Sambar Server 4.1 beta allows remote attackers to obtain sensitive information about the server via an HTTP request for the dumpenv.pl script.


Ascom Timeplex router allows remote attackers to obtain sensitive information or conduct unauthorized activities by entering debug mode through a sequence of CTRL-D characters.


Microsoft Office 98 Macintosh Edition does not properly initialize the disk space used by Office 98 files and effectively inserts data from previously deleted files into the Office file which could allow attackers to obtain sensitive information.


vacm ucd-snmp SNMP server version 3.52 does not properly disable access to the public community string which could allow remote attackers to obtain sensitive information.


iHTML Merchant allows remote attackers to obtain sensitive information or execute commands via a code parsing error.


Gattaca Server 2003 1.1.10.0 allows remote attackers to obtain sensitive information via (1) a trailing null byte (\%00\) to a URL or (2) an invalid LANGUAGE parameter to web.tmpl which reveals the full installation path in an error message.


The file server in ActivePost Standard 3.1 and earlier allows remote authenticated users to obtain sensitive information by uploading a file which reveals the path in a success message.


Sweex Wireless Broadband Router/Accesspoint 802.11g (LC000060) allows remote attackers to obtain sensitive information and gain privileges by using TFTP to download the nvram file then extracting the username password and other data from the file.


AMAX Magic Winmail Server 3.6 allows remote attackers to obtain sensitive information by entering (1) invalid characters such as \()\ or (2) a large number of characters in the Lookup field on the netaddressbook.php web form which reveals the path in an ldaplib.php error message when the ldap_search function fails due to improper processing of the $keyword variable.


PHPMyChat 0.14.5 does not remove or protect setup.php3 after installation which allows attackers to obtain sensitive information including database passwords via a direct request.


John Lim ADOdb Library for PHP before 4.23 allows remote attackers to obtain sensitive information via direct requests to certain scripts that result in an undefined value of ADODB_DIR which reveals the installation path in an error message.


NetWin (1) SurgeMail before 2.0c and (2) WebMail allow remote attackers to obtain sensitive information via HTTP requests that (a) specify the / URI (b) specify the /scripts/ URI or (c) specify a non-existent file which reveal the path in an error message.


class.vfs_dav.inc.php in phpGroupWare 0.9.16.000 does not create .htaccess files to enable authorization checks for access to users' home-directory files which allows remote attackers to obtain sensitive information from these files.


Novell iChain 2.3 includes the build number in the VIA line of the proxy server's HTTP headers which allows remote attackers to obtain sensitive information.


The acl_check function in phpGroupWare 0.9.16RC2 always returns True even when mkdir does not behave as expected which could allow remote attackers to obtain sensitive information via WebDAV from users' home directories that lack .htaccess files and possibly has other unknown impacts.


Check Point Firewall-1 4.1 up to NG AI R55 allows remote attackers to obtain potentially sensitive information by sending an Internet Key Exchange (IKE) with a certain Vendor ID payload that causes Firewall-1 to return a response containing version and other information.


Soft3304 04WebServer before 1.41 does not properly check file names which allows remote attackers to obtain sensitive information (CGI source code).


ColdFusion MX 6.1 and 6.1 J2EE allows local users to bypass sandbox security restrictions and obtain sensitive information by using Java reflection methods to access trusted Java objects without using the CreateObject function or cfobject tag.


aMSN 0.90 for Microsoft Windows allows local users to obtain sensitive information such as hashed passwords from (1) hotlog.htm and (2) config.xml.


BugPort before 1.099 stores its configuration file (conf/config.conf) under the web document root with a file extension that is not normally parsed by web servers which allows remote attackers to obtain sensitive information.


Squid Web Proxy Cache 2.5 might allow remote attackers to obtain sensitive information via URLs containing invalid hostnames that cause DNS operations to fail which results in references to previously used error messages.


S-Mart Shopping Cart or RediCart 3.9.5b stores smart.cfg under the web document root with insufficient access control which allows remote attackers to obtain sensitive information such as the database name.


The client and server for Roger Wilco 1.4.1.6 and earlier or Roger Wilco Base Station 0.30a and earlier report sensitive information such as IDs and source IP addresses which allows remote attackers to obtain sensitive information.


mod.php in eNdonesia 8.3 allows remote attackers to obtain sensitive information via certain direct requests and certain requests with invalid parameter values which reveal the path in various error messages as demonstrated by the (1) mod and (2) cid parameters.


DotNetNuke (formerly IBuySpy Workshop) 1.0.6 through 1.0.10d allows remote attackers to obtain sensitive information including the SQL server username and password via a GET request for source or configuration files such as Web.config.


nbmember.cgi in Netbilling 2.0 allows remote attackers to obtain sensitive information via the cmd=test option which can be leveraged to determine the access key.


Admin Console in Secure Computing Corporation Sidewinder G2 6.1.0.01 exports private keys when exporting firewall certificates which might allow attackers to obtain sensitive information.


Outlook Express 6.0 when sending multipart e-mail messages using the \Break apart messages larger than\ setting leaks the BCC recipients of the message to the addresses listed in the To and CC fields which may allow remote attackers to obtain sensitive information.


phpGroupWare 0.9.14.005 and earlier allow remote attackers to obtain sensitive information via a direct request to (1) hook_admin.inc.php (2) hook_home.inc.php (3) class.holidaycalc.inc.php and (4) setup.inc.php.sample which reveals the path in an error message.


Intentional information leak in phpinfo.php in XMB (aka extreme message board) 1.9 beta (aka Nexus beta) allows remote attackers to obtain sensitive information such as the configuration of the web server and the PHP application.


e107 0.615 allows remote attackers to obtain sensitive information via a direct request to (1) alt_news.php (2) backend_menu.php (3) clock_menu.php (4) counter_menu.php (5) login_menu.php and other files which reveal the full path in a PHP error message.


Abczone.it WWWguestbook 1.1 stores db/dbase.mdb under the web document root with insufficient access control which allows remote attackers to obtain sensitive information such as the plaintext username and password.


The preview_review function in the Reviews module in PHP-Nuke 6.0 to 7.3 when running on Windows systems allows remote attackers to obtain sensitive information via an invalid date parameter which generates an error message.


Unparsed web content delivery vulnerability in WIKINDX before 0.9.9g allows remote attackers to obtain sensitive information via a direct HTTP request to the config.inc file.


SmartWebby Smart Guest Book stores SmartGuestBook.mdb (aka the \news database\) under the web document root with insufficient access control which allows remote attackers to obtain sensitive information such as the unencrypted username and password of the administrator's account.


Mantis before 20041016 provides a complete Issue History (Bug History) in the web interface regardless of view_history_threshold which allows remote attackers to obtain sensitive information (private bug details) by visiting a bug's web page.


The WebLinks module in Php-Nuke 6.x through 7.3 allows remote attackers to obtain sensitive information via an invalid show parameter which displays the full path in a PHP error message.


The firmware for Intelligent Platform Management Interface (IPMI) 1.5-based Intel Server Boards and Platforms is shipped with an Authentication Type Enables parameter set to an invalid None parameter which allows remote attackers to obtain sensitive information when LAN management functionality is enabled.


Information leak in Mbedthis AppWeb HTTP server 1.0 through 1.1.2 allows remote attackers to obtain sensitive information via a user message that is generated when Mbedthis denies access.


Dameware Mini Remote Control 4.1.0.0 uses insufficiently random data to create the encryption key which makes it easier for remote attackers to obtain sensitive information via brute force guessing.


The (1) updateuser.php and (2) forums_prune.php scripts in PHP-Fusion 4.00 allow remote attackers to obtain sensitive information via a direct HTTP request which reveals the installation path in an error message.


McFreeScan.CoMcFreeScan.1 ActiveX object in Mcafee FreeScan allows remote attackers to obtain sensitive information via the GetSpecialFolderLocation function with certain parameters.


YaBB SE 1.5.1 allows remote attackers to obtain sensitive information via a direct HTTP request to Admin.php which reveals the full path in a PHP error message.


Bugzilla 2.17.1 through 2.18rc2 and 2.19 from cvs when using the insidergroup feature does not sufficiently protect private attachments when there are changes to the metadata such as filename description MIME type or review flags which allows remote authenticated users to obtain sensitive information when (1) viewing the bug activity log or (2) receiving bug change notification mails.


Debian GNU/Linux 3.0 installs the libpam-radius-auth package with the pam_radius_auth.conf set to be world-readable which allows local users to obtain sensitive information.


ASP-Nuke 1.3 and earlier places user credentials under the web document root with insufficient access control which allows remote attackers to obtain sensitive information via a direct request to main.mdb.


nqt.php in Network Query Tool (NQT) 1.6 allows remote attackers to obtain sensitive information via a string in the portNum parameter which reveals the full path in an error message.


slxweb.dll in SalesLogix 6.1 allows remote attackers to obtain sensitive information via a (1) Library or (2) Attachment request with an invalid file parameter which reveals the path in an error message.


Coppermine

Photo

Gallery

and

allows

remote

attackers

to

obtain

sensitive

information

via

a

direct

HTTP

request

to

phpinfo.php

addpic.php

config.php

displayecard.php

ecard.php

crop.inc.php

which

reveal

the

full

path

in

a

PHP

error

message.


Zyxel P681 running ZyNOS Vt020225a contains portions of memory in an ARP request which allows remote attackers to obtain sensitive information by sniffing the network.


error.php in Error Manager 2.1 for PHP-Nuke 6.0 allows remote attackers to obtain sensitive information via an invalid (1) language (2) newlang or (3) lang parameter which leaks the pathname in a PHP error message.


