FreedomBox through 20.13 allows remote attackers to obtain sensitive information from the /server-status page of the Apache HTTP Server because a connection from the Tor onion service (or from PageKite) is considered a local connection. This affects both the freedombox and plinth packages of some Linux distributions but only if the Apache mod_status module is enabled.


An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory aka CID-f232326f6966. This affects pointer types that do not define a ptr_limit.


An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error (with a resultant integer underflow) affecting out-of-bounds speculation on pointer arithmetic leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory aka CID-10d2bb2e6b1d.


Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.


An issue was discovered on Samsung mobile devices with Q(10.0) and R(11.0) (Exynos chipsets) software. They allow attackers to obtain sensitive information by reading a log. The Samsung ID is SVE-2020-18596 (October 2020).


info.php in Logaritmo Aware CallManager 2012 allows remote attackers to obtain sensitive information via a direct request which calls the phpinfo function.


An issue was discovered on Samsung mobile devices with Q(10.0) software. Auto Hotspot allows attackers to obtain sensitive information. The Samsung ID is SVE-2020-17288 (October 2020).


In

Legion

of

the

Bouncy

Castle

BC

before

and

BC-FJA

before

attackers

can

obtain

sensitive

information

about

a

private

exponent

because

of

Observable

Differences

in

Behavior

to

Error

Inputs.

This

occurs

in

org.bouncycastle.crypto.encodings.OAEPEncoding.

Sending

invalid

ciphertext

that

decrypts

to

a

short

payload

in

the

OAEP

Decoder

could

result

in

the

throwing

of

an

early

exception

potentially

leaking

some

information

about

the

private

exponent

of

the

RSA

private

key

performing

the

encryption.


Inappropriate implementation in developer tools in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had convinced the user to take certain actions in developer tools to obtain potentially sensitive information from disk via a crafted HTML page.


Inappropriate implementation in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information via a crafted Chrome Extension.


A cleartext storage of sensitive information vulnerability in FortiOS command line interface in versions 6.2.4 and earlier and FortiProxy 2.0.0 1.2.9 and earlier may allow an authenticated attacker to obtain sensitive information such as users passwords by connecting to FortiGate CLI and executing the \diag sys ha checksum show\ command.


Inappropriate implementation in accessibility in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.


ZTE SDN controller platform is impacted by an information leakage vulnerability. Due to the program's failure to optimize the response of failure to the request the caller can directly view the internal error code location of the component. Attackers could exploit this vulnerability to obtain sensitive information. This affects: OSCP versions V16.19.10 and V16.19.20.


Information leakage in WebRTC in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to obtain potentially sensitive information via a crafted WebRTC interaction.


Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory or disk via a crafted Chrome Extension.


This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4 (47270). An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the prl_hypervisor kext. By examining a log file an attacker can disclose a memory address. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute code in the context of the kernel. Was ZDI-CAN-11063.


This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the OEMNet component. The issue results from the lack of proper validation of user-supplied data which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute code in the context of the hypervisor. Was ZDI-CAN-11132.


Uninitialized Use in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.


Insufficient policy enforcement in developer tools in Google Chrome prior to 87.0.4280.66 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from the user's disk via a crafted Chrome Extension.


The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG aka CID-f227e3ec3b5c. This is related to drivers/char/random.c and kernel/time/timer.c.


SolarWinds N-central before 12.1 SP1 HF5 and 12.2 before SP1 HF2 allows remote attackers to retrieve cleartext domain admin credentials from the Agent & Probe settings and obtain other sensitive information. The attacker can use a customer ID to self register and read any aspects of the agent/appliance configuration.


Evoko Home devices 1.31 through 1.37 allow remote attackers to obtain sensitive information (such as usernames and password hashes) via a WebSocket request as demonstrated by the sockjs/224/uf1psgff/websocket URI at a wss:// URL.


In Kibana versions before 6.8.11 and 7.8.1 the region map visualization in contains a stored XSS flaw. An attacker who is able to edit or create a region map visualization could obtain sensitive information or perform destructive actions on behalf of Kibana users who view the region map visualization.


Kibana versions before 6.8.9 and 7.7.0 contains a stored XSS flaw in the TSVB visualization. An attacker who is able to edit or create a TSVB visualization could allow the attacker to obtain sensitive information from or perform destructive actions on behalf of Kibana users who edit the TSVB visualization.


AX3600 router sensitive information leaked.There is an unauthorized interface through luci to obtain sensitive information and log in to the web background.


SHARP AQUOS series (AQUOS SH-M02 build number 01.00.05 and earlier AQUOS SH-RM02 build number 01.00.04 and earlier AQUOS mini SH-M03 build number 01.00.04 and earlier AQUOS Keitai SH-N01 build number 01.00.01 and earlier AQUOS L2 (UQ mobile/J:COM) build number 01.00.05 and earlier AQUOS sense lite SH-M05 build number 03.00.04 and earlier AQUOS sense (UQ mobile) build number 03.00.03 and earlier AQUOS compact SH-M06 build number 02.00.02 and earlier AQUOS sense plus SH-M07 build number 02.00.02 and earlier AQUOS sense2 SH-M08 build number 02.00.05 and earlier and AQUOS sense2 (UQ mobile) build number 02.00.06 and earlier) allow an attacker to obtain the sensitive information of the device via malicious applications installed on the device.


Dell EMC VxRail versions 4.7.410 and 4.7.411 contain an improper authentication vulnerability. A remote unauthenticated attacker may exploit this vulnerability to obtain sensitive information in an encrypted form.


apt-cacher-ng

through

allows

local

users

to

obtain

sensitive

information

by

hijacking

the

hardcoded

TCP

port.

The

program

attempts

to

connect

to

apt-cacher-ng

via

TCP

on

localhost

port

even

if

the

explicit

SocketPath=/var/run/apt-cacher-ng/socket

command-line

option

is

passed.

The

cron

job

(which

is

active

by

default)

attempts

this

periodically.

Because

is

an

unprivileged

port

any

local

user

can

try

to

bind

to

this

port

and

will

receive

requests

from

acngtool.

There

can

be

sensitive

data

in

these

requests

e.g.

if

AdminAuth

is

enabled

in

This

sensitive

data

can

leak

to

unprivileged

local

users

that

manage

to

bind

to

this

port

before

the

apt-cacher-ng

daemon

can.


IBM WebSphere Application Server 7.0 8.0 8.5 9.0 and Liberty 17.0.0.3 through 20.0.0.4 could allow a remote authenticated attacker to obtain sensitive information caused by improper parameter checking. This could be exploited to conduct spoofing attacks. IBM X-Force ID: 177841.


IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.


IBM MQ Appliance (IBM DataPower Gateway 10.0.0.0 and 2018.4.1.0 through 2018.4.1.12) could allow a local user under special conditions to obtain highly sensitive information from log files. IBM X-Force ID: 182658.


IBM API Connect V10 and V2018 could allow an attacker who has intercepted a registration invitation link to impersonate the registered user or obtain sensitive information. IBM X-Force ID: 191105.


IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information caused by the failure to set the secure flag for the session cookie in SSL mode. By intercepting its transmission within an HTTP session an attacker could exploit this vulnerability to capture the cookie and obtain sensitive information. IBM X-Force ID: 175360.


IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 178761.


IBM Security Information Queue (ISIQ) 1.0.0 1.0.1 1.0.2 1.0.3 1.0.4 and 1.0.5 could allow a remote attacker to obtain sensitive information caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM X-Force ID: 176332.


IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 and 6.0.0.0 through 6.0.3.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.


IBM Security Key Lifecycle Manager 3.0.1 and 4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 190290.


IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.


IBM Security Guardium Insights 2.0.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 174402.


IBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 179988.


IBM Planning Analytics Local 2.0 could allow an attacker to obtain sensitive information due to accepting body parameters in a query. IBM X-Force ID: 192642.


IBM MQ 9.1.4 could allow a local attacker to obtain sensitive information by inclusion of sensitive data within runmqras data. IBM X-Force ID: 177937.


IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 184179.


IBM API Connect's V2018.4.1.0 through 2018.4.1.10 management server has an unsecured api which can be exploited by an unauthenticated attacker to obtain sensitive information. IBM X-Force ID: 178322.


IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to obtain sensitive information caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 189214.


IBM MQ IBM MQ Appliance and IBM MQ for HPE NonStop 8.0 9.1 LTS and 9.1 CD could allow under special circumstances an authenticated user to obtain sensitive information due to a data leak from an error message within the pre-v7 pubsub logic. IBM X-Force ID: 177402.


IBM Business Automation Workflow 18.0 19.0 and 20.0 and IBM Business Process Manager 8.0 8.5 and 8.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 182715.


IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 175484.


IBM Emptoris Contract Management and IBM Emptoris Spend Analysis 10.1.0 10.1.1 and 10.1.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 190988.


