the System Management/Repository component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5 on z/OS allows remote authenticated users to obtain sensitive information via unknown use of the wsadmin scripting tool related to a \security exposure in wsadmin.\


The Cisco Linksys WVC54GCA wireless video camera with firmware 1.00R22 and 1.00R24 sends configuration data in response to a Setup Wizard remote-management command which allows remote attackers to obtain sensitive information such as passwords by reading the SetupWizard.exe process memory a related issue to CVE-2008-4390.


The Configservice APIs in the Administrative Console component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5 when tracing is enabled allow remote attackers to obtain sensitive information via unspecified use of the wsadmin scripting tool.


The Cisco Linksys WVC54GCA wireless video camera with firmware 1.00R22 and 1.00R24 stores passwords and wireless-network keys in cleartext in (1) pass_wd.htm and (2) Wsecurity.htm which allows remote attackers to obtain sensitive information by reading the HTML source code.


Application Access Server (A-A-S) 2.0.48 stores (1) passwords and (2) the port keyword in cleartext in aas.ini which allows local users to obtain sensitive information by reading this file.


IBM DB2 9.1 before FP7 returns incorrect query results in certain situations related to the order of application of an INNER JOIN predicate and an OUTER JOIN predicate which might allow attackers to obtain sensitive information via a crafted query.


XScreenSaver in Sun Solaris 10 and OpenSolaris before snv_109 and Solaris 8 and 9 with GNOME 2.0 or 2.0.2 allows physically proximate attackers to obtain sensitive information by reading popup windows which are displayed even when the screen is locked as demonstrated by Thunderbird new-mail notifications.


Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not use SSL in all expected circumstances which makes it easier for remote attackers to obtain sensitive information by sniffing the network related to \ssl termination devices\ and lack of support for relative URLs.


The process_stat function in (1) Memcached before 1.2.8 and (2) MemcacheDB 1.2.0 discloses (a) the contents of /proc/self/maps in response to a stats maps command and (b) memory-allocation statistics in response to a stats malloc command which allows remote attackers to obtain sensitive information such as the locations of memory regions and defeat ASLR protection by sending a command to the daemon's TCP port.


Frontend User Registration (sr_feuser_register) extension 2.5.20 and earlier for TYPO3 does not properly verify access rights which allows remote authenticated users to obtain sensitive information such as passwords via unknown attack vectors.


The process_stat function in Memcached 1.2.8 discloses memory-allocation statistics in response to a stats malloc command which allows remote attackers to obtain potentially sensitive information by sending this command to the daemon's TCP port.


activeCollab 2.1 Corporate allows remote attackers to obtain sensitive information via an invalid re_route parameter to the login script which reveals the installation path in an error message.


The db interface in libc in FreeBSD 6.3 6.4 7.0 7.1 and 7.2-PRERELEASE does not properly initialize memory for Berkeley DB 1.85 database structures which allows local users to obtain sensitive information by reading a database file.


PAD Site Scripts 3.6 stores sensitive information under the web document root with insufficient access control which allows remote attackers to download the database and obtain sensitive information via a direct request for dbbackup.txt.


Adobe ColdFusion 8.0.1 and earlier might allow attackers to obtain sensitive information via unspecified vectors related to a \double-encoded null character vulnerability.\


The (1) agp_generic_alloc_page and (2) agp_generic_alloc_pages functions in drivers/char/agp/generic.c in the agp subsystem in the Linux kernel before 2.6.30-rc3 do not zero out pages that may later be available to a user-space process which allows local users to obtain sensitive information by reading these pages.


Mozilla Firefox before 3.0.9 and SeaMonkey before 1.1.17 allow user-assisted remote attackers to obtain sensitive information via a web page with an embedded frame which causes POST data from an outer page to be sent to the inner frame's URL during a SAVEMODE_FILEONLY save of the inner frame.


import_wbb1.php in Unclassified NewsBoard (UNB) 1.6.4 allows remote attackers to obtain sensitive information via a direct request which reveals the installation path in an error message.


Microsoft XML Core Services as used in Microsoft Expression Web Office Internet Explorer 6 and 7 and other products does not properly restrict access from web pages to Set-Cookie2 HTTP response headers which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls related to the HTTPOnly protection mechanism. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-4033.


IBM WebSphere Message Broker 6.1.x before 6.1.0.2 writes a database connection password to the Event Log and System Log during exception handling for a JDBC error which allows local users to obtain sensitive information by reading these logs.