4nalbum 0.92 for PHP-Nuke 6.5 through 7.0 allows remote attackers to obtain sensitive information via a direct request to displaycategory.php which reveals the path in an error message.


Dreamweaver MX when \Using Driver On Testing Server\ or \Using DSN on Testing Server\ is selected uploads the mmhttpdb.asp script to the web site but does not require authentication which allows remote attackers to obtain sensitive information and possibly execute arbitrary SQL commands via a direct request to mmhttpdb.asp.


The (1) modules.php (2) block-Calendar.php (3) block-Calendar1.php (4) block-Calendar_center.php scripts in NukeCalendar 1.1.a as used in PHP-Nuke allow remote attackers to obtain sensitive information via a URL with an invalid argument which reveals the full path in an error message.


Trend ScanMail allows remote attackers to obtain potentially sensitive information or disable the anti-virus capability via the smency.nsf file.


The Hawking Technologies HAR11A modem/router allows remote attackers to obtain sensitive information by connecting to port 254 which displays a management interface and information on established connections.


MS Analysis module 2.0 for PHP-Nuke allows remote attackers to obtain sensitive information via a direct request to (1) browsers.php (2) mstrack.php or (3) title.php which reveal the full path in a PHP error message.


Unknown vulnerability in 4D WebSTAR 5.3.2 and earlier allows remote attackers to read the php.ini configuration file and possibly obtain sensitive information.


Mozilla Firefox before the Preview Release Mozilla before 1.7.3 and Thunderbird before 0.8 allows untrusted Javascript code to read and write to the clipboard and possibly obtain sensitive information via script-generated events such as Ctrl-Ins.


PHP 4.3.4 and earlier in Apache 1.x and 2.x (mod_php) can leak global variables between virtual hosts that are handled by the same Apache child process but have different settings which could allow remote attackers to obtain sensitive information.


The JFS file system code in Linux 2.4.x has an information leak in which in-memory data is written to the device for the JFS file system which allows local users to obtain sensitive information by reading the raw device.


The XFS file system code in Linux 2.4.x has an information leak in which in-memory data is written to the device for the XFS file system which allows local users to obtain sensitive information by reading the raw device.


DHCP on Linksys BEFSR11 BEFSR41 BEFSR81 and BEFSRU31 Cable/DSL Routers firmware version 1.45.7 does not properly clear previously used buffer contents in a BOOTP reply packet which allows remote attackers to obtain sensitive information.


Apple Mac OS X 10.3.4 10.4 10.5 and possibly other versions does not properly clear memory for login (aka Loginwindow.app) Keychain or FileVault passwords which could allow the root user or an attacker with physical access to obtain sensitive information by reading memory.


admin.php in PHPGEDVIEW 2.61 allows remote attackers to obtain sensitive information via an action parameter with a phpinfo command.


login.php in phpGedView 2.65 and earlier allows remote attackers to obtain sensitive information via an HTTP request to login.php that does not contain the required username or password parameters which causes the information to be leaked in an error message.


The BT Voyager 2000 Wireless ADSL Router has a default public SNMP community name which allows remote attackers to obtain sensitive information such as the password which is stored in plaintext.


Certain USB drivers in the Linux 2.4 kernel use the copy_to_user function on uninitialized structures which could allow local users to obtain sensitive information by reading memory that was not cleared from previous usage.


The make_recovery command for the TFTP server in HP Ignite-UX before C.6.2.241 makes a copy of the password file in the TFTP directory tree which allows remote attackers to obtain sensitive information.


IBM Atlas eDiscovery Process Management 6.0.3 could allow an authenticated attacker to obtain sensitive information when an unsuspecting user clicks on unsafe third-party links. IBM X-Force ID: 126680.


IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM Reference #: 1998874.


IBM Security Access Manager Appliance 8.0.0 and 9.0.0 could allow a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web site a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 130676.


IBM Emptoris Sourcing 9.5 - 10.1.3 could allow a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web site a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 128177.


IBM Security Guardium 10.0 Database Activity Monitor could allow a local attacker to obtain highly sensitive information via unspecified vectors. IBM X-Force ID: 132550.


IBM Emptoris Supplier Lifecycle Management 10.0.x and 10.1.x could allow a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web site a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 128173.


IBM Team Concert (RTC) 5.0 5.0.1 5.0.2 6.0 6.0.1 6.0.2 6.0.3 6.0.4 and 6.0.5 stores credentials for users using a weak encryption algorithm which could allow an authenticated user to obtain highly sensitive information. IBM X-Force ID: 134393.


IBM Jazz Foundation products could allow an authenticated user to obtain sensitive information from a stack trace that could be used to aid future attacks. IBM X-Force ID: 129719.


IBM UrbanCode Deploy 6.1 and 6.2 could allow an authenticated privileged user to obtain highly sensitive information. IBM X-Force ID: 135547.


IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) could allow an authenticated user to obtain sensitive information from a specially crafted HTTP request that could be used to aid future attacks. IBM X-Force ID: 129970.


IBM Doors Web Access 9.5 and 9.6 could allow an authenticated user to obtain sensitive information from HTTP internal server error responses. IBM X-Force ID: 129825.


IBM Tivoli Endpoint Manager could allow a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web site a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 123902.


IBM WebSphere MQ 9.0.1 and 9.0.2 could allow a local user with ability to run or enable trace to obtain sensitive information from WebSphere Application Server traces including user credentials. IBM X-Force ID: 125145.


IBM Marketing Operations 9.1.0 9.1.2 and 10.1 could allow a remote attacker to obtain sensitive information. An attacker could send a specially-crafted request to cause an error message to be returned containing the full root path. An attacker could use this information to launch further attacks against the affected system. IBM X-Force ID: 121171.


IBM WebSphere Portal 8.5 and 9.0 could allow a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web site a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force. ID: 122592


IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information caused by the failure to set the secure flag for the session cookie in SSL mode. By intercepting its transmission within an HTTP session an attacker could exploit this vulnerability to capture the cookie and obtain sensitive information. IBM Reference #: 1998874.


IBM WebSphere Application Server 7.0 8.0 8.5 and 9.0 could allow a remote attacker to obtain sensitive information caused by improper handling of Administrative Console panel fields. When exploited an attacker could browse the file system. IBM X-Force ID: 134933.


IBM Tivoli Key Lifecycle Manager 2.5 2.6 and 2.7 could allow a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web site a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 133562.


IBM WebSphere Application Server (IBM Liberty for Java for Bluemix 3.15) could allow a local attacker to obtain sensitive information caused by improper handling of application requests which could allow unauthorized access to read a file. IBM X-Force ID: 134003.


IBM Emptoris Sourcing 9.5 - 10.1.3 could allow a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web site a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 128174.


IBM Security Access Manager Appliance 7.0.0 8.0.0 through 8.0.1.6 and 9.0.0 through 9.0.3.1 could allow a remote attacker to obtain sensitive information caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 128610.


IBM WebSphere Commerce Enterprise Professional Express and Developer 6.0 7.0 and 8.0 could allow a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web site a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 127385.


IBM Jazz Foundation products could allow an authenticated user to obtain sensitive information from stack traces. IBM X-Force ID: 131852.


IBM WebSphere Application Server 7.0 8.0 8.5 and 9.0 could allow a remote attacker to obtain sensitive information caused by improper handling of Administrative Console panel fields. When exploited an attacker could read files on the file system. IBM X-Force ID: 134931.


IBM API Connect 5.0.0.0 could allow a remote attacker to obtain sensitive information caused by improper handling of requests to the Developer Portal. IBM X-Force ID: 127002.


IBM Security Guardium 10.0 Database Activity Monitor could allow a local attacker to obtain highly sensitive information via unspecified vectors. IBM X-Force ID: 132549.


IBM API Connect 5.0.7 and 5.0.8 could allow an authenticated remote user to modify query parameters to obtain sensitive information. IBM X-Force ID: 136859.


IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) could allow a remote attacker to obtain sensitive information caused by the failure to properly enable the secure cookie attribute. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 123907.


IBM WebSphere Message Broker (IBM Integration Bus 9.0 and 10.0) could allow an unauthorized user to obtain sensitive information about software versions that could lead to further attacks. IBM X-Force ID: 121341.


IBM Insights Foundation for Energy 1.0 1.5 and 1.6 could allow an authenticated user to obtain sensitive information from error messages. IBM X-Force ID: 121907.


IBM Business Process Manager 8.0 and 8.5 could allow a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web site a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 122891.


IBM Security Identity Governance and Intelligence Virtual Appliance 5.2 through 5.2.3.2 could allow a remote attacker to obtain sensitive information caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 127341.


IBM Tivoli Endpoint Manager (IBM BigFix 9.2 and 9.5) could allow a remote attacker to obtain sensitive information caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 123908.


IBM Rhapsody DM 5.0 and 6.0 could allow a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web site a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.


IBM Maximo Asset Management 7.5 and 7.6 could allow a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web site a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 131548.


IBM Connections 5.0 5.5 and 6.0 could allow a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web site a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 135521.


IBM Curam Social Program Management 6.0 6.1 6.2 and 7.0 could allow a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web site a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 123670.


SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to obtain sensitive information gain unauthorized access or have unspecified other impacts by leveraging incorrect persistent NameID generation when an Identity Provider (IdP) is misconfigured.


