Microsoft Internet Explorer 6 through 9 does not block cross-domain scrolling events which allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site aka \Scrolling Events Information Disclosure Vulnerability.\


Microsoft Internet Explorer 6 through 9 does not properly perform copy-and-paste operations which allows user-assisted remote attackers to read content from a different (1) domain or (2) zone via a crafted web site aka \Copy and Paste Information Disclosure Vulnerability.\


Microsoft Internet Explorer 9 does not properly handle the creation and initialization of string objects which allows remote attackers to read data from arbitrary process-memory locations via a crafted web site aka \Null Byte Information Disclosure Vulnerability.\


Zend_XmlRpc Class in Magento before 1.7.0.2 contains an information disclosure vulnerability.


An Information Disclosure vulnerability exists in the my config file in NEtGEAR WGR614 v7 and v9 which could let a malicious user recover all previously used passwords on the device for both the control panel and WEP/WPA/WPA2 in plaintext. This is a different issue than CVE-2012-6340.


BlackBerry PlayBook before 2.1 has an Information Disclosure Vulnerability via a Web browser component error


An information disclosure vulnerability exists in the way that the Microsoft Server Message Block 2.0 (SMBv2) server handles certain requests aka \Windows SMB Information Disclosure Vulnerability.\ This affects Windows Server 2012 Windows 10 Windows 8.1 Windows RT 8.1 Windows Server 2012 R2.


An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory aka \Windows GDI Information Disclosure Vulnerability.\ This affects Windows 7 Windows Server 2008 R2. This CVE ID is unique from CVE-2018-8424.


An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory aka \Windows Kernel Information Disclosure Vulnerability.\ This affects Windows 10 Servers Windows 10. This CVE ID is unique from CVE-2018-8207.


An information disclosure vulnerability exists when \Kernel Remote Procedure Call Provider\ driver improperly initializes objects in memory aka \MSRPC Information Disclosure Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2019 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers.


An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory aka \Windows GDI Information Disclosure Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2019 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2018-8595.


An information disclosure vulnerability exists when Microsoft Excel software reads out of bound memory due to an uninitialized variable which could disclose the contents of memory aka \Microsoft Excel Information Disclosure Vulnerability.\ This affects Microsoft Office Office 365 ProPlus Microsoft Excel Microsoft Excel Viewer Excel. This CVE ID is unique from CVE-2018-8598.


An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory aka \Windows GDI Information Disclosure Vulnerability.\ This affects Windows Server 2008 Windows 7 Windows Server 2008 R2. This CVE ID is unique from CVE-2018-8394 CVE-2018-8398.


An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory aka \Microsoft Graphics Components Information Disclosure Vulnerability.\ This affects Microsoft Office Microsoft Office Word Viewer Office 365 ProPlus Windows Server 2008 Microsoft PowerPoint Viewer Microsoft Excel Viewer.


An information disclosure vulnerability exists in Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address Space Layout Randomization (KASLR) bypass aka \Win32k Information Disclosure Vulnerability.\ This affects Windows 10 Servers Windows 10 Windows Server 2019.


An information disclosure vulnerability exists when Remote Procedure Call runtime improperly initializes objects in memory aka \Remote Procedure Call runtime Information Disclosure Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2019 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers.


An information disclosure vulnerability exists when the browser scripting engine improperly handle object types aka \Microsoft Scripting Engine Information Disclosure Vulnerability.\ This affects ChakraCore Internet Explorer 11 Microsoft Edge Internet Explorer 10.


An information disclosure vulnerability exists in Windows when the Windows bowser.sys kernel-mode driver fails to properly handle objects in memory aka \Windows Information Disclosure Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers.


An information disclosure vulnerability exists when Windows Media Player improperly discloses file information aka \Windows Media Player Information Disclosure Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2019 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2018-8482.


An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages aka \Microsoft SharePoint Information Disclosure Vulnerability.\ This affects Microsoft SharePoint.


An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing malicious XML content containing a reference to an external entity aka \SQL Server Management Studio Information Disclosure Vulnerability.\ This affects SQL Server Management Studio 17.9 SQL Server Management Studio 18.0. This CVE ID is unique from CVE-2018-8527 CVE-2018-8532.


An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory aka \Windows GDI Information Disclosure Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2019 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2018-8596.


An Information Disclosure vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory aka \Microsoft Windows Codecs Library Information Disclosure Vulnerability.\ This affects Windows 10 Servers Windows 10 Windows Server 2019.


An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect aka \.NET Core Information Disclosure Vulnerability.\ This affects .NET Core 2.1 .NET Core 1.0 .NET Core 1.1 PowerShell Core 6.0.


An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory aka \Windows GDI Information Disclosure Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2018-8396 CVE-2018-8398.


An information disclosure vulnerability exists when the Windows TCP/IP stack improperly handles fragmented IP packets aka \Windows TCP/IP Information Disclosure Vulnerability.\ This affects Windows Server 2012 R2 Windows RT 8.1 Windows Server 2016 Windows 8.1 Windows 10 Windows 10 Servers.


An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory aka \Windows GDI Information Disclosure Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2018-8394 CVE-2018-8396.


An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory aka \Windows Kernel Information Disclosure Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers.


An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious XEL file containing a reference to an external entity aka \SQL Server Management Studio Information Disclosure Vulnerability.\ This affects SQL Server Management Studio 17.9 SQL Server Management Studio 18.0. This CVE ID is unique from CVE-2018-8532 CVE-2018-8533.


An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory allowing an attacker to retrieve information from a targeted system aka \Windows GDI Information Disclosure Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2019 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers.


An information disclosure vulnerability exists when Windows allows a normal user to access the Wireless LAN profile of an administrative user aka \Windows Wireless Network Profile Information Disclosure Vulnerability.\ This affects Windows Server 2016 Windows 10 Windows 10 Servers.


An information disclosure vulnerability exists when Microsoft Outlook fails to respect \Default link type\ settings configured via the SharePoint Online Admin Center aka \Microsoft Outlook Information Disclosure Vulnerability.\ This affects Office 365 ProPlus Microsoft Office. This CVE ID is unique from CVE-2018-8579.


An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory aka \Windows GDI Information Disclosure Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2018-8422.


An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory aka \Microsoft Excel Information Disclosure Vulnerability.\ This affects Office 365 ProPlus Microsoft Office Microsoft Excel. This CVE ID is unique from CVE-2018-8627.


An information disclosure vulnerability exists when Windows Media Player improperly discloses file information aka \Windows Media Player Information Disclosure Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2019 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2018-8481.


An information disclosure vulnerability exists when affected Microsoft browsers improperly allow cross-frame interaction aka \Microsoft Browser Information Disclosure Vulnerability.\ This affects Internet Explorer 11 Microsoft Edge Internet Explorer 10.


An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious XMLA file containing a reference to an external entity aka \SQL Server Management Studio Information Disclosure Vulnerability.\ This affects SQL Server Management Studio 17.9 SQL Server Management Studio 18.0. This CVE ID is unique from CVE-2018-8527 CVE-2018-8533.


An information disclosure vulnerability exists in Microsoft .NET Framework that could allow an attacker to access information in multi-tenant environments aka \.NET Framework Information Disclosure Vulnerability.\ This affects Microsoft .NET Framework 4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 Microsoft .NET Framework 3.0 Microsoft .NET Framework 3.5.1 Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 4.5.2 Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2 Microsoft .NET Framework 4.7.1/4.7.2 Microsoft .NET Framework 4.7.2 Microsoft .NET Framework 2.0 Microsoft .NET Framework 4.6/4.6.1/4.6.2.


An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a guest operating system aka \Windows Hyper-V Information Disclosure Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers.


An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable which could disclose the contents of memory aka \Microsoft Office Information Disclosure Vulnerability.\ This affects Word Microsoft SharePoint Server Microsoft Office Word Viewer Microsoft Excel Viewer Microsoft SharePoint Microsoft Office.


An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address aka \Windows Kernel Information Disclosure Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2018-8336 CVE-2018-8442 CVE-2018-8443 CVE-2018-8445 CVE-2018-8446.


An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft browsers aka \Scripting Engine Information Disclosure Vulnerability.\ This affects ChakraCore Internet Explorer 11 Microsoft Edge.


An information disclosure vulnerability exists when the win32k component improperly provides kernel information aka \Win32k Information Disclosure Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers.


The ASG/ProxySG FTP proxy WebFTP mode allows intercepting FTP connections where a user accesses an FTP server via a ftp:// URL in a web browser. An information disclosure vulnerability in the WebFTP mode allows a malicious user to obtain plaintext authentication credentials for a remote FTP server from the ASG/ProxySG's web listing of the FTP server. Affected versions: ASG 6.6 and 6.7 prior to 6.7.4.2; ProxySG 6.5 prior to 6.5.10.15 6.6 and 6.7 prior to 6.7.4.2.