IBM Engineering Workflow Management 7.0 7.0.1 and 7.0.2 and IBM Rational Team Concert 6.0.6 and 6.0.0.1 could allow an authenticated user to obtain sensitive information about build definitions. IBM X-Force ID: 192707.


IBM Security Secret Server 10.6 could allow a remote attacker to obtain sensitive information caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 190045.


IBM Sterling File Gateway 2.2.0.0 through 2.2.6.5 and 6.0.0.0 through 6.0.3.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 181778.


IBM Jazz Foundation Products could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 181862.


IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information caused by the lack of server hostname verification for SSL/TLS communication. By sending a specially-crafted request an attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 190851.


IBM Security Guardium Insights 2.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 184824.


IBM WebSphere Application Server 7.0 8.0 8.5 and 9.0 could allow a local user with specialized access to obtain sensitive information from a detailed technical error message. This information could be used in further attacks against the system. IBM X-Force ID: 185370.


IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information caused by the failure to set the Secure flag for the session cookie in TLS mode. By intercepting its transmission within an HTTP session an attacker could exploit this vulnerability to capture the cookie and obtain sensitive information. IBM X-Force ID: 182631.


IBM Planning Analytics 2.0 could allow a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web site a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.


IBM Security Guardium Insights 2.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 184832.


IBM UrbanCode Deploy (UCD) 6.2.7.3 6.2.7.4 7.0.3.0 and 7.0.4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 181857.


IBM Cloud Pak for Security (CP4S) 1.4.0.0 could allow a remote attacker to obtain sensitive information caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 189703.


IBM Security Guardium Insights 2.0.1 could allow a remote attacker to obtain sensitive information caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 174684.


An XPath vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10 caused by the improper handling of user-supplied input. By sending a specially-crafted input a remote attacker could exploit this vulnerability to obtain unauthorized access or reveal sensitive information such as XML document structure and content. IBM X-Force ID: 189152.


IBM Spectrum Scale 1.1.1.0 through 1.1.8.4 Transparent Cloud Tiering could allow a remote attacker to obtain sensitive information caused by the leftover files after configuration. IBM X-Force ID: 190298.


IBM Business Automation Workflow and IBM Business Process Manager (IBM Business Process Manager Express 8.5.5 8.5.6 8.5.7 and 8.6) could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 182716.


IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 could allow an remote attacker to obtain sensitive information caused by a man in the middle attack. By SSL striping an attacker could exploit this vulnerability to obtain sensitive information.


IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.10.and 7.1.0.000 through 7.1.11 could allow a remote attacker to obtain sensitive information caused by improper authentication of a websocket endpoint. By using known tools to subscribe to the websocket event stream an attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 188993.


IBM PowerHA 7.2 could allow a local attacker to obtain sensitive information from temporary directories after a discovery failure occurs. IBM X-Force ID: 189969.


IBM QRadar Network Security 5.4.0 and 5.5.0 could allow a remote attacker to obtain sensitive information caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 174340.


IBM Security Secret Server 10.6 could allow a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially crafted Web site a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 190044.


IBM Jazz Foundation and IBM Engineering products could allow an authenticated user to obtain sensitive information due to lack of security restrictions. IBM X-Force ID: 188126.


IBM Engineering Requirements Quality Assistant On-Premises could allow an authenticated user to obtain sensitive information due to improper input validation. IBM X-Force ID: 186282.


IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2 6.0.0.0 through 6.0.3.2 and 6.1.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 188895.


IBM Security Guardium Insights 2.0.1 could allow a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially crafted Web site a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 184823.


IBM i2 iBase 8.9.13 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 184574.


IBM Cloud Pak for Security (CP4S) 1.3.0.1 and 1.4.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 185369.


IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote attacker to conduct phishing attacks using a tabnabbing attack. By persuading a victim to visit a specially-crafted Web site a remote attacker could exploit this vulnerability to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 179537.


IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 175412.


IBM Jazz Foundation Products could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 183189.


Inappropriate implementation in cache in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.


Uninitialized data in PDFium in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted PDF file.


A exposure of sensitive information to an unauthorized actor in Fortinet FortiMail versions 6.0.9 and below FortiMail versions 6.2.4 and below FortiMail versions 6.4.1 and 6.4.0 allows attacker to obtain potentially sensitive software-version information via client-side resources inspection.


The October CMS debugbar plugin before version 3.1.0 contains a feature where it will log all requests (and all information pertaining to each request including session data) whenever it is enabled. This presents a problem if the plugin is ever enabled on a system that is open to untrusted users as the potential exists for them to use this feature to view all requests being made to the application and obtain sensitive information from those requests. There even exists the potential for account takeovers of authenticated users by non-authenticated public users which would then lead to a number of other potential issues as an attacker could theoretically get full access to the system if the required conditions existed. Issue has been patched in v3.1.0 by locking down access to the debugbar to all users; it now requires an authenticated backend user with a specifically enabled permission before it is even usable and the feature that allows access to stored request information is restricted behind a different permission that's more restrictive.


Ivanti Workspace Control before 10.4.30.0 when SCCM integration is enabled allows local users to obtain sensitive information (keying material).


In Foxit Reader and PhantomPDF before 10.0.1 and PhantomPDF before 9.7.3 attackers can obtain sensitive information about an uninitialized object because of direct transformation from PDF Object to Stream without concern for a crafted XObject.


An issue was discovered in xenoprof in Xen through 4.13.x allowing guest OS users (without active profiling) to obtain sensitive information about other guests. Unprivileged guests can request to map xenoprof buffers even if profiling has not been enabled for those guests. These buffers were not scrubbed.


An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. It allows remote attackers to obtain sensitive information via info.php4.


Archer before 6.8 P2 (6.8.0.2) is affected by a path exposure vulnerability. A remote authenticated malicious attacker with access to service files may obtain sensitive information to use it in further attacks.


Xen through 4.14.x allows guest OS administrators to obtain sensitive information (such as AES keys from outside the guest) via a side-channel attack on a power/energy monitoring interface aka a \Platypus\ attack. NOTE: there is only one logically independent fix: to change the access control for each such interface in Xen.


The ABUS Secvest wireless alarm system FUAA50000 (v3.01.17) fails to properly authenticate some requests to its built-in HTTPS interface. Someone can use this vulnerability to obtain sensitive information from the system such as usernames and passwords. This information can then be used to reconfigure or disable the alarm system.


Arm Mbed TLS before 2.16.5 allows attackers to obtain sensitive information (an RSA private key) by measuring cache usage during an import.


An information-disclosure flaw was found in the way that gluster-block before 0.5.1 logs the output from gluster-block CLI operations. This includes recording passwords to the cmd_history.log file which is world-readable. This flaw allows local users to obtain sensitive information by reading the log file. The highest threat from this vulnerability is to data confidentiality.


The affected product lacks proper validation of user-supplied data which can result in deserialization of untrusted data on the Ignition 8 Gateway (versions prior to 8.0.10) and Ignition 7 Gateway (versions prior to 7.9.14) allowing an attacker to obtain sensitive information.


An issue was discovered in Zammad 3.0 through 3.2. It does not prevent caching of confidential data within browser memory. An attacker who either remotely compromises or obtains physical access to a user's workstation can browse the browser cache contents and obtain sensitive information. The attacker does not need to be authenticated with the application to view this information as it would be available via the browser cache.


A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache perform an XSS attack or obtain sensitive information from request other than their own.


A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated remote attacker to conduct SQL injection attacks on an affected system. The vulnerability is due to improper validation of user-submitted parameters. An attacker could exploit this vulnerability by authenticating to the application and sending malicious requests to an affected system. A successful exploit could allow the attacker to obtain and modify sensitive information that is stored in the underlying database.


A vulnerability in Cisco Data Center Network Manager (DCNM) Software could allow an authenticated local attacker to obtain confidential information from an affected device. The vulnerability is due to insufficient protection of confidential information on an affected device. An attacker at any privilege level could exploit this vulnerability by accessing local filesystems and extracting sensitive information from them. A successful exploit could allow the attacker to view sensitive data which they could use to elevate their privilege.


A vulnerability in the web-based management interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated remote attacker to obtain sensitive information about an affected device. The vulnerability exists because replies from the web-based management interface include unnecessary server information. An attacker could exploit this vulnerability by inspecting replies received from the web-based management interface. A successful exploit could allow the attacker to obtain details about the operating system including the web server version that is running on the device which could be used to perform further attacks.


A vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) could allow an unauthenticated remote attacker to access sensitive information on an affected device. The vulnerability is due to insufficient validation of requests that are sent to the web-based management interface. An attacker could exploit this vulnerability by sending a crafted request to the interface of an affected device. A successful exploit could allow the attacker to obtain the IP addresses that are configured on the internal interfaces of the affected device. There is a workaround that addresses this vulnerability.


A vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) Cisco Content Security Management Appliance (SMA) and Cisco Web Security Appliance (WSA) could allow an authenticated remote attacker to access sensitive information on an affected device. The vulnerability exists because an insecure method is used to mask certain passwords on the web-based management interface. An attacker could exploit this vulnerability by looking at the raw HTML code that is received from the interface. A successful exploit could allow the attacker to obtain some of the passwords configured throughout the interface.


A vulnerability in the multicast DNS (mDNS) protocol configuration of Cisco Webex Meetings Client for MacOS could allow an unauthenticated adjacent attacker to obtain sensitive information about the device on which the Webex client is running. The vulnerability exists because sensitive information is included in the mDNS reply. An attacker could exploit this vulnerability by doing an mDNS query for a particular service against an affected device. A successful exploit could allow the attacker to gain access to sensitive information.


A vulnerability in the CLI of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco AsyncOS for Cisco Content Security Management Appliance (SMA) could allow an authenticated remote attacker to access sensitive information on an affected device. The vulnerability is due to excessive verbosity in certain log subscriptions. An attacker could exploit this vulnerability by accessing specific log files on an affected device. A successful exploit could allow the attacker to obtain sensitive log data which may include user credentials. To exploit this vulnerability the attacker would need to have valid credentials at the operator level or higher on the affected device.


A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an authenticated remote attacker to conduct SQL injection attacks on an affected system. The vulnerability is due to improper validation of user-submitted parameters. An attacker could exploit this vulnerability by authenticating to the application and sending malicious requests to an affected system. A successful exploit could allow the attacker to obtain and modify sensitive information that is stored in the underlying database.


A vulnerability in the installation component of Cisco Hyperflex HX-Series Software could allow an authenticated local attacker to retrieve the password that was configured at installation on an affected device. The vulnerability exists because sensitive information is stored as clear text. An attacker could exploit this vulnerability by authenticating to an affected device and navigating to the directory that contains sensitive information. A successful exploit could allow the attacker to obtain sensitive information in clear text from the affected device.


The affected product is vulnerable to the handling of serialized data. The issue results from the lack of proper validation of user-supplied data which can result in deserialization of untrusted data on the Ignition 8 Gateway (versions prior to 8.0.10) and Ignition 7 Gateway (versions prior to 7.9.14) allowing an attacker to obtain sensitive information.


The affected product lacks proper authentication required to query the server on the Ignition 8 Gateway (versions prior to 8.0.10) and Ignition 7 Gateway (versions prior to 7.9.14) allowing an attacker to obtain sensitive information.


The Correos Express addon for PrestaShop 1.6 through 1.7 allows remote attackers to obtain sensitive information such as a service's owner password that can be used to modify orders via SOAP. Attackers can also retrieve information about orders or buyers.


The keygen protocol implementation in Binance tss-lib before 1.2.0 allows attackers to generate crafted h1 and h2 parameters in order to compromise a signing round or obtain sensitive information from other parties.


An issue was discovered in the stashcat app through 3.9.1 for macOS Windows Android iOS and possibly other platforms. The GET method is used with client_key and device_id data in the query string which allows attackers to obtain sensitive information by reading web-server logs.


The web interface of Maipu MP1800X-50 7.5.3.14(R) devices allows remote attackers to obtain sensitive information via the form/formDeviceVerGet URI such as system id hardware model hardware version bootloader version software version software image file compilation time and system uptime. This is similar to CVE-2019-1653.


In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8 the local www-data user has sudo privileges to execute grep as root without a password which allows an attacker to obtain sensitive information via a grep of a /root/*.db or /etc/shadow file.


The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags.


IBM Predictive Solutions Foundation (formerly PMQ) could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL to specify a file from the local system which could allow the attacker to obtain sensitive information. IBM X-Force ID: 119618.


IBM Jazz Foundation could allow an authenticated user to obtain sensitive information from stack traces. IBM X-Force ID: 119781


IBM Jazz Foundation could allow an authenticated attacker to obtain sensitive information from error message stack traces. IBM X-Force ID: 119528.


arch/x86/kvm/emulate.c in the Linux kernel before 4.8.12 does not properly initialize Code Segment (CS) in certain error cases which allows local users to obtain sensitive information from kernel stack memory via a crafted application.


CMPXCHG8B emulation in Xen 3.3.x through 4.7.x on x86 systems allows local HVM guest OS users to obtain sensitive information from host stack memory via a \supposedly-ignored\ operand size prefix.


Citrix Provisioning Services before 7.12 allows attackers to obtain sensitive information from kernel memory via unspecified vectors.


The vmnc decoder in the gstreamer does not initialize the render canvas which allows remote attackers to obtain sensitive information as demonstrated by thumbnailing a simple 1 frame vmnc movie that does not draw to the allocated render canvas.


The __get_user_asm_ex macro in arch/x86/include/asm/uaccess.h in the Linux kernel before 4.7.5 does not initialize a certain integer variable which allows local users to obtain sensitive information from kernel stack memory by triggering failure of a get_user_ex call.


The postinst script in the tomcat6 package before 6.0.45+dfsg-1~deb7u4 on Debian wheezy before 6.0.35-1ubuntu3.9 on Ubuntu 12.04 LTS and on Ubuntu 14.04 LTS; the tomcat7 package before 7.0.28-4+deb7u8 on Debian wheezy before 7.0.56-3+deb8u6 on Debian jessie before 7.0.52-1ubuntu0.8 on Ubuntu 14.04 LTS and on Ubuntu 12.04 LTS 16.04 LTS and 16.10; and the tomcat8 package before 8.0.14-1+deb8u5 on Debian jessie before 8.0.32-1ubuntu1.3 on Ubuntu 16.04 LTS before 8.0.37-1ubuntu0.1 on Ubuntu 16.10 and before 8.0.38-2ubuntu1 on Ubuntu 17.04 might allow local users with access to the tomcat account to obtain sensitive information or gain root privileges via a symlink attack on the Catalina localhost directory.


IBM QRadar 7.2 and 7.3 could allow a remote attacker to obtain sensitive information caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 120208.


The OTR plugin for Gajim sends information in cleartext when using XHTML which allows remote attackers to obtain sensitive information via unspecified vectors.


Huawei FusionAccess with software V100R005C10 and V100R005C20 could allow remote attackers with specific permission to inject a Lightweight Directory Access Protocol (LDAP) operation command into a specific input variable to obtain sensitive information from the database.


Improper neutralization of CRLF sequences in HTTP headers vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote unauthenticated attacker to obtain sensitive information via the server HTTP response spoofing.


IBM BigFix Inventory v9 could allow a remote attacker to obtain sensitive information caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.


IBM Emptoris Sourcing 9.5.x through 10.1.x could allow a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web site a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 118840.


IBM Emptoris Sourcing 9.5.x through 10.1.x could allow a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web site a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 118834


IBM Emptoris Supplier Lifecycle Management 10.0.x and 10.1.x could allow a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web site a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 118836.


ION memory management module in Huawei P9 phones with software EVA-AL10C00B192 and earlier versions EVA-DL10C00B192 and earlier versions EVA-TL10C00B192 and earlier versions EVA-CL10C00B192 and earlier versions allows attackers to obtain sensitive information from uninitialized memory.


IBM BigFix Inventory v9 could allow a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web site a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.


The exif_process_IFD_in_TIFF function in ext/exif/exif.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles the case of a thumbnail offset that exceeds the file size which allows remote attackers to obtain sensitive information from process memory via a crafted TIFF image.


Siemens SIMATIC STEP 7 (TIA Portal) before 14 improperly stores pre-shared key data in TIA project files which makes it easier for local users to obtain sensitive information by leveraging access to a file and conducting a brute-force attack.


The buf.pl script before 2.20 in Irssi before 0.8.20 uses weak permissions for the scrollbuffer dump file created between upgrades which might allow local users to obtain sensitive information from private chat conversations by reading the file.


An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. The issue involves the \WebKit\ component. It allows remote attackers to obtain sensitive information via a blob URL on a web site.


An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before 12.5.4 is affected. The issue involves the \WebKit\ component which allows remote attackers to obtain sensitive information via crafted JavaScript prompts on a web site.


An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue involves the \Kernel\ component which allows attackers to obtain sensitive information from kernel memory via a crafted app.


An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before 12.5.4 is affected. The issue involves the \WebKit\ component. It allows remote attackers to obtain sensitive information via a crafted web site.


** DISPUTED ** Moodle 3.1.2 allows remote attackers to obtain sensitive information via unspecified vectors related to a \SQL Injection\ issue affecting the Administration panel function in the installation process component. NOTE: the vendor disputes the relevance of this report noting that \the person who is installing Moodle must know database access credentials and they can access the database directly; there is no need for them to create a SQL injection in one of the installation dialogue fields.\


An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before 12.5.4 is affected. The issue involves the \WebKit\ component. It allows remote attackers to obtain sensitive information from process memory via a crafted web site.


Crypto++ (aka cryptopp) through 5.6.4 does not document the requirement for a compile-time NDEBUG definition disabling the many assert calls that are unintended in production use which might allow context-dependent attackers to obtain sensitive information by leveraging access to process memory after an assertion failure as demonstrated by reading a core dump.


An issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue involves the \Clipboard\ component which allows physically proximate attackers to obtain sensitive information in the lockscreen state by viewing clipboard contents.


An issue was discovered in certain Apple products. Transporter before 1.9.2 is affected. The issue involves the \iTMSTransporter\ component which allows attackers to obtain sensitive information via a crafted EPUB.


An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue involves the \IOKit\ component. It allows attackers to obtain sensitive information from kernel memory via a crafted app.


An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before 12.5.4 is affected. The issue involves the \WebKit\ component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site that uses HTTP redirects.


An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the \OpenPAM\ component which allows local users to obtain sensitive information by leveraging mishandling of failed PAM authentication by a sandboxed app.


An issue was discovered in certain Apple products. iOS before 10 is affected. The issue involves the \Springboard\ component which allows physically proximate attackers to obtain sensitive information by viewing application snapshots in the Task Switcher.


An issue was discovered in certain Apple products. iCloud before 6.1 is affected. The issue involves the \Windows Security\ component. It allows local users to obtain sensitive information from iCloud desktop-client process memory via unspecified vectors.


An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the \IOFireWireFamily\ component which allows local users to obtain sensitive information from kernel memory via unspecified vectors.


in

the

IMAPx

component

in

GNOME

evolution-data-server

before

proceeds

with

cleartext

data

containing

a

password

if

the

client

wishes

to

use

STARTTLS

but

the

server

will

not

use

STARTTLS

which

makes

it

easier

for

remote

attackers

to

obtain

sensitive

information

by

sniffing

the

network.

The

server

code

was

intended

to

report

an

error

and

not

proceed

but

the

code

was

written

incorrectly.


The from method in library/core/class.email.php in Vanilla Forums before 2.3.1 allows remote attackers to spoof the email domain in sent messages and potentially obtain sensitive information via a crafted HTTP Host header as demonstrated by a password reset request.


Webdynpro

in

SAP

Solman

through

allows

remote

attackers

to

obtain

sensitive

information

via

webdynpro/dispatcher/sap.com/caf~eu~gp~example~timeoff~wd

requests

aka

SAP

Security

Note


An issue was discovered in Mattermost Server before 3.0.0. It potentially allows attackers to obtain sensitive information (credential fields within config.json) via the System Console UI.


An issue was discovered in Mattermost Server before 3.0.0. It allows attackers to obtain sensitive information about team URLs via an API.


The Motorola USBNet driver in Android before 2016-10-05 on Nexus 6 devices allows attackers to obtain sensitive information via a crafted application aka internal bug 29914434.


drivers/misc/qcom/qdsp6v2/audio_utils.c in a Qualcomm QDSP6v2 driver in Android before 2016-10-05 on Nexus 5X Nexus 6P and Android One devices does not initialize certain data structures which allows attackers to obtain sensitive information via a crafted application aka Android internal bug 30152182 and Qualcomm internal bug CR 1049521.


The kernel in Android before 2016-10-05 on Nexus 6P devices allows attackers to obtain sensitive information via a crafted application aka internal bug 30402628.


MediaWiki before 1.23.15 1.26.x before 1.26.4 and 1.27.x before 1.27.1 does not generate head items in the context of a given title which allows remote attackers to obtain sensitive information via a parse action to api.php.


CORE/HDD/src/wlan_hdd_wext.c in the Qualcomm Wi-Fi driver in Android before 2016-10-05 on Nexus 5X and Android One devices allows attackers to obtain sensitive information via a crafted application that makes an iw_set_priv ioctl call aka Android internal bug 29982678 and Qualcomm internal bug CR 1048052.


F5 BIG-IP 12.0.0 and 11.5.0 - 11.6.1 REST requests which timeout during user account authentication may log sensitive attributes such as passwords in plaintext to /var/log/restjavad.0.log. It may allow local users to obtain sensitive information by reading these files.


The kernel in Android before 2016-10-05 on Nexus 5 Nexus 5X Nexus 6 Nexus 6P Nexus 9 Nexus Player and Android One devices allows attackers to obtain sensitive information via a crafted application aka internal bug 30148243.


The client in MongoDB uses world-readable permissions on .dbshell history files which might allow local users to obtain sensitive information by reading these files.


The Configuration Manager in IBM Sterling Secure Proxy (SSP) 3.4.2 before 3.4.2.0 iFix 8 and 3.4.3 before 3.4.3.0 iFix 1 does not enable the HSTS protection mechanism which makes it easier for remote attackers to obtain sensitive information or modify data by leveraging use of HTTP.


Adobe AIR SDK & Compiler before 23.0.0.257 on Windows does not support Android runtime-analytics transport security which might allow remote attackers to obtain sensitive information by leveraging access to a network over which analytics data is sent.


CORE/HDD/src/wlan_hdd_hostapd.c in the Qualcomm Wi-Fi driver in Android before 2016-10-05 on Nexus 5X and Android One devices allows attackers to obtain sensitive information via a crafted application that makes a setwpaie ioctl call aka Android internal bug 29915601 and Qualcomm internal bug CR 1000913.


The NVIDIA profiler in Android before 2016-10-05 on Nexus 9 devices allows attackers to obtain sensitive information via a crafted application aka internal bug 30593080.


Huawei X6800 and XH620 V3 servers with software before V100R003C00SPC606 RH1288 V3 servers with software before V100R003C00SPC613 RH2288 V3 servers with software before V100R003C00SPC617 CH140 V3 and CH226 V3 servers with software before V100R001C00SPC122 CH220 V3 servers with software before V100R001C00SPC201 and CH121 V3 and CH222 V3 servers with software before V100R001C00SPC202 might allow remote attackers to decrypt encrypted data and consequently obtain sensitive information by leveraging selection of an insecure SSH encryption algorithm.


IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 could allow a remote attacker to obtain sensitive information caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.


drivers/misc/qcom/qdsp6v2/audio_utils.c in a Qualcomm QDSP6v2 driver in Android before 2016-10-05 on Nexus 5X Nexus 6P and Android One devices does not initialize certain data structures which allows attackers to obtain sensitive information via a crafted application aka Android internal bug 30152501 and Qualcomm internal bug CR 1049615.


The User Data Services (UDS) API implementation in Cisco Unified Communications Manager 11.5 allows remote attackers to bypass intended access restrictions and obtain sensitive information via unspecified API calls aka Bug ID CSCux67855.


The NVIDIA profiler in Android before 2016-10-05 on Nexus 9 devices allows attackers to obtain sensitive information via a crafted application aka internal bug 30163101.


The machinectl command in oci-register-machine allows local users to list running containers and possibly obtain sensitive information by running that command.


Cisco Firepower Management Center 6.0.1 has hardcoded database credentials which allows local users to obtain sensitive information by leveraging CLI access aka Bug ID CSCva30370.


The NVIDIA GPU driver in Android before 2016-10-05 on Nexus 9 devices allows attackers to obtain sensitive information via a crafted application aka internal bug 30259955.


IBM Emptoris Strategic Supply Management Platform 10.0 and 10.1 could allow a remote attacker to obtain sensitive information caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 116881.


SAP HANA SPS09 1.00.091.00.14186593 allows local users to obtain sensitive information by leveraging the EXPORT statement to export files aka SAP Security Note 2252941.


The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6 IOS XE through 3.18S IOS XR 4.3.x and 5.0.x through 5.2.x and PIX before 7.0 allows remote attackers to obtain sensitive information from device memory via a Security Association (SA) negotiation request aka Bug IDs CSCvb29204 and CSCvb36055 or BENIGNCERTAIN.


Incomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote authenticated users to obtain sensitive information by reading the fields in the (1) ics or (2) XML calendar feeds.


xbcrypt in Percona XtraBackup before 2.3.6 and 2.4.x before 2.4.5 does not properly set the initialization vector (IV) for encryption which makes it easier for context-dependent attackers to obtain sensitive information from encrypted backup files via a Chosen-Plaintext attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6394.


The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 8.5.0 to 8.5.6 8.0.0.RC1 to 8.0.38 7.0.0 to 7.0.72 and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited in conjunction with a proxy that also permitted the invalid characters but with a different interpretation to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache perform an XSS attack and/or obtain sensitive information from requests other then their own.


Huawei FusionCompute before V100R005C10CP7002 stores cleartext AES keys in a file which allows remote authenticated users to obtain sensitive information via unspecified vectors.


The MariaDB audit_plugin component in Pivotal Cloud Foundry (PCF) cf-mysql-release 27 and 28 allows remote attackers to obtain sensitive information by reading syslog messages as demonstrated by cleartext credentials.


Red Hat JBoss BPM Suite 6.3.x does not include the HTTPOnly flag in a Set-Cookie header for session cookies which makes it easier for remote attackers to obtain potentially sensitive information via script access to the cookies.