Unspecified vulnerability in WMI Mapper for HP Systems Insight Manager before 2.5.2.0 allows remote attackers to obtain sensitive information via unknown vectors.


PerfServlet in the PMI/Performance Tools component in IBM WebSphere Application Server (WAS) 6.0.x before 6.0.2.31 6.1.x before 6.1.0.21 and 7.0.x before 7.0.0.1 when Performance Monitoring Infrastructure (PMI) is enabled allows local users to obtain sensitive information by reading the (1) systemout.log and (2) ffdc files. NOTE: this is probably a duplicate of CVE-2008-5413.


Google Chrome before 1.0.154.46 does not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls and other web script.


Downloadcenter 2.1 stores common.h under the web root with insufficient access control which allows remote attackers to obtain user credentials and other sensitive information via a direct request. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


admin.php in Ninja Designs Mailist 3.0 stores backup copies of maillist.php under the web root with insufficient access control which allows remote attackers to obtain sensitive information via a direct request to the backup directory.


The domain-locking implementation in the GARMINAXCONTROL.GarminAxControl_t.1 ActiveX control in npGarmin.dll in the Garmin Communicator Plug-In 2.6.4.0 does not properly enforce the restrictions that (1) download and (2) upload requests come from a web site specified by the user which allows remote attackers to obtain sensitive information or reconfigure Garmin GPS devices via unspecified vectors related to a \synchronisation error.\


IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.24 and 7.0 through 7.0.0.4 IBM WebSphere Portal Server 5.1 through 6.0 and IBM Integrated Solutions Console (ISC) 6.0.1 do not properly set the IsSecurityEnabled security flag during migration of WebSphere Member Manager (WMM) to Virtual Member Manager (VMM) and a Federated Repository which allows attackers to obtain sensitive information from repositories via unspecified vectors.


Mozilla Firefox 3.x before 3.0.6 does not properly implement the (1) no-store and (2) no-cache Cache-Control directives which allows local users to obtain sensitive information by using the (a) back button or (b) history list of the victim's browser as demonstrated by reading the response page of an https POST request.


CFNetwork in Apple Mac OS X 10.5 before 10.5.7 does not properly parse noncompliant Set-Cookie headers which allows remote attackers to obtain sensitive information by sniffing the network for \secure cookies\ that are sent over unencrypted HTTP connections.


Unspecified vulnerability in fseventsd in the FSEvents framework in Apple Mac OS X 10.5.6 allows local users to obtain sensitive information (filesystem activities and directory names) via unknown vectors related to \credential management.\


The sock_getsockopt function in net/core/sock.c in the Linux kernel before 2.6.28.6 does not initialize a certain structure member which allows local users to obtain potentially sensitive information from kernel memory via an SO_BSDCOMPAT getsockopt request.


images/captcha.php in RavenNuke 2.30 allows remote attackers to obtain sensitive information via an aFonts array parameter value that does not correspond to a valid font file which reveals the installation path in an error message.


iChat in Apple Mac OS X 10.5 before 10.5.7 disables SSL for AOL Instant Messenger (AIM) communication in certain circumstances that are inconsistent with the Require SSL setting which allows remote attackers to obtain sensitive information by sniffing the network.


Microsoft Windows XP Server 2003 and 2008 and Vista exposes I/O activity measurements of all processes which allows local users to obtain sensitive information as demonstrated by reading the I/O Other Bytes column in Task Manager (aka taskmgr.exe) to estimate the number of characters that a different user entered at a runas.exe password prompt related to a \benchmarking attack.\


IBM WebSphere Partner Gateway (WPG) 6.1.0 before 6.1.0.1 and 6.1.1 before 6.1.1.1 allows remote authenticated users to obtain sensitive information via vectors related to the \schema DB2 instance id\ and the bcgarchive (aka the archiver script).


The Installation Factory installation process for IBM WebSphere Application Server (WAS) 6.0.2 on Windows when WAS is registered as a Windows service allows local users to obtain sensitive information by reading the logs/instconfigifwas6.log log file.


Mozilla Firefox before 3.0.6 and SeaMonkey before 1.1.15 do not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls related to the HTTPOnly protection mechanism.


The installation process for the File Transfer servlet in the System Management/Repository component in IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.19 does not enable the secure version which allows remote attackers to obtain sensitive information via unspecified vectors.