An exploitable information disclosure vulnerability exists in the crash handler of the hubCore binary of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. When hubCore crashes Google Breakpad is used to record minidumps which are sent over an insecure HTTPS connection to the backtrace.io service leading to the exposure of sensitive data. An attacker can impersonate the remote backtrace.io server in order to trigger this vulnerability.


An exploitable information disclosure vulnerability exists in the 'Secret Chats' functionality of Rakuten Viber on Android 9.3.0.6. The 'Secret Chats' functionality allows a user to delete all traces of a chat either by using a time trigger or by direct request. There is a bug in this functionality which leaves behind photos taken and shared on the secret chats even after the chats are deleted. These photos will be stored in the device and accessible to all applications installed on the Android device.


An exploitable information disclosure vulnerability exists in the phone-to-camera communications of Yi Home Camera 27US 1.8.7.0D. An attacker can sniff network traffic to exploit this vulnerability.


An exploitable information disclosure vulnerability exists in the password protection functionality of Quicken Deluxe 2018 for Mac version 5.2.2. A specially crafted sqlite3 request can cause the removal of the password protection allowing an attacker to access and modify the data without knowing the password. An attacker needs to have access to the password-protected files to trigger this vulnerability.


An exploitable information disclosure vulnerability exists in the \Secret Chats\ functionality of the Telegram Android messaging application version 4.9.0. The \Secret Chats\ functionality allows a user to delete all traces of a chat either by using a time trigger or by direct request. There is a bug in this functionality that leaves behind photos taken and shared on the secret chats even after the chats are deleted. These photos will be stored in the device and accessible to all applications installed on the Android device.


IBM API Connect v2018.1 and 2018.4.1 is affected by an information disclosure vulnerability in the consumer API. Any registered user can obtain a list of all other users in all other orgs including email id/names etc. IBM X-Force ID: 155148.


The Windows kernel in Windows 7 SP1 Windows Server 2008 SP2 and R2 and Windows Server 2012 allows an information disclosure vulnerability due to the way memory is initialized aka \Windows Kernel Information Disclosure Vulnerability\. This CVE is unique from CVE-2018-0757.


An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address Space Layout Randomization (ASLR) bypass aka \Windows Kernel Information Disclosure Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2018-0887 CVE-2018-0960 CVE-2018-0968 CVE-2018-0969 CVE-2018-0970 CVE-2018-0971 CVE-2018-0972 CVE-2018-0973 CVE-2018-0975.


Internet Explorer in Microsoft Windows 7 SP1 Windows Server 2008 R2 SP1 Windows 8.1 and Windows RT 8.1 Windows Server 2012 and R2 and Microsoft Edge and Internet Explorer in Windows 10 Gold 1511 1607 1703 1709 Windows Server 2016 and Windows Server version 1709 allows information disclosure due to how Microsoft browsers handle objects in memory aka \Microsoft Browser Information Disclosure Vulnerability\.


The Windows kernel in Windows 10 version 1709 and Windows Server version 1709 allows an information disclosure vulnerability due to how objects in memory are handled aka \Windows Kernel Information Disclosure Vulnerability\. This CVE is unique from CVE-2018-0742 CVE-2018-0756 CVE-2018-0809 and CVE-2018-0820.


Microsoft Edge in Microsoft Windows 10 Gold 1511 1607 1703 1709 and Windows Server 2016 allows an attacker to obtain information to further compromise the user's system due to how the Microsoft Edge PDF Reader handles objects in memory aka \Microsoft Edge Information Disclosure Vulnerability\.


The

Windows

kernel

in

Microsoft

Windows

Server

and

Windows

Windows

and

RT

Windows

Server

and

Windows

Gold

and

Windows

Server

and

Windows

Server

version

allows

an

information

disclosure

vulnerability

due

to

the

way

objects

are

initialized

in

memory

aka

\Windows

Kernel

Information

Disclosure

Vulnerability\.

This

CVE

is

unique

from

and

and


An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address Space Layout Randomization (ASLR) bypass aka \Windows Kernel Information Disclosure Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2018-0887 CVE-2018-0960 CVE-2018-0968 CVE-2018-0969 CVE-2018-0971 CVE-2018-0972 CVE-2018-0973 CVE-2018-0974 CVE-2018-0975.


Microsoft Exchange Server 2016 Cumulative Update 7 and Microsoft Exchange Server 2016 Cumulative Update 8 allow an information disclosure vulnerability due to how data is imported aka \Microsoft Exchange Information Disclosure Vulnerability\. This CVE is unique from CVE-2018-0924.


The Windows kernel in Windows 7 SP1 Windows 8.1 and RT 8.1 Windows Server 2008 SP2 and R2 SP1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 1703 and 1709 Windows Server 2016 and Windows Server version 1709 allows an information disclosure vulnerability due to the way objects are handled in memory aka \Windows Kernel Information Disclosure Vulnerability\. This CVE is unique from CVE-2018-0810.


An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address aka \Windows Kernel Information Disclosure Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2018-0960 CVE-2018-0968 CVE-2018-0969 CVE-2018-0970 CVE-2018-0971 CVE-2018-0972 CVE-2018-0973 CVE-2018-0974 CVE-2018-0975.


Internet Explorer in Microsoft Windows 7 SP1 Windows Server 2008 R2 SP1 Windows 8.1 and Windows RT 8.1 Windows Server 2012 and R2 and Windows 10 Gold 1511 1607 1703 1709 and Windows Server 2016 allow information disclosure due to how Internet Explorer handles objects in memory aka \Internet Explorer Information Disclosure Vulnerability\.


An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address Space Layout Randomization (ASLR) bypass aka \Windows Kernel Information Disclosure Vulnerability.\ This affects Windows Server 2012 R2 Windows RT 8.1 Windows Server 2016 Windows 8.1 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2018-0887 CVE-2018-0960 CVE-2018-0969 CVE-2018-0970 CVE-2018-0971 CVE-2018-0972 CVE-2018-0973 CVE-2018-0974 CVE-2018-0975.


An information disclosure vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer aka \Scripting Engine Information Disclosure Vulnerability.\ This affects Internet Explorer 9 Internet Explorer 11 Internet Explorer 10. This CVE ID is unique from CVE-2018-0987 CVE-2018-0989 CVE-2018-1000.


Microsoft Edge in Microsoft Windows 10 1709 allows an attacker to obtain information to further compromise the user's system due to how the scripting engine handles objects in memory aka \Scripting Engine Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2018-0767 and CVE-2018-0780.


An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a guest operating system aka \Hyper-V Information Disclosure Vulnerability.\ This affects Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2018-0957.


The Windows kernel in Windows 7 SP1 Windows 8.1 and RT 8.1 Windows Server 2008 SP2 and R2 SP1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 1703 and 1709 Windows Server 2016 and Windows Server version 1709 allows an information disclosure vulnerability due to how objects in memory are handled aka \Windows Information Disclosure Vulnerability\. This CVE is unique from CVE-2018-0830 and CVE-2018-0832.


Microsoft Office 2010 SP2 Microsoft Office 2013 SP1 and RT SP1 Microsoft Office 2016 and Microsoft Office 2016 Click-to-Run (C2R) allow an information disclosure vulnerability due to how Office initializes the affected variable aka \Microsoft Office Information Disclosure Vulnerability\.


An information disclosure vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer aka \Scripting Engine Information Disclosure Vulnerability.\ This affects Internet Explorer 9 Internet Explorer 11 Internet Explorer 10. This CVE ID is unique from CVE-2018-0981 CVE-2018-0987 CVE-2018-1000.


The

Windows

kernel

in

Microsoft

Windows

Server

and

Windows

Windows

and

RT

Windows

Server

and

Windows

Gold

and

Windows

Server

and

Windows

Server

version

allows

an

information

disclosure

vulnerability

due

to

the

way

memory

addresses

are

handled

aka

\Windows

Kernel

Information

Disclosure

Vulnerability\.

This

CVE

is

unique

from

and


The Windows kernel in Windows 7 SP1 Windows 8.1 and RT 8.1 Windows Server 2008 SP2 and R2 SP1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 1703 and 1709 Windows Server 2016 and Windows Server version 1709 allows an information disclosure vulnerability due to the way memory addresses are handled aka \Windows Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2018-0745 and CVE-2018-0746.


The Windows kernel in Windows 7 SP1 Windows 8.1 and RT 8.1 Windows Server 2008 SP2 and R2 SP1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 1703 and 1709 Windows Server 2016 and Windows Server version 1709 allows an information disclosure vulnerability due to how objects in memory are handled aka \Windows Information Disclosure Vulnerability\. This CVE is unique from CVE-2018-0829 and CVE-2018-0832.


