A

pointer

dereference

was

discovered

in

wasm::SExpressionWasmBuilder::parseExpression

in

wasm-s-parser.cpp

in

Binaryen

A

crafted

wasm

input

can

cause

a

segmentation

fault

leading

to

denial-of-service

as

demonstrated

by

wasm-as.


A null pointer dereference was addressed with improved input validation. This issue is fixed in AirPort Base Station Firmware Update 7.8.1 AirPort Base Station Firmware Update 7.9.1. A remote attacker may be able to cause arbitrary code execution.


A null pointer dereference vulnerability in Lenovo Power Management Driver for Windows 10 prior to version 1.67.17.54 that could cause systems to experience a blue screen error.


A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened.


A Null Pointer Dereference vulnerability exists in the gf_sg_vrml_mf_alloc function in gpac 1.1.0-DEV which causes a segmentation fault and application crash.


A null pointer dereference vulnerability exists in gpac 1.1.0 in the gf_isom_parse_movie_boxes_internal function which causes a segmentation fault and application crash.


A null pointer dereference vulnerability exists in gpac 1.1.0 in the gf_svg_get_attribute_name function which causes a segmentation fault and application crash.


A Null Pointer Dereference vulnerability exists in gpac 1.1.0 in the gf_node_get_field function which can cause a segmentation fault and application crash.


A null pointer dereference vulnerability exists in gpac 1.1.0 in the gf_dump_vrml_dyn_field.isra function which causes a segmentation fault and application crash.


A null pointer dereference vulnerability exists in gpac 1.1.0 in the gf_sg_vrml_mf_append function which causes a segmentation fault and application crash.


A null pointer dereference vulnerability exists in gpac 1.1.0 in the BD_CheckSFTimeOffset function which causes a segmentation fault and application crash.


A null pointer dereference vulnerability exists in gpac 1.1.0-DEV in the gf_node_get_tag function which causes a segmentation fault and application crash.


Possible null pointer dereference due to lack of WDOG structure validation during registration in Snapdragon Auto Snapdragon Connectivity Snapdragon Industrial IOT Snapdragon Mobile


A NULL pointer dereference in CS104_IPAddress_setFromString at src/iec60870/cs104/cs104_slave.c of lib60870 commit 0d5e76e can lead to a segmentation fault or application crash.


A null pointer dereference vulnerability exists in gpac 1.1.0 in the lsr_read_id.part function which causes a segmentation fault and application crash.


A Null Pointer Dereference vulnerability existfs in nasm 2.16rc0 via asm/preproc.c.


A NULL pointer dereference in AcseConnection_parseMessage at src/mms/iso_acse/acse.c of libiec61850 v1.5.0 can lead to a segmentation fault or application crash.


A null pointer dereference vulnerability exists in gpac 1.1.0 via the lsr_read_anim_values_ex function which causes a segmentation fault and application crash.


A NULL pointer dereference vulnerability exists in eXcall_api.c in Antisip eXosip2 through 5.2.0 when handling certain 3xx redirect responses.


A null pointer dereference in Teradici PCoIP Soft Client versions prior to 20.07.3 could allow an attacker to crash the software.


Potential null pointer dereference in KGSL GPU auxiliary command due to improper validation of user input in Snapdragon Auto Snapdragon Connectivity Snapdragon Industrial IOT Snapdragon Mobile


Possible null pointer dereference due to improper validation of APE clip in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Voice & Music Snapdragon Wearables


A NULL pointer dereference flaw was found in the way LibVNCServer before 0.9.9 handled certain ClientCutText message. A remote attacker could use this flaw to crash the VNC server by sending a specially crafted ClientCutText message from a VNC client.


A null pointer dereference vulnerability was found in netpbm before 10.61. A maliciously crafted SVG file could cause the application to crash.


A NULL pointer dereference was discovered in sbr_process_channel of libfaad/sbr_dec.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash.


A NULL pointer dereference bug in the function ObReferenceObjectByHandle in the Kingsoft Internet Security 9+ kernel driver KWatch3.sys allows local non-privileged users to crash the system via IOCTL 0x80030030.


A NULL pointer dereference (aka SEGV on unknown address 0x000000000000) was discovered in work_stuff_copy_to_from in cplus-dem.c in GNU libiberty as distributed in GNU Binutils 2.30. This can occur during execution of objdump.


A null pointer dereference was addressed with improved validation. This issue affected versions prior to macOS High Sierra 10.13.6.


A NULL pointer dereference was found in the net/rds/rdma.c __rds_rdma_map() function in the Linux kernel before 4.14.7 allowing local attackers to cause a system panic and a denial-of-service related to RDS_GET_MR and RDS_GET_MR_FOR_DEST.


A NULL pointer dereference flaw was found in the Linux kernel's GPU Nouveau driver functionality in versions prior to 5.12-rc1 in the way the user calls ioctl DRM_IOCTL_NOUVEAU_CHANNEL_ALLOC. This flaw allows a local user to crash the system.


A NULL pointer dereference (DoS) Vulnerability was found in the function aubio_source_avcodec_readframe in io/source_avcodec.c of aubio 0.4.6 which may lead to DoS when playing a crafted audio file.


Possible null pointer dereference due to race condition between timeline fence signal and time line fence destroy in Snapdragon Auto Snapdragon Connectivity Snapdragon Industrial IOT Snapdragon Mobile


An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1. It mishandles situations in which an array size (derived from a /Size entry) is smaller than the maximum indirect object number and thus there is an attempted incorrect array access (leading to a NULL pointer dereference or out-of-bounds read or write).

null pointer dereference
out of bound read


NVIDIA Tegra kernel driver contains a vulnerability in NVHost where a specific race condition can lead to a null pointer dereference which may lead to a system reboot.


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel as a result of a race condition between two userspace processes that interact with the driver concurrently a null pointer dereference can potentially occur.


The tower_probe function in drivers/usb/misc/legousbtower.c in the Linux kernel before 4.8.1 allows local users (who are physically proximate for inserting a crafted USB device) to gain privileges by leveraging a write-what-where condition that occurs after a race condition and a NULL pointer dereference.


In net/socket.c in the Linux kernel through 4.17.1 there is a race condition between fchownat and close in cases where they target the same socket file descriptor related to the sock_close and sockfs_setattr functions. fchownat does not increment the file descriptor reference count which allows close to set the socket to NULL during fchownat's execution leading to a NULL pointer dereference and system crash.


In the Linux Kernel before version 4.16.11 4.14.43 4.9.102 and 4.4.133 multiple race condition errors when handling probe disconnect and rebind operations can be exploited to trigger a use-after-free condition or a NULL pointer dereference by sending multiple USB over IP packets.


A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be used by local attackers to corrupt memory cause a NULL pointer dereference or possibly have unspecified other impact aka CID-17743798d812.


An issue was discovered in the Linux kernel through 5.9.1 as used with Xen through 4.14.x. drivers/xen/events/events_base.c allows event-channel removal during the event-handling loop (a race condition). This can cause a use-after-free or NULL pointer dereference as demonstrated by a dom0 crash via events for an in-reconfiguration paravirtualized device aka CID-073d0552ead5.


In the Linux kernel through 5.4.6 there is a NULL pointer dereference in drivers/scsi/libsas/sas_discover.c because of mishandling of port disconnection during discovery related to a PHY down race condition aka CID-f70267f379b5.


A use-after-free issue could be triggered remotely in the SFTP component of PSFTPd 10.0.4 Build 729. This issue could be triggered prior to authentication. The PSFTPd server did not automatically restart which enabled attackers to perform a very effective DoS attack against this service. By sending a crafted SSH identification / version string to the server a NULL pointer dereference could be caused apparently because of a race condition in the window message handling performing the cleanup for invalid connections. This incorrect cleanup code has a use-after-free.

null pointer dereference
race condition
dos


When SWFTools 0.9.2 processes a crafted file in swfextract it can lead to a NULL Pointer Dereference in the swf_FoldSprite() function in lib/rxfswf.c.


MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via vectors involving error log files.


IBM AIX 5.3 6.1 7.1 and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privileges. IBM X-Force ID: 134067.


IBM AIX 5.3 6.1 7.1 and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privileges. IBM APARs: IV88658 IV87981 IV88419 IV87640 IV88053.


Extreme EXOS 16.x 21.x and 22.x allows administrators to obtain a root shell via vectors involving a privileged process.


Extreme EXOS 16.x 21.x and 22.x allows administrators to obtain a root shell via vectors involving an exsh debug shell.


An issue was discovered in the libsecp256k1 crate before 0.3.1 for Rust. Scalar::check_overflow allows a timing side-channel attack; consequently attackers can obtain sensitive information.


All versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have a file reading vulnerability. Attackers could obtain log file information without authorization causing the disclosure of sensitive information.


All versions up to V2.5.0_EG1T5_TED of ZTE ZXHN H108N product are impacted by an information leak vulnerability. An attacker could exploit the vulnerability to obtain sensitive information and perform unauthorized operations.


All versions up to BD_R218V2.4 of ZTE MF920 product are impacted by information leak vulnerability. Due to some interfaces can obtain the WebUI login password without login an attacker can exploit the vulnerability to obtain sensitive information about the affected components.


The Trend Micro Security 2020 consumer family of products contains a vulnerability that could allow a local attacker to disclose sensitive information or to create a denial-of-service condition on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.


iTerm2 through 3.3.6 has potentially insufficient documentation about the presence of search history in com.googlecode.iterm2.plist which might allow remote attackers to obtain sensitive information as demonstrated by searching for the NoSyncSearchHistory string in .plist files within public Git repositories.


Atos Unify OpenScape UC Web Client V9 before version V9 R4.31.0 and V10 before version V10 R0.6.0 allows remote attackers to obtain sensitive information. By iterating the value of conferenceId to getMailFunction in the JSON API one can enumerate all conferences scheduled on the platform with their numbers and access PINs.