The username command in Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers and Cisco ACE 4710 Application Control Engine Appliance stores a cleartext password by default which allows context-dependent attackers to obtain sensitive information.


Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 stores an exception for a hostname when the user accepts an untrusted Exchange server certificate which causes it to be accepted without prompting in future usage and allows remote Exchange servers to obtain sensitive information such as credentials.


Unspecified vulnerability in WebAccess in Novell GroupWise 6.5 7.0 7.01 7.02x 7.03 7.03HP1a and 8.0 might allow remote attackers to obtain sensitive information via a crafted URL related to conversion of POST requests to GET requests.


Multiple unspecified vulnerabilities in the Control Center in Symantec Brightmail Gateway Appliance before 8.0.1 allow remote authenticated users to gain privileges and possibly obtain sensitive information or hijack sessions of arbitrary users via vectors involving (1) administrative scripts or (2) console functions.


The installation for Zen Cart stores sensitive information and insecure programs under the (1) docs (2) extras and (3) zc_install folders and (4) install.txt which allows remote attackers to obtain sensitive information delete the database and conduct other attacks via a direct request different vulnerabilities than CVE-2009-4321 and CVE-2009-4322.


WP-Cumulus Plug-in 1.20 for WordPress and possibly other versions allows remote attackers to obtain sensitive information via a crafted request to wp-cumulus.php probably without parameters which reveals the installation path in an error message.


nm-connection-editor in NetworkManager (NM) 0.7.x exports connection objects over D-Bus upon actions in the connection editor GUI which allows local users to obtain sensitive information by reading D-Bus signals as demonstrated by using dbus-monitor to discover the password for the WiFi network.


The Dump Servlet in Mort Bay Jetty 6.x and 7.0.0 allows remote attackers to obtain sensitive information about internal variables and other data via a request to a URI ending in /dump/ as demonstrated by discovering the value of the getPathTranslated variable.


Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 stores (1) password hashes and (2) unspecified \secrets\ in backup files which might allow attackers to obtain sensitive information.


CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote attackers to obtain sensitive information via an invalid date value in the from_date_day parameter to search.php which reveals the installation path in an error message.


Wolfram Research webMathematica allows remote attackers to obtain sensitive information via a direct request to the MSP script which reveals the installation path in an error message.


extras/ipn_test_return.php in Zen Cart allows remote attackers to obtain sensitive information via a direct request which reveals the installation path in an error message.


RADIO istek scripti 2.5 stores sensitive information under the web root with insufficient access control which allows remote attackers to obtain user credentials via a direct request for estafresgaftesantusyan.inc.


index.php in AdPeeps 8.5d1 allows remote attackers to obtain sensitive information via (1) a view_adrates action with an invalid uid parameter which reveals the installation path in an error message; or (2) an adminlogin action with a crafted uid parameter which reveals the version number.


The configuration page in ToutVirtual VirtualIQ Pro 3.2 build 7882 contains cleartext SSH credentials which allows remote attackers to obtain sensitive information by reading the username and password fields.


Unspecified vulnerability in the PayPal Website Payments Standard functionality in the Ubercart module 5.x before 5.x-1.9 and 6.x before 6.x-2.1 for Drupal when a custom checkout completion message is enabled allows attackers to obtain sensitive information via unknown vectors.


PowerPhlogger

allows

remote

attackers

to

obtain

sensitive

information

via

a

direct

request

to

edCss.inc.php

foot.inc.php

head.inc.php

loglist.inc.php

and

in

include/

which

reveals

the

installation

path

in

an

error

message.


The

process

function

in

in

EC-CUBE

through

and

Community

Edition

through

allows

remote

attackers

to

obtain

sensitive

information

(customer

data)

via

unknown

vectors

related

to

sessions.


Sun Ray Server Software 4.0 and 4.1 does not generate a unique DSA private key for the firmware on each Sun Ray 1 1g 100 and 150 DTU device which makes it easier for remote attackers to obtain sensitive information by predicting a key and then using it to decrypt sniffed network traffic.


DeluxeBB 1.3 stores sensitive information under the web root with insufficient access control which allows remote attackers to obtain user and configuration information log data and gain administrative access via a direct request to scripts in (1) templates/ including (2) templates/deluxe/admincp/ (3) templates/corporate/admincp/ and (4) templates/blue/admincp/; (5) images/; (6) logs/ including (7) logs/cp.php; (8) wysiwyg/; (9) docs/; (10) classes/; (11) lang/; and (12) settings/.