Hybris Management Console (HMC) in SAP Hybris before 6.0 allows remote attackers to obtain sensitive information by triggering an error and then reading a Java stack trace.


SOGo before 2.3.12 and 3.x before 3.1.1 does not restrict access to the UID and DTSTAMP attributes which allows remote authenticated users to obtain sensitive information about appointments with the \View the Date & Time\ restriction as demonstrated by correlating UIDs and DTSTAMPs between all users.


The PPTP server in Cisco IOS 15.5(3)M does not properly initialize packet buffers which allows remote attackers to obtain sensitive information from earlier network communication by reading packet data aka Bug ID CSCvb16274.


The Intelligent Baseboard Management Controller (iBMC) in Huawei RH1288 V3 servers with software before V100R003C00SPC613 RH2288 V3 servers with software before V100R003C00SPC617 RH2288H V3 servers with software before V100R003C00SPC515 RH5885 V3 servers with software before V100R003C10SPC102 and XH620 V3 XH622 V3 and XH628 V3 servers with software before V100R003C00SPC610 might allow remote attackers to decrypt encrypted data and consequently obtain sensitive information by leveraging selection of an insecure SSL encryption algorithm.


ecryptfs-setup-swap in eCryptfs does not prevent the unencrypted swap partition from activating during boot when using GPT partitioning on a (1) NVMe or (2) MMC drive which allows local users to obtain sensitive information via unspecified vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8946.


The kernel in Android before 2016-10-05 on Nexus devices allows attackers to obtain sensitive information via a crafted application aka internal bug 30143283.


Cloud Foundry PHP Buildpack (aka php-buildpack) before 4.3.18 and PHP Buildpack Cf-release before 242 as used in Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.38 and 1.7.x before 1.7.19 and other products place the .profile file in the htdocs directory which might allow remote attackers to obtain sensitive information via an HTTP GET request for this file.


IBM Sterling B2B Integrator Standard Edition could allow a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web site a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.


AVer Information EH6108H+ devices with firmware X9.03.24.00.07l store passwords in a cleartext base64 format and require cleartext credentials in HTTP Cookie headers which allows context-dependent attacks to obtain sensitive information by reading these strings.


The NVIDIA profiler in Android before 2016-10-05 on Nexus 9 devices allows attackers to obtain sensitive information via a crafted application aka internal bug 30162222.


MediaWiki before 1.23.15 1.26.x before 1.26.4 and 1.27.x before 1.27.1 when $wgBlockDisablesLogin is true might allow remote attackers to obtain sensitive information by leveraging failure to terminate sessions when a user account is blocked.


The Backup functionality in Adobe Experience Manager 5.6.1 6.0 6.1 and 6.2 allows attackers to obtain sensitive information via unspecified vectors.


The (1) Device Manager (2) Tiered Storage Manager (3) Replication Manager (4) Replication Monitor and (5) Hitachi Automation Director (HAD) components in HPE XP P9000 Command View Advanced Edition Software before 8.4.1-00 and XP7 Command View Advanced Edition Suite before 8.4.1-00 allow remote attackers to obtain sensitive information via unspecified vectors.


Fortinet FortiWan (formerly AscernLink) before 4.2.5 allows remote authenticated users to obtain sensitive information from (1) a backup of the device configuration via script/cfg_show.php or (2) PCAP files via script/system/tcpdump.php.


The rack-mini-profiler gem before 0.10.1 for Ruby allows remote attackers to obtain sensitive information about allocated strings and objects by leveraging incorrect ordering of security checks.


The Data Provisioning Agent (aka DP Agent) in SAP HANA does not properly restrict access to service functionality which allows remote attackers to obtain sensitive information gain privileges and conduct unspecified other attacks via unspecified vectors aka SAP Security Note 2262742.


The proc_connectinfo function in drivers/usb/core/devio.c in the Linux kernel through 4.6 does not initialize a certain data structure which allows local users to obtain sensitive information from kernel stack memory via a crafted USBDEVFS_CONNECTINFO ioctl call.


The snd_timer_user_params function in sound/core/timer.c in the Linux kernel through 4.6 does not initialize a certain data structure which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface.


The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel before 4.5.5 does not properly initialize a certain data structure which allows attackers to obtain sensitive information from kernel stack memory via an X.25 Call Request.


An incorrect permissions vulnerability in Juniper Networks Junos OS on vMX may allow local unprivileged users on a host system read access to vMX or vPFE images and obtain sensitive information contained in them such as private cryptographic keys. This issue was found during internal product security testing. Juniper SIRT is not aware of any malicious exploitation of this vulnerability. No other Juniper Networks products or platforms are affected by this issue. Affected releases are Juniper Networks Junos OS 15.1 prior to 15.1F5; 14.1 prior to 14.1R8


The rtnl_fill_link_ifmap function in net/core/rtnetlink.c in the Linux kernel before 4.5.5 does not initialize a certain data structure which allows local users to obtain sensitive information from kernel stack memory by reading a Netlink message.


ABB PCM600 before 2.7 improperly stores the main application password after a password change which allows local users to obtain sensitive information via unspecified vectors.


ABB PCM600 before 2.7 improperly stores PCM600 authentication credentials which allows local users to obtain sensitive information via unspecified vectors.


Red Hat Enterprise Virtualization (RHEV) Manager 3.6 allows local users to obtain encryption keys certificates and other sensitive information by reading the engine-setup log file.


HPE Service Manager Software 9.30 9.31 9.32 9.33 9.34 9.35 9.40 and 9.41 allows remote authenticated users to obtain sensitive information modify data and conduct server-side request forgery (SSRF) attacks via unspecified vectors related to the Server Web Client Windows Client and Service Request components.


Apache Ambari 2.x before 2.4.0 includes KDC administrator passwords on the kadmin command line which allows local users to obtain sensitive information via a process listing.


Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors a different vulnerability than CVE-2016-4271 and CVE-2016-4278.


HPE Insight Control server deployment allows remote attackers to obtain sensitive information via unspecified vectors.


The patch_instruction function in hw/i386/kvmvapic.c in QEMU does not initialize the imm32 variable which allows local guest OS administrators to obtain sensitive information from host stack memory by accessing the Task Priority Register (TPR).


A Cross-origin vulnerability exists in WebKit in Apple Safari before 10.0.1 when processing location attributes which could let a remote malicious user obtain sensitive information.


sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface related to the (1) snd_timer_user_ccallback and (2) snd_timer_user_tinterrupt functions.


The TLS implementation in HPE Integrated Lights-Out 3 (aka iLO3) firmware before 1.88 does not properly use a MAC protection mechanism in conjunction with CBC padding which allows remote attackers to obtain sensitive information via a padding-oracle attack aka a Vaudenay attack.


Unspecified ActiveX controls in Advantech WebAccess before 8.1_20160519 allow remote authenticated users to obtain sensitive information or modify data via unknown vectors related to the INTERFACESAFE_FOR_UNTRUSTED_CALLER (aka safe for scripting) flag.


Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors a different vulnerability than CVE-2016-4277 and CVE-2016-4278 aka a \local-with-filesystem Flash sandbox bypass\ issue.


The quagga package before 0.99.23-2.6.1 in openSUSE and SUSE Linux Enterprise Server 11 SP 1 uses weak permissions for /etc/quagga which allows local users to obtain sensitive information by reading files in the directory.


The

ironic-api

service

in

OpenStack

Ironic

before

(Liberty)

and

before

(Mitaka)

allows

remote

attackers

to

obtain

sensitive

information

about

a

registered

node

by

leveraging

knowledge

of

the

MAC

address

of

a

network

card

belonging

to

that

node

and

sending

a

crafted

POST

request

to

the

resource.


The llc_cmsg_rcv function in net/llc/af_llc.c in the Linux kernel before 4.5.5 does not initialize a certain data structure which allows attackers to obtain sensitive information from kernel stack memory by reading a message.


Cloudera Manager 5.5 and earlier allows remote attackers to obtain sensitive information via a (1) stderr.log or (2) stdout.log value in the filename parameter to /cmf/process/<process_id>/logs.


The Universal Discovery component in HPE Universal CMDB 10.0 10.01 10.10 10.11 10.20 and 10.21 allows remote attackers to obtain sensitive information via unspecified vectors.


The Subscription Manager package (aka subscription-manager) before 1.17.7-1 for Candlepin uses weak permissions (755) for subscription-manager cache directories which allows local users to obtain sensitive information by reading files in the directories.


MEDHOST Perioperative Information Management System (aka PIMS or VPIMS) before 2015R1 has hardcoded credentials which makes it easier for remote attackers to obtain sensitive information via direct requests to the application database server.


Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors a different vulnerability than CVE-2016-4271 and CVE-2016-4277.


An issue was discovered in certain Apple products. Safari before 10.0.1 is affected. iCloud before 6.0.1 is affected. iTunes before 12.5.2 is affected. tvOS before 10.0.1 is affected. The issue involves the \WebKit\ component. It allows remote attackers to obtain sensitive information via a crafted web site.