WebAccess/SCADA Version 8.3. Specially crafted requests could allow a possible authentication bypass that could allow an attacker to obtain and manipulate sensitive information.


This vulnerability allows local attackers to disclose sensitive information on affected installations of Samsung Knox 1.2.02.39 on Samsung Galaxy S9 build G9600ZHS3ARL1 Secure Folder. An attacker must first obtain physical access to the device in order to exploit this vulnerability. The specific flaws exists within the the handling of the lock screen for Secure Folder. The issue results from the lack of proper validation that a user has correctly authenticated. An attacker can leverage this vulnerability to disclose the contents of the secure container. Was ZDI-CAN-7381.


IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information caused by the failure to set the secure flag for a sensitive cookie in an HTTPS session. A remote attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 163780.


IBM StoredIQ 7.6 could allow a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web site a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 158699.


IBM MQ and IBM MQ Appliance 7.1 7.5 8.0 9.0 LTS 9.1 LTS and 9.1 CD could allow a local attacker to obtain sensitive information by inclusion of sensitive data within runmqras data.


IBM Security Directory Server 6.4.0 could allow a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web site a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 165660.


IBM QRadar 7.3.0 to 7.3.2 Patch 4 is vulnerable to incorrect authorization in some components which could allow an authenticated user to obtain sensitive information. IBM X-Force ID: 164430.


IBM Security Access Manager 9.0.1 through 9.0.6 could allow a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web site a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 158517.


IBM Emptoris Sourcing 10.1.0 through 10.1.3 IBM Contract Management 10.1.0 through 10.1.3 and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 could allow an authenticated user to obtain sensitive information from error messages IBM X-Force ID: 161034.


IBM Spectrum Protect Operations Center 7.1 and 8.1 could allow a remote attacker to obtain sensitive information caused by an error message containing a stack trace. By creating an error with a stack trace an attacker could exploit this vulnerability to potentially obtain details on the Operations Center architecture. IBM X-Force ID: 158279.


IBM WebSphere Application Server 7.0 8.0 8.5 and 9.0 Network Deployment could allow a remote attacker to obtain sensitive information caused by sending a specially-crafted URL. This can lead the attacker to view any file in a certain directory. IBM X-Force ID: 164364.


IBM QRadar SIEM 7.2.8 WinCollect could allow an attacker to obtain sensitive information by spoofing a trusted entity using man in the middle techniques due to not validating or incorrectly validating a certificate. IBM X-Force ID: 160072.


IBM Jazz Foundation products (IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1) could allow an authenticated user to obtain sensitive information from CLM Applications that could be used in further attacks against the system. IBM X-Force ID: 157384.


IBM Tivoli Storage Productivity Center 5.2.13 through 5.3.0.1 could allow a remote attacker to obtain sensitive information caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. X-Force ID: 158334.


IBM Cognos Controller 10.2.0 10.2.1 10.3.0 10.3.1 and 10.4.0 could allow a remote attacker to obtain sensitive information caused by a flaw in the HTTP OPTIONS method aka Optionsbleed. By sending an OPTIONS HTTP request a remote attacker could exploit this vulnerability to read secret data from process memory and obtain sensitive information. IBM X-Force ID: 158878.


IBM MaaS360 3.96.62 for iOS could allow an attacker with physical access to the device to obtain sensitive information from the agent outside of the container. IBM X-Force ID: 172705.


IBM Security Guardium Data Encryption (GDE) 3.0.0.2 could allow a remote attacker to obtain sensitive information caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 171826.


IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 172519.


IBM MQ Appliance 9.1.4.CD could allow a local attacker to obtain highly sensitive information by inclusion of sensitive data within trace. IBM X-Force ID: 172616.


IBM StoreIQ 7.6.0.0. through 7.6.0.18 could allow an authenticated user to obtain sensitive information that a privileged user should only be allowed to view. IBM X-Force ID: 158696.


IBM Jazz for Service Management 1.1.3 1.1.3.1 and 1.1.3.2 could allow a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web site a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 159122.


IBM QRadar Advisor 1.1 through 2.5 could allow an unauthorized attacker to obtain sensitive information from specially crafted HTTP requests that could aid in further attacks against the system. IBM X-Force ID: 171438.


IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 could allow a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web site a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 167878.


IBM Security Secret Server 10.7 could allow a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web site a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 170001.


IBM Content Navigator 2.0.3 and 3.0CD could allow a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web site a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 157654.


IBM Cloud Automation Manager 3.1.2 could allow a user to be impropertly redirected and obtain sensitive information rather than receive a 404 error message. IBM X-Force ID: 158274.


IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 could allow a local user to obtain sensitive information from SessionManagement cookies. IBM X-Force ID: 162259.


IBM Quality Manager (RQM) 6.02 6.06 and 6.0.6.1 could allow an authenticated user to obtain sensitive information from a stack trace that could aid in further attacks against the system.


IBM MQ and IBM MQ Appliance 7.1 7.5 8.0 9.0 LTS 9.1 LTS and 9.1 CD could allow a local attacker to obtain sensitive information by inclusion of sensitive data within trace. IBM X-Force ID: 168862.


IBM i 7.27.3 Clustering could allow a local attacker to obtain sensitive information caused by the use of advanced node failure detection using the REST API to interface with the HMC. An attacker could exploit this vulnerability to obtain HMC credentials. IBM X-Force ID: 162159.


IBM UrbanCode Deploy (UCD) 7.0.5.2 could allow a remote attacker to obtain sensitive information caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 171249.


IBM SmartCloud Analytics 1.3.1 through 1.3.5 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 159185.


IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 could allow a local user to obtain sensitive information from temporary script files. IBM X-Force ID: 162333.


IBM QRadar 7.3.0 to 7.3.3 Patch 2 could allow a remote attacker to obtain sensitive information caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-ForceID: 167810.


Information leak in autofill in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.


Uninitialized data in media in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file.


OnCommand Unified Manager for VMware vSphere Linux and Windows prior to 9.5 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensitive information via unspecified vectors.


OnCommand Unified Manager 7-Mode prior to version 5.2.4 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensitive information via unspecified vectors.


There is an information leak vulnerability in some Huawei phones versions earlier than Jackman-L21 8.2.0.155(C185R1P2). When a local attacker uses the camera of a smartphone the attacker can exploit this vulnerability to obtain sensitive information by performing a series of operations.


OnCommand Workflow Automation versions prior to 5.0 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensitive information via unspecified vectors.


Incorrect font handling in autofill in Google Chrome prior to 75.0.3770.142 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.


Oncommand Insight versions prior to 7.3.5 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensitive information via unspecified vectors.


An exposed debugging endpoint in the browser in Google Chrome on Android prior to 72.0.3626.81 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted Intent.


A vulnerability has been identified in EN100 Ethernet module DNP3 variant (All versions) EN100 Ethernet module IEC 61850 variant (All versions < V4.37) EN100 Ethernet module IEC104 variant (All versions) EN100 Ethernet module Modbus TCP variant (All versions) EN100 Ethernet module PROFINET IO variant (All versions). A vulnerability in the integrated web server of the affected devices could allow unauthorized attackers to obtain sensitive information about the device including logs and configurations. At the time of advisory publication no public exploitation of this security vulnerability was known.


A vulnerability has been identified in SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.3) SCALANCE X204RNA (HSR) (All versions) SCALANCE X204RNA (PRP) (All versions) SCALANCE X204RNA EEC (HSR) (All versions) SCALANCE X204RNA EEC (PRP) (All versions) SCALANCE X204RNA EEC (PRP/HSR) (All versions). Affected devices contain a vulnerability that allows an unauthenticated attacker to violate access-control rules. The vulnerability can be triggered by sending GET request to specific uniform resource locator on the web configuration interface of the device. The security vulnerability could be exploited by an attacker with network access to the affected systems. An attacker could use the vulnerability to obtain sensitive information or change the device configuration. At the time of advisory publication no public exploitation of this security vulnerability was known.


Uninitialized data in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.


TOPMeeting before version 8.8 (2019/08/19) shows attendees account and password in front end page that allows an attacker to obtain sensitive information by browsing the source code of the page.


GAT-Ship Web Module through 1.30 allows remote attackers to obtain potentially sensitive information via {} in a ws/gatshipWs.asmx/SqlVersion request.


It is possible for an attacker with regular user access to the web application of Pydio through 8.2.2 to trick an administrator user into opening a link shared through the application that in turn opens a shared file that contains JavaScript code (that is executed in the context of the victim user to obtain sensitive information such as session identifiers and perform actions on behalf of him/her).


doorGets

has

a

SQL

injection

vulnerability

in

when

action=siteweb.

A

remote

background

administrator

privilege

user

(or

a

user

with

permission

to

manage

configuration

siteweb)

could

exploit

the

vulnerability

to

obtain

database

sensitive

information.


doorGets

has

a

SQL

injection

vulnerability

in

A

remote

background

administrator

privilege

user

(or

a

user

with

permission

to

manage

modulecategory)

could

exploit

the

vulnerability

to

obtain

database

sensitive

information

via


doorGets

has

a

SQL

injection

vulnerability

in

A

remote

normal

registered

user

could

exploit

the

vulnerability

to

obtain

database

sensitive

information.


doorGets

has

a

SQL

injection

vulnerability

in

when

action=analytics.

A

remote

background

administrator

privilege

user

(or

a

user

with

permission

to

manage

configuration

analytics)

could

exploit

the

vulnerability

to

obtain

database

sensitive

information.


The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel before 5.0.15 allows a local user to obtain potentially sensitive information from kernel stack memory via a HIDPCONNADD command because a name field may not end with a '\\0' character.