The Windows kernel in Windows 8.1 and RT 8.1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 1703 and 1709 Windows Server 2016 and Windows Server version 1709 allows an information disclosure vulnerability due to the way memory addresses are handled aka \Windows Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2018-0745 and CVE-2018-0747.


An information disclosure vulnerability exists when Office renders Rich Text Format (RTF) email messages containing OLE objects when a message is opened or previewed aka \Microsoft Office Information Disclosure Vulnerability.\ This affects Microsoft Word Microsoft Office. This CVE ID is unique from CVE-2018-1007.


Internet Explorer in Microsoft Windows 7 SP1 Windows Server 2008 R2 SP1 Windows 8.1 and Windows RT 8.1 Windows Server 2012 and R2 and Microsoft Edge and Internet Explorer in Windows 10 Gold 1511 1607 1703 1709 Windows Server 2016 and Windows Server version 1709 allows information disclosure due to how Microsoft browsers handle objects in memory aka \Microsoft Browser Information Disclosure Vulnerability\.


The

Windows

kernel

in

Microsoft

Windows

Server

and

Windows

Windows

and

RT

Windows

Server

and

Windows

Gold

and

Windows

Server

and

Windows

Server

version

allows

an

information

disclosure

vulnerability

due

to

the

way

objects

are

initialized

in

memory

aka

\Windows

Kernel

Information

Disclosure

Vulnerability\.

This

CVE

is

unique

from

and


An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address Space Layout Randomization (ASLR) bypass aka \Windows Kernel Information Disclosure Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2018-0887 CVE-2018-0960 CVE-2018-0968 CVE-2018-0969 CVE-2018-0970 CVE-2018-0971 CVE-2018-0972 CVE-2018-0973 CVE-2018-0974.


Microsoft Edge in Microsoft Windows 10 1511 1607 1703 1709 and Windows Server 2016 allows an attacker to obtain information to further compromise the user's system due to how the scripting engine handles objects in memory aka \Scripting Engine Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2018-0780 and CVE-2018-0800.


An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address Space Layout Randomization (ASLR) bypass aka \Windows Kernel Information Disclosure Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2018-0887 CVE-2018-0960 CVE-2018-0968 CVE-2018-0969 CVE-2018-0970 CVE-2018-0972 CVE-2018-0973 CVE-2018-0974 CVE-2018-0975.


An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address Space Layout Randomization (ASLR) bypass aka \Windows Kernel Information Disclosure Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2018-0887 CVE-2018-0960 CVE-2018-0968 CVE-2018-0970 CVE-2018-0971 CVE-2018-0972 CVE-2018-0973 CVE-2018-0974 CVE-2018-0975.


Microsoft Edge in Windows 10 1709 allows information disclosure due to how Edge handles objects in memory aka \Microsoft Edge Information Disclosure Vulnerability\.


The Windows kernel in Windows 8.1 and RT 8.1 Windows Server 2012 R2 Windows 10 Gold 1511 1607 1703 and 1709 Windows Server 2016 and Windows Server version 1709 allows an information disclosure vulnerability due to how objects in memory are handled aka \Windows Information Disclosure Vulnerability\. This CVE is unique from CVE-2018-0829 and CVE-2018-0830.


The Microsoft Hyper-V Network Switch in 64-bit versions of Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 1703 and 1709 Windows Server 2016 and Windows Server version 1709 allows an information disclosure vulnerability due to how guest operating system input is validated aka \Hyper-V Information Disclosure Vulnerability\.


Microsoft Edge in Microsoft Windows 10 Gold 1511 1607 1703 1709 and Windows Server 2016 allows an attacker to obtain information to further compromise the user's system due to how the scripting engine handles objects in memory aka \Scripting Engine Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2018-0767 and CVE-2018-0800.


Microsoft Office 2010 SP2 2013 SP1 and 2016 Microsoft Office 2016 Click-to-Run Microsoft Office 2016 for Mac Microsoft Office Web Apps 2010 SP2 Microsoft Office Web Apps 2013 SP1 Microsoft SharePoint Enterprise Server 2013 SP1 Microsoft SharePoint Enterprise Server 2016 Microsoft SharePoint Server 2010 SP2 Microsoft Word 2010 SP2 Word 2013 SP1 and Microsoft Word 2016 allow an information disclosure vulnerability due to how variables are initialized aka \Microsoft Office Information Disclosure Vulnerability\.


The

Windows

kernel

in

Microsoft

Windows

Server

and

Windows

Windows

and

RT

Windows

Server

and

Windows

Gold

and

Windows

Server

and

Windows

Server

version

allows

an

information

disclosure

vulnerability

due

to

the

way

objects

are

initialized

in

memory

aka

\Windows

Kernel

Information

Disclosure

Vulnerability\.

This

CVE

is

unique

from

and

and


The Microsoft Windows Embedded OpenType (EOT) font engine in Microsoft Windows 7 SP1 and Windows Server 2008 R2 allows information disclosure due to how the Windows EOT font engine handles embedded fonts aka \Windows EOT Font Engine Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2018-0755 CVE-2018-0760 and CVE-2018-0855.


The

Windows

kernel

in

Microsoft

Windows

Server

and

Windows

Windows

and

RT

Windows

Server

and

Windows

Gold

and

Windows

Server

and

Windows

Server

version

allows

an

information

disclosure

vulnerability

due

to

the

way

memory

addresses

are

handled

aka

\Windows

Kernel

Information

Disclosure

Vulnerability\.

This

CVE

is

unique

from

and


Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 20 Microsoft Exchange Server 2013 Cumulative Update 18 Microsoft Exchange Server 2013 Cumulative Update 19 Microsoft Exchange Server 2013 Service Pack 1 Microsoft Exchange Server 2016 Cumulative Update 7 and Microsoft Exchange Server 2016 Cumulative Update 8 allow an information disclosure vulnerability due to how URL redirects are handled aka \Microsoft Exchange Information Disclosure Vulnerability\. This CVE is unique from CVE-2018-0941.


An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address Space Layout Randomization (ASLR) bypass aka \Windows Kernel Information Disclosure Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2018-0887 CVE-2018-0960 CVE-2018-0968 CVE-2018-0969 CVE-2018-0970 CVE-2018-0971 CVE-2018-0972 CVE-2018-0974 CVE-2018-0975.


The Windows Adobe Type Manager Font Driver (Atmfd.dll) in Windows 7 SP1 Windows 8.1 and RT 8.1 Windows Server 2008 SP2 and R2 SP1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 1703 and 1709 Windows Server 2016 and Windows Server version 1709 allows an information disclosure vulnerability due to the way objects are handled in memory aka \OpenType Font Driver Information Disclosure Vulnerability\.


The Microsoft Windows Embedded OpenType (EOT) font engine in Microsoft Windows 7 SP1 Windows Server 2008 R2 and Windows Server 2012 allows information disclosure due to how the Windows EOT font engine handles embedded fonts aka \Windows EOT Font Engine Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2018-0755 CVE-2018-0761 and CVE-2018-0855.


An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Internet Explorer aka \Scripting Engine Information Disclosure Vulnerability.\ This affects Internet Explorer 9 Internet Explorer 11 Internet Explorer 10. This CVE ID is unique from CVE-2018-0981 CVE-2018-0989 CVE-2018-1000.


ChakraCore and Microsoft Edge in Windows 10 1703 and 1709 allow information disclosure due to how the scripting engine handles objects in memory aka \Scripting Engine Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2018-0891.


An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address Space Layout Randomization (ASLR) bypass aka \Windows Kernel Information Disclosure Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2018-0887 CVE-2018-0960 CVE-2018-0968 CVE-2018-0969 CVE-2018-0970 CVE-2018-0971 CVE-2018-0973 CVE-2018-0974 CVE-2018-0975.


The Microsoft Windows Embedded OpenType (EOT) font engine in Microsoft Windows 7 SP1 and Windows Server 2008 R2 allows information disclosure due to how the Windows EOT font engine handles embedded fonts aka \Windows EOT Font Engine Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2018-0760 CVE-2018-0761 and CVE-2018-0855.


An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a guest operating system aka \Hyper-V Information Disclosure Vulnerability.\ This affects Windows Server 2012 R2 Windows RT 8.1 Windows Server 2016 Windows 8.1 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2018-0964.


Windows Remote Assistance in Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 and RT 8.1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 1703 and 1709 Windows Server 2016 and Windows Server version 1709 allows an information disclosure vulnerability due to how XML External Entities (XXE) are processed aka \Windows Remote Assistance Information Disclosure Vulnerability\.