Lexmark

Scan

To

Network

(SNF)

and

earlier

stores

network

configuration

credentials

in

plaintext

and

transmits

them

in

requests

which

allows

remote

attackers

to

obtain

sensitive

information

via

requests

to

cgi-bin/direct/printer/prtappauth/apps/snfDestServlet

or

cgi-bin/direct/printer/prtappauth/apps/ImportExportServlet.


The Fastly CDN module before 1.2.26 for Magento2 when used with a third-party authentication plugin might allow remote authenticated users to obtain sensitive information from authenticated sessions via vectors involving caching of redirect responses.


The acpi_ds_create_operands() function in drivers/acpi/acpica/dsutils.c in the Linux kernel through 4.12.9 does not flush the operand cache and causes a kernel stack dump which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table.


The acpi_ns_evaluate() function in drivers/acpi/acpica/nseval.c in the Linux kernel through 4.12.9 does not flush the operand cache and causes a kernel stack dump which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table.


An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the \Kernel\ component. It allows local users to obtain sensitive information by leveraging an error in packet counters.


In ImageMagick before 6.9.7-6 and 7.x before 7.0.4-6 the ReadMATImage function in coders/mat.c uses uninitialized data which might allow remote attackers to obtain sensitive information from process memory.


An issue was discovered in certain Apple products. iOS before 11.1 is affected. The issue involves the \Siri\ component. It allows physically proximate attackers to obtain sensitive information via a Siri request for private-content notifications that should not have been available in the lock-screen state.


The acpi_ps_complete_final_op() function in drivers/acpi/acpica/psobject.c in the Linux kernel through 4.12.9 does not flush the node and node_ext caches and causes a kernel stack dump which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table.


The rend_service_intro_established function in or/rendservice.c in Tor before 0.2.8.15 0.2.9.x before 0.2.9.12 0.3.0.x before 0.3.0.11 0.3.1.x before 0.3.1.7 and 0.3.2.x before 0.3.2.1-alpha when SafeLogging is disabled allows attackers to obtain sensitive information by leveraging access to the log files of a hidden service because uninitialized stack data is included in an error message about construction of an introduction point circuit.


gdi32.dll in Graphics Device Interface (GDI) in Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 and Windows 10 Gold 1511 and 1607 allows remote attackers to obtain sensitive information from process heap memory via a crafted EMF file as demonstrated by an EMR_SETDIBITSTODEVICE record with modified Device Independent Bitmap (DIB) dimensions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-3216 CVE-2016-3219 and/or CVE-2016-3220.


The ReadJPEGImage function in coders/jpeg.c in ImageMagick before 7.0.6-1 allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted file.


The acpi_ns_terminate() function in drivers/acpi/acpica/nsutils.c in the Linux kernel before 4.12 does not flush the operand cache and causes a kernel stack dump which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table.


An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves the \WebKit JavaScript Bindings\ component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.


An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves mishandling of OpenGL shaders in the \WebKit\ component. It allows remote attackers to obtain sensitive information from process memory via a crafted web site.


An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. The issue involves the \WebKit\ component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.


An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. iCloud before 6.2 on Windows is affected. tvOS before 10.2 is affected. The issue involves the \WebKit\ component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted elements on a web site.


An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the \SafariViewController\ component. It allows attackers to obtain sensitive information by leveraging the SafariViewController's incorrect synchronization of Safari cache clearing.


An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the \Hypervisor\ component. It allows guest OS users to obtain sensitive information from the CR8 control register via unspecified vectors.


An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. tvOS before 10.1.1 is affected. The issue involves the \WebKit\ component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.


GroupSession versions 4.6.4 and earlier allows remote authenticated attackers to bypass access restrictions to obtain sensitive information such as emails via unspecified vectors.


It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited in conjunction with a proxy that also permitted the invalid characters but with a different interpretation to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache perform an XSS attack or obtain sensitive information from requests other than their own.


An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the \Intel Graphics Driver\ component. It allows attackers to obtain sensitive information from kernel memory via a crafted app.


An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the \WebKit\ component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.


An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. tvOS before 10.1.1 is affected. watchOS before 3.1.3 is affected. The issue involves the \WebKit\ component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.


An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. iCloud before 6.2 on Windows is affected. iTunes before 12.6 on Windows is affected. tvOS before 10.2 is affected. The issue involves the \WebKit\ component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.


An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the \iBooks\ component. It allows remote attackers to obtain sensitive information from local files via a file: URL in an iBooks file.


The make_response function in drivers/block/xen-blkback/blkback.c in the Linux kernel before 4.11.8 allows guest OS users to obtain sensitive information from host OS (or other guest OS) kernel memory by leveraging the copying of uninitialized padding fields in Xen block-interface response structures aka XSA-216.


Piwigo through 2.9.1 allows remote attackers to obtain sensitive information about the descriptive name of a permalink by examining the redirect URL that is returned in a request for the permalink ID number of a private album. The permalink ID numbers are easily guessed.


The grant-table feature in Xen through 4.8.x provides false mapping information in certain cases of concurrent unmap calls which allows backend attackers to obtain sensitive information or gain privileges aka XSA-218 bug 1.


The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 NVG599 and unspecified other devices when IP Passthrough mode is not used configures an sbdc.ha WAN TCP service on port 61001 with the bdctest account and the bdctest password which allows remote attackers to obtain sensitive information (such as the Wi-Fi password) by leveraging knowledge of a hardware identifier related to the Bulk Data Collection (BDC) mechanism defined in Broadband Forum technical reports.


The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel before 4.13.4 allows local users to obtain sensitive information from uninitialized kernel heap-memory locations via an SG_GET_REQUEST_TABLE ioctl call for /dev/sg0.


The atyfb_ioctl function in drivers/video/fbdev/aty/atyfb_base.c in the Linux kernel through 4.12.10 does not initialize a certain data structure which allows local users to obtain sensitive information from kernel stack memory by reading locations associated with padding bytes.


EE 4GEE WiFi MBB (before EE60_00_05.00_31) devices allow remote attackers to obtain sensitive information via a JSONP endpoint as demonstrated by passwords and SMS content.


The waitid implementation in kernel/exit.c in the Linux kernel through 4.13.4 accesses rusage data structures in unintended cases which allows local users to obtain sensitive information and bypass the KASLR protection mechanism via a crafted system call.


The Vibease Wireless Remote Vibrator app for Android and the Vibease Chat app for iOS use cleartext to exchange messages with other apps and the PLAIN SASL mechanism to send auth tokens to Vibease servers which allows remote attackers to obtain user credentials messages and other sensitive information by sniffing the network for XMPP traffic.


Pulse Secure Pulse One On-Premise 2.0.1649 and below does not properly validate requests which allows remote users to query and obtain sensitive information.


NetApp OnCommand Performance Manager and OnCommand Unified Manager for Clustered Data ONTAP before 7.1P1 improperly bind the Java Management Extension Remote Method Invocation (aka JMX RMI) service to the network which allows remote attackers to obtain sensitive information via unspecified vectors.


QNAP QTS 4.2.6 build 20171026 QTS 4.3.3 build 20170727 and earlier allows remote attackers to obtain potentially sensitive information (firmware version and running services) via a request to sysinfoReq.cgi.


An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the \Keyboard Suggestions\ component. It allows attackers to obtain sensitive information by reading keyboard autocorrect suggestions.


In Undertow 2.x before 2.0.0.Alpha2 1.4.x before 1.4.17.Final and 1.3.x before 1.3.31.Final it was found that the fix for CVE-2017-2666 was incomplete and invalid characters are still allowed in the query string and path parameters. This could be exploited in conjunction with a proxy that also permitted the invalid characters but with a different interpretation to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache perform an XSS attack or obtain sensitive information from requests other than their own.


Samsung Android devices with L(5.0/5.1) M(6.0) and N(7.x) software allow attackers to obtain sensitive information by reading a world-readable log file after an unexpected reboot. The Samsung ID is SVE-2017-8290.


tif_read.c in LibTIFF 4.0.7 does not ensure that tif_rawdata is properly initialized which might allow remote attackers to obtain sensitive information from process memory via a crafted image.


An issue was discovered in certain Apple products. Safari before 11 is affected. The issue involves the \WebKit Storage\ component. It allows attackers to bypass the Safari Private Browsing protection mechanism and consequently obtain sensitive information about visited web sites.


Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c in the Linux kernel through 4.10.9 allows local users to obtain sensitive information from uninitialized stack data by triggering failure of a certain bitmap operation.


fs/ext4/inode.c in the Linux kernel before 4.6.2 when ext4 data=ordered mode is used mishandles a needs-flushing-before-commit list which allows local users to obtain sensitive information from other users' files in opportunistic circumstances by waiting for a hardware reset creating a new file making write system calls and reading this file.


An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the \Notes\ component. It allows local users to obtain sensitive information by reading search results that contain locked-note content.


An issue was discovered in certain Apple products. iOS before 11 is affected. macOS before 10.13 is affected. The issue involves the \Mail Drafts\ component. It allows remote attackers to obtain sensitive information by reading unintended cleartext transmissions.


An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. tvOS before 10.2.2 is affected. The issue involves the \WebKit\ component. It allows remote attackers to conduct a timing side-channel attack to bypass the Same Origin Policy and obtain sensitive information via a crafted web site that uses SVG filters.


The Management Web Interface in Palo Alto Networks PAN-OS before 7.1.9 allows remote authenticated users to obtain sensitive information via unspecified request parameters.


An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the \Phone\ component. It allows attackers to obtain sensitive information by leveraging a timing bug to read a secure-content screenshot that occurred during a locking action.