Go through 1.12.5 on Windows mishandles process creation with a nil environment in conjunction with a non-nil token which allows attackers to obtain sensitive information or gain privileges.


doorGets

has

a

SQL

injection

vulnerability

in

A

remote

unauthorized

attacker

could

exploit

the

vulnerability

to

obtain

database

sensitive

information.


fs/ext4/extents.c in the Linux kernel through 5.1.2 does not zero out the unused memory region in the extent tree block which might allow local users to obtain sensitive information by reading uninitialized data in the filesystem.


doorGets

has

a

SQL

injection

vulnerability

in

A

remote

background

administrator

privilege

user

(or

a

user

with

permission

to

manage

emailing)

could

exploit

the

vulnerability

to

obtain

database

sensitive

information.


doorGets

has

a

SQL

injection

vulnerability

in

when

action=network.

A

remote

background

administrator

privilege

user

(or

a

user

with

permission

to

manage

network

configuration)

could

exploit

the

vulnerability

to

obtain

database

sensitive

information.


Pydio 6.0.8 mishandles error reporting when a directory allows unauthenticated uploads and the remote-upload option is used with the http://localhost:22 URL. The attacker can obtain sensitive information such as the name of the user who created that directory and other internal server information.


The ContentProvider in the Canon PRINT jp.co.canon.bsd.ad.pixmaprint 2.5.5 application for Android does not properly restrict canon.ij.printer.capability.data data access. This allows an attacker's malicious application to obtain sensitive information including factory passwords for the administrator web interface and WPA2-PSK key.


Phoenix Contact ILC 131 ETH ILC 131 ETH/XC ILC 151 ETH ILC 151 ETH/XC ILC 171 ETH 2TX ILC 191 ETH 2TX ILC 191 ME/AN and AXC 1050 devices allow remote attackers to establish TCP sessions to port 1962 and obtain sensitive information or make changes as demonstrated by using the Create Backup feature to traverse all directories.


Cobham Sea Tel v170 224521 through v194 225444 devices allow attackers to obtain potentially sensitive information such as a vessel's latitude and longitude via the public SNMP community.


An issue was discovered in the AbuseFilter extension for MediaWiki. includes/special/SpecialAbuseLog.php allows attackers to obtain sensitive information such as deleted/suppressed usernames and summaries from AbuseLog revision data. This affects REL1_32 and REL1_33.


A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10 Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with access to email templates can send malicious SQL queries and obtain access to sensitive information stored in the database.


Heimdal Thor Agent 2.5.17x before 2.5.173 does not verify X.509 certificates from TLS servers which allows remote attackers to spoof servers and obtain sensitive information via a crafted certificate.


The mISDN_sock_recvmsg function in drivers/isdn/mISDN/socket.c in the Linux kernel before 3.12.4 does not ensure that a certain length value is consistent with the size of an associated data structure which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom (2) recvmmsg or (3) recvmsg system call.


Apple Safari 6.0.5 on Mac OS X 10.7.5 and 10.8.5 stores cleartext credentials in LastSession.plist which allows local users to obtain sensitive information by reading this file.


The atalk_recvmsg function in net/appletalk/ddp.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom (2) recvmmsg or (3) recvmsg system call.


The Direct Mail (direct_mail) extension before 3.1.2 for TYPO3 allows remote attackers to obtain sensitive information by leveraging improper checking of authentication codes.


The Linux kernel before 3.12.4 updates certain length values before ensuring that associated data structures have been initialized which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom (2) recvmmsg or (3) recvmsg system call related to net/ipv4/ping.c net/ipv4/raw.c net/ipv4/udp.c net/ipv6/raw.c and net/ipv6/udp.c.


Fat Free CRM before 0.12.1 does not restrict JSON serialization which allows remote attackers to obtain sensitive information via a direct request as demonstrated by a request for users/1.json.


D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1.08B44; and DSR-500 DSR-500N DSR-1000 and DSR-1000N with firmware before 1.08B77 stores account passwords in cleartext which allows local users to obtain sensitive information by reading the Users#\Password\ fields in /tmp/teamf1.cfg.ascii.


The Invitation module 7.x-2.x for Drupal does not properly check permissions which allows remote attackers to obtain sensitive information via unspecified default views.


** DISPUTED ** The TFTP service in Cisco Unified Communications Manager (aka CUCM or Unified CM) allows remote attackers to obtain sensitive information from a phone via an RRQ operation as demonstrated by discovering a cleartext UseUserCredential field in an SPDefault.cnf.xml file. NOTE: the vendor reportedly disputes the significance of this report stating that this is an expected default behavior and that the product's documentation describes use of the TFTP Encrypted Config option in addressing this issue.


Cantata before 1.2.2 does not restrict access to files in the play queue which allows remote attackers to obtain sensitive information by reading the songs in the queue.


The pn_recvmsg function in net/phonet/datagram.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom (2) recvmmsg or (3) recvmsg system call.


The put_call function in the API client (api/api_client.rb) in the BaseSpace Ruby SDK (aka bio-basespace-sdk) gem 0.1.7 for Ruby uses the API_KEY on the command line which allows remote attackers to obtain sensitive information by listing the processes.


Valve Bug Reporter in the valve-bugreporter package 2.10+bsos1 in Valve SteamOS Beta stores cleartext credentials in a .valve-bugreporter.cfg file upon a Remember Credentials action which allows local users to obtain sensitive information by reading this file.


Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive information via an unspecified search API.


The x25_recvmsg function in net/x25/af_x25.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom (2) recvmmsg or (3) recvmsg system call.


The nr_recvmsg function in net/netrom/af_netrom.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom (2) recvmmsg or (3) recvmsg system call.


The packet_recvmsg function in net/packet/af_packet.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom (2) recvmmsg or (3) recvmsg system call.


in

Tntnet

before

allows

remote

attackers

to

obtain

sensitive

information

via

a

header

that

ends

in

instead

of

which

prevents

a

terminator

from

being

added

and

causes

Tntnet

to

include

headers

from

other

requests.


The dgram_recvmsg function in net/ieee802154/dgram.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom (2) recvmmsg or (3) recvmsg system call.


The ipx_recvmsg function in net/ipx/af_ipx.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom (2) recvmmsg or (3) recvmsg system call.


The l2tp_ip_recvmsg function in net/l2tp/l2tp_ip.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom (2) recvmmsg or (3) recvmsg system call.


The CGI::Application module before 4.50_50 and 4.50_51 for Perl when run modes are not specified allows remote attackers to obtain sensitive information (web queries and environment details) via vectors related to the dump_html function.


Fat Free CRM before 0.12.1 does not restrict XML serialization which allows remote attackers to obtain sensitive information via a direct request as demonstrated by a request for users/1.xml a different vulnerability than CVE-2013-7224.


The Huawei E355 adapter with firmware 21.157.37.01.910 does not require authentication for API pages which allows remote attackers to change passwords and settings or obtain sensitive information via a direct request to (1) api/wlan/security-settings (2) api/device/information (3) api/wlan/basic-settings (4) api/wlan/mac-filter (5) api/monitoring/status or (6) api/dhcp/settings.


The get_dht function in jdmarker.c in libjpeg-turbo through 1.3.0 as used in Google Chrome before 31.0.1650.48 and other products does not set all elements of a certain Huffman value array during the reading of segments that follow Define Huffman Table (DHT) JPEG markers which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted JPEG image.


The ZippyYum Subway CA Kiosk app 3.4 for iOS uses cleartext storage in SQLite cache databases which allows attackers to obtain sensitive information by reading data elements as demonstrated by password elements.


The XSSAuditor::init function in core/html/parser/XSSAuditor.cpp in the XSS auditor in Blink as used in Google Chrome before 33.0.1750.117 processes POST requests by using the body of a redirecting page instead of the body of a redirect target which allows remote attackers to obtain sensitive information via unspecified vectors.


Unspecified vulnerability in m4 in HP HP-UX B.11.23 and B.11.31 allows local users to obtain sensitive information or modify data via unknown vectors.


Juniper Junos 10.4 before 10.4S15 11.4 before 11.4R9 11.4X27 before 11.4X27.44 12.1 before 12.1R7 12.1X44 before 12.1X44-D20 12.1X45 before 12.1X45-D15 12.2 before 12.2R6 12.3 before 12.3R3 13.1 before 13.1R3 and 13.2 before 13.2R1 when Proxy ARP is enabled on an unnumbered interface allows remote attackers to perform ARP poisoning attacks and possibly obtain sensitive information via a crafted ARP message.


Red Hat Conga 0.12.2 allows remote attackers to obtain sensitive information via a crafted request to the (1) homebase (2) cluster (3) storage (4) portal_skins/custom or (5) logs Luci extension.


EMC Watch4Net before 6.3 stores cleartext polled-device passwords in the installation repository which allows local users to obtain sensitive information by leveraging repository privileges.


The Mijosoft MijoSearch component 2.0.1 and earlier for Joomla! allows remote attackers to obtain sensitive information via a request to component/mijosearch/search which reveals the installation path in an error message.


The nand_ioctl function in sys/dev/nand/nand_geom.c in the nand driver in the kernel in FreeBSD 10 and earlier does not properly initialize a certain data structure which allows local users to obtain sensitive information from kernel memory via a crafted ioctl call.


The Connect client in IBM Sametime 8.5.2 through 8.5.2.1 and 9.0 before HF1 does not properly restrict unsigned Java plugins which allows remote attackers to obtain sensitive information via unspecified vectors.


The Edge Client components in F5 BIG-IP APM 10.x 11.x 12.x 13.x and 14.x BIG-IP Edge Gateway 10.x and 11.x and FirePass 7.0.0 allow attackers to obtain sensitive information from process memory via unspecified vectors.


The TLS driver in ejabberd before 2.1.12 supports (1) SSLv2 and (2) weak SSL ciphers which makes it easier for remote attackers to obtain sensitive information via a brute-force attack.


The qls_eioctl function in sys/dev/qlxge/qls_ioctl.c in the kernel in FreeBSD 10 and earlier does not validate a certain size parameter which allows local users to obtain sensitive information from kernel memory via a crafted ioctl call.