The Keyboards component in Apple iOS before 10 does not properly use a cache for auto-correct suggestions which allows remote attackers to obtain sensitive information in opportunistic circumstances by leveraging an unintended correction.


An issue was discovered in certain Apple products. iOS before 10.1 is affected. tvOS before 10.0.1 is affected. watchOS before 3.1 is affected. The issue involves the \Kernel\ component. It allows attackers to obtain sensitive information from kernel memory via a crafted app.


HPE Insight Control server deployment allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors.


HPE FOS before 7.4.1d and 8.x before 8.0.1 on StoreFabric B switches allows remote attackers to obtain sensitive information via unspecified vectors.


ABB PCM600 before 2.7 improperly stores OPC Server IEC61850 passwords in unspecified temporary circumstances which allows local users to obtain sensitive information via unknown vectors.


The get_rock_ridge_filename function in fs/isofs/rock.c in the Linux kernel before 4.5.5 mishandles NM (aka alternate name) entries containing \\0 characters which allows local users to obtain sensitive information from kernel memory or possibly have unspecified other impact via a crafted isofs filesystem.


The SecKeyDeriveFromPassword function in Apple OS X before 10.12 does not use the CF_RETURNS_RETAINED keyword which allows attackers to obtain sensitive information from process memory by triggering key derivation.


IBM Security Privileged Identity Manager Virtual Appliance could allow a remote attacker to obtain sensitive information caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.


IBM Jazz for Service Management could allow a remote attacker to obtain sensitive information caused by the failure to properly validate the SSL certificate. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.


IBM Tealeaf Customer Experience on Cloud Network Capture Add-On could allow a remote attacker to obtain sensitive information caused by the failure to properly validate the TLS certificate. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.


jose-php before 2.2.1 does not use constant-time operations for HMAC comparison which makes it easier for remote attackers to obtain sensitive information via a timing attack related to JWE.php and JWS.php.


Moxa OnCell G3100V2 devices before 2.8 and G3111 G3151 G3211 and G3251 devices before 1.7 use cleartext password storage which makes it easier for local users to obtain sensitive information by reading a configuration file.


Mozilla Firefox before 49.0 does not properly restrict the scheme in favicon requests which might allow remote attackers to obtain sensitive information via unspecified vectors as demonstrated by a jar: URL for a favicon resource.


IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43 8.0.x before 8.0.0.13 8.5.x before 8.5.5.11 9.0.x before 9.0.0.2 and Liberty before 16.0.0.3 mishandles responses which allows remote attackers to obtain sensitive information via unspecified vectors.


phpMyAdmin before 4.6.2 places tokens in query strings and does not arrange for them to be stripped before external navigation which allows remote attackers to obtain sensitive information by reading (1) HTTP requests or (2) server logs.


The tipc_nl_compat_link_dump function in net/tipc/netlink_compat.c in the Linux kernel through 4.6.3 does not properly copy a certain string which allows local users to obtain sensitive information from kernel stack memory by reading a Netlink message.


CloudView NMS before 2.10a allows remote attackers to obtain sensitive information via a direct request for admin/auto.def.


Huawei

OceanStor

and

before

sends

the

plaintext

session

token

in

the

HTTP

header

which

allows

remote

attackers

to

conduct

replay

attacks

and

obtain

sensitive

information

by

sniffing

the

network.


NUUO NVRmini 2 1.7.5 through 3.0.0 NUUO NVRsolo 1.0.0 through 3.0.0 and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 have a hardcoded qwe23622260 password for the nuuoeng account which allows remote attackers to obtain sensitive information via an __nvr_status___.php request.


Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 does not properly implement the HSTS protection mechanism which makes it easier for remote attackers to obtain sensitive information by sniffing the network for unintended HTTP traffic on port 8445.


The iControl REST service in F5 BIG-IP LTM AAM AFM Analytics APM ASM Link Controller and PEM 11.5.x before 11.5.4 11.6.x before 11.6.1 and 12.x before 12.0.0 HF3; BIG-IP DNS 12.x before 12.0.0 HF3; BIG-IP GTM 11.5.x before 11.5.4 and 11.6.x before 11.6.1; BIG-IQ Cloud and Security 4.0.0 through 4.5.0; BIG-IQ Device 4.2.0 through 4.5.0; BIG-IQ ADC 4.5.0; BIG-IQ Centralized Management 4.6.0; and BIG-IQ Cloud and Orchestration 1.0.0 allows remote authenticated administrators to obtain sensitive information via unspecified vectors.


phpMyAdmin 4.0.x before 4.0.10.16 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving (1) an array value to FormDisplay.php (2) incorrect data to validate.php (3) unexpected data to Validator.php (4) a missing config directory during setup or (5) an incorrect OpenID identifier data type which reveals the full path in an error message.


IBM Security Privileged Identity Manager could allow a remote attacker to obtain sensitive information caused by the failure to set the secure flag for the session cookie in SSL mode. By intercepting its transmission within an HTTP session an attacker could exploit this vulnerability to capture the cookie and obtain sensitive information.


The parser in Google V8 as used in Google Chrome before 53.0.2785.113 mishandles scopes which allows remote attackers to obtain sensitive information from arbitrary memory locations via crafted JavaScript code.


libstorage libstorage-ng and yast-storage improperly store passphrases for encrypted storage devices in a temporary file on disk which might allow local users to obtain sensitive information by reading the file as demonstrated by /tmp/libstorage-XXXXXX/pwdf.


Johnson & Johnson Animas OneTouch Ping devices do not use encryption for certain data which might allow remote attackers to obtain sensitive information by sniffing the network.


Huawei Honor WS851 routers with software 1.1.21.1 and earlier allow remote attackers to obtain sensitive information via unspecified vectors aka HWPSIRT-2016-05053.


The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel through 4.6.3 does not initialize a certain structure member which allows remote attackers to obtain sensitive information from kernel stack memory by reading an RDS message.


Mozilla Firefox before 45.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by reading a Content Security Policy (CSP) violation report that contains path information associated with an IFRAME element.


The API web interface in Cisco Prime Infrastructure before 3.1 and Cisco Evolved Programmable Network Manager before 1.2.4 allows remote authenticated users to bypass intended RBAC restrictions and obtain sensitive information and consequently gain privileges via crafted JSON data aka Bug ID CSCuy12409.


Cisco Unified Communications Manager (aka CallManager) 9.1(2.10000.28) 10.5(2.10000.5) 10.5(2.12901.1) and 11.0(1.10000.10); Unified Communications Manager IM & Presence Service 10.5(2); Unified Contact Center Express 11.0(1); and Unity Connection 10.5(2) store a cleartext encryption key which allows local users to obtain sensitive information via unspecified vectors aka Bug ID CSCuv85958.


Cisco NX-OS before 7.0(3)I2(2e) and 7.0(3)I4 before 7.0(3)I4(1) has an incorrect iptables local-interface configuration which allows remote attackers to obtain sensitive information via TCP or UDP traffic aka Bug ID CSCuz05365.


J-Web

in

Juniper

Junos

OS

before

before

before

before

before

before

before

before

before

before

or

before

and

before

might

allow

remote

attackers

to

obtain

sensitive

information

and

consequently

gain

administrative

privileges

via

unspecified

vectors.


The System Configuration Protocol (SCP) core messaging interface in Cisco Prime Network Registrar 8.2 before 8.2.3.1 and 8.3 before 8.3.2 allows remote attackers to obtain sensitive information via crafted SCP messages aka Bug ID CSCuv35694.


The SkATan2_255 function in effects/gradients/SkSweepGradient.cpp in Skia as used in Google Chrome before 49.0.2623.75 mishandles arctangent calculations which allows remote attackers to obtain sensitive information via a crafted web site.


The Messages component in Apple OS X before 10.11.5 mishandles filename encoding which allows remote attackers to obtain sensitive information via unspecified vectors.


Adobe Reader and Acrobat before 11.0.16 Acrobat and Acrobat Reader DC Classic before 15.006.30172 and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to obtain sensitive information from process memory via unspecified vectors a different vulnerability than CVE-2016-1092.


The JSGenericLowering class in compiler/js-generic-lowering.cc in Google V8 as used in Google Chrome before 50.0.2661.94 mishandles comparison operators which allows remote attackers to obtain sensitive information via crafted JavaScript code.


The administration interface on Cisco DPC3939B and DPC3941 devices allows remote attackers to obtain sensitive information via a crafted HTTP request aka Bug ID CSCus49506.


The CFNetwork Proxies subsystem in Apple iOS before 9.3.2 OS X before 10.11.5 and tvOS before 9.2.1 mishandles URLs in http and https requests which allows remote attackers to obtain sensitive information via unspecified vectors.


ownCloud Server before 8.0.9 and 8.1.x before 8.1.4 allow remote authenticated users to obtain sensitive information via unspecified vectors which reveals the installation path in the resulting exception messages.