ChakraCore and Internet Explorer in Microsoft Windows 7 SP1 Windows Server 2008 and R2 SP1 Windows 8.1 and Windows RT 8.1 Windows Server 2012 and R2 and Internet Explorer and Microsoft Edge in Windows 10 Gold 1511 1607 1703 1709 and Windows Server 2016 allow information disclosure due to how the scripting engine handles objects in memory aka \Scripting Engine Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2018-0939.


The Color Management Module (Icm32.dll) in Windows 7 SP1 and Windows Server 2008 SP2 and R2 SP1 allows an information disclosure vulnerability due to the way objects are handled in memory aka \Microsoft Color Management Information Disclosure Vulnerability\.


The Windows kernel in Microsoft Windows Server 2008 R2 SP1 Windows 7 SP1 Windows 8.1 and RT 8.1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 1703 and 1709 Windows Server 2016 and Windows Server version 1709 allows information disclosure vulnerability due to how memory addresses are handled aka \Windows Kernel Information Disclosure Vulnerability\.


Internet Explorer in Microsoft Windows 7 SP1 Windows Server 2008 SP2 and R2 SP1 Windows 8.1 and Windows RT 8.1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 1703 1709 and Windows Server 2016 allow information disclosure due to how Internet Explorer handles objects in memory aka \Internet Explorer Information Disclosure Vulnerability\.


Juniper Networks CSO versions prior to 4.0.0 may log passwords in log files leading to an information disclosure vulnerability.


The Windows kernel in Windows 10 version 1703. Windows 10 version 1709 and Windows Server version 1709 allows an information disclosure vulnerability due to the way objects are handled in memory aka \Windows Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2018-0746 and CVE-2018-0747.


The Microsoft Windows Embedded OpenType (EOT) font engine in Microsoft Windows 7 SP1 and Windows Server 2008 R2 allows information disclosure due to how the Windows EOT font engine handles embedded fonts aka \Windows EOT Font Engine Information Disclosure Vulnerability\. This CVE ID is unique from CVE-2018-0755 CVE-2018-0760 and CVE-2018-0761.


SharePoint Project Server 2013 and SharePoint Enterprise Server 2016 allow an information disclosure vulnerability due to how web requests are handled aka \Microsoft SharePoint Information Disclosure Vulnerability\.


The

Windows

kernel

in

Microsoft

Windows

Server

and

Windows

Windows

and

RT

Windows

Server

and

Windows

Gold

and

Windows

Server

and

Windows

Server

version

allows

an

information

disclosure

vulnerability

due

to

the

way

memory

addresses

are

handled

aka

\Windows

Kernel

Information

Disclosure

Vulnerability\.

This

CVE

is

unique

from

and


In CMS Made Simple (CMSMS) through 2.2.7 the \file view\ operation in the admin dashboard contains a sensitive information disclosure vulnerability exploitable by ordinary users because the product exposes unrestricted access to the PHP file_get_contents function.


An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate an SMB connection embedded in a malicious file as demonstrated by xlink:href=file://192.168.0.2/test.jpg within an office:document-content element in a .odt XML document.


A SQL injection information disclosure vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to disclose sensitive information on vulnerable installations due to a flaw in the formChangePass class. Authentication is required to exploit this vulnerability.


An information disclosure vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer aka \Scripting Engine Information Disclosure Vulnerability.\ This affects Internet Explorer 9 Internet Explorer 11 Internet Explorer 10. This CVE ID is unique from CVE-2018-0981 CVE-2018-0987 CVE-2018-0989.


An information disclosure vulnerability exists when Visual Studio improperly discloses limited contents of uninitialized memory while compiling program database (PDB) files aka \Microsoft Visual Studio Information Disclosure Vulnerability.\ This affects Microsoft Visual Studio.


IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 contain an information disclosure vulnerability that could allow an authenticated attacker to obtain highly sensitive information. IBM X-Force ID: 146340.


Ajenti version 2 contains an Information Disclosure vulnerability in Line 176 of the code source that can result in user and system enumeration as well as data from the /etc/ajenti/config.yml file. This attack appears to be exploitable via network connectivity to the web application.


An exploitable information disclosure vulnerability exists in the ACEManager template_load.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause a information leak resulting in the disclosure of internal paths and files. An attacker can make an authenticated HTTP request to trigger this vulnerability.


An exploitable information disclosure vulnerability exists in the ACEManager functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A HTTP request can result in disclosure of the default configuration for the device. An attacker can send an unauthenticated HTTP request to trigger this vulnerability.


An exploitable Information Disclosure vulnerability exists in the ACEManager EmbeddedAceGet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. This binary does not have any restricted configuration settings so once the MSCIID is discovered any authenticated user can send configuration changes using the /cgi-bin/Embedded_Ace_Get_Task.cgi endpoint.


An information disclosure vulnerability exists in the ACEManager authentication functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The ACEManager authentication functionality is done in plaintext XML to the web server. An attacker can listen to network traffic upstream from the device to capitalize on this vulnerability.


An exploitable Information Disclosure vulnerability exists in the ACEManager EmbeddedAceGet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The EmbeddedAceTLGet_Task.cgi executable is used to retrieve MSCII configuration values within the configuration manager of the AirLink ES450. This binary does not have any restricted configuration settings so once the MSCIID is discovered any authenticated user can send configuration changes using the /cgi-bin/Embedded_Ace_TLGet_Task.cgi endpoint.


Dell EMC RecoverPoint versions prior to 5.1.2.1 and RecoverPoint for VMs versions prior to 5.2.0.2 contain an information disclosure vulnerability. A malicious boxmgmt user may potentially be able to determine the existence of any system file via Boxmgmt CLI.


Cloud Foundry Bits Service versions prior to 2.18.0 includes an information disclosure vulnerability. A remote malicious user may execute a timing attack to brute-force the signing key allowing them complete read and write access to the the Bits Service storage.


Dell Encryption (formerly Dell Data Protection | Encryption) v10.1.0 and earlier contain an information disclosure vulnerability. A malicious user with physical access to the machine could potentially exploit this vulnerability to access the unencrypted RegBack folder that contains back-ups of sensitive system files.


Pivotal Container Service versions prior to 1.2.0 contains an information disclosure vulnerability which exposes IaaS credentials to application logs. A malicious user with access to application logs may be able to obtain IaaS credentials and perform actions using these credentials.


VMware Horizon View Agents (7.x.x before 7.5.1) contain a local information disclosure vulnerability due to insecure logging of credentials in the vmmsi.log file when an account other than the currently logged on user is specified during installation (including silent installations). Successful exploitation of this issue may allow low privileged users access to the credentials specified during the Horizon View Agent installation.


An information disclosure vulnerability exists In Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UPS and MGE STS. The integrated web server (Port 80/443/TCP) of the affected devices could allow a remote attacker to obtain sensitive device information if network access was obtained.


Swift File Transfer Mobile v1.1.2 and below was discovered to contain an information disclosure vulnerability in the path parameter. This vulnerability is exploited via an error caused by including non-existent path environment variables.


An information disclosure vulnerability was discovered in alipay_function.php in the log file of Alibaba payment interface on PHPPYUN prior to version 5.0.1. If exploited this vulnerability will allow attackers to obtain users' personally identifiable information including e-mail address and telephone numbers.


Smartwares HOME easy <=1.0.9 is vulnerable to an unauthenticated database backup download and information disclosure vulnerability. An attacker could disclose sensitive and clear-text information resulting in authentication bypass session hijacking and full system control.


Affected

versions

of

Atlassian

Jira

Server

and

Data

Center

allow

an

unauthenticated

user

to

enumerate

users

via

an

Information

Disclosure

vulnerability

in

the

QueryComponentRendererValue!Default.jspa

endpoint.

The

affected

versions

are

before

version

from

version

before

and

from

version

before


Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field options via an Information Disclosure vulnerability in the /rest/api/2/customFieldOption/ endpoint. The affected versions are before version 8.15.0.


Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by an information disclosure vulnerability. Through the PUK signature functionality an administrator will not have access to the current p12 certificate and password. When accessing this functionality the administrator has the option to replace the current certificate and it is not possible to view the certificate password (p12) already deployed on the platform. The replacement p12 certificate returns to users in base64 with its password which can be accessed by non-administrator users.


Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field and custom SLA names via an Information Disclosure vulnerability in the mobile site view. The affected versions are before version 8.13.2 and from version 8.14.0 before 8.14.1.


curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS server(s).


FusionCompute 8.0.0 has an information disclosure vulnerability. Due to the properly protection of certain information attackers may exploit this vulnerability to obtain certain information.