The get_sos function in jdmarker.c in (1) libjpeg 6b and (2) libjpeg-turbo through 1.3.0 as used in Google Chrome before 31.0.1650.48 Ghostscript and other products does not check for certain duplications of component data during the reading of segments that follow Start Of Scan (SOS) JPEG markers which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted JPEG image.


(1) impl_db2.py and (2) impl_mongodb.py in OpenStack Ceilometer 2013.2 and earlier when the logging level is set to INFO logs the connection string from ceilometer.conf which allows local users to obtain sensitive information (the DB2 or MongoDB password) by reading the log file.


core/html/parser/XSSAuditor.cpp in the XSS auditor in Blink as used in Google Chrome before 33.0.1750.117 inserts the about:blank URL during certain blocking of FORM elements within HTTP requests which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via unspecified vectors.


security/MemberLoginForm.php in SilverStripe 3.0.3 supports credentials in a GET request which allows remote or local attackers to obtain sensitive information by reading web-server access logs web-server Referer logs or the browser history a similar vulnerability to CVE-2013-2653.


The Dell Quest One Password Manager possibly 5.0 allows remote attackers to bypass CAPTCHA protections and obtain sensitive information (user's full name) by sending a login request with a valid domain and username but without the CaptchaType UseCaptchaEveryTime and CaptchaResponse parameters.


SAP

Sybase

Adaptive

Server

Enterprise

(ASE)

before

before

and

before

or

allows

local

users

to

obtain

sensitive

information

via

unspecified

vectors.


The python-qpid client (common/rpc/impl_qpid.py) in OpenStack Oslo before 2013.2 does not enforce SSL connections when qpid_protocol is set to ssl which allows remote attackers to obtain sensitive information by sniffing the network.


IBM Platform Symphony 5.2 before build 229037 and 6.1.0.1 before build 229073 uses the same credentials encryption key across different customers' installations which makes it easier for context-dependent attackers to obtain sensitive information by leveraging knowledge of this key.


The genlock_dev_ioctl function in genlock.c in the Genlock driver for the Linux kernel 3.x as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products does not properly initialize a certain data structure which allows local users to obtain sensitive information from kernel stack memory via a crafted GENLOCK_IOC_EXPORT ioctl call.


The J2EE Engine in SAP NetWeaver 6.40 7.02 and earlier allows remote attackers to redirect users to arbitrary web sites conduct phishing attacks and obtain sensitive information (cookies and SAPPASSPORT) via unspecified vectors.


Cumin (aka MRG Management Console) as used in Red Hat Enterprise MRG 2.5 uses the DES-based crypt function to hash passwords which makes it easier for attackers to obtain sensitive information via a brute-force attack.


The RBAC implementation in Cisco Secure Access Control System (ACS) does not properly verify privileges for support-bundle downloads which allows remote authenticated users to obtain sensitive information via a download action as demonstrated by obtaining read access to the user database aka Bug ID CSCuj39274.


IBM WebSphere eXtreme Scale Client 7.1 through 8.6.0.4 does not properly isolate the cached data of different users which allows remote authenticated users to obtain sensitive information in opportunistic circumstances by leveraging access to the same web container.


Libcloud 0.12.3 through 0.13.2 does not set the scrub_data parameter for the destroy DigitalOcean API which allows local users to obtain sensitive information by leveraging a new VM.


The ql_eioctl function in sys/dev/qlxgbe/ql_ioctl.c in the kernel in FreeBSD 10 and earlier does not validate a certain size parameter which allows local users to obtain sensitive information from kernel memory via a crafted ioctl call.


The ISL Desktop plugin for Windows before 1.4.7 for ISL Light 3.5.4 and earlier allows remote authenticated users to obtain sensitive information by pasting the clipboard contents that have been copied by another user in the session.


phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote attackers to obtain sensitive information via an invalid request which reveals the installation path in an error message related to pmd_common.php and other files.


Puppet Enterprise before 3.2.0 does not properly restrict access to node endpoints in the console which allows remote attackers to obtain sensitive information via unspecified vectors.


The vos command in OpenAFS 1.6.x before 1.6.5 when using the -encrypt option only enables integrity protection and sends data in cleartext which allows remote attackers to obtain sensitive information by sniffing the network.


Interpretation conflict in drivers/md/dm-snap-persistent.c in the Linux kernel through 3.11.6 allows remote authenticated users to obtain sensitive information or modify data via a crafted mapping to a snapshot block device.


Juniper Junos 10.4 before 10.4S13 11.4 before 11.4R7-S1 12.1 before 12.1R5-S3 12.1X44 before 12.1X44-D20 and 12.1X45 before 12.1X45-D10 on the SRX1400 SRX3400 and SRX3600 does not properly initialize memory locations used during padding of Ethernet packets which allows remote attackers to obtain sensitive information by reading packet data aka PR 829536 a related issue to CVE-2003-0001.


The gpg_ctx_add_recipient function in camel/camel-gpg-context.c in GNOME Evolution 3.8.4 and earlier and Evolution Data Server 3.9.5 and earlier does not properly select the GPG key to use for email encryption which might cause the email to be encrypted with the wrong key and allow remote attackers to obtain sensitive information.


The bcm_char_ioctl function in drivers/staging/bcm/Bcmchar.c in the Linux kernel before 3.12 does not initialize a certain data structure which allows local users to obtain sensitive information from kernel memory via an IOCTL_BCM_GET_DEVICE_DRIVER_INFO ioctl call.


The Spaces OG submodule in the Spaces module 6.x-3.x before 6.x-3.7 for Drupal does not properly delete organic group group spaces content when using the option to move to a new group which causes the content to be \orphaned\ and allows remote authenticated users with the \access content\ permission to obtain sensitive information via vectors involving a rebuild access for the site or content.


Unspecified vulnerability in HP IceWall SSO 8.0 through 10.0 IceWall SSO Agent Option 8.0 through 10.0 IceWall SSO Smart Device Option 10.0 IceWall SSO SAML2 Agent Option 8.0 IceWall SSO JAVA Agent Library 8.0 through 10.0 IceWall Federation Agent 3.0 and IceWall File Manager 3.0 through SP4 allows remote authenticated users to obtain sensitive information via unknown vectors.


DDSN Interactive cm3 Acora CMS 6.0.6/1a 6.0.2/1a 5.5.7/12b 5.5.0/1b-p1 and possibly other versions allows remote attackers to obtain sensitive information via a .. (dot dot) in the \l\ parameter which reveals the installation path in an error message.


The Yahoo! Tumblr app before 3.4.1 for iOS sends cleartext credentials which allows remote attackers to obtain sensitive information by sniffing the network.


A certain Gentoo patch for the PAM S/Key module does not properly clear credentials from memory which allows local users to obtain sensitive information by reading system memory.


Puppet Enterprise before 3.0.1 includes version information for the Apache and Phusion Passenger products in its HTTP response headers which allows remote attackers to obtain sensitive information.


The automatic update request in Nagstamont before 0.9.10 uses a cleartext base64 format for transmission of a username and password which allows remote attackers to obtain sensitive information by sniffing the network.


DDSN Interactive cm3 Acora CMS 6.0.6/1a 6.0.2/1a 5.5.7/12b 5.5.0/1b-p1 and possibly other versions does not include the HTTPOnly flag in a Set-Cookie header for an unspecified cookie which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.


Light Display Manager (aka LightDM) 1.4.x before 1.4.3 1.6.x before 1.6.2 and 1.7.x before 1.7.14 uses 0664 permissions for the temporary .Xauthority file which allows local users to obtain sensitive information by reading the file.


The clear_volume function in LVMVolumeDriver driver in OpenStack Cinder 2013.1.1 through 2013.1.2 does not properly clear data when deleting a snapshot which allows local users to obtain sensitive information via unspecified vectors.


Jahia xCM before 6.6.2 does not include the HTTPOnly flag in a Set-Cookie header for the JSESSIONID cookie which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.


HP LaserJet M4555 M525 and M725; LaserJet flow MFP M525c; LaserJet Enterprise color flow MFP M575c; Color LaserJet CM4540 M575 and M775; and ScanJet Enterprise 8500fn1 FutureSmart devices do not properly encrypt PDF documents which allows remote attackers to obtain sensitive information via unspecified vectors.


The gadget renderer in Apache Shindig 2.5.0 for PHP allows remote attackers to obtain sensitive information via an XML document containing an external entity declaration in conjunction with an entity reference related to an XML External Entity (XXE) issue.


IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.2.x before 7.2.1.5 and 7.2.x before 7.2.2.0 on Unix use weak permissions (755) for unspecified configuration and log files which allows local users to obtain sensitive information by reading the files. IBM X-Force ID: 86176.


The Revisioning module 7.x-1.x before 7.x-1.6 for Drupal does not properly check node access permissions for content marked unpublished by the Scheduled module which allows remote authenticated users to obtain sensitive information via unspecified vectors.


The Quick Tabs module 6.x-2.x before 6.x-2.2 6.x-3.x before 6.x-3.2 and 7.x-3.x before 7.x-3.6 for Drupal does not properly check block permissions which allows remote attackers to obtain sensitive information by reading a Quick Tab.


HP Service Manager 9.30 through 9.32 does not properly manage privileges which allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors.


The

MSM

camera

driver

for

the

Linux

kernel

as

used

in

Qualcomm

Innovation

Center

(QuIC)

Android

contributions

for

MSM

devices

and

other

products

allows

attackers

to

obtain

sensitive

information

from

kernel

stack

memory

via

a

crafted

ioctl

call

related

to

or

a

crafted

ioctl

call

related

to


in

MediaWiki

before

before

and

before

allows

remote

attackers

to

obtain

sensitive

information

via

a

(open

angle

bracket)

character

in

the

lang

parameter

to

w/load.php

which

reveals

the

installation

path

in

an

error

message.