The default configuration of Apache Tomcat in Websense Manager in Websense Web Security 7.0 and Web Filter 7.0 enables weak SSL ciphers in conf/server.xml which makes it easier for remote attackers to obtain sensitive information by sniffing the network and then conducting a brute-force attack against encrypted session data.


The encrypted e-mail feature in IBM Lotus Notes Traveler before 8.5.0.2 sends unencrypted messages when the feature is used without uploading a Notes ID file which makes it easier for remote attackers to obtain sensitive information by sniffing the network.


IBM

Tivoli

Federated

Identity

Manager

(TFIM)

before

when

com.tivoli.am.fim.infocard.delegates.InfoCardSTSDelegate

tracing

is

enabled

creates

a

cleartext

log

entry

containing

a

password

which

might

allow

local

users

to

obtain

sensitive

information

by

reading

the

log

data.


The Personal Email Manager component in Websense Email Security before 7.2 allows remote attackers to obtain potentially sensitive information from the JBoss status page via an unspecified query.


The Web Post Protection feature in McAfee Host Data Loss Prevention (DLP) 3.x before 3.0.100.10 and 9.x before 9.0.0.422 when HTTP Capture mode is enabled allows local users to obtain sensitive information from web traffic by reading unspecified files.


Vignette StoryServer and Vignette V/5 allows remote attackers to obtain sensitive information via a request for the /vgn/style template.


Multiple vulnerabilities in suidperl 5.6.1 and earlier allow a local user to obtain sensitive information about files for which the user does not have appropriate permissions.


web-tools in SAP DB before 7.4.03.30 installs several services that are enabled by default which could allow remote attackers to obtain potentially sensitive information or redirect attacks against internal databases via (1) waecho (2) Web SQL Interface (websql) or (3) Web Database Manager (webdbm).


Multiple vulnerabilities in aoljtest.jsp of Oracle Applications AOL/J Setup Test Suite in Oracle E-Business Suite 11.5.1 through 11.5.8 allow a remote attacker to obtain sensitive information without authentication such as the GUEST user password and the application server security key.


wgate.dll in SAP Internet Transaction Server (ITS) 4620.2.0.323011 allows remote attackers to obtain potentially sensitive information such as directory structure and operating system via incorrect parameters (1) ~service (2) ~templatelanguage (3) ~language (4) ~theme or (5) ~template which leaks the information in the resulting error message.


/proc/tty/driver/serial in Linux 2.4.x reveals the exact number of characters used in serial links which could allow local users to obtain potentially sensitive information such as the length of passwords.


The /proc filesystem in Linux allows local users to obtain sensitive information by opening various entries in /proc/self before executing a setuid program which causes the program to fail to change the ownership and permissions of those entries.


The NetBT Name Service (NBNS) for NetBIOS in Windows NT 4.0 2000 XP and Server 2003 may include random memory in a response to a NBNS query which could allow remote attackers to obtain sensitive information.


foo.php3 in DotBr 0.1 allows remote attackers to obtain sensitive information via a direct request which calls the phpinfo function.


Multiple SQL injection vulnerabilities in (1) addcustomer.asp (2) addprod.asp and (3) process.asp in a.shopKart 2.0.3 allow remote attackers to execute arbitrary SQL and obtain sensitive information via the zip state country phone and fax parameters.


WEB-ERP 0.1.4 and earlier allows remote attackers to obtain sensitive information via an HTTP request for the logicworks.ini file which contains the MySQL database username and password.


Petitforum stores the liste.txt data file under the web document root with insufficient access control which allows remote attackers to obtain sensitive information such as e-mail addresses and encrypted passwords.


AXIS 2400 Video Server 2.00 through 2.33 allows remote attackers to obtain sensitive information via an HTTP request to /support/messages which displays the server's /var/log/messages file.


Sambar Server before 6.0 beta 6 allows remote attackers to obtain sensitive information via direct requests to the default scripts (1) environ.pl and (2) testcgi.exe.


Microsoft Internet Information Services (IIS) 5.0 does not log requests that use the TRACK method which allows remote attackers to obtain sensitive information without detection.


Worker Filemanager 1.0 through 2.7 sets the permissions on the destination directory to world-readable and executable while copying data which could allow local users to obtain sensitive information.