Taurus-AN00B versions earlier than 10.1.0.156(C00E155R7P2) have an information disclosure vulnerability. The device does not sufficiently validate the output of device in certain specific scenario the attacker can gain information in the victim's smartphone to launch the attack successful exploit could cause information disclosure.


HUAWEI P30 and HUAWEI P30 Pro smartphones with versions earlier than 10.1.0.123(C432E22R2P5) and versions earlier than 10.1.0.160(C00E160R2P8) have an information disclosure vulnerability. Certain WI-FI function's default configuration in the system seems insecure an attacker should craft a WI-FI hotspot to launch the attack. Successful exploit could cause information disclosure.


There is an information disclosure vulnerability in TE Mobile software versions V600R006C10 V600R006C10SPC100. Due to the improper storage of some information in certain specific scenario the attacker can gain information in the victim's device to launch the attack successful exploit could cause information disclosure.


There is an information disclosure vulnerability in several smartphones. The device does not sufficiently validate the identity of smart wearable device in certain specific scenario the attacker need to gain certain information in the victim's smartphone to launch the attack and successful exploit could cause information disclosure.Affected product versions include:HUAWEI Mate 20 versions earlier than 10.1.0.160(C00E160R3P8) versions earlier than 10.1.0.160(C01E160R2P8);HUAWEI Mate 20 X versions earlier than 10.1.0.160(C00E160R2P8) versions earlier than 10.1.0.160(C01E160R2P8);HUAWEI P30 Pro versions earlier than 10.1.0.160(C00E160R2P8);Laya-AL00EP versions earlier than 10.1.0.160(C786E160R3P8);Tony-AL00B versions earlier than 10.1.0.160(C00E160R2P11);Tony-TL00B versions earlier than 10.1.0.160(C01E160R2P11).


When in maintenance mode Magento version 2.4.0 and 2.3.4 (and earlier) are affected by an information disclosure vulnerability that could expose the installation path during build deployments. This information could be helpful to attackers if they are able to identify other exploitable vulnerabilities in the environment.


A sensitive information disclosure vulnerability in Kyland KPS2204 6 Port Managed Din-Rail Programmable Serial Device Servers Software Version:R0002.P05 allows remote attackers to get username and password by request /cgi-bin/webadminget.cgi script via the browser.


Sensitive information disclosure vulnerability in Micro Focus Self Service Password Reset (SSPR) product. The vulnerability affects versions 4.4.0.0 to 4.4.0.6 and 4.5.0.1 and 4.5.0.2. In certain configurations the vulnerability could disclose sensitive information.


Trend Micro Antivirus for Mac 2020 (Consumer) contains an Error Message Information Disclosure vulnerability that if exploited could allow kernel pointers and debug messages to leak to userland. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability.


Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an information disclosure vulnerability which could allow an attacker to access a specific database and key.


In Hamilton Medical AG T1-Ventillator versions 2.2.3 and prior an information disclosure vulnerability in the ventilator allows attackers with physical access to the configuration interface's logs to get valid checksums for tampered configuration files.


A limited information disclosure vulnerability exists in Gitlab CE/EE from >= 12.2 to <13.4.7 >=13.5 to <13.5.5 and >=13.6 to <13.6.2 that allows an attacker to view limited information in user's private profile


An exploitable information disclosure vulnerability exists in the get_dnode_of_data functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem can cause information disclosure resulting in a information disclosure. An attacker can provide a malicious file to trigger this vulnerability.


An exploitable information disclosure vulnerability exists in the way Nitro Pro 13.9.1.155 does XML error handling. A specially crafted PDF document can cause uninitialized memory access resulting in information disclosure. In order to trigger this vulnerability victim must open a malicious file.


A sensitive information disclosure vulnerability in Tableau Server 10.5 2018.x 2019.x 2020.x released before June 26 2020 could allow access to sensitive information in log files.


An exploitable information disclosure vulnerability exists in the init_node_manager functionality of F2fs-Tools F2fs.Fsck 1.12 and 1.13. A specially crafted filesystem can be used to disclose information. An attacker can provide a malicious file to trigger this vulnerability.


An exploitable information disclosure vulnerability exists in the dev_read functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem can cause an uninitialized read resulting in an information disclosure. An attacker can provide a malicious file to trigger this vulnerability.


Windows Error Reporting Information Disclosure Vulnerability This CVE ID is unique from CVE-2020-17138.


Microsoft Outlook Information Disclosure Vulnerability


Windows Function Discovery SSDP Provider Information Disclosure Vulnerability


Windows GDI+ Information Disclosure Vulnerability


Windows Delivery Optimization Information Disclosure Vulnerability


Win32k Information Disclosure Vulnerability


Windows NDIS Information Disclosure Vulnerability


Microsoft SharePoint Information Disclosure Vulnerability


Windows Error Reporting Information Disclosure Vulnerability This CVE ID is unique from CVE-2020-17094.


Microsoft SharePoint Information Disclosure Vulnerability This CVE ID is unique from CVE-2020-16979.


Microsoft Raw Image Extension Information Disclosure Vulnerability


Windows KernelStream Information Disclosure Vulnerability


Microsoft Exchange Information Disclosure Vulnerability


Windows Canonical Display Driver Information Disclosure Vulnerability


Remote Desktop Protocol Client Information Disclosure Vulnerability


WebP Image Extensions Information Disclosure Vulnerability


Windows MSCTF Server Information Disclosure Vulnerability


Microsoft Excel Information Disclosure Vulnerability


Windows Camera Codec Information Disclosure Vulnerability


An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory.To exploit this vulnerability an authenticated attacker could run a specially crafted application aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16938.


An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages aka 'Microsoft SharePoint Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16941 CVE-2020-16948 CVE-2020-16950 CVE-2020-16953.


An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface Plus (GDI+) handles objects in memory allowing an attacker to retrieve information from a targeted system aka 'Windows GDI+ Information Disclosure Vulnerability'.


Remote Desktop Protocol Server Information Disclosure Vulnerability


An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory aka 'Microsoft SharePoint Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16941 CVE-2020-16942 CVE-2020-16948 CVE-2020-16950.


An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages aka 'Microsoft SharePoint Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16942 CVE-2020-16948 CVE-2020-16950 CVE-2020-16953.


Windows WalletService Information Disclosure Vulnerability


An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory aka 'Microsoft SharePoint Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16941 CVE-2020-16942 CVE-2020-16950 CVE-2020-16953.


Microsoft SharePoint Information Disclosure Vulnerability This CVE ID is unique from CVE-2020-17017.


An information disclosure vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted requests aka 'Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability'.


An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory aka 'Microsoft SharePoint Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16941 CVE-2020-16942 CVE-2020-16948 CVE-2020-16953.


Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp system.asp backup.asp sys-power.asp ifaces-wls.asp ifaces-wls-pkt.asp and ifaces-wls-pkt-adv.asp.


HPE OneView Global Dashboard (OVGD) 1.9 has a remote information disclosure vulnerability. HPE OneView Global Dashboard - After Upgrade or Install of OVGD Version 1.9 Appliance Firewall May Leave Ports Open. This is resolved in OVGD 1.91 or later.


A sensitive information disclosure vulnerability was discovered in the web interface component of IP Office that may potentially allow a local user to gain unauthorized access to the component. Affected versions of IP Office include: 9.x 10.0 through 10.1.0.7 and 11.0 though 11.0.4.3.


Information Disclosure Vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 September 2020 Update allows local users to gain access to sensitive information via incorrectly logging of sensitive information in debug logs.


An information disclosure vulnerability was found in libvirt in versions before 6.3.0. HTTP cookies used to access network-based disks were saved in the XML dump of the guest domain. This flaw allows an attacker to access potentially sensitive information in the domain configuration via the `dumpxml` command.


HCL Domino v9 v10 v11 is susceptible to an Information Disclosure vulnerability in XPages due to improper error handling of user input. An unauthenticated attacker could exploit this vulnerability to obtain information about the XPages software running on the Domino server.


Affected versions of Jira Server & Data Center allow a remote attacker with limited (non-admin) privileges to view a Jira instance's Support Entitlement Number (SEN) via an Information Disclosure vulnerability in the HTTP Response headers. The affected versions are before version 7.13.18 from version 8.0.0 before 8.5.9 and from version 8.6.0 before 8.12.1.


Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project keys via an Information Disclosure vulnerability in the /browse.PROJECTKEY endpoint. The affected versions are before version 7.13.7 from version 8.0.0 before 8.5.8 and from version 8.6.0 before 8.12.0.


An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API if multiple containers are created in a short duration the environment variables from the first container will get leaked into subsequent containers. An attacker who has control over the subsequent containers could use this flaw to gain access to sensitive information stored in such variables.


Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the /ViewUserHover.jspa endpoint. The affected versions are before version 7.13.6 from version 8.0.0 before 8.5.7 and from version 8.6.0 before 8.12.0.