Unspecified vulnerability in HP IceWall SSO 8.0 through 10.0 IceWall SSO Agent Option 8.0 through 10.0 IceWall SSO Smart Device Option 10.0 and IceWall File Manager 3.0 through SP4 allows remote attackers to obtain sensitive information via unknown vectors.


phpMyAdmin 4.0.x before 4.0.4.2 allows remote attackers to obtain sensitive information via an invalid request which reveals the installation path in an error message related to Error.class.php and Error_Handler.class.php.


The object manager implementation (objectmanager.py) in Plone 2.1 through 4.1 4.2.x through 4.2.5 and 4.3.x through 4.3.1 does not properly restrict access to internal methods which allows remote attackers to obtain sensitive information via a crafted request.


Puppet Enterprise before 3.0.1 uses HTTP responses that contain sensitive information without the \no-cache\ setting which might allow local users to obtain sensitive information such as (1) host name (2) MAC address and (3) SSH keys via the web browser cache.


lighttpd before 1.4.34 when SNI is enabled configures weak SSL ciphers which makes it easier for remote attackers to hijack sessions by inserting packets into the client-server data stream or obtain sensitive information by sniffing the network.


The

function

in

in

the

OSAL

crypt

module

in

the

Intel

WiMAX

Network

Service

through

for

Intel

Wireless

WiMAX

Connection

devices

logs

a

cleartext

password

during

certain

attempts

to

set

a

password

which

allows

local

users

to

obtain

sensitive

information

by

reading

a

log

file.


The Authenticated User Page Caching (Authcache) module 7.x-1.x before 7.x-1.5 for Drupal does not properly restrict access to cached pages which allows remote attackers with the same role-combination as the superuser to obtain sensitive information via the cached pages of the superuser.


The Intelligent Platform Management Interface (IPMI) implementation in Integrated Management Module (IMM) on IBM BladeCenter Flex System System x iDataPlex and System x3### servers uses cleartext for password storage which allows context-dependent attackers to obtain sensitive information by reading a file.


DDSN Interactive cm3 Acora CMS 6.0.6/1a 6.0.2/1a 5.5.7/12b 5.5.0/1b-p1 and possibly other versions allows remote attackers to obtain sensitive information via a request to Admin/top.aspx.


The Secure Pages module 6.x-2.x before 6.x-2.0 for Drupal does not properly match URLs which causes HTTP to be used instead of HTTPS and makes it easier for remote attackers to obtain sensitive information via a crafted web page.


on

the

Canon

and

printers

shows

the

Wi-Fi

PSK

passphrase

in

cleartext

which

allows

physically

proximate

attackers

to

obtain

sensitive

information

by

reading

the

screen

of

an

unattended

workstation.


The IPv6 SCTP implementation in net/sctp/ipv6.c in the Linux kernel through 3.11.1 uses data structures and function calls that do not trigger an intended configuration of IPsec encryption which allows remote attackers to obtain sensitive information by sniffing the network.


The WYSIWYG component (wysiwyg.py) in Plone 2.1 through 4.1 4.2.x through 4.2.5 and 4.3.x through 4.3.1 allows remote attackers to obtain sensitive information via a crafted URL which reveals the installation path in an error message.


Automatic Bug Reporting Tool (ABRT) before 2.1.6 allows local users to obtain sensitive information about arbitrary files via vectors related to sha1sums.


The mp_get_count function in drivers/staging/sb105x/sb_pci_mp.c in the Linux kernel before 3.12 does not initialize a certain data structure which allows local users to obtain sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call.


The SecureSphere Operations Manager (SOM) Management Server in Imperva SecureSphere 9.0.0.5 allows context-dependent attackers to obtain sensitive information by leveraging the presence of (1) a session ID in the jsessionid field to secsphLogin.jsp or (2) credentials in the j_password parameter to j_acegi_security_check and reading (a) web-server access logs (b) web-server Referer logs or (c) the browser history.


Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1 when LDAP or HTTP is provided over SSL uses world-readable permissions for a private key which allows local users to obtain sensitive information by reading the key file as demonstrated by access to the local filesystem on an AD domain controller.


The LTI (aka IMS-LTI) mod_form implementation in Moodle through 2.1.10 2.2.x before 2.2.11 2.3.x before 2.3.8 2.4.x before 2.4.5 and 2.5.x before 2.5.1 does not properly support the sendname sendemailaddr and acceptgrades settings which allows remote attackers to obtain sensitive information in opportunistic circumstances by leveraging an environment in which there was an ineffective attempt to enable the more secure values.


The BOTCHA Spam Prevention module 7.x-1.x before 7.x-1.6 7.x-2.x before 7.x-2.1 and 7.x-3.x before 7.x-3.3 for Drupal when the debugging level is set to 5 or 6 logs the content of submitted forms which allows context-dependent users to obtain sensitive information such as usernames and passwords by reading the log file.


The

SecureSphere

Operations

Manager

(SOM)

Management

Server

in

Imperva

SecureSphere

allows

remote

attackers

to

obtain

sensitive

information

via

a

direct

request

to

which

reveals

the

installation

path

in

the

field

or

a

T/keyManagement

request

to

plain/settings.html

which

reveals

a

temporary

path

in

an

error

message.


The firewall module on the Huawei Quidway Service Process Unit (SPU) board S7700 S9300 and S9700 on Huawei Campus Switch devices allows remote authenticated users to obtain sensitive information from the high-priority security zone by leveraging access to the low-priority security zone.


The outs instruction emulation in Xen 3.1.x 4.2.x 4.3.x and earlier when using FS: or GS: segment override uses an uninitialized variable as a segment base which allows local 64-bit PV guests to obtain sensitive information (hypervisor stack content) via unspecified vectors related to stale data in a segment register.


zip.py in Plone 2.1 through 4.1 4.2.x through 4.2.5 and 4.3.x through 4.3.1 does not properly enforce access restrictions when including content in a zip archive which allows remote attackers to obtain sensitive information by reading a generated archive.


The CleanChanges extension for MediaWiki before 1.19.9 1.20.x before 1.20.8 and 1.21.x before 1.21.3 when \Group changes by page in recent changes and watchlist\ is enabled allows remote attackers to obtain sensitive information (revision-deleted IPs) via the Recent Changes page.


lib/filelib.php in Moodle through 2.2.11 2.3.x before 2.3.10 2.4.x before 2.4.7 and 2.5.x before 2.5.3 does not send \Cache-Control: private\ HTTP headers which allows remote attackers to obtain sensitive information by requesting a file that had been previously retrieved by a caching proxy server.


ServerAdmin/TestDRConnection.jsp in DS3 Authentication Server allows remote attackers to obtain sensitive information via a direct request which reveals the installation path in a -REG-E-OPEN error message.


IBM WebSphere Extended Deployment Compute Grid 8.0 before 8.0.0.3 allows remote authenticated users to obtain sensitive information and consequently bypass intended access restrictions on jobs via unspecified vectors.


The

InitMethodAndPassword

function

in

in

the

Intel

WiMAX

Network

Service

through

for

Intel

Wireless

WiMAX

Connection

devices

uses

the

same

RSA

private

key

in

on

all

systems

which

allows

local

users

to

obtain

sensitive

information

via

unspecified

decryption

operations.


The server in Red Hat JBoss Operations Network (JON) 3.1.2 logs passwords in plaintext which allows local users to obtain sensitive information by reading the log files.


Red Hat JBoss Operations Network 3.1.2 uses world-readable permissions for the (1) server and (2) agent configuration files which allows local users to obtain authentication credentials and other unspecified sensitive information by reading these files.


HP Service Manager 9.30 through 9.32 allows remote authenticated users to obtain sensitive information via unspecified vectors.


Symantec Backup Exec 2010 R3 before 2010 R3 SP3 and 2012 before SP2 uses weak permissions (Everyone: Read and Everyone: Change) for backup data files which allows local users to obtain sensitive information or modify the outcome of a restore via direct access to these files.


administration.jsp in Cisco SocialMiner allows remote attackers to obtain sensitive information by sniffing the network for HTTP client-server traffic aka Bug ID CSCuh76780.


The ldapsearch command-line program in OpenLDAP in Apple Mac OS X before 10.9 does not properly process the minssf configuration setting which allows remote attackers to obtain sensitive information by leveraging unintended weak encryption and sniffing the network.


The (1) REST and (2) memcache interfaces in the Hazelcast cluster API in Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 do not require authentication which allows remote attackers to obtain sensitive information or modify data via an API call.


The auto-configuration feature in Mail in Apple Mac OS X before 10.9 selects plaintext authentication for unspecified servers that support CRAM-MD5 authentication which allows remote attackers to obtain sensitive information by sniffing the network.


phpMyAdmin 3.5.x before 3.5.8.2 allows remote attackers to obtain sensitive information via an invalid request which reveals the installation path in an error message related to config.default.php and other files.


The syslog implementation in Apple Mac OS X before 10.9 allows local users to obtain sensitive information by leveraging access to the Guest account and reading console-log messages from previous Guest sessions.


The Push Notifications subsystem in Apple iOS before 7 provides the push-notification token to an app without user approval which allows attackers to obtain sensitive information via an app that employs a crafted push-notification registration process.


Juniper Junos Space before 13.1R1.6 as used on the JA1500 appliance and in other contexts does not properly restrict access to the list of user accounts and their MD5 password hashes which makes it easier for remote authenticated users to obtain sensitive information via a dictionary attack aka PR 879462.


The sctp_send_initiate_ack function in sys/netinet/sctp_output.c in the SCTP implementation in the kernel in FreeBSD 8.3 through 9.2-PRERELEASE does not properly initialize the state-cookie data structure which allows remote attackers to obtain sensitive information from kernel stack memory by reading packet data in INIT-ACK chunks.


Apple Remote Desktop before 3.7 does not properly use server authentication-type information during decisions about whether to present an unencrypted-connection warning message which allows remote attackers to obtain sensitive information in opportunistic circumstances by sniffing the network during an unintended cleartext VNC session.