The Management Web Interface in Palo Alto Networks PAN-OS before 6.1.17 7.x before 7.0.15 and 7.1.x before 7.1.9 allows remote authenticated users to obtain sensitive information by leveraging incorrect permission validation aka PAN-SA-2017-0013 and PAN-70541.


WordPress 4.7.2 mishandles listings of post authors which allows remote attackers to obtain sensitive information (Path Disclosure) via a /wp-json/oembed/1.0/embed?url= request related to the \author_name\:\ substring.


A vulnerability in the web interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated remote attacker to access sensitive data. The attacker could use this information to conduct additional reconnaissance attacks. The vulnerability is due to insufficient protection of sensitive data when responding to an HTTP request on the web interface. An attacker could exploit the vulnerability by sending a crafted HTTP request to the application to access specific system files. An exploit could allow the attacker to obtain sensitive information about the application which could include user credentials. This vulnerability affects Cisco Prime Collaboration Provisioning Software Releases 10.6 through 11.5. Cisco Bug IDs: CSCvc99626.


kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL function with a full https URL (potentially including Basic Authentication credentials a query string or PATH_INFO) which allows remote attackers to obtain sensitive information via a crafted PAC file.


The HTTP and WebSocket engine components in the server in Kaazing Gateway before 4.5.3 hotfix-1 Gateway - JMS Edition before 4.0.5 hotfix-15 4.0.6 before hotfix-4 4.0.7 4.0.9 before hotfix-19 4.4.x before 4.4.2 hotfix-1 4.5.x before 4.5.3 hotfix-1 and Gateway Community and Enterprise Editions before 5.6.0 allow remote attackers to bypass intended access restrictions and obtain sensitive information via vectors related to HTTP request handling.


Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06 Camera Firmware 2.400.0000.28.R 2016-03-29 and SmartPSS Software 1.16.1 2017-01-19 send cleartext passwords in response to requests from the Web Page Mobile Application and Desktop Application interfaces which allows remote attackers to obtain sensitive information by sniffing the network a different vulnerability than CVE-2013-6117.


QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information via unspecified vectors.


Use of uninitialized memory in Skia in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.


An issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to obtain sensitive information from the host OS (or an arbitrary guest OS) because intercepted I/O operations can cause a write of data from uninitialized hypervisor stack memory.


The configuration file import for applications spyware and vulnerability objects functionality in the web interface in Palo Alto Networks PAN-OS before 6.1.19 7.0.x before 7.0.19 and 7.1.x before 7.1.14 allows remote attackers to conduct server-side request forgery (SSRF) attacks and consequently obtain sensitive information via vectors related to parsing of external entities.


In the \Diary with lock\ (aka WriteDiary) application 4.72 for Android neither HTTPS nor other encryption is used for transmitting data despite the documentation that the product is intended for \a personal journal of ... secrets and feelings \ which allows remote attackers to obtain sensitive information by sniffing the network during LoginActivity or NoteActivity execution.


AltaVault OST Plug-in versions prior to 1.2.2 may allow attackers to obtain sensitive information via unspecified vectors. All users are urged to move to a fixed version and change passwords used by Veritas NetBackup to access the OST shares on the NetApp AltaVault as a precaution.


Artifex Ghostscript 9.22 is affected by: Obtain Information. The impact is: obtain sensitive information. The component is: affected source code file affected function affected executable affected libga (imagemagick used that). The attack vector is: Someone must open a postscript file though ghostscript. Because of imagemagick also use libga so it was affected as well.


bgpd in FRRouting (FRR) before 2.0.2 and 3.x before 3.0.2 as used in Cumulus Linux before 3.4.3 and other products allows remote attackers to obtain sensitive information via a malformed BGP UPDATE packet from a connected peer which triggers transmission of up to a few thousand unintended bytes because of a mishandled attribute length aka RN-690 (CM-18492).


Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles the rendering of wiki links which allows remote attackers to obtain sensitive information.


XML

external

entity

(XXE)

vulnerability

in

Umbraco

CMS

before

allows

attackers

to

obtain

sensitive

information

by

reading

files

on

the

server

or

sending

TCP

requests

to

intranet

hosts

(aka

SSRF)

related

to


Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles Time Entry rendering in activity views which allows remote attackers to obtain sensitive information.


Samba before 4.7.3 might allow remote attackers to obtain sensitive information by leveraging failure of the server to clear allocated heap memory.


In Redmine before 3.2.6 and 3.3.x before 3.3.3 remote attackers can obtain sensitive information (password reset tokens) by reading a Referer log because account/lost_password does not use a redirect.


A debug tool in Synaptics TouchPad drivers allows local users with administrative access to obtain sensitive information about keyboard scan codes by modifying registry keys.


Homeputer CL Studio fur HomeMatic 4.0 Rel 160808 and earlier uses cleartext to exchange the username and password between server and client instances which allows remote attackers to obtain sensitive information via a man in the middle attack.


BA SYSTEMS BAS Web on BAS920 devices (with Firmware 01.01.00* HTTPserv 00002 and Script 02.*) and ISC2000 devices allows remote attackers to obtain sensitive information via a request for isc/get_sid_js.aspx or isc/get_sid.aspx as demonstrated by obtaining administrative access by subsequently using the credential information for the Supervisor/Administrator account.


The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel through 4.14.4 when CONFIG_NLMON is enabled does not restrict observations of Netlink messages to a single net namespace which allows local users to obtain sensitive information by leveraging the CAP_NET_ADMIN capability to sniff an nlmon interface for all Netlink activity on the system.


Samsung Internet Browser 6.2.01.12 allows remote attackers to bypass the Same Origin Policy and conduct UXSS attacks to obtain sensitive information via vectors involving an IFRAME element inside XSLT data in one part of an MHTML file. Specifically JavaScript code in another part of this MHTML file does not have a document.domain value corresponding to the domain that is hosting the MHTML file but instead has a document.domain value corresponding to an arbitrary URL within the content of the MHTML file.


Scubez Posty Readymade Classifieds has Incorrect Access Control for visiting admin/user_activate_submit.php (aka the backend PHP script) which might allow remote attackers to obtain sensitive information via a direct request.


An issue was discovered in Xen through 4.9.x on the ARM platform allowing guest OS users to obtain sensitive information from DRAM after a reboot because disjoint blocks and physical addresses that do not start at zero are mishandled.


Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.5 before build 67.13 11.0 before build 71.22 11.1 before build 56.19 and 12.0 before build 53.22 allow remote attackers to obtain sensitive information from the backend client TLS handshake by leveraging use of TLS with Client Certificates and a Diffie-Hellman Ephemeral (DHE) key exchange.


Vivo modems allow remote attackers to obtain sensitive information by reading the index.cgi?page=wifi HTML source code as demonstrated by ssid and psk_wepkey fields.


fileio.c in Vim prior to 8.0.1263 sets the group ownership of a .swp file to the editor's primary group (which may be different from the group ownership of the original file) which allows local users to obtain sensitive information by leveraging an applicable group membership as demonstrated by /etc/shadow owned by root:shadow mode 0640 but /etc/.shadow.swp owned by root:users mode 0640 a different vulnerability than CVE-2017-1000382.


Samsung Internet Browser 5.4.02.3 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code that redirects to a child tab and rewrites the innerHTML property.


Dolibarr ERP/CRM version 6.0.4 does not block direct requests to *.tpl.php files which allows remote attackers to obtain sensitive information.


In

Laravel

framework

through

remote

attackers

can

obtain

sensitive

information

(such

as

externally

usable

passwords)

via

a

direct

request

for

the

/.env

URI.

NOTE:

this

CVE

is

only

about

Laravel

framework's

writeNewEnvironmentFileWith

function

in

which

uses

without

restricting

the

.env

permissions.

The

.env

filename

is

not

used

exclusively

by

Laravel

framework.


In Redmine before 3.2.7 and 3.3.x before 3.3.4 the reminders function in app/models/mailer.rb does not check whether an issue is visible which allows remote authenticated users to obtain sensitive information by reading e-mail reminder messages.


The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel before 4.14.2 mishandles holes in hugetlb ranges which allows local users to obtain sensitive information from uninitialized kernel memory via crafted use of the mincore() system call.


Use of an uninitialized value in Skia in Google Chrome prior to 61.0.3163.79 for Linux and Windows allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.


The klsi_105_get_line_state function in drivers/usb/serial/kl5kusb105.c in the Linux kernel before 4.9.5 places uninitialized heap-memory contents into a log entry upon a failure to read the line status which allows local users to obtain sensitive information by reading the log.


in

the

REST

API

implementation

in

WordPress

before

does

not

properly

restrict

listings

of

post

authors

which

allows

remote

attackers

to

obtain

sensitive

information

via

a

request.


Use of an uninitialized value in Skia in Google Chrome prior to 60.0.3112.78 for Linux Windows and Mac allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.


Use of an uninitialized value in Skia in Google Chrome prior to 60.0.3112.78 for Mac Windows Linux and Android allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.


Odoo Version <= 8.0-20160726 and Version 9 is affected by: CWE-601: Open redirection. The impact is: obtain sensitive information (remote).


Off-by-one error in the pipe_advance function in lib/iov_iter.c in the Linux kernel before 4.9.5 allows local users to obtain sensitive information from uninitialized heap-memory locations in opportunistic circumstances by reading from a pipe after an incorrect buffer-release decision.


Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitive information by leveraging the Python string format method.


The autocomplete feature in the E-Mail share dialog in ownCloud Server before 8.1.11 8.2.x before 8.2.9 9.0.x before 9.0.7 and 9.1.x before 9.1.3 allows remote authenticated users to obtain sensitive information via unspecified vectors.