Affected versions of Atlassian Jira Service Desk Server and Data Center allow remote attackers authenticated as a non-administrator user to view Project Request-Types and Descriptions via an Information Disclosure vulnerability in the editform request-type-fields resource. The affected versions are before version 4.12.0.


Affected versions of Atlassian Jira Server and Data Center allow remote unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability in the /secure/QueryComponent!Default.jspa endpoint. The affected versions are before version 8.5.8 and from version 8.6.0 before 8.11.1.


An information disclosure vulnerability was found in Red Hat Quay in versions before 3.3.1. This flaw allows an attacker who can create a build trigger in a repository to disclose the names of robot accounts and the existence of private repositories within any namespace.


Dell EMC OpenManage Integration for Microsoft System Center (OMIMSSC) for SCCM and SCVMM versions prior to 7.2.1 contain an information disclosure vulnerability. Authenticated low privileged OMIMSCC users may be able to retrieve sensitive information from the logs.


Dell EMC Networking X-Series firmware versions 3.0.1.2 and older Dell EMC Networking PC5500 firmware versions 4.1.0.22 and older and Dell EMC PowerEdge VRTX Switch Modules firmware versions 2.0.0.77 and older contain an information disclosure vulnerability. A remote unauthenticated attacker could exploit this vulnerability to retrieve sensitive data by sending a specially crafted request to the affected endpoints.


SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability. The module controller in `SimpleSAML\\Module` that processes requests for pages hosted by modules has code to identify paths ending with `.php` and process those as PHP code. If no other suitable way of handling the given path exists it presents the file to the browser. The check to identify paths ending with `.php` does not account for uppercase letters. If someone requests a path ending with e.g. `.PHP` and the server is serving the code from a case-insensitive file system such as on Windows the processing of the PHP code does not occur and the source code is instead presented to the browser. An attacker may use this issue to gain access to the source code in third-party modules that is meant to be private or even sensitive. However the attack surface is considered small as the attack will only work when SimpleSAMLphp serves such content from a file system that is not case-sensitive such as on Windows. This issue is fixed in version 1.18.6.


The /plugins/servlet/jira-blockers/ resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to get the ID of configured Jira application links via an information disclosure vulnerability.


SSB-DB version 20.0.0 has an information disclosure vulnerability. The get() method is supposed to only decrypt messages when you explicitly ask it to but there is a bug where it's decrypting any message that it can. This means that it is returning the decrypted content of private messages which a malicious peer could use to get access to private data. This only affects peers running SSB-DB@20.0.0 who also have private messages and is only known to be exploitable if you're also running SSB-OOO (default in SSB-Server) which exposes a thin wrapper around get() to anonymous peers. This is fixed in version 20.0.1. Note that users of SSB-Server verion 16.0.0 should upgrade to 16.0.1 to get the fixed version of SSB-DB.


The /rest/jira-ril/1.0/jira-rest/applinks resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to get information about any configured Jira application links via an information disclosure vulnerability.


Versions before 8.9.1 Various resources in Jira responded with a 404 instead of redirecting unauthenticated users to the login page in some situations this may have allowed unauthorised attackers to determine if certain resources exist or not through an Information Disclosure vulnerability.


The /json/fe/activeUserFinder.do resource in Altassian Fisheye and Crucible before version 4.8.1 allows remote attackers to view user user email addresses via a information disclosure vulnerability.


In Open Enclave before version 0.12.0 an information disclosure vulnerability exists when an enclave application using the syscalls provided by the sockets.edl is loaded by a malicious host application. An attacker who successfully exploited the vulnerability could read privileged data from the enclave heap across trust boundaries. To exploit this vulnerability an attacker would have to log on to an affected system and run a specially crafted application. The vulnerability would not allow an attacker to elevate user rights directly but it could be used to obtain information otherwise considered confidential in an enclave which could be used in further compromises. The issue has been addressed in version 0.12.0 and the current master branch. Users will need to to recompile their applications against the patched libraries to be protected from this vulnerability.


Brocade SANNav before version 2.1.1 contains an information disclosure vulnerability. Successful exploitation of internal server information in the initial login response header.


An information disclosure vulnerability in Web Vulnerability Scan profile of Fortinet's FortiWeb version 6.2.x below 6.2.4 and version 6.3.x below 6.3.5 may allow a remote authenticated attacker to read the password used by the FortiWeb scanner to access the device defined in the scan profile.


In JUnit4 from version 4.7 and before 4.13.1 the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems the system's temporary directory is shared between all users on that system. Because of this when files and directories are written into this directory they are by default readable by other users on that same system. This vulnerability does not allow other users to overwrite the contents of these directories or files. This is purely an information disclosure vulnerability. This vulnerability impacts you if the JUnit tests write sensitive information like API keys or passwords into the temporary folder and the JUnit tests execute in an environment where the OS has other untrusted users. Because certain JDK file system APIs were only added in JDK 1.7 this this fix is dependent upon the version of the JDK you are using. For Java 1.7 and higher users: this vulnerability is fixed in 4.13.1. For Java 1.6 and lower users: no patch is available you must use the workaround below. If you are unable to patch or are stuck running on Java 1.6 specifying the `java.io.tmpdir` system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability. For more information including an example of vulnerable code see the referenced GitHub Security Advisory.


Information disclosure vulnerability in Micro Focus Verastream Host Integrator (VHI) product affecting versions earlier than 7.8 Update 1 (7.8.49 or 7.8.0.49). The vulnerability allows an unauthenticated attackers to view information they may not have been authorized to view.


Their is an information disclosure vulnerability in Helm from version 3.1.0 and before version 3.2.0. `lookup` is a Helm template function introduced in Helm v3. It is able to lookup resources in the cluster to check for the existence of specific resources and get details about them. This can be used as part of the process to render templates. The documented behavior of `helm template` states that it does not attach to a remote cluster. However a the recently added `lookup` template function circumvents this restriction and connects to the cluster even during `helm template` and `helm install|update|delete|rollback --dry-run`. The user is not notified of this behavior. Running `helm template` should not make calls to a cluster. This is different from `install` which is presumed to have access to a cluster in order to load resources into Kubernetes. Helm 2 is unaffected by this vulnerability. A malicious chart author could inject a `lookup` into a chart that when rendered through `helm template` performs unannounced lookups against the cluster a user's `KUBECONFIG` file points to. This information can then be disclosed via the output of `helm template`. This issue has been fixed in Helm 3.2.0


Unauthorized information disclosure vulnerability in Micro Focus ArcSight Management Center product Affecting versions 2.6.1 2.7.x 2.8.x 2.9.x prior to 2.9.4. The vulnerabilities could be remotely exploited resulting unauthorized information disclosure.


A log information disclosure vulnerability in B&R GateManager 4260 and 9250 versions <9.0.20262 and GateManager 8250 versions <9.2.620236042 allows authenticated users to view log information reserved for other users.


An information disclosure vulnerability exists in the Cryptography Next Generation (CNG) service when it fails to properly handle objects in memory.To exploit this vulnerability an attacker would have to log on to an affected system and run a specially crafted application.The security update addresses the vulnerability by correcting how the service handles objects in memory. aka 'Windows Key Isolation Service Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-0676 CVE-2020-0677 CVE-2020-0748 CVE-2020-0755 CVE-2020-0756.


An information vulnerability exists when Windows Connected User Experiences and Telemetry Service improperly discloses file information aka 'Connected User Experiences and Telemetry Service Information Disclosure Vulnerability'.


An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-0774 CVE-2020-0874 CVE-2020-0879 CVE-2020-0880.


An information vulnerability exists when Windows Modules Installer Service improperly discloses file information aka 'Windows Modules Installer Service Information Disclosure Vulnerability'.


An information disclosure vulnerability exists when the Windows Network Driver Interface Specification (NDIS) improperly handles memory.To exploit this vulnerability an attacker would first have to gain execution on the victim system aka 'Windows Network Driver Interface Specification (NDIS) Information Disclosure Vulnerability'.


An information disclosure vulnerability exists in the Cryptography Next Generation (CNG) service when it fails to properly handle objects in memory.To exploit this vulnerability an attacker would have to log on to an affected system and run a specially crafted application.The security update addresses the vulnerability by correcting how the service handles objects in memory. aka 'Windows Key Isolation Service Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-0675 CVE-2020-0676 CVE-2020-0677 CVE-2020-0748 CVE-2020-0755.


An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory allowing an attacker to retrieve information from a targeted system aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-0774 CVE-2020-0879 CVE-2020-0880 CVE-2020-0882.