The sendfile system-call implementation in sys/kern/uipc_syscalls.c in the kernel in FreeBSD 9.2-RC1 and 9.2-RC2 does not properly pad transmissions which allows local users to obtain sensitive information (kernel memory) via a length greater than the length of the file.


The history-clearing feature in Safari in Apple iOS before 7 does not clear the back/forward history of an open tab which allows physically proximate attackers to obtain sensitive information by leveraging an unattended workstation.


Unspecified vulnerability in the Webservice Axis Gateway in IBM Rational Focal Point 6.4 before devfix1 6.4.1.3 before devfix1 6.5.1 before devfix1 6.5.2 before devfix4 6.5.2.3 before devfix9 6.6 before devfix5 6.6.0.1 before devfix2 and 6.6.1 allows remote attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors a different vulnerability than CVE-2013-5397.


The Social subsystem in Apple iOS before 7 does not properly restrict access to the cache of Twitter icons which allows physically proximate attackers to obtain sensitive information about recent Twitter interaction via unspecified vectors.


An ActiveX control in NationalInstruments.Help2.dll in National Instruments NI .NET Class Library Help as used in Measurement Studio 2013 and earlier and other products allows remote attackers to obtain sensitive information about the existence of registry keys via crafted (1) key-open or (2) key-close method calls.


The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.


IBM Algo One as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0 ACSWeb in Algo Security Access Control Management 4.7.0 through 4.9.0 and ACSWeb in AlgoWebApps 5.0.0 does not encrypt login requests which allows remote attackers to obtain sensitive information by sniffing the network.


Power Management in Apple Mac OS X before 10.9 does not properly handle the interaction between locking and power assertions which allows physically proximate attackers to obtain sensitive information by reading a screen that should have transitioned into the locked state.


The Data Growth Solution for JD Edwards EnterpriseOne in IBM InfoSphere Optim 3.0 through 9.1 has hardcoded database credentials which allows remote authenticated users to obtain sensitive information by reading an unspecified field in an XML document.


The displaySystemError function in html/handle_error.php in LOCKON EC-CUBE 2.11.0 through 2.11.5 allows remote attackers to obtain sensitive information by leveraging incorrect handling of error-log output.


The gadget implementation in Cisco SocialMiner does not properly restrict the content of GET requests which allows remote attackers to obtain sensitive information by reading (1) web-server access logs (2) web-server Referer logs or (3) the browser history aka Bug ID CSCuh74125.


data/class/helper/SC_Helper_Address.php in the front-features implementation in LOCKON EC-CUBE 2.12.3 through 2.13.0 allows remote authenticated users to obtain sensitive information via unspecified vectors related to addresses.


Unspecified vulnerability in the Webservice Axis Gateway in IBM Rational Focal Point 6.4 before devfix1 6.4.1.3 before devfix1 6.5.1 before devfix1 6.5.2 before devfix4 6.5.2.3 before devfix9 6.6 before devfix5 6.6.0.1 before devfix2 and 6.6.1 allows remote attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors a different vulnerability than CVE-2013-5398.


The Thecus NAS server N8800 with firmware 5.03.01 uses cleartext credentials for administrative authentication which allows remote attackers to obtain sensitive information by sniffing the network.


The Screen Lock implementation in Apple Mac OS X before 10.9 does not immediately accept Keychain Status menu Lock Screen commands and instead incorrectly relies on a certain timeout setting which allows physically proximate attackers to obtain sensitive information by reading a screen that should have transitioned into the locked state.


The Node View Permissions module 7.x-1.x before 7.x-1.2 for Drupal does not properly implement the hook_query_alter function which might allow remote attackers to obtain sensitive information by reading a node listing.


IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 do not properly restrict use of FRAME elements which allows remote authenticated users to bypass intended access restrictions or obtain sensitive information via a crafted web site related to a \frame injection\ issue.


The Hazelcast cluster API in Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 allows remote attackers to obtain sensitive information about (1) runtime activity (2) network configuration (3) user sessions (4) the memcache interface and (5) the REST interface via API calls such as a hazelcast/rest/cluster/ call a different vulnerability than CVE-2013-5200.


in

LOCKON

EC-CUBE

through

allows

remote

attackers

to

obtain

sensitive

information

via

a

direct

request

which

reveals

the

full

path

in

an

error

message.


The IonMonkey JavaScript engine in Mozilla Firefox before 24.0 Thunderbird before 24.0 and SeaMonkey before 2.21 when Valgrind mode is used does not properly initialize memory which makes it easier for remote attackers to obtain sensitive information via unspecified vectors.


The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets with the same codebase path but from different domains which allows remote attackers to obtain sensitive information or possibly alter other applets via a crafted applet.


X.Org X server before 1.13.4 and 1.4.x before 1.14.1 does not properly restrict access to input events when adding a new hot-plug device which might allow physically proximate attackers to obtain sensitive information as demonstrated by reading passwords from a tty.


Open-Xchange Server before 6.20.7 rev14 6.22.0 before rev13 and 6.22.1 before rev14 uses weak permissions (group \other\ readable) under opt/open-xchange/etc/ which allows local users to obtain sensitive information via standard filesystem operations.


The nsAPI interface in Cisco Cloud Portal 9.1 SP1 and SP2 and 9.3 through 9.3.2 does not properly check privileges which allows remote authenticated users to obtain sensitive information via a crafted URL aka Bug ID CSCud81134.


Joomla! 3.0.x through 3.0.2 allows attackers to obtain sensitive information via unspecified vectors related to \Coding errors.\


Mozilla Firefox before 21.0 Firefox ESR 17.x before 17.0.6 Thunderbird before 17.0.6 and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions which allows remote attackers to obtain sensitive information from process memory via a crafted web site.


Microsoft Internet Explorer 8 and 9 when the Proxy Settings configuration has the same Proxy address and Port values in the HTTP and Secure rows does not properly reuse TCP sessions to the proxy server which allows remote attackers to obtain sensitive information intended for a specific host via a crafted HTML document that triggers many HTTPS requests and then triggers an HTTP request to that host as demonstrated by reading a Cookie header aka MSRC 12096gd.


lib/setuplib.php in Moodle through 2.1.10 2.2.x before 2.2.8 2.3.x before 2.3.5 and 2.4.x before 2.4.2 allows remote attackers to obtain sensitive information via an invalid request which reveals the absolute path in an exception message.


Almanah Diary 0.9.0 and 0.10.0 does not encrypt the database when closed which allows local users to obtain sensitive information by reading the database.


calendar/managesubscriptions.php in Moodle 2.4.x before 2.4.2 does not consider capability requirements before displaying calendar subscriptions which allows remote authenticated users to obtain potentially sensitive information by leveraging the student role.


Joomla! 3.0.x through 3.0.2 allows attackers to obtain sensitive information via unspecified vectors related to an \Undefined variable.\


The do_search function in ldap/servers/slapd/search.c in 389 Directory Server 1.2.x before 1.2.11.20 and 1.3.x before 1.3.0.5 does not properly restrict access to entries when the nsslapd-allow-anonymous-access configuration is set to rootdse and the BASE search scope is used which allows remote attackers to obtain sensitive information outside of the rootDSE via a crafted LDAP search.


Moodle 2.x through 2.1.10 2.2.x before 2.2.8 2.3.x before 2.3.5 and 2.4.x before 2.4.2 allows remote authenticated administrators to obtain sensitive information from the external repositories of arbitrary users by leveraging the login_as feature.


cronjobs/homedirs.php

deb-specific/fileforge.pl

and

utils/include.pl

in

FusionForge

and

allows

local

users

to

change

arbitrary

file

permissions

obtain

sensitive

information

and

have

other

unspecified

impacts

via

a

symlink

or

hard

link

attack

on

certain

files.


The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter as demonstrated by discovering password hashes in the password field of a response.


plugins/system/highlight/highlight.php in Joomla! 3.0.x through 3.0.2 and 2.5.x through 2.5.8 allows attackers to unserialize arbitrary PHP objects to obtain sensitive information delete arbitrary directories conduct SQL injection attacks and possibly have other impacts via the highlight parameter. Note: it was originally reported that this issue only allowed attackers to obtain sensitive information but later analysis demonstrated that other attacks exist.


The pe_mcollective module in Puppet Enterprise (PE) before 2.7.1 does not properly restrict access to a catalog of private SSL keys which allows remote authenticated users to obtain sensitive information and gain privileges by leveraging root access to a node related to the master role.


The KVM subsystem in the Linux kernel before 3.0 does not check whether kernel addresses are specified during allocation of memory slots for use in a guest's physical address space which allows local users to gain privileges or obtain sensitive information from kernel memory via a crafted application related to arch/x86/kvm/paging_tmpl.h and virt/kvm/kvm_main.c.


An

Authentication

Bypass

vulnerability

exists

in

when

streaming

live

video

in

D-Link

TESCO

TESCO

and

and

which

could

let

a

malicious

user

obtain

sensitive

information.


mdmclient in Mobile Device Management in Apple Mac OS X before 10.8.5 places a password on the command line which allows local users to obtain sensitive information by listing the process.


OpenStack devstack uses world-readable permissions for keystone.conf which allows local users to obtain sensitive information such as the LDAP password and admin_token secret by reading the file.


MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive information.


Xen 4.0 through 4.3.x when using AVX or LWP capable CPUs does not properly clear previous data from registers when using an XSAVE or XRSTOR to extend the state components of a saved or restored vCPU after touching other restored extended registers which allows local guest OSes to obtain sensitive information by reading the registers.


The management console (aka Java console) on the Symantec Security Information Manager (SSIM) appliance 4.7.x and 4.8.x before 4.8.1 allows remote attackers to obtain sensitive information via unspecified web-GUI API calls.


repository/webdav/lib.php in Moodle 2.x through 2.1.10 2.2.x before 2.2.8 2.3.x before 2.3.5 and 2.4.x before 2.4.2 includes the WebDAV password in the configuration form which allows remote authenticated administrators to obtain sensitive information by configuring an instance.