Riverbed RiOS through 9.6.0 deletes the secure vault with the rm program (not shred or srm) which makes it easier for physically proximate attackers to obtain sensitive information by reading raw disk blocks.


The NetApp ONTAP Select Deploy administration utility 2.0 through 2.2.1 might allow remote attackers to obtain sensitive information via unspecified vectors.


Use of an uninitialized value in Skia in Google Chrome prior to 61.0.3163.79 for Mac Windows and Linux and 61.0.3163.81 for Android allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.


An issue was discovered in Mattermost Server before 4.2.0 4.1.1 and 4.0.5. It allows attackers to obtain sensitive information (user statuses) via a REST API version 4 endpoint.


Parity Browser 1.6.10 and earlier allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by requesting other websites via the Parity web proxy engine (reusing the current website's token which is not bound to an origin).


In meta/classes/package_ipk.bbclass in Poky in poky-pyro 17.0.0 for Yocto Project through YP Core - Pyro 2.3 attackers can obtain sensitive information by reading a URL in a Source entry in an ipk package.


KDE kmail before 5.5.2 and messagelib before 5.5.2 as distributed in KDE Applications before 17.04.2 do not ensure that a plugin's sign/encrypt action occurs during use of the Send Later feature which allows remote attackers to obtain sensitive information by sniffing the network.


The

Comcast

firmware

on

Cisco

(firmware

version

Cisco

(firmware

version

Cisco

(firmware

version

Cisco

(firmware

version

and

Arris

(eMTA&DOCSIS

version

software

version

devices

does

not

include

the

HTTPOnly

flag

in

a

Set-Cookie

header

for

administration

applications

which

makes

it

easier

for

remote

attackers

to

obtain

potentially

sensitive

information

via

script

access

to

cookies.


Metadata Anonymisation Toolkit (MAT) 0.6 and 0.6.1 silently fails to perform \Clean metadata\ actions upon invocation from the Nautilus contextual menu which allows context-dependent attackers to obtain sensitive information by reading a file for which cleaning had been attempted.


The

function

(accessible

via

in

in

the

Linux

kernel

through

defines

a

variable

but

does

not

give

it

an

initial

value.

If

one

attempts

to

create

a

GB

surface

with

a

previously

allocated

DMA

buffer

to

be

used

as

a

backup

buffer

the

variable

does

not

get

written

to

and

is

then

later

returned

to

user

space

allowing

local

users

to

obtain

sensitive

information

from

uninitialized

kernel

memory

via

a

crafted

ioctl

call.


Wireless IP Camera (P2P) WIFICAM devices have an \Apple Production IOS Push Services\ private RSA key and certificate stored in /system/www/pem/ck.pem inside the firmware which allows attackers to obtain sensitive information.


OceanStor 5800 V3 with software V300R002C00 and V300R002C10 OceanStor 6900 V3 V300R001C00 has an information leakage vulnerability. Products use TLS1.0 to encrypt. Attackers can exploit TLS1.0's vulnerabilities to decrypt data to obtain sensitive information.


The edge_bulk_in_callback function in drivers/usb/serial/io_ti.c in the Linux kernel before 4.10.4 allows local users to obtain sensitive information (in the dmesg ringbuffer and syslog) from uninitialized kernel memory by using a crafted USB device (posing as an io_ti USB serial device) to trigger an integer underflow.


Wireless IP Camera (P2P) WIFICAM devices rely on a cleartext UDP tunnel protocol (aka the Cloud feature) for communication between an Android application and a camera device which allows remote attackers to obtain sensitive information by sniffing the network.


The OS Installation Management component in CA Client Automation r12.9 r14.0 and r14.0 SP1 places an encrypted password into a readable local file during operating system installation which allows local users to obtain sensitive information by reading this file after operating system installation.


FusionSphere OpenStack with software V100R006C00SPC102(NFV) and V100R006C10 have an information leak vulnerability. Due to an incorrect configuration item the information transmitted by a transmission channel is not encrypted. An attacker accessing the internal network may obtain sensitive information transmitted.


vbf_stp_error in bin/varnishd/cache/cache_fetch.c in Varnish HTTP Cache 4.1.x before 4.1.9 and 5.x before 5.2.1 allows remote attackers to obtain sensitive information from process memory because a VFP_GetStorage buffer is larger than intended in certain circumstances involving -sfile Stevedore transient objects.


Schneider Electric StruxureWare Data Center Expert before 7.4.0 uses cleartext RAM storage for passwords which might allow remote attackers to obtain sensitive information via unspecified vectors.


Schneider Electric Telvent Sage 2300 RTUs with firmware before C3413-500-S01 and LANDAC II-2 Sage 1410 Sage 1430 Sage 1450 Sage 2400 and Sage 3030M RTUs with firmware before C3414-500-S02J2 allow remote attackers to obtain sensitive information from device memory by reading a padding field of an Ethernet packet.


The setBackground function in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13 Acrobat and Acrobat Reader DC Classic before 2015.006.30094 and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to obtain sensitive information from process memory via invalid arguments a different vulnerability than CVE-2015-6697 CVE-2015-6699 CVE-2015-6701 CVE-2015-6702 CVE-2015-6703 and CVE-2015-6704.


The animations property implementation in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13 Acrobat and Acrobat Reader DC Classic before 2015.006.30094 and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to obtain sensitive information from process memory via a function call a different vulnerability than CVE-2015-6697 CVE-2015-6699 CVE-2015-6700 CVE-2015-6701 CVE-2015-6702 and CVE-2015-6703.


The Audio component in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to obtain sensitive information via a crafted audio file as demonstrated by obtaining Signature or SignatureOrSystem access aka internal bug 24211743.


HPE UCMDB Browser before 4.02 allows remote attackers to obtain sensitive information or bypass intended access restrictions via unspecified vectors.


IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server 5.5 before 5.5.6.1 6.3 before 6.3.1.5 6.4 before 6.4.1.7 and 7.1 before 7.1.2; Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server 5.5 before 5.5.1.1 6.1 before 6.1.3.7 6.3 before 6.3.1.5 6.4 before 6.4.1.7 and 7.1 before 7.1.2; and Tivoli Storage FlashCopy Manager 3.1 before 3.1.1.5 3.2 before 3.2.1.7 and 4.1 before 4.1.2 when application tracing is used place cleartext passwords in exception messages which allows physically proximate attackers to obtain sensitive information by reading trace output a different vulnerability than CVE-2015-4949.


The addForegroundSprite function in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13 Acrobat and Acrobat Reader DC Classic before 2015.006.30094 and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to obtain sensitive information from process memory via invalid arguments a different vulnerability than CVE-2015-6697 CVE-2015-6700 CVE-2015-6701 CVE-2015-6702 CVE-2015-6703 and CVE-2015-6704.


libstagefright in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to obtain sensitive information and consequently bypass an unspecified protection mechanism via unknown vectors as demonstrated by obtaining Signature or SignatureOrSystem access aka internal bug 24310423.


Bouncy Castle in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to obtain sensitive information via a crafted application aka internal bug 24106146.


The Native Frameworks Library in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to obtain sensitive information and consequently bypass an unspecified protection mechanism via unknown vectors as demonstrated by obtaining Signature or SignatureOrSystem access aka internal bug 23905002.


Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets which makes it easier for context-dependent attackers to obtain sensitive information by leveraging access to a database backup.


The ambientIlluminationColor property implementation in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13 Acrobat and Acrobat Reader DC Classic before 2015.006.30094 and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to obtain sensitive information from process memory via a function call a different vulnerability than CVE-2015-6697 CVE-2015-6699 CVE-2015-6700 CVE-2015-6702 CVE-2015-6703 and CVE-2015-6704.


Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux Adobe AIR before 19.0.0.190 Adobe AIR SDK before 19.0.0.190 and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to bypass the Same Origin Policy and obtain sensitive information via unspecified vectors.


libstagefright in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to obtain sensitive information and consequently bypass an unspecified protection mechanism via unknown vectors as demonstrated by obtaining Signature or SignatureOrSystem access aka internal bug 24346430.


The GetResource servlet in Pentaho Business Analytics (BA) Suite 4.5.x 4.8.x and 5.0.x through 5.2.x and Pentaho Data Integration (PDI) Suite 4.3.x 4.4.x and 5.0.x through 5.2.x does not restrict access to files in the pentaho-solutions/system folder which allows remote attackers to obtain passwords and other sensitive information via a file name in the resource parameter.


Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13 Acrobat and Acrobat Reader DC Classic before 2015.006.30094 and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors a different vulnerability than CVE-2015-5583 CVE-2015-6706 and CVE-2015-7624.


The mDNS module in Huawei WLAN AC6005 AC6605 and ACU2 devices with software before V200R006C00SPC100 allows remote attackers to obtain sensitive information by leveraging failure to restrict processing of mDNS unicast queries to the link local network.


Eaton Cooper Power Systems ProView 4.x and 5.x before 5.1 on Form 6 controls and Idea and IdeaPLUS relays does not properly initialize padding fields in Ethernet packets which allows remote attackers to obtain sensitive information by reading packet data.


The guest portal in Cisco Identity Services Engine (ISE) 3300 1.2(0.899) does not restrict access to uploaded HTML documents which allows remote attackers to obtain sensitive information from customized documents via a direct request aka Bug ID CSCuo78045.