An information disclosure vulnerability exists in the Cryptography Next Generation (CNG) service when it fails to properly handle objects in memory.To exploit this vulnerability an attacker would have to log on to an affected system and run a specially crafted application.The security update addresses the vulnerability by correcting how the service handles objects in memory. aka 'Windows Key Isolation Service Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-0675 CVE-2020-0676 CVE-2020-0677 CVE-2020-0748 CVE-2020-0756.


An information disclosure vulnerability exists in the Cryptography Next Generation (CNG) service when it fails to properly handle objects in memory.To exploit this vulnerability an attacker would have to log on to an affected system and run a specially crafted application.The security update addresses the vulnerability by correcting how the service handles objects in memory. aka 'Windows Key Isolation Service Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-0675 CVE-2020-0677 CVE-2020-0748 CVE-2020-0755 CVE-2020-0756.


An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface Plus (GDI+) handles objects in memory allowing an attacker to retrieve information from a targeted system aka 'Windows GDI+ Information Disclosure Vulnerability'.


An information disclosure vulnerability exists in the Windows Common Log File System (CLFS) driver when it fails to properly handle objects in memory aka 'Windows Common Log File System Driver Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-0615.


An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-0874 CVE-2020-0879 CVE-2020-0880 CVE-2020-0882.


An information disclosure vulnerability exists in the Cryptography Next Generation (CNG) service when it fails to properly handle objects in memory.To exploit this vulnerability an attacker would have to log on to an affected system and run a specially crafted application.The security update addresses the vulnerability by correcting how the service handles objects in memory. aka 'Windows Key Isolation Service Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-0675 CVE-2020-0676 CVE-2020-0748 CVE-2020-0755 CVE-2020-0756.


An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory allowing an attacker to retrieve information from a targeted system aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-0774 CVE-2020-0874 CVE-2020-0880 CVE-2020-0882.


An information disclosure vulnerability exists in the Windows Common Log File System (CLFS) driver when it fails to properly handle objects in memory aka 'Windows Common Log File System Driver Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-0639.


An information disclosure vulnerability exists when Windows Error Reporting improperly handles file operations.To exploit this vulnerability an attacker would first have to gain execution on the victim system aka 'Windows Error Reporting Information Disclosure Vulnerability'.


An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory allowing an attacker to retrieve information from a targeted system aka 'Windows GDI Information Disclosure Vulnerability'.


An information disclosure vulnerability exists in the Cryptography Next Generation (CNG) service when it fails to properly handle objects in memory.To exploit this vulnerability an attacker would have to log on to an affected system and run a specially crafted application.The security update addresses the vulnerability by correcting how the service handles objects in memory. aka 'Windows Key Isolation Service Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-0675 CVE-2020-0676 CVE-2020-0677 CVE-2020-0755 CVE-2020-0756.


An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-0774 CVE-2020-0874 CVE-2020-0879 CVE-2020-0882.


An information disclosure vulnerability exists in the Remote Desktop Connection Manager (RDCMan) application when it improperly parses XML input containing a reference to an external entity aka 'Remote Desktop Connection Manager Information Disclosure Vulnerability'.


An

information

disclosure

vulnerability

exists

in

Download

Master

before

A

direct

access

to

/downloadmaster/dm_apply.cgi?action_mode=initial&download_type=General&special_cgi=get_language

makes

it

possible

to

reach

\unknown

functionality\

in

a

\known

to

be

easy\

manner

via

an

unspecified

\public

exploit.\


Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate Jira projects via an Information Disclosure vulnerability in the Jira Projects plugin report page. The affected versions are before version 8.5.11 from version 8.6.0 before 8.13.3 and from version 8.14.0 before 8.14.1.


An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address Space Layout Randomization (ASLR) bypass aka 'Windows Kernel Information Disclosure Vulnerability'.


An information disclosure vulnerability exists when the Windows Resource Policy component improperly handles memory.To exploit this vulnerability an attacker would first have to gain execution on the victim system aka 'Windows Resource Policy Information Disclosure Vulnerability'.


An information disclosure vulnerability exists in the way that the Windows Server DHCP service improperly discloses the contents of its memory.To exploit the vulnerability an unauthenticated attacker could send a specially crafted packet to an affected DHCP server aka 'Windows DHCP Server Information Disclosure Vulnerability'.


An information disclosure vulnerability exists when Microsoft Dynamics Business Central/NAV on-premise does not properly hide the value of a masked field when showing the records as a chart page.The attacker who successfully exploited the vulnerability could see the information that are in a masked field.The security update addresses the vulnerability by updating the rendering engine the Windows client to properly detect masked fields and render the content as masked. aka 'Microsoft Dynamics Business Central/NAV Information Disclosure'.


An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory allowing an attacker to retrieve information from a targeted system aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-0963 CVE-2020-1145 CVE-2020-1179.


An information disclosure vulnerability exists when the Windows WaasMedic Service improperly handles memory.To exploit this vulnerability an attacker would first have to gain execution on the victim system aka 'Windows WaasMedic Service Information Disclosure Vulnerability'.


Huawei smartphones Honor V20 with versions earlier than 10.0.0.179(C636E3R4P3) versions earlier than 10.0.0.180(C185E3R3P3) versions earlier than 10.0.0.180(C432E10R3P4) have an information disclosure vulnerability. The device does not sufficiently validate the identity of smart wearable device in certain specific scenario the attacker need to gain certain information in the victim's smartphone to launch the attack successful exploit could cause information disclosure.


An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory allowing an attacker to retrieve information from a targeted system aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-0963 CVE-2020-1141 CVE-2020-1179.


HUAWEI P30 with versions earlier than 10.1.0.160(C00E160R2P11) and HUAWEI P30 Pro with versions earlier than 10.1.0.160(C00E160R2P8) have an information disclosure vulnerability. Certain function's default configuration in the system seems insecure an attacker should craft a WI-FI hotspot to launch the attack. Successful exploit could cause information disclosure.


HUAWEI Mate 10 smartphones with versions earlier than 10.0.0.143(C00E143R2P4) have an information disclosure vulnerability. The attacker could wake up voice assistant then do a series of crafted voice operation successful exploit could allow the attacker read certain files without unlock the phone leading to information disclosure.


The optional initial password change and password expiration features present in Apache Jackrabbit Oak 1.2.0 to 1.22.0 are prone to a sensitive information disclosure vulnerability. The code mandates the changed password to be passed as an additional attribute to the credentials object but does not remove it upon processing during the first phase of the authentication. In combination with additional independent authentication mechanisms this may lead to the new password being disclosed.


An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory.To exploit this vulnerability an authenticated attacker could run a specially crafted application aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-0928 CVE-2020-1033 CVE-2020-1589 CVE-2020-16854.


HUAWEI Mate 30 with versions earlier than 10.1.0.126(C00E125R5P3) have an information disclosure vulnerability. A logic judgment error occurs when the system handling Bluetooth connections an attacker could craft as an authenticated Bluetooth peer to launch the attack. Successful exploit could cause information disclosure.


An information disclosure vulnerability exists when the Windows Image Acquisition (WIA) Service improperly discloses contents of its memory aka 'Windows Image Acquisition Service Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-1485.


An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable which could disclose the contents of memory aka 'Microsoft Office Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-1445.


An information disclosure vulnerability exists when the Windows Image Acquisition (WIA) Service improperly discloses contents of its memory aka 'Windows Image Acquisition Service Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-1474.


An information vulnerability exists when Windows Connected User Experiences and Telemetry Service improperly discloses file information aka 'Connected User Experiences and Telemetry Service Information Disclosure Vulnerability'.


Doorkeeper version 5.0.0 and later contains an information disclosure vulnerability that allows an attacker to retrieve the client secret only intended for the OAuth application owner. After authorizing the application and allowing access the attacker simply needs to request the list of their authorized applications in a JSON format (usually GET /oauth/authorized_applications.json). An application is vulnerable if the authorized applications controller is enabled.


VMware Workspace ONE SDK and dependent mobile application updates address sensitive information disclosure vulnerability.


VMware Horizon Client for Windows (5.x prior to 5.5.0) contains an information disclosure vulnerability. A malicious attacker with local privileges on the machine where Horizon Client for Windows is installed may be able to retrieve hashed credentials if the client crashes.


vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) contains an information disclosure vulnerability due to incorrect pairing implementation between the vRealize Operations for Horizon Adapter and Horizon View. An unauthenticated remote attacker who has network access to vRealize Operations with the Horizon Adapter running may obtain sensitive information


qmail-verify as used in netqmail 1.06 is prone to an information disclosure vulnerability. A local attacker can test for the existence of files and directories anywhere in the filesystem because qmail-verify runs as root and tests for the existence of files in the attacker's home directory without dropping its privileges first.