The web interface in the Manager component in Cisco Unified Computing System (UCS) 1.x and 2.x before 2.0(2m) allows remote attackers to obtain sensitive information by reading a (1) technical-support bundle file or (2) on-device configuration backup aka Bug ID CSCtq86543.


The do_video_set_spu_palette function in fs/compat_ioctl.c in the Linux kernel before 3.6.5 on unspecified architectures lacks a certain error check which might allow local users to obtain sensitive information from kernel stack memory via a crafted VIDEO_SET_SPU_PALETTE ioctl call on a /dev/dvb device.


PHP-Fusion before 7.02.06 stores backup files with predictable filenames in an unrestricted directory under the web document root which might allow remote attackers to obtain sensitive information via a direct request to the backup file in administration/db_backups/.


The ArtIME Japanese Input application 1.1.2 and earlier for Android uses weak permissions for unspecified files which allows attackers to obtain sensitive information via an application that accesses the local filesystem.


IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to obtain sensitive information about application implementation via unspecified vectors a different vulnerability than CVE-2013-0463 CVE-2013-2985 CVE-2013-2987 CVE-2013-3020 CVE-2013-0568 and CVE-2013-0567.


store/swift.py in OpenStack Glance Essex (2012.1) Folsom (2012.2) before 2012.2.3 and Grizzly when in Swift single tenant mode logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable allows remote authenticated users to obtain sensitive information by reading the error messages.


IBM Sterling Secure Proxy 3.2.0 and 3.3.01 before 3.3.01.23 Interim Fix 1 3.4.0 before 3.4.0.6 Interim Fix 1 and 3.4.1 before 3.4.1.7 provides web-server version data in (1) an unspecified page title and (2) an unspecified HTTP header field which allows remote attackers to obtain potentially sensitive information by reading a version string.


The Chrome Object Wrapper (COW) and System Only Wrapper (SOW) implementations in Mozilla Firefox before 19.0 Firefox ESR 17.x before 17.0.3 Thunderbird before 17.0.3 Thunderbird ESR 17.x before 17.0.3 and SeaMonkey before 2.16 do not prevent modifications to a prototype which allows remote attackers to obtain sensitive information from chrome objects or possibly execute arbitrary JavaScript code with chrome privileges via a crafted web site.


The COBIME application before 0.9.4 for Android uses weak permissions for unspecified files which allows attackers to obtain sensitive information via an application that accesses the local filesystem.


IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to obtain sensitive information about application implementation via unspecified vectors a different vulnerability than CVE-2013-0463 CVE-2013-2985 CVE-2013-2987 CVE-2013-3020 CVE-2013-0568 and CVE-2013-0475.


The Connect client in IBM Sametime 8.5.1 8.5.1.1 8.5.1.2 8.5.2 and 8.5.2.1 as used in the Lotus Notes client and separately might allow local users to obtain sensitive information by leveraging the persistence of cleartext password strings within process memory.


The SSL implementation in IBM Security AppScan Enterprise before 8.7.0.1 enables cipher suites with weak encryption algorithms which makes it easier for remote attackers to obtain sensitive information by sniffing the network.


wp-php-widget.php in the WP PHP widget plugin 1.0.2 for WordPress allows remote attackers to obtain sensitive information via a direct request which reveals the full path in an error message.


packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS authenticators and hash passwords which makes it easier for remote attackers to obtain sensitive information via a brute force attack.


An unspecified third-party component in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 uses short session ID values which makes it easier for remote attackers to hijack sessions and consequently obtain sensitive information via a brute-force attack.


The Simeji application 4.8.1 and earlier for Android uses weak permissions for unspecified files which allows attackers to obtain sensitive information via an application that accesses the local filesystem.


Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X before 10.3.183.61 and 11.x before 11.2.202.270 on Linux before 11.1.111.43 on Android 2.x and 3.x and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allow attackers to obtain sensitive information via unspecified vectors.


Ruby agent 3.2.0 through 3.5.2 serializes sensitive data when communicating with servers operated by New Relic which allows remote attackers to obtain sensitive information (database credentials and SQL statements) by sniffing the network and deserializing the data.


The Contact Customer Support feature in the TigerText Free Private Texting app before 3.1.402 for iOS sends a log-file e-mail message with unencrypted credentials which allows remote attackers to obtain sensitive information by sniffing the network or leveraging access to an e-mail endpoint.


EMC RSA Authentication API before 8.1 SP1 RSA Web Agent before 5.3.5 for Apache Web Server RSA Web Agent before 5.3.5 for IIS RSA PAM Agent before 7.0 and RSA Agent before 6.1.4 for Microsoft Windows use an improper encryption algorithm and a weak key for maintaining the stored data of the node secret for the SecurID Authentication API which allows local users to obtain sensitive information via cryptographic attacks on this data.


** DISPUTED ** Apache Tomcat 7.x uses world-readable permissions for the log directory and its files which might allow local users to obtain sensitive information by reading a file. NOTE: One Tomcat distributor has stated \The tomcat log directory does not contain any sensitive information.\


IBM iNotes before 8.5.3 Fix Pack 6 and 9.x before 9.0.1 allows remote attackers to bypass the remote image filtering mechanism and obtain sensitive information via a crafted e-mail message. IBM X-Force ID: 83371.


thttpd.c in sthttpd before 2.26.4-r2 and thttpd 2.25b use world-readable permissions for /var/log/thttpd.log which allows local users to obtain sensitive information by reading the file.


Siemens WinCC before 7.2 as used in SIMATIC PCS7 before 8.0 SP1 and other products does not properly assign privileges for the database containing WebNavigator credentials which allows remote authenticated users to obtain sensitive information via a SQL query.


Microsoft OneNote 2010 SP1 does not properly determine buffer sizes during memory allocation which allows remote attackers to obtain sensitive information via a crafted OneNote file aka \Buffer Size Validation Vulnerability.\


IBM Eclipse Help System (IEHS) as used in IBM Rational Directory Server 5.1.1 through 5.1.1.2 and 5.2 through 5.2.1 and other products allows remote attackers to obtain sensitive information by providing a crafted parameter path and then reading the debug information associated with the 500 HTTP status code.


The Fibre Channel over Ethernet (FCoE) feature in IBM System Networking and Blade Network Technology (BNT) switches running IBM Networking Operating System (aka NOS formerly BLADE Operating System) floods data frames with unknown MAC addresses out on all interfaces on the same VLAN which might allow remote attackers to obtain sensitive information in opportunistic circumstances by eavesdropping on the broadcast domain. IBM X-Force ID: 83166.


IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to obtain sensitive information about application implementation via unspecified vectors a different vulnerability than CVE-2013-0463 CVE-2013-2985 CVE-2013-2987 CVE-2013-3020 CVE-2013-0475 and CVE-2013-0567.


IBM WebSphere Commerce Enterprise 5.6.x through 5.6.1.5 6.0.x through 6.0.0.11 and 7.0.x through 7.0.0.7 does not use a suitable encryption algorithm for storefront web requests which allows remote attackers to obtain sensitive information via a padding oracle attack that targets certain UTF-8 processing of the krypto parameter and leverages unspecified browser access or traffic-log access.


EMC Documentum Webtop before 6.7 SP2 Documentum WDK before 6.7 SP2 Documentum Taskspace before 6.7 SP2 and Documentum Records Manager before 6.7 SP2 allow remote attackers to obtain sensitive information via vectors involving cross-origin frame navigation related to a \Cross Frame Scripting\ issue.


The login component in SOAP Gateway in IBM IMS Enterprise Suite 1.1 2.1 and 2.2 uses cleartext credentials which allows remote attackers to obtain sensitive information by sniffing the network.


Adobe ColdFusion 9.0 9.0.1 and 9.0.2 allows attackers to obtain sensitive information via unspecified vectors as exploited in the wild in January 2013.


The kernel in ENEA OSE on the Emerson Process Management ROC800 RTU with software 3.50 and earlier DL8000 RTU with software 2.30 and earlier and ROC800L RTU with software 1.20 and earlier performs network-beacon broadcasts which allows remote attackers to obtain potentially sensitive information about device presence by listening for broadcast traffic.


Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 6 through Update 38 5.0 through Update 38 and 1.4.2_40 and earlier and OpenJDK 6 and 7 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect validation of Diffie-Hellman keys which allows remote attackers to conduct a \small subgroup attack\ to force the use of weak session keys or obtain sensitive information about the private key.


The Linux kernel through 3.7.9 allows local users to obtain sensitive information about keystroke timing by using the inotify API on the /dev/ptmx device.


varnish 3.0.3 uses world-readable permissions for the /var/log/varnish/ directory and the log files in the directory which allows local users to obtain sensitive information by reading the files. NOTE: some of these details are obtained from third party information.


Unspecified vulnerability in ownCloud Server before 4.0.12 allows remote attackers to obtain sensitive information via unspecified vectors related to \inclusion of the Amazon SDK testing suite.\ NOTE: due to lack of details it is not clear whether the issue exists in ownCloud itself or in Amazon SDK.


The hidp_setup_hid function in net/bluetooth/hidp/core.c in the Linux kernel before 3.7.6 does not properly copy a certain name field which allows local users to obtain sensitive information from kernel memory by setting a long name and making an HIDPCONNADD ioctl call.


Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 6 through Update 38 5.0 through Update 38 and 1.4.2_40 and earlier and OpenJDK 6 and 7 allows remote attackers to affect confidentiality via vectors related to JAXP. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to the public declaration of the loadPropertyFile method in the JAXP FuncSystemProperty class which allows remote attackers to obtain sensitive information.


IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to obtain sensitive information about application implementation via unspecified vectors a different vulnerability than CVE-2013-2985 CVE-2013-2987 CVE-2013-3020 CVE-2013-0568 CVE-2013-0475 and CVE-2013-0567.


vzkernel before 042stab080.2 in the OpenVZ modification for the Linux kernel 2.6.32 does not initialize certain length variables which allows local users to obtain sensitive information from kernel stack memory via (1) a crafted ploop driver ioctl call related to the ploop_getdevice_ioc function in drivers/block/ploop/dev.c or (2) a crafted quotactl system call related to the compat_quotactl function in fs/quota/quota.c.


The mmc_ioctl_cdrom_read_data function in drivers/cdrom/cdrom.c in the Linux kernel through 3.10 allows local users to obtain sensitive information from kernel memory via a read operation on a malfunctioning CD-ROM drive.


net/dcb/dcbnl.c in the Linux kernel before 3.8.4 does not initialize certain structures which allows local users to obtain sensitive information from kernel stack memory via a crafted application.


The default configuration of Red Hat JBoss Portal before 6.1.0 enables the JGroups diagnostics service with no authentication when a JGroups channel is started which allows remote attackers to obtain sensitive information (diagnostics) by accessing the service.


status.cgi in Nagios 4.0 before 4.0 beta4 and 3.x before 3.5.1 does not properly restrict access to certain users that are a contact for a service which allows remote authenticated users to obtain sensitive information about hostnames via the servicegroup (1) overview (2) summary or (3) grid style in status.cgi. NOTE: this behavior is by design in most 3.x versions but the upstream vendor \decided to change it for Nagios 4\ and 3.5.1.


drivers/hid/hid-sensor-hub.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11 when CONFIG_HID_SENSOR_HUB is enabled allows physically proximate attackers to obtain sensitive information from kernel memory via a crafted device.


Cisco Linksys E4200 1.0.05 Build 7 devices contain a Clickjacking Vulnerability which allows remote attackers to obtain sensitive information.


Xen 4.0.x 4.1.x and 4.2.x when running on AMD64 processors only save/restore the FOP FIP and FDP x87 registers in FXSAVE/FXRSTOR when an exception is pending which allows one domain to determine portions of the state of floating point instructions of other domains which can be leveraged to obtain sensitive information such as cryptographic keys a similar vulnerability to CVE-2006-1056. NOTE: this is the documented behavior of AMD64 processors but it is inconsistent with Intel processors in a security-relevant fashion that was not addressed by the kernels.


The Buffer::Set function in core/cross/buffer.cc in the O3D plug-in in Google Chrome OS before 26.0.1410.57 does not prevent uninitialized data from remaining in a buffer which might allow remote attackers to obtain sensitive information via unspecified vectors.


Telean before 1.3.1 contains a full path disclosure vulnerability which could allow remote attackers to obtain sensitive information through a specially crafted URL request.


The SharedMemory::Create function in memory/shared_memory_posix.cc in Google Chrome before 29.0.1547.57 uses weak permissions under /dev/shm/ which allows attackers to obtain sensitive information via direct access to a POSIX shared-memory file.


The do_tkill function in kernel/signal.c in the Linux kernel before 3.8.9 does not initialize a certain data structure which allows local users to obtain sensitive information from kernel memory via a crafted application that makes a (1) tkill or (2) tgkill system call.


The crypto_report_one function in crypto/crypto_user.c in the report API in the crypto user configuration API in the Linux kernel through 3.8.2 uses an incorrect length value during a copy operation which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability.


The Linux kernel before 3.12.2 does not properly use the get_dumpable function which allows local users to bypass intended ptrace restrictions or obtain sensitive information from IA64 scratch registers via a crafted application related to kernel/ptrace.c and arch/ia64/include/asm/processor.h.


The Red Hat Directory Server before 8.2.11-13 and 389 Directory Server do not properly restrict access to entity attributes which allows remote authenticated users to obtain sensitive information via a search query for the attribute.


Moodle through 2.1.10 2.2.x before 2.2.10 2.3.x before 2.3.7 and 2.4.x before 2.4.4 does not enforce capability requirements for reading blog comments which allows remote attackers to obtain sensitive information via a crafted request.


HP Database and Middleware Automation (DMA) 10.x before 10.10 when SSL is used allows remote attackers to obtain sensitive information via unspecified vectors.


OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:is_public property which allows remote authenticated users to obtain sensitive information (flavor properties) boot arbitrary flavors and possibly have other unspecified impacts by guessing the flavor id.


importbuddy.php in the BackupBuddy plugin 1.3.4 2.1.4 2.2.25 2.2.28 and 2.2.4 for WordPress does not require that authentication be enabled which allows remote attackers to obtain sensitive information or overwrite or delete files via vectors involving a (1) direct request (2) step=1 request (3) step=2 or step=3 request or (4) step=7 request.


The configuration loader in ownCloud 5.0.x before 5.0.6 allows remote attackers to obtain CSRF tokens and other sensitive information by reading an unspecified JavaScript file.


The (1) key_notify_sa_flush and (2) key_notify_policy_flush functions in net/key/af_key.c in the Linux kernel before 3.10 do not initialize certain structure members which allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notify interface of an IPSec key_socket.


bitcoind and Bitcoin-Qt before 0.4.9rc1 0.5.x before 0.5.8rc1 0.6.0 before 0.6.0.11rc1 0.6.1 through 0.6.5 before 0.6.5rc1 and 0.7.x before 0.7.3rc1 make it easier for remote attackers to obtain potentially sensitive information about returned change by leveraging certain predictability in the outputs of a Bitcoin transaction.


TinyWebGallery (TWG) 1.8.9 and earlier contains a full path disclosure vulnerability which allows remote attackers to obtain sensitive information through the parameters \twg_browserx\ and \twg_browsery\ in the page image.php.


An Access vulnerability exists in FOSCAM IP Camera FI8620 due to insufficient access restrictions in the /tmpfs/ and /log/ directories which could let a malicious user obtain sensitive information.


A JavaScript API in Adobe Reader and Acrobat 9.x before 9.5.5 10.x before 10.1.7 and 11.x before 11.0.03 allows attackers to obtain sensitive information via unspecified vectors.


mod/feedback/lib.php in Moodle through 2.1.10 2.2.x before 2.2.11 2.3.x before 2.3.8 2.4.x before 2.4.5 and 2.5.x before 2.5.1 does not consider the mod/feedback:view capability before displaying recent feedback which allows remote authenticated users to obtain sensitive information via a request for all course feedback that has occurred since a specified time.


HP SQL/MX 3.2 and earlier on NonStop servers when SQL/MP Objects are used allows remote authenticated users to obtain sensitive information via unspecified vectors aka the \SQL/MP index\ issue.


The rtnl_fill_ifinfo function in net/core/rtnetlink.c in the Linux kernel before 3.8.4 does not initialize a certain structure member which allows local users to obtain sensitive information from kernel stack memory via a crafted application.


The fill_event_metadata function in fs/notify/fanotify/fanotify_user.c in the Linux kernel through 3.9.4 does not initialize a certain structure member which allows local users to obtain sensitive information from kernel memory via a read operation on the fanotify descriptor.


The Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47 7.0 before 7.0.0.29 8.0 before 8.0.0.7 and 8.5 before 8.5.5.0 does not properly perform caching which allows local users to obtain sensitive information via unspecified vectors.


The Web API in the Statistics Server in TIBCO Spotfire Statistics Services 3.3.x before 3.3.1 4.5.x before 4.5.1 and 5.0.x before 5.0.1 allows remote attackers to obtain sensitive information via an unspecified HTTP request.


IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to obtain sensitive information about application implementation via unspecified vectors a different vulnerability than CVE-2013-0463 CVE-2013-2985 CVE-2013-3020 CVE-2013-0568 CVE-2013-0475 and CVE-2013-0567.


IBM WebSphere Portal 7.0.0.x and 8.0.0.x write passwords to a trace file when tracing is enabled for the Selfcare Portlet (Profile Management) which allows local users to obtain sensitive information by reading the file. IBM X-Force ID: 83621.


The user-password-update command in python-keystoneclient before 0.2.4 accepts the new password in the --password argument which allows local users to obtain sensitive information by listing the process.


The Flash plug-in in Google Chrome before 27.0.1453.116 as used on Google Chrome OS before 27.0.1453.116 and separately does not properly determine whether a user wishes to permit camera or microphone access by a Flash application which allows remote attackers to obtain sensitive information from a machine's physical environment via a clickjacking attack as demonstrated by an attack using a crafted Cascading Style Sheets (CSS) opacity property.


The core_grade component in Moodle through 2.2.10 2.3.x before 2.3.7 and 2.4.x before 2.4.4 does not properly consider the existence of hidden grades which allows remote authenticated users to obtain sensitive information by leveraging the student role and reading the Gradebook Overview report.


Mambo CMS 4.6.5 stores the MySQL database password in cleartext in the document root which allows local users to obtain sensitive information via unspecified vectors.


The OMRON OpenWnn application before 1.3.6 for Android uses weak permissions for unspecified files which allows attackers to obtain sensitive information via an application that accesses the local filesystem.


in

LOCKON

EC-CUBE

through

does

not

properly

validate

the

input

to

the

password

reminder

function

which

allows

remote

attackers

to

obtain

sensitive

information

via

a

crafted

request.


The crypto_report_one function in crypto/crypto_user.c in the report API in the crypto user configuration API in the Linux kernel through 3.8.2 does not initialize certain structure members which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability.


The openvpn_decrypt function in crypto.c in OpenVPN 2.3.0 and earlier when running in UDP mode allows remote attackers to obtain sensitive information via a timing attack involving an HMAC comparison function that does not run in constant time and a padding oracle attack on the CBC mode cipher.


Piwik before 1.11 accepts input from a POST request instead of a GET request in unspecified circumstances which might allow attackers to obtain sensitive information by leveraging the logging of parameters.


browser/extensions/api/tabs/tabs_api.cc in Google Chrome before 28.0.1500.71 does not properly enforce restrictions on the capture of screenshots by extensions which allows remote attackers to obtain sensitive information about the content of a previous page via vectors involving an interstitial page.