The Extensions subsystem in Google Chrome before 50.0.2661.75 incorrectly relies on GetOrigin method calls for origin comparisons which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted extension.


The

createCustomType

function

in

in

the

extension

bindings

in

Google

Chrome

before

does

not

validate

module

types

which

might

allow

attackers

to

load

arbitrary

modules

or

obtain

sensitive

information

by

leveraging

a

poisoned

definition.


The REST interface in Cisco Spark 2015-06 allows remote authenticated users to obtain sensitive information via a request for an unspecified file aka Bug ID CSCuv84048.


Adobe RoboHelp Server 9 before 9.0.1 mishandles SQL queries which allows attackers to obtain sensitive information via unspecified vectors.


The setup_snappy_os_mounts function in the ubuntu-core-launcher package before 1.0.27.1 improperly determines the mount point of bind mounts when using snaps which might allow remote attackers to obtain sensitive information or gain privileges via a snap with a name starting with \ubuntu-core.\


Mozilla Firefox before 45.0 does not properly restrict the availability of IFRAME Resource Timing API times which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code that leverages history.back and performance.getEntries calls after restoring a browser session. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-7207.


Adobe Reader and Acrobat before 11.0.16 Acrobat and Acrobat Reader DC Classic before 15.006.30172 and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to obtain sensitive information via unspecified vectors.


In ZOHO Password Manager Pro (PMP) 8.3.0 (Build 8303) and 8.4.0 (Build 8400 8401 8402) underprivileged users can obtain sensitive information (entry password history) via a vulnerable hidden service.


The oarsh script in OAR before 2.5.7 allows remote authenticated users of a cluster to obtain sensitive information and possibly gain privileges via vectors related to OpenSSH options.


uri.js in Google V8 before 5.1.281.26 as used in Google Chrome before 51.0.2704.63 uses an incorrect array type which allows remote attackers to obtain sensitive information by calling the decodeURI function and leveraging \type confusion.\


Samsung KNOX 1.0 uses a weak eCryptFS Key generation algorithm which makes it easier for local users to obtain sensitive information by leveraging knowledge of the TIMA key and a brute-force attack.


HPE ArcSight ESM before 6.8c and ArcSight ESM Express before 6.9.1 allows remote authenticated users to obtain sensitive information via unspecified vectors.


The

UnacceleratedImageBufferSurface

class

in

in

Blink

as

used

in

Google

Chrome

before

mishandles

the

initialization

mode

which

allows

remote

attackers

to

obtain

sensitive

information

from

process

memory

via

a

crafted

web

site.


The \Clear History and Website Data\ feature in Apple Safari before 9.1.1 as used in iOS before 9.3.2 and other products mishandles the deletion of browsing history which might allow local users to obtain sensitive information by leveraging read access to a Safari directory.


CCCrypt in CommonCrypto in Apple iOS before 9.3.2 OS X before 10.11.5 tvOS before 9.2.1 and watchOS before 2.2.1 mishandles return values during key-length calculations which allows attackers to obtain sensitive information via a crafted app.


The renderer implementation in Google Chrome before 51.0.2704.63 does not properly restrict public exposure of classes which allows remote attackers to obtain sensitive information via vectors related to extensions.


The Time Machine server in Server App in Apple OS X Server before 5.1 does not notify the user about ignored permissions during a backup which makes it easier for remote attackers to obtain sensitive information in opportunistic circumstances by reading backup data that lacks intended restrictions.


LiveTime/WebObjects/LiveTime.woa/wa/DownloadAction/downloadFile

in

Micro

Focus

Novell

Service

Desk

before

allows

remote

authenticated

users

to

conduct

Hibernate

Query

Language

(HQL)

injection

attacks

and

obtain

sensitive

information

via

the

entityName

parameter.


The Page Loading implementation in WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles character encoding during access to cached data which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.


Mozilla Firefox before 44.0 stores cookies with names containing vertical tab characters which allows remote attackers to obtain sensitive information by reading HTTP Cookie headers. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-7208.


The Content Security Policy (CSP) implementation in Messages in Apple OS X before 10.11.4 allows remote attackers to obtain sensitive information via a javascript: URL.


Adobe Reader and Acrobat before 11.0.16 Acrobat and Acrobat Reader DC Classic before 15.006.30172 and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to obtain sensitive information from process memory via unspecified vectors a different vulnerability than CVE-2016-1079.


IBM Security Guardium 10.x through 10.1 before p100 allows remote authenticated users to obtain sensitive information by reading an Application Error message.


IBM General Parallel File System (GPFS) 3.5 before 3.5.0.29 efix 6 and 4.1.1 before 4.1.1.4 efix 9 when the Spectrum Scale GUI is used with DB2 on Linux UNIX and Windows allows remote authenticated users to obtain sensitive information via unspecified vectors as demonstrated by discovering ADMIN passwords.


The metrics-collection component in RabbitMQ for Pivotal Cloud Foundry (PCF) 1.6.x before 1.6.4 logs command lines of failed commands which might allow context-dependent attackers to obtain sensitive information by reading the log data as demonstrated by a syslog message that contains credentials from a command line.


IBM Connections 5.5 and earlier allows remote attackers to obtain sensitive information by reading stack traces in returned responses.


Admin Center in IBM WebSphere Application Server (WAS) 8.5.5.2 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 allows remote attackers to obtain sensitive information via unspecified vectors.


Moxa Secure Router EDR-G903 devices before 3.4.12 do not delete copies of configuration and log files after completing the import function which allows remote attackers to obtain sensitive information by requesting these files at an unspecified URL.


The Servlets Post component 2.3.6 in Apache Sling as used in Adobe Experience Manager 5.6.1 6.0.0 and 6.1.0 allows remote attackers to obtain sensitive information via unspecified vectors.


IBM UrbanCode Deploy 6.0.x before 6.0.1.13 6.1.x before 6.1.3.3 and 6.2.x before 6.2.1.1 does not properly implement a logging-obfuscation feature for secure properties which allows remote authenticated users to obtain sensitive information via vectors involving special characters.


IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x through 7.0.0.9 allows remote authenticated Commerce Accelerator administrators to obtain sensitive information via unspecified vectors.


IBM Multi-Enterprise Integration Gateway 1.0 through 1.0.0.1 and B2B Advanced Communications 1.0.0.2 through 1.0.0.4 do not require HTTPS which might allow remote attackers to obtain sensitive information by sniffing the network.


The agent in Apache Ambari before 2.1.2 uses weak permissions for the (1) /var/lib/ambari-agent/data and (2) /var/lib/ambari-agent/keys directories which allows local users to obtain sensitive information by reading files in the directories.


IBM Sterling B2B Integrator Standard Edition could allow a remote attacker to obtain sensitive information. By allowing HTTP OPTIONS method a remote attacker could send a specially-crafted query to a vulnerable server running to cause the server to disclose sensitive information in the HTTP response.


The BnGraphicBufferConsumer::onTransact function in libs/gui/IGraphicBufferConsumer.cpp in mediaserver in Android 5.x before 5.1.1 LMY49H and 6.x before 2016-03-01 does not initialize a certain slot variable which allows attackers to obtain sensitive information and consequently bypass an unspecified protection mechanism by triggering an ATTACH_BUFFER action as demonstrated by obtaining Signature or SignatureOrSystem access aka internal bug 26338113.


The

and

web

services

in

Moodle

through

before

before

before

and

before

do

not

consider

the

moodle/course:viewhiddencourses

capability

which

allows

remote

authenticated

users

to

obtain

sensitive

information

via

a

web-service

request.


The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x 6.x and 7.x before 7.1p2 allows remote servers to obtain sensitive information from process memory by requesting transmission of an entire buffer as demonstrated by reading a private key.


WebReports in IBM BigFix Platform (formerly Tivoli Endpoint Manager) 9.x before 9.5.2 allows remote attackers to obtain sensitive information by sniffing the network for HTTP traffic.


XML external entity (XXE) vulnerability in IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013 Financial Transaction Manager (FTM) for Check Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013 and Financial Transaction Manager (FTM) for Corporate Payment Services (CPS) for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013 allows remote authenticated users to obtain sensitive information via crafted XML data. IBM X-Force ID: 110915.


runmqsc in IBM WebSphere MQ 8.x before 8.0.0.5 allows local users to bypass an intended +dsp authority requirement and obtain sensitive information via unspecified display commands.


libmpeg2 in libstagefright in Android 6.x before 2016-03-01 allows attackers to obtain sensitive information and consequently bypass an unspecified protection mechanism via crafted Bitstream data as demonstrated by obtaining Signature or SignatureOrSystem access aka internal bug 25765591.


IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013 Financial Transaction Manager (FTM) for Check Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013 and Financial Transaction Manager (FTM) for Corporate Payment Services (CPS) for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013 allows local users to obtain sensitive information via vectors related to cacheable HTTPS responses.


The Administrative Console in IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43 8.0.x before 8.0.0.13 and 8.5.x before 8.5.5.10 mishandles CSRFtoken cookies which allows remote authenticated users to obtain sensitive information via unspecified vectors.