System Server in Android 6.0 before 2015-12-01 allows attackers to obtain sensitive information via a crafted application as demonstrated by obtaining Signature or SignatureOrSystem access aka internal bug 23999740.


mediaserver in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to obtain sensitive information and consequently bypass an unspecified protection mechanism via unknown vectors aka internal bugs 23905951 23912202 23953967 23696300 23600291 23756261 23541506 23284974 23542351 and 23542352 a different vulnerability than CVE-2015-8074.


Cisco Content Delivery System Manager Software 3.2 on Videoscape Distribution Suite Service Manager allows remote attackers to obtain sensitive information via crafted URLs in REST API requests aka Bug ID CSCuv86960.


The kernel in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to obtain sensitive information and consequently bypass an unspecified protection mechanism via unknown vectors as demonstrated by obtaining Signature or SignatureOrSystem access aka internal bug 24157888.


Cisco DPQ3925 devices with EDVA r1 Base allow remote attackers to obtain sensitive information via a crafted HTTP request aka Bug ID CSCuv03958.


HP Insight Control server provisioning before 7.5.0 RabbitMQ allows remote attackers to obtain sensitive information via unspecified vectors.


The loadFlashMovie function in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13 Acrobat and Acrobat Reader DC Classic before 2015.006.30094 and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to obtain sensitive information from process memory via invalid arguments a different vulnerability than CVE-2015-6697 CVE-2015-6699 CVE-2015-6700 CVE-2015-6701 CVE-2015-6702 and CVE-2015-6704.


Media Framework in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to obtain sensitive information and consequently bypass an unspecified protection mechanism via unknown vectors as demonstrated by obtaining Signature or SignatureOrSystem access aka internal bug 24074485.


Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13 Acrobat and Acrobat Reader DC Classic before 2015.006.30094 and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allow attackers to obtain sensitive information about color objects from process memory by reading a light object's RGB data a different vulnerability than CVE-2015-6699 CVE-2015-6700 CVE-2015-6701 CVE-2015-6702 CVE-2015-6703 and CVE-2015-6704.


The createSquareMesh function in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13 Acrobat and Acrobat Reader DC Classic before 2015.006.30094 and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to obtain sensitive information from process memory via invalid arguments a different vulnerability than CVE-2015-6697 CVE-2015-6699 CVE-2015-6700 CVE-2015-6701 CVE-2015-6703 and CVE-2015-6704.


libstagefright in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to obtain sensitive information and consequently bypass an unspecified protection mechanism via unknown vectors as demonstrated by obtaining Signature or SignatureOrSystem access aka internal bug 24623447.


Wi-Fi in Android 5.x before 5.1.1 LMY48Z allows attackers to obtain sensitive information via unspecified vectors as demonstrated by obtaining Signature or SignatureOrSystem access aka internal bug 22667667.


Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13 Acrobat and Acrobat Reader DC Classic before 2015.006.30094 and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors a different vulnerability than CVE-2015-5583 CVE-2015-6705 and CVE-2015-7624.


The debug-logging (aka debug cns) feature in Cisco Networking Services (CNS) for IOS 15.2(2)E3 allows local users to obtain sensitive information by reading an unspecified file aka Bug ID CSCux18010.


Veritas NetBackup 7.x through 7.5.0.7 and 7.6.0.x through 7.6.0.4 and NetBackup Appliance through 2.5.4 and 2.6.0.x through 2.6.0.4 do not use TLS for administration-console traffic to the NBU server which allows remote attackers to obtain sensitive information by sniffing the network for key-exchange packets.


System Server in Android 6.0 before 2015-12-01 allows attackers to obtain sensitive information and consequently gain privileges via a crafted application aka internal bug 23936840.


The shouldTreatAsUniqueOrigin function in platform/weborigin/SecurityOrigin.cpp in Blink as used in Google Chrome before 46.0.2490.71 does not ensure that the origin of a LocalStorage resource is considered unique which allows remote attackers to obtain sensitive information via vectors involving a blob: URL.


The administration UI in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.1 Build 133.9 10.5 before Build 58.11 and 10.5.e before Build 56.1505.e on NetScaler Service Delivery Appliance Service VM (SVM) devices allows attackers to obtain sensitive information via unspecified vectors.


IBM Rational Engineering Lifecycle Manager 3.0 before 3.0.1.6 iFix7 Interim Fix 1 and 4.0 before 4.0.7 iFix10 allow remote authenticated users with access to lifecycle projects to obtain sensitive information by sending a crafted URL to the Lifecycle Query Engine. IBM X-Force ID: 108619.


rx/rx.c in OpenAFS 1.5.75 through 1.5.78 1.6.x before 1.6.15 and 1.7.x before 1.7.33 does not properly initialize padding at the end of an Rx acknowledgement (ACK) packet which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.


The Update Installer in IBM WebSphere Commerce Enterprise 7.0.0.8 and 7.0.0.9 does not properly replicate the search index which allows attackers to obtain sensitive information via unspecified vectors.


eWON devices with firmware before 10.1s0 omit RBAC for I/O server information and status requests which allows remote attackers to obtain sensitive information via an unspecified URL.


Adcon Telemetry A840 Telemetry Gateway Base Station allows remote attackers to obtain sensitive information by sniffing the network.


The Scheduler in IBM Maximo Asset Management 7.5 before 7.5.0.8 IF6 and 7.6 before 7.6.0.1 FP1 and Maximo Asset Management 7.5 before 7.5.0.8 IF6 7.5.1 and 7.6 before 7.6.0.1 FP1 for SmartCloud Control Desk allows remote authenticated users to bypass intended access restrictions and obtain sensitive information or modify data via unspecified vectors.


IBM

Rational

Collaborative

Lifecycle

Management

(CLM)

before

before

before

and

before

Rational

Quality

Manager

(RQM)

before

before

before

and

before

Rational

Team

Concert

(RTC)

before

before

before

and

before

Rational

Requirements

Composer

(RRC)

before

Rational

DOORS

Next

Generation

(RDNG)

before

before

before

and

before

Rational

Engineering

Lifecycle

Manager

(RELM)

before

before

and

before

Rational

Rhapsody

Design

Manager

(Rhapsody

DM)

before

before

before

and

before

Rational

Software

Architect

Design

Manager

(RSA

DM)

before

before

before

and

before

allow

local

users

to

obtain

sensitive

information

by

leveraging

weak

encryption.

IBM

X-Force

ID:


Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 provides different error messages for failed login attempts in unspecified circumstances which allows remote attackers to obtain sensitive information via a series of requests.


sosreport in SoS 3.x allows local users to obtain sensitive information from sosreport files or gain privileges via a symlink attack on an archive file in a temporary directory as demonstrated by sosreport-$hostname-$date.tar in /tmp/sosreport-$hostname-$date.


Queue Watcher in IBM Sterling B2B Integrator 5.2 allows local users to obtain sensitive information via unspecified vectors.


Puppet Server in Puppet Enterprise before 3.8.x before 3.8.3 and 2015.2.x before 2015.2.3 uses world-readable permissions for the private key of the Certification Authority (CA) certificate during the initial installation and configuration which might allow local users to obtain sensitive information via unspecified vectors.


Mozilla Firefox before 43.0 does not properly restrict the availability of IFRAME Resource Timing API times which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code that leverages history.back and performance.getEntries calls a related issue to CVE-2015-1300.


OpenStack Ironic 4.2.0 through 4.2.1 does not \clean\ the disk after use which allows remote authenticated users to obtain sensitive information.


Remote Artifact Loader (RAL) in IBM WebSphere Process Server 7 and Business Process Manager Advanced 7.5 through 7.5.1.2 8.0 through 8.0.1.3 8.5.0 through 8.5.0.2 8.5.5 through 8.5.5.0 and 8.5.6 through 8.5.6.2 does not properly use SSL for its HTTPS connection which allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors.


The Apple iWork application before 2.6 for iOS Apple Keynote before 6.6 Apple Pages before 5.6 and Apple Numbers before 3.6 allow remote attackers to obtain sensitive information via a crafted document.


rx/rx.c in OpenAFS before 1.6.15 and 1.7.x before 1.7.33 does not properly initialize the padding of a data structure when constructing an Rx acknowledgement (ACK) packet which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.


IBM Multi-Enterprise Integration Gateway 1.0 through 1.0.0.1 and B2B Advanced Communications 1.x before 1.0.0.4 when guest access is configured allow remote authenticated users to obtain sensitive information by reading error messages in responses.


The Administration Views module 7.x-1.x before 7.x-1.5 for Drupal checks access permissions based on the router path from the view instead of the display property which allows remote attackers to obtain sensitive information via vectors related to the access handler.


SAP Mobile Platform 3.0 SP05 ClientHub allows attackers to obtain the keystream and other sensitive information via the DataVault aka SAP Security Note 2094830.


eWON devices with firmware through 10.1s0 support unspecified GET requests which might allow remote attackers to obtain sensitive information by reading (1) web-server access logs (2) web-server Referer logs or (3) the browser history.


The RESTful module 7.x-1.x before 7.x-1.3 for Drupal does not properly cache pages of authenticated users when using non-cookie authentication providers which allows remote attackers to obtain sensitive information via unspecified vectors.


The Data Protection extension in the VMware GUI in IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware (aka Spectrum Protect for Virtual Environments) 7.1 before 7.1.4 and Tivoli Storage FlashCopy Manager for VMware (aka Spectrum Protect Snapshot) 4.1 before 4.1.4 allows remote authenticated users to restore arbitrary virtual machines and consequently obtain sensitive information by visiting the vSphere inventory.


IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server (aka Spectrum Protect for Databases) 5.5 before 5.5.6.2 6.3 before 6.3.1.6 6.4 before 6.4.1.8 and 7.1 before 7.1.4; Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server (aka Spectrum Protect for Mail) 5.5 before 5.5.1.1 6.1 and 6.3 before 6.3.1.6 6.4 before 6.4.1.8 and 7.1 before 7.1.4; and Tivoli Storage FlashCopy Manager for Windows (aka Spectrum Protect Snapshot) 2.x and 3.1 before 3.1.1.6 3.2 before 3.2.1.8 and 4.1 before 4.1.4 when application tracing is configured write cleartext passwords during changetsmpassword command execution which allows local users to obtain sensitive information by reading the application trace output.


The

SecEmailComposer/EmailComposer

application

in

the

Samsung

Edge

before

the

October

MR

uses

weak

permissions

for

the

com.samsung.android.email.intent.action.QUICK_REPLY_BACKGROUND

service

action

which

might

allow

remote

attackers

with

knowledge

of

the

local

email

address

to

obtain

sensitive

information

via

a

crafted

application

that

sends

a

crafted

intent.


The Secondary server in Threat Intelligence Exchange (TIE) before 1.2.0 uses weak permissions for unspecified (1) configuration files and (2) installation logs which allows local users to obtain sensitive information by reading the files.


Unspecified vulnerability in GSKit on IBM MQ M2000 appliances before 8.0.0.4 allows remote attackers to obtain sensitive information via unknown vectors a different vulnerability than CVE-2015-7420.


The dgnc_mgmt_ioctl function in drivers/staging/dgnc/dgnc_mgmt.c in the Linux kernel through 4.3.3 does not initialize a certain structure member which allows local users to obtain sensitive information from kernel memory via a crafted application.


IBM Maximo Asset Management 7.1 through 7.1.1.13 7.5.0 before 7.5.0.9 IFIX002 and 7.6.0 before 7.6.0.3 IFIX001; Maximo Asset Management 7.5.0 before 7.5.0.9 IFIX002 7.5.1 and 7.6.0 before 7.6.0.3 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products allow local users to obtain sensitive information by leveraging administrative privileges and reading log files.


The com_contenthistory component in Joomla! 3.2 before 3.4.5 does not properly check ACLs which allows remote attackers to obtain sensitive information via unspecified vectors.


IDE SCM in Apple Xcode before 7.2 does not recognize .gitignore files which allows remote attackers to obtain sensitive information in opportunistic circumstances by leveraging the presence of a file matching an ignore pattern.


The com_content component in Joomla! 3.x before 3.4.5 does not properly check ACLs which allows remote attackers to obtain sensitive information via unspecified vectors.


IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27 6.1.5 through 6.1.5.3 CF27 7.0.0 through 7.0.0.2 CF29 8.0.0 before 8.0.0.1 CF20 and 8.5.0 before CF09 allows remote attackers to bypass intended Portal AccessControl REST API access restrictions and obtain sensitive information via unspecified vectors.


The URL parsing implementation in Mozilla Firefox before 42.0 improperly recognizes escaped characters in hostnames within Location headers which allows remote attackers to obtain sensitive information via vectors involving a redirect.


Unspecified vulnerability in GSKit on IBM MQ M2000 appliances before 8.0.0.4 allows remote attackers to obtain sensitive information via unknown vectors a different vulnerability than CVE-2015-7421.


The

function

in

in

the

Linux

kernel

through

does

not

initialize

a

certain

structure

member

which

allows

local

users

to

obtain

sensitive

information

from

kernel

memory

via

a

crafted

application.


Mozilla Firefox before 43.0 stores cookies containing vertical tab characters which allows remote attackers to obtain sensitive information by reading HTTP Cookie headers.


Mozilla Firefox before 41.0 does not properly restrict the availability of High Resolution Time API times which allows remote attackers to track last-level cache access and consequently obtain sensitive information via crafted JavaScript code that makes performance.now calls.


Notification Center in Apple iOS before 9.1 mishandles changes to \Show on Lock Screen\ settings which allows physically proximate attackers to obtain sensitive information by looking for a (1) Phone or (2) Messages notification on the lock screen soon after a setting was disabled.


Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux Adobe AIR before 19.0.0.213 Adobe AIR SDK before 19.0.0.213 and Adobe AIR SDK & Compiler before 19.0.0.213 allow remote attackers to bypass the Same Origin Policy and obtain sensitive information via unspecified vectors.


D-Link DVG-N5402SP with firmware W1000CN-00 W1000CN-03 or W2000EN-00 discloses usernames passwords keys values and web account hashes (super and admin) in plaintext when running a configuration backup which allows remote attackers to obtain sensitive information.


Revive Adserver before 3.2.2 does not send the appropriate Cache-Control HTTP headers in responses for admin UI pages which allows local users to obtain sensitive information via the web browser cache.


IBM InfoSphere Master Data Management (MDM) - Collaborative Edition 9.1 10.1 11.0 11.3 11.4 and 11.5 allow remote authenticated users to bypass intended access restrictions and obtain sensitive information by leveraging Catalogs access. IBM X-Force ID: 107780.


Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 sends cleartext credentials which allows remote attackers to obtain sensitive information by sniffing the network.


IBM WebSphere Message Broker 7 before 7.0.0.8 and 8 before 8.0.0.6 and IBM Integration Bus 9 before 9.0.0.3 and 10 before 10.0.0.0 allow remote attackers to obtain sensitive information about the HTTP server via unspecified vectors.


Siemens RUGGEDCOM ROS before 4.2.1 allows remote attackers to obtain sensitive information by sniffing the network for VLAN data within the padding section of an Ethernet frame.


IBM Maximo Asset Management 7.5 before 7.5.0.9 FP9 and 7.6 before 7.6.0.3 FP3 and Maximo Asset Management 7.5 before 7.5.0.9 FP9 7.5.1 and 7.6 before 7.6.0.3 FP3 for SmartCloud Control Desk allow remote authenticated users to obtain sensitive information via the REST API.


Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13 Acrobat and Acrobat Reader DC Classic before 2015.006.30094 and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors a different vulnerability than CVE-2015-5583 CVE-2015-6705 and CVE-2015-6706.


VeeamVixProxy in Veeam Backup & Replication (B&R) before 8.0 update 3 stores local administrator credentials in log files with world-readable permissions which allows local users to obtain sensitive information by reading the files.


HP CentralView Fraud Risk Management 11.1 11.2 and 11.3; CentralView Revenue Leakage Control 4.1 4.2 and 4.3; CentralView Dealer Performance Audit 2.0 and 2.1; CentralView Credit Risk Control 2.1 2.2 and 2.3; CentralView Roaming Fraud Control 2.1 2.2 and 2.3; and CentralView Subscription Fraud Prevention 2.0 and 2.1 allow remote attackers to obtain sensitive information via unspecified vectors a different vulnerability than CVE-2015-5406 and CVE-2015-5408.


The Administration and Reporting tool in IBM Rational License Key Server (RLKS) before 8.1.4.9 iFix 04 allows local users to obtain sensitive information via unspecified vectors. IBM X-Force ID: 106938.


TIBCO Managed File Transfer Internet Server before 7.2.5 Managed File Transfer Command Center before 7.2.5 Slingshot before 1.9.4 and Vault before 2.0.1 allow remote authenticated users to obtain sensitive information via a crafted HTTP request.


HP Virtual Connect Enterprise Manager (VCEM) SDK before 7.5.0 as used in HP Matrix Operating Environment before 7.5.0 and other products allows remote attackers to obtain sensitive information or modify data via unspecified vectors.


The

JVM

in

IBM

SDK

Java

Technology

Edition

before

before

before

and

before

allows

remote

attackers

to

obtain

sensitive

information

or

inject

data

by

invoking

non-public

interface

methods.


HP Asset Manager 9.40 and 9.41 before 9.41.11103 P4-rev1 and 9.50 before 9.50.11925 P3 allows local users to obtain sensitive information via unspecified vectors.


HP Systems Insight Manager (SIM) before 7.5.0 as used in HP Matrix Operating Environment before 7.5.0 and other products allows remote authenticated users to obtain sensitive information via unspecified vectors a different vulnerability than CVE-2015-2139.


The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.4 and 1.13.x before 1.13.1 when a case-insensitive filesystem is used allow remote attackers to obtain sensitive information via vectors related to inclusion of .pbl files from WML. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-5069.


Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config (2) temp or (3) logs directory.


The sidepanel widgets in the CLI command overview and help pages in Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to the pages.


IBM

Java

Security

Components

in

IBM

SDK

Java

Technology

Edition

before

before

before

before

and

before

allow

physically

proximate

attackers

to

obtain

sensitive

information

by

reading

the

Kerberos

Credential

Cache.


HP Version Control Repository Manager (VCRM) before 7.5.0 allows remote authenticated users to gain privileges and obtain sensitive information via unspecified vectors.


Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12 Acrobat and Acrobat Reader DC Classic before 2015.006.30060 and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors a different vulnerability than CVE-2014-8450 CVE-2015-4449 CVE-2015-4450 CVE-2015-5088 and CVE-2015-5092.


The Shipwire API module 7.x-1.x before 7.x-1.03 for Drupal does not check the view permission for the shipments overview (admin/shipwire/shipments) which allows remote attackers to obtain sensitive information via a request to the page.


The rating component in Moodle through 2.6.11 2.7.x before 2.7.10 2.8.x before 2.8.8 and 2.9.x before 2.9.2 mishandles group-based authorization checks which allows remote authenticated users to obtain sensitive information by reading a rating value.