Haakon Nilsen Simple Internet Publishing System (SIPS) 0.2.2 stores sensitive information under the web root with insufficient access control which allows remote attackers to obtain password and other user information via a direct request to a user-specific configuration directory.


Secure Internet Live Conferencing (SILC) 0.9.11 and 0.9.12 stores passwords and sessions in plaintext in memory which could allow local users to obtain sensitive information.


IBM Net.Data allows remote attackers to obtain sensitive information such as path names server names and possibly user names and passwords by causing the (1) $(DTW_CURRENT_FILENAME) (2) $(DATABASE) (3) $(LOGIN) (4) $(PASSWORD) and possibly other predefined variables that can be echoed back to the user via a web form.


Trend Micro Virus Control System (TVCS) Log Collector allows remote attackers to obtain usernames encrypted passwords and other sensitive information via a URL request for getservers.exe with the action parameter set to \selects1\ which returns log files.


PlanetMoon Guestbook tr3.a stores sensitive information under the web root with insufficient access control which allows remote attackers to obtain the admin script password and other passwords via a direct request to files/passwd.txt.


ScozNet ScozBook 1.1 BETA allows remote attackers to obtain sensitive information via an invalid PG parameter in view.php which reveals the installation path in an error message.


The AGate component for SAP Internet Transaction Server (ITS) allows remote attackers to obtain sensitive information via a ~command parameter with an AgateInstallCheck value which provides a list of installed DLLs and full pathnames.


CoffeeCup Software Password Wizard 4.0 stores sensitive information such as usernames and passwords in a .apw file under the web document root with insufficient access control which allows remote attackers to obtain that information via a direct request for the file.


Apache HTTP Server 1.3.22 through 1.3.27 on OpenBSD allows remote attackers to obtain sensitive information via (1) the ETag header which reveals the inode number or (2) multipart MIME boundary which reveals child process IDs (PID).


clarkconnectd in ClarkConnect Linux 1.2 allows remote attackers to obtain sensitive information about the server via the characters (1) A which reveals the date and time (2) F (3) M which reveals 'ifconfig' information (4) P which lists the processes (5) Y which reveals the snort log files or (6) b which reveals /var/log/messages.


DotBr 0.1 stores config.inc with insufficient access control under the web document root which allows remote attackers to obtain sensitive information such as SQL usernames and passwords.


Netscape 4 sends Referer headers containing https:// URLs in requests for http:// URLs which allows remote attackers to obtain potentially sensitive information by reading Referer log data.


Microsoft URLScan 2.5 with the RemoveServerHeader option enabled allows remote attackers to obtain sensitive information (server name and version) via an HTTP request that generates certain errors such as 400 \Bad Request \ which leak the Server header in the response.


login.php in php-Board 1.0 stores plaintext passwords in $username.txt with insufficient access control under the web document root which allows remote attackers to obtain sensitive information via a direct request.


Sun Cluster 2.2 when HA-Oracle or HA-Sybase DBMS services are used stores database credentials in cleartext in a cluster configuration file which allows local users to obtain sensitive information by reading this file.


Opera probably before 7.50 sends Referer headers containing https:// URLs in requests for http:// URLs which allows remote attackers to obtain potentially sensitive information by reading Referer log data.


HTTP Commander 4.0 allows remote attackers to obtain sensitive information via an HTTP request that contains a . (dot) in the file parameter which reveals the installation path in an error message.


Advanced Poll 2.0.2 allows remote attackers to obtain sensitive information via an HTTP request to info.php which invokes the phpinfo() function.


Easy File Sharing (EFS) Web Server 1.2 stores the (1) option.ini (aka options.ini) file and (2) log directory under the web root with insufficient access control which allows remote attackers to obtain sensitive information including an SMTP account username and password hash the server configuration and server log files.


mod.php in eNdonesia 8.2 allows remote attackers to obtain sensitive information via a ' (quote) value in the lng parameter which reveals the path in an error message. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.


NetCharts XBRL Server 4.0.0 allows remote attackers to obtain sensitive information via an HTTP request with an invalid chunked transfer encoding specification.


Web Wiz Guestbook 6.0 stores sensitive information under the web root with insufficient access control which allows remote attackers to download the database and obtain sensitive information via a direct request for database/WWGguestbook.mdb. NOTE: it was later reported that 8.21 is also affected.