IBM Security Guardium Database Activity Monitor 8.2 before p310 9.x through 9.5 before p700 and 10.x through 10.1 before p100 does not enable the HSTS protection mechanism which makes it easier for remote attackers to obtain sensitive information by leveraging use of HTTP.


The BnGraphicBufferProducer::onTransact function in libs/gui/IGraphicBufferConsumer.cpp in mediaserver in Android 4.x before 4.4.4 5.x before 5.1.1 LMY49H and 6.x before 2016-03-01 does not initialize a certain output data structure which allows attackers to obtain sensitive information and consequently bypass an unspecified protection mechanism by triggering a QUEUE_BUFFER action as demonstrated by obtaining Signature or SignatureOrSystem access aka internal bug 26338109.


Advantech WebAccess before 8.1 allows remote attackers to obtain sensitive information via crafted input.


The

getDeviceIdForPhone

function

in

in

Telephony

in

Android

before

and

before

does

not

check

for

the

permission

which

allows

attackers

to

obtain

sensitive

information

via

a

crafted

application

aka

internal

bug


EMC RSA Data Loss Prevention 9.6 before SP2 P5 allows remote authenticated users to obtain sensitive information by reading error messages.


HP LaserJet printers and MFPs and OfficeJet Enterprise printers with firmware before 3.7.01 allow remote attackers to obtain sensitive information via unspecified vectors.


libs/gui/BufferQueueConsumer.cpp in mediaserver in Android 4.x before 4.4.4 5.0.x before 5.0.2 5.1.x before 5.1.1 and 6.x before 2016-04-01 does not check for the android.permission.DUMP permission which allows attackers to obtain sensitive information and consequently bypass an unspecified protection mechanism via a dump request as demonstrated by obtaining Signature or SignatureOrSystem access aka internal bug 27046057.


IBM Connections 4.x through 4.5 CR5 5.0 before CR4 and 5.5 before CR1 allows remote authenticated users to obtain sensitive information via an unspecified brute-force attack.


IBM IMS Enterprise Suite Data Provider before 3.2.0.1 for Microsoft .NET allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors.


mediaserver in Android 4.x before 4.4.4 5.0.x before 5.0.2 5.1.x before 5.1.1 and 6.x before 2016-05-01 does not initialize certain data structures which allows attackers to obtain sensitive information via a crafted application related to IGraphicBufferConsumer.cpp and IGraphicBufferProducer.cpp aka internal bug 27556038.


AudioSource.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4 5.0.x before 5.0.2 5.1.x before 5.1.1 and 6.x before 2016-06-01 does not initialize certain data which allows attackers to obtain sensitive information via a crafted application aka internal bug 27855172.


IBM WebSphere Application Server (WAS) 8.5 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 does not include the HTTPOnly flag in a Set-Cookie header for an unspecified JAX-RS API cookie which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.


VMware NSX Edge 6.1 before 6.1.7 and 6.2 before 6.2.3 and vCNS Edge 5.5 before 5.5.4.3 when the SSL-VPN feature is configured allow remote attackers to obtain sensitive information via unspecified vectors.


calendar/externallib.php in Moodle through 2.6.11 2.7.x before 2.7.13 2.8.x before 2.8.11 2.9.x before 2.9.5 and 3.0.x before 3.0.3 provides calendar-event data without considering whether an activity is hidden which allows remote authenticated users to obtain sensitive information via a web-service request.


A vulnerability exists in the Aruba AirWave Management Platform 8.x prior to 8.2 in the management interface of an underlying system component called RabbitMQ which could let a malicious user obtain sensitive information. This interface listens on TCP port 15672 and 55672


The permission control module in Huawei Document Security Management (aka DSM) before V100R002C05SPC670 allows remote authenticated users to obtain sensitive information from encrypted documents by leveraging incorrect control of permissions on the PrintScreen button.


libraries/sql-parser/autoload.php in the SQL parser in phpMyAdmin 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request which reveals the full path in an error message.


Activity Manager in Android 5.0.x before 5.0.2 5.1.x before 5.1.1 and 6.x before 2016-06-01 does not properly terminate process groups which allows attackers to obtain sensitive information via a crafted application aka internal bug 19285814.


HPE Systems Insight Manager (SIM) before 7.5.1 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors a different vulnerability than CVE-2016-2019 CVE-2016-2020 CVE-2016-2021 CVE-2016-2022 and CVE-2016-2030.


mediaserver in Android 4.x before 4.4.4 5.0.x before 5.0.2 5.1.x before 5.1.1 and 6.x before 2016-05-01 does not initialize certain data structures which allows attackers to obtain sensitive information via a crafted application related to IGraphicBufferConsumer.cpp and IGraphicBufferProducer.cpp aka internal bug 27555981.


HPE Network Node Manager i (NNMi) 9.20 9.23 9.24 9.25 10.00 and 10.01 allows remote authenticated users to obtain sensitive information via unspecified vectors.


HPE Systems Insight Manager (SIM) before 7.5.1 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors a different vulnerability than CVE-2016-2017 CVE-2016-2019 CVE-2016-2020 CVE-2016-2021 and CVE-2016-2030.


Ecava IntegraXor before 5.0 build 4522 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.


HPE RESTful Interface Tool 1.40 allows local users to obtain sensitive information via unspecified vectors.


media/libmedia/IOMX.cpp in mediaserver in Android 4.x before 4.4.4 5.0.x before 5.0.2 5.1.x before 5.1.1 and 6.x before 2016-04-01 does not initialize a parameter data structure which allows attackers to obtain sensitive information from process memory and consequently bypass an unspecified protection mechanism via unspecified vectors as demonstrated by obtaining Signature or SignatureOrSystem access aka internal bug 26914474.


The adjust_branches function in kernel/bpf/verifier.c in the Linux kernel before 4.5 does not consider the delta in the backward-jump case which allows local users to obtain sensitive information from kernel memory by creating a packet filter and then loading crafted BPF instructions.


The password-sync feature on Belden Hirschmann Classic Platform switches L2B before 05.3.07 and L2E L2P L3E and L3P before 09.0.06 sets an SNMP community to the same string as the administrator password which allows remote attackers to obtain sensitive information by sniffing the network.


server/content/ContentService.java in the Framework component in Android 4.x before 4.4.4 5.0.x before 5.0.2 5.1.x before 5.1.1 and 6.x before 2016-04-01 does not check for a GET_ACCOUNTS permission which allows attackers to obtain sensitive information via a crafted application aka internal bug 26094635.


American Auto-Matrix Aspect-Nexus Building Automation Front-End Solutions application before 3.0.0 and Aspect-Matrix Building Automation Front-End Solutions application store passwords in cleartext which allows remote attackers to obtain sensitive information by reading a file.


The compose functionality in AOSP Mail in Android 5.0.x before 5.0.2 5.1.x before 5.1.1 and 6.x before 2016-05-01 does not properly restrict attachments which allows attackers to obtain sensitive information via a crafted application related to ComposeActivity.java and ComposeActivityEmail.java aka internal bug 27335139.


IBM Connections 4.0 through CR4 4.5 through CR5 and 5.0 before CR4 allows remote authenticated users to obtain sensitive information by reading an \archaic\ e-mail address in a response.


Ecava IntegraXor before 5.0 build 4522 allows remote attackers to obtain sensitive information by reading detailed error messages.


The GIT Integration component in IBM Rational Team Concert (RTC) 5.x before 5.0.2 iFix14 and 6.x before 6.0.1 iFix5 and Rational Collaborative Lifecycle Management 5.x before 5.0.2 iFix14 and 6.x before 6.0.1 iFix5 allows remote authenticated users to obtain sensitive information via a malformed request.


media/libmedia/IDrm.cpp in mediaserver in Android 6.x before 2016-04-01 does not initialize a certain key-request data structure which allows attackers to obtain sensitive information from process memory and consequently bypass an unspecified protection mechanism via unspecified vectors as demonstrated by obtaining Signature or SignatureOrSystem access aka internal bug 26323455.


HPE Systems Insight Manager (SIM) before 7.5.1 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors a different vulnerability than CVE-2016-2017 CVE-2016-2019 CVE-2016-2020 CVE-2016-2022 and CVE-2016-2030.


exchange/eas/EasAutoDiscover.java in the Autodiscover implementation in Exchange ActiveSync in Android 5.0.x before 5.0.2 5.1.x before 5.1.1 and 6.x before 2016-04-01 allows attackers to obtain sensitive information via a crafted application that triggers a spoofed response to a GET request aka internal bug 26488455.


Mozilla Firefox before 46.0 on Android does not properly restrict JavaScript access to orientation and motion data which allows remote attackers to obtain sensitive information about a device's physical environment and possibly discover PIN values via a crafted web site a similar issue to CVE-2016-1780.


IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 uses cleartext storage for unspecified passwords which allows local users to obtain sensitive information by reading a configuration file.