OpenStack Object Storage (Swift) before 2.4.0 allows attackers to obtain sensitive information via a PUT tempurl and a DLO object manifest that references an object in another container.


The SAND STUDIO AirDroid application 1.1.0 and earlier for Android mishandles implicit intents which allows attackers to obtain sensitive information via a crafted application.


HP UCMDB 10.00 and 10.01 before 10.01CUP12 10.10 and 10.11 before 10.11CUP6 and 10.2x before 10.21 allows local users to obtain sensitive information via unspecified vectors.


Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux Adobe AIR before 19.0.0.190 Adobe AIR SDK before 19.0.0.190 and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors.


Jenkins before 1.638 and LTS before 1.625.2 do not properly verify the shared secret used in JNLP slave connections which allows remote attackers to connect as slaves and obtain sensitive information or possibly gain administrative access by leveraging knowledge of the name of a slave.


Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 mishandles authentication requests which allows remote authenticated users to conduct LDAP injection attacks and consequently bypass intended login restrictions or obtain sensitive information by leveraging certain group-administration privileges.


The TripleO Heat templates (tripleo-heat-templates) do not properly order the Identity Service (keystone) before the OpenStack Object Storage (Swift) staticweb middleware in the swiftproxy pipeline when the staticweb middleware is enabled which might allow remote attackers to obtain sensitive information from private containers via unspecified vectors.


Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to queue/api.


Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12 Acrobat and Acrobat Reader DC Classic before 2015.006.30060 and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors a different vulnerability than CVE-2014-8450 CVE-2015-4449 CVE-2015-4450 CVE-2015-5089 and CVE-2015-5092.


ldb before 1.1.24 as used in the AD LDAP server in Samba 4.x before 4.1.22 4.2.x before 4.2.7 and 4.3.x before 4.3.3 mishandles string lengths which allows remote attackers to obtain sensitive information from daemon heap memory by sending crafted packets and then reading (1) an error message or (2) a database value.


HP CentralView Fraud Risk Management 11.1 11.2 and 11.3; CentralView Revenue Leakage Control 4.1 4.2 and 4.3; CentralView Dealer Performance Audit 2.0 and 2.1; CentralView Credit Risk Control 2.1 2.2 and 2.3; CentralView Roaming Fraud Control 2.1 2.2 and 2.3; and CentralView Subscription Fraud Prevention 2.0 and 2.1 allow remote attackers to obtain sensitive information via unspecified vectors a different vulnerability than CVE-2015-5407 and CVE-2015-5408.


The Siemens SIMATIC WinCC Sm@rtClient and Sm@rtClient Lite applications before 01.00.01.00 for Android do not properly store passwords which allows physically proximate attackers to obtain sensitive information via unspecified vectors.


HP Virtual Connect Enterprise Manager (VCEM) SDK before 7.5.0 as used in HP Matrix Operating Environment before 7.5.0 and other products allows remote authenticated users to obtain sensitive information via unspecified vectors.


Apple iOS before 9 allows attackers to obtain sensitive information about inter-app communication via a crafted app that conducts an interception attack involving an unspecified URL scheme.


The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.3 and 1.13.x before 1.13.1 allow remote attackers to obtain sensitive information via vectors related to inclusion of .pbl files from WML.


IBM Multi-Enterprise Integration Gateway 1.x through 1.0.0.1 and B2B Advanced Communications 1.0.0.2 and 1.0.0.3 before 1.0.0.3_2 when access by guests is enabled place an internal hostname and a payload path in a response which allows remote authenticated users to obtain sensitive information by leveraging a trading-partner relationship and reading response fields.


The get_bitmap_file function in drivers/md/md.c in the Linux kernel before 4.1.6 does not initialize a certain bitmap data structure which allows local users to obtain sensitive information from kernel memory via a GET_BITMAP_FILE ioctl call.


The CFNetwork HTTPProtocol component in Apple iOS before 9 and OS X before 10.11 does not properly recognize the HSTS preload list during a Safari private-browsing session which makes it easier for remote attackers to obtain sensitive information by sniffing the network.


Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12 Acrobat and Acrobat Reader DC Classic before 2015.006.30060 and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to obtain sensitive information via unspecified vectors.


HP 3PAR Service Processor SP 4.2.0.GA-29 (GA) SPOCC SP 4.3.0.GA-17 (GA) SPOCC and SP 4.3.0-GA-24 (MU1) SPOCC allows remote authenticated users to obtain sensitive information via unspecified vectors.


HP CentralView Fraud Risk Management 11.1 11.2 and 11.3; CentralView Revenue Leakage Control 4.1 4.2 and 4.3; CentralView Dealer Performance Audit 2.0 and 2.1; CentralView Credit Risk Control 2.1 2.2 and 2.3; CentralView Roaming Fraud Control 2.1 2.2 and 2.3; and CentralView Subscription Fraud Prevention 2.0 and 2.1 allow remote attackers to obtain sensitive information via unspecified vectors a different vulnerability than CVE-2015-5406 and CVE-2015-5407.


IDE Xcode Server in Apple Xcode before 7.0 does not ensure that server traffic is encrypted which allows remote attackers to obtain sensitive information by sniffing the network.


Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12 Acrobat and Acrobat Reader DC Classic before 2015.006.30060 and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors a different vulnerability than CVE-2014-8450 CVE-2015-4449 CVE-2015-4450 CVE-2015-5088 and CVE-2015-5089.


IBM WebSphere Commerce Enterprise 7.0.0.9 and 8.x before Feature Pack 8 allows remote attackers to obtain sensitive information via a crafted REST URL.


The iTunes Store component in Apple iOS before 9 does not properly delete AppleID credentials from the keychain upon a signout action which might allow physically proximate attackers to obtain sensitive information via unspecified vectors.


libreport 2.0.7 before 2.6.3 only saves changes to the first file when editing a crash report which allows remote attackers to obtain sensitive information via unspecified vectors related to the (1) backtrace (2) cmdline (3) environ (4) open_fds (5) maps (6) smaps (7) hostname (8) remote (9) ks.cfg or (10) anaconda-tb file attachment included in a Red Hat Bugzilla bug report.


The Remote Client and change management integrations in IBM Rational ClearCase 7.1.x 8.0.0.x before 8.0.0.18 and 8.0.1.x before 8.0.1.11 do not properly validate hostnames in X.509 certificates from SSL servers which allows remote attackers to spoof servers and obtain sensitive information or modify network traffic via a crafted certificate. IBM X-Force ID: 106715.


The service daemon in CRIU does not properly restrict access to non-dumpable processes which allows local users to obtain sensitive information via (1) process dumps or (2) ptrace access.


The Secure Empty Trash feature in Finder in Apple OS X before 10.11 improperly deletes Trash files which might allow local users to obtain sensitive information by reading storage media as demonstrated by reading a flash drive.


The CFNetwork HTTPProtocol component in Apple iOS before 9 allows remote attackers to bypass the HSTS protection mechanism and consequently obtain sensitive information via a crafted URL.


The Edge Component Caching Proxy in IBM WebSphere Application Server (WAS) 8.0 before 8.0.0.12 and 8.5 before 8.5.5.8 does not properly encrypt data which allows remote authenticated users to obtain sensitive information via unspecified vectors.


The Mail Drop feature in Mail in Apple OS X before 10.11 mishandles encryption parameters for attachments which makes it easier for remote attackers to obtain sensitive information by sniffing the network during transmission of an S/MIME e-mail message with a large attachment.


HP Version Control Repository Manager (VCRM) before 7.5.0 allows remote authenticated users to obtain sensitive information via unspecified vectors.


Cisco Application Policy Infrastructure Controller (APIC) 1.0(1.110a) and 1.0(1e) on Nexus 9000 devices does not properly implement RBAC health scoring which allows remote authenticated users to obtain sensitive information via unspecified vectors aka Bug ID CSCuq77485.


The admin command in ceph-deploy before 1.5.25 uses world-readable permissions for /etc/ceph/ceph.client.admin.keyring which allows local users to obtain sensitive information by reading the file.


Cisco WebEx Meeting Center does not properly restrict the content of URLs in GET requests which allows remote attackers to obtain sensitive information or conduct SQL injection attacks via vectors involving read access to a request aka Bug ID CSCup88398.


The RESTWS Basic Auth submodule in the RESTful Web Services module 7.x-1.x before 7.x-1.5 and 7.x-2.x before 7.x-2.3 for Drupal caches pages for authenticated requests which allows remote attackers to obtain sensitive information via unspecified vectors.


The TCP Socket API implementation in Mozilla Firefox before 41.0 mishandles array boundaries that were established with a navigator.mozTCPSocket.open method call and send method calls which allows remote TCP servers to obtain sensitive information from process memory by reading packet data as demonstrated by availability of this API in a Firefox OS application.


The web-based user interface in Cisco Jabber through 9.6(3) and 9.7 through 9.7(5) on Windows allows remote attackers to obtain sensitive information via a crafted value in a GET request aka Bug IDs CSCuu65622 and CSCuu70858.


The HybridAuth Social Login module 7.x-2.x before 7.x-2.10 for Drupal stores passwords in plaintext when the \Ask user for a password when registering\ option is enabled which allows remote authenticated users with certain permissions to obtain sensitive information by leveraging access to the database.


EMC Documentum Content Server before 7.0 P20 7.1 before P18 and 7.2 before P02 when RPC tracing is configured stores certain obfuscated password data in a log file which allows remote authenticated users to obtain sensitive information by reading this file.