An information disclosure vulnerability in the /cgi-bin/ExportAllSettings.sh endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to leak router settings including cleartext login details DNS settings and other sensitive information without authentication.


The Advanced Woo Search plugin version through 1.99 for Wordpress suffers from a sensitive information disclosure vulnerability in every ajax search request via the sql field to includes/class-aws-search.php.


An information disclosure vulnerability exists in the WinRing0x64 Driver IRP 0x9c406144 functionality of NZXT CAM 4.8.0. A specially crafted I/O request packet (IRP) can cause the disclosure of sensitive information. An attacker can send a malicious IRP to trigger this vulnerability.


An information disclosure vulnerability exists in the WinRing0x64 Driver IRP 0x9c406104 functionality of NZXT CAM 4.8.0. A specially crafted I/O request packet (IRP) can cause the disclosure of sensitive information. An attacker can send a malicious IRP to trigger this vulnerability.


An information disclosure vulnerability exists in the WinRing0x64 Driver Privileged I/O Read IRPs functionality of NZXT CAM 4.8.0. A specially crafted I/O request packet (IRP) using the IRP 0x9c4060d4 gives a low privilege user direct access to the IN instruction that is completely unrestrained at an elevated privilege level. An attacker can send a malicious IRP to trigger this vulnerability.


An information disclosure vulnerability exists in the WinRing0x64 Driver Privileged I/O Read IRPs functionality of NZXT CAM 4.8.0. A specially crafted I/O request packet (IRP) Using the IRP 0x9c4060cc gives a low privilege user direct access to the IN instruction that is completely unrestrained at an elevated privilege level. An attacker can send a malicious IRP to trigger this vulnerability and this access could allow for information leakage of sensitive data.


An information disclosure vulnerability exists in the Web Manager and telnet CLI functionality of Lantronix XPort EDGE 3.0.0.0R11 3.1.0.0R9 3.4.0.0R12 and 4.2.0.0R7. A specially crafted HTTP request can cause information disclosure. An attacker can sniff the network to trigger this vulnerability.


An information disclosure vulnerability exists in the WinRing0x64 Driver IRP 0x9c402084 functionality of NZXT CAM 4.8.0. A specially crafted I/O request packet (IRP) can cause the disclosure of sensitive information. An attacker can send a malicious IRP to trigger this vulnerability.


Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they do not have access to by guessing the ID of the file. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.


An information disclosure vulnerability exists in the WinRing0x64 Driver Privileged I/O Read IRPs functionality of NZXT CAM 4.8.0. A specially crafted I/O request packet (IRP) using the IRP 0x9c4060d0 gives a low privilege user direct access to the IN instruction that is completely unrestrained at an elevated privilege level. An attacker can send a malicious IRP to trigger this vulnerability.


Symantec Advanced Secure Gateway (ASG) 6.6 prior to 6.6.5.13 ASG 6.7 prior to 6.7.3.1 ProxySG 6.5 prior to 6.5.10.6 ProxySG 6.6 prior to 6.6.5.13 and ProxySG 6.7 prior to 6.7.3.1 are susceptible to an information disclosure vulnerability. An attacker with local access to the client host of an authenticated administrator user can under certain circumstances obtain sensitive authentication credential information.


An information disclosure vulnerability in the Qualcomm camera driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10 Kernel-3.18. Android ID: A-32720522. References: QC-CR#1090007.


An information disclosure vulnerability in the STMicroelectronics driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10. Android ID: A-31795790.


An information disclosure vulnerability in the NVIDIA video driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10. Android ID: A-31495687. References: N-CVE-2016-8409.


An exploitable Information Disclosure vulnerability exists in the Web Application functionality of Moxa AWK-3131A Series Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client. Retrieving a specific URL without authentication can reveal sensitive information to an attacker.


An information disclosure vulnerability in kernel components including the ION subsystem Binder USB driver and networking subsystem could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10 Kernel-3.18. Android ID: A-31651010.


An information disclosure vulnerability in kernel components including the ION subsystem Binder USB driver and networking subsystem could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10 Kernel-3.18. Android ID: A-31494725.


An information disclosure vulnerability in kernel components including the ION subsystem Binder USB driver and networking subsystem could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10. Android ID: A-31496950.


An exploitable information disclosure vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point. Retrieving a series of URLs without authentication can reveal sensitive configuration and system information to an attacker.


An information disclosure vulnerability in the bootloader could enable a local attacker to access data outside of its permission level. This issue is rated as High because it could be used to access sensitive data. Product: Android. Versions: N/A. Android ID: A-32510383.


An information disclosure vulnerability in the NVIDIA librm library (libnvrm) could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: Kernel-3.18. Android ID: A-31251599. References: N-CVE-2016-8400.


An information disclosure vulnerability in the Qualcomm Secure Execution Environment Communicator could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10 Kernel-3.18. Android ID: A-31704078. References: QC-CR#1076407.


An information disclosure vulnerability in the MediaTek driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: N/A. Android ID: A-31531758. References: MT-ALPS02961384.


Pivotal Gemfire for PCF versions 1.6.x prior to 1.6.5.0 and 1.7.x prior to 1.7.1.0 contain an information disclosure vulnerability. The application inadvertently exposed WAN replication credentials at a public route.


An information disclosure vulnerability in the NVIDIA video driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10. Android ID: A-31496571. References: N-CVE-2016-8408.


An information disclosure vulnerability in the Qualcomm power driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission. Product: Android. Versions: Kernel-3.10. Android ID: A-33745862. References: QC-CR#1035099.


An information disclosure vulnerability in the Qualcomm sound driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10 Kernel-3.18. Android ID: A-31498403. References: QC-CR#987010.


A remote information disclosure vulnerability in HPE Matrix Operating Environment version 7.6 was found.


An information disclosure vulnerability in kernel components including the ION subsystem Binder USB driver and networking subsystem could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10 Kernel-3.18. Android ID: A-31796940.


An information disclosure vulnerability in the NVIDIA video driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission. Product: Android. Versions: Kernel-3.10. Android ID: A-31668540. References: N-CVE-2016-8460.


An exploitable information disclosure vulnerability exists in the Web Application functionality of the Moxa AWK-3131A wireless access point running firmware 1.1. Retrieving a specific URL without authentication can reveal sensitive information to an attacker.


An information disclosure vulnerability in the Qualcomm video driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-32511270. References: QC-CR#1088206.


An information disclosure vulnerability in kernel components including the ION subsystem Binder USB driver and networking subsystem could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10 Kernel-3.18. Android ID: A-31495231.


An information disclosure vulnerability in the MediaTek video driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission. Product: Android. Versions: N/A. Android ID: A-31249105.


An information disclosure vulnerability in the STMicroelectronics driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10. Android ID: A-31799972.


An information disclosure vulnerability in the Qualcomm video driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-32510746. References: QC-CR#1088206.


An information disclosure vulnerability in the MediaTek driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: N/A. Android ID: A-31528889. References: MT-ALPS02961395.


An information disclosure vulnerability in the HTC input driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-32591129.


An information disclosure vulnerability in the MediaTek driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: N/A. Android ID: A-31528890. References: MT-ALPS02961380.


An information disclosure vulnerability in the camera driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10. Android ID: A-31351206. References: N-CVE-2016-8469.


An information disclosure vulnerability in the Qualcomm camera driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10 Kernel-3.18. Android ID: A-32709702. References: QC-CR#518731.


An information disclosure vulnerability in kernel components including the ION subsystem Binder USB driver and networking subsystem could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10 Kernel-3.18. Android ID: A-31802656.


An information disclosure vulnerability in the bootloader could enable a local attacker to access data outside of its permission level. This issue is rated as High because it could be used to access sensitive data. Product: Android. Versions: Kernel-3.18. Android ID: A-32369621.


An exploitable information disclosure vulnerability exists in the serviceAgent functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. A specially crafted TCP query will allow an attacker to retrieve potentially sensitive information.


An information disclosure vulnerability in the NVIDIA video driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission. Product: Android. Versions: Kernel-3.10. Android ID: A-31385953. References: N-CVE-2016-8397.


An information disclosure vulnerability in kernel components including the ION subsystem Binder USB driver and networking subsystem could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10. Android ID: A-31495348.


The kernel in Microsoft Windows 10 Gold 1511 and 1607 and Windows Server 2016 mishandles page-fault system calls which allows local users to obtain sensitive information from arbitrary processes via a crafted application aka \Windows Kernel Memory Address Information Disclosure Vulnerability.\


An information disclosure vulnerability was found in JBoss Enterprise Application Platform before 7.0.4. It was discovered that when configuring RBAC and marking information as sensitive users with a Monitor role are able to view the sensitive information.