** DISPUTED ** The ipv6_getsockopt_sticky function in the kernel in Red Hat Enterprise Linux (RHEL) Beta 5.1.0 allows local users to obtain sensitive information (kernel memory contents) via a negative value of the len parameter. NOTE: this issue has been disputed in a bug comment stating that \len is ignored when copying header info to the user's buffer.\


SonicBB 1.0 allows remote attackers to obtain sensitive information via the (1) by parameter to search.php (2) p parameter to viewforum.php and the (3) id parameter to (a) viewforum.php or (b) members.php which reveal the installation path in the resulting error message.


The faq section in PostNuke 0.764 allows remote attackers to obtain sensitive information (the full path) via \unvalidated output\ in FAQ/index.php possibly involving an undefined id_cat variable.


The writeFile function in core/smb4kfileio.cpp in Smb4K before 0.8.0 does not preserve /etc/sudoers permissions across modifications which allows local users to obtain sensitive information (/etc/sudoers contents) by reading this file.


Scriptsez Random PHP Quote 1.0 stores sensitive information under the web root with insufficient access control which allows remote attackers to obtain password information via a direct request for pwd.txt.


wcSimple Poll stores sensitive information under the web root with insufficient access control which allows remote attackers to obtain password hashes via a direct request for password.txt.


Capital Request Forms stores sensitive information under the web root with insufficient access control which allows remote attackers to obtain database credentials via a direct request for inc/common_db.inc.


umount when running with the Linux 2.6.15 kernel on Slackware Linux 10.2 allows local users to trigger a NULL dereference and application crash by invoking the program with a pathname for a USB pen drive that was mounted and then physically removed which might allow the users to obtain sensitive information including core file contents.


The NFS client implementation in the kernel in Red Hat Enterprise Linux (RHEL) 3 when a filesystem is mounted with the noacl option checks permissions for the open system call via vfs_permission (mode bits) data rather than an NFS ACCESS call to the server which allows local client processes to obtain a false success status from open calls that the server would deny and possibly obtain sensitive information about file permissions on the server as demonstrated in a root_squash environment. NOTE: it is uncertain whether any scenarios involving this issue cross privilege boundaries.


MediaWiki before 1.9.2 allows remote attackers to obtain sensitive information via a direct request to (1) Simple.deps.php (2) MonoBook.deps.php (3) MySkin.deps.php or (4) Chick.deps.php in wiki/skins which shows the installation path in the resulting error message.


WordPress 2.0.6 and 2.1Alpha 3 (SVN:4662) does not properly verify that the m parameter value has the string data type which allows remote attackers to obtain sensitive information via an invalid m parameter as demonstrated by obtaining the path and obtaining certain SQL information such as the table prefix.


show.php in Vlad Alexa Mancini PHPFootball 1.6 allows remote attackers to obtain sensitive information (database contents) via a % (percent) character in the dbfieldv parameter.


VMware Workstation 5.5.3 34685 does not immediately change the availability of a shared clipboard when the \Enable copy and paste to and from this virtual machine\ checkbox is changed which allows local users to obtain sensitive information or conduct certain attacks that are facilitated by weaker isolation between the host and guest operating systems.


Tuan Do Uploader (aka php-uploader) 6 beta 1 stores sensitive information under the web root with insufficient access control which allows remote attackers to obtain the administrator password hash via a direct request for userdata/user_1.txt.


Interpretation conflict in ASP.NET in Microsoft .NET Framework 1.0 1.1 and 2.0 for Windows 2000 XP Server 2003 and Vista allows remote attackers to access configuration files and obtain sensitive information and possibly bypass security mechanisms that try to constrain the final substring of a string via %00 characters related to use of %00 as a string terminator within POSIX functions but a data character within .NET strings aka \Null Byte Termination Vulnerability.\


Advanced Guestbook 2.4.2 allows remote attackers to obtain sensitive information via an invalid (1) GB_TBL parameter to (a) lang/codes-english.php or (b) image.php which reveal the database name; (2) an invalid GB_DB parameter to index.php coupled with a ../index lang cookie which reveals the installation path; or (3) a direct request to index.php with no parameters or cookies which reveals the installation path.


admin.php in MKPortal M1.1 RC1 allows remote attackers to obtain sensitive information via a direct request with an MK_PATH=1 query string which reveals the path in an error message.


Joomla! 1.5.0 Beta allows remote attackers to obtain sensitive information via a direct request for (1) plugins/user/example.php; (2) gmail.php (3) example.php or (4) ldap.php in plugins/authentication/; (5) modules/mod_mainmenu/menu.php; or other unspecified PHP scripts which reveals the path in various error messages related to a jimport function call at the beginning of each script.


The Find feature in Palm OS Treo smart phones operates despite the system password lock which allows attackers with physical access to obtain sensitive information (memory contents) by doing (1) text searches or (2) paste operations after pressing certain keyboard shortcut keys.


xterm on Slackware Linux 10.2 stores information that had been displayed for a different user account using the same xterm process which might allow local users to bypass file permissions and read other users' files or obtain other sensitive information by reading the xterm process memory. NOTE: it could be argued that this is an expected consequence of multiple users sharing the same interactive process in which case this is not a vulnerability.


DocMan 1.3 RC2 allows remote attackers to obtain sensitive information (the full path) via unspecified vectors.


The page cache feature in Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2 and SeaMonkey before 1.0.8 can generate hash collisions that cause page data to be appended to the wrong page cache which allows remote attackers to obtain sensitive information or enable further attack vectors when the target page is reloaded from the cache.


index.php in Nwom topsites 3.0 allows remote attackers to obtain potentially sensitive information via a ' (quote) character in the o parameter which forces a SQL error.


Unspecified vulnerability in the \Show debugging information\ feature in MoinMoin 1.5.7 allows remote attackers to obtain sensitive information. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Aztek Forum 4.00 allows remote attackers to obtain sensitive information via a direct request to forum.php with the fid=XD query string which reveals the path in an error message.


Scriptsez Smart PHP Subscriber (aka subscribe) stores sensitive information under the web root with insufficient access control which allows remote attackers to obtain encoded passwords via a direct request for pwd.txt.


URLMount in Apple Mac OS X 10.3.9 through 10.4.9 passes the username and password credentials for mounting filesystems on SMB servers as command line arguments to the mount_sub command which may allow local users to obtain sensitive information by listing the process.


Michael Still gtalkbot before 1.2 places username and password arguments on the command line which allows local users to obtain sensitive information by listing the process.


MyBB 1.2.4 allows remote attackers to obtain sensitive information via the (1) action parameter to member.php (2) imagehash parameter to captcha.php and (3) a direct request to inc/datahandlers/event.php which reveal the installation path in the resulting error message.


M-Core stores the database under the web document root which allows remote attackers to obtain sensitive information via a direct request to db/uyelik.mdb.


buscador/buscador.htm in Portal Search allows remote attackers to obtain sensitive information (business logic) via a query string composed of a search for certain characters.


w-agora 4.2.1 allows remote attackers to obtain sensitive information by via the (1) bn array parameter to index.php which expects a string and (2) certain parameters to delete_forum.php which displays the path name in the resulting error message.


BEA WebLogic Server 8.1 through 8.1 SP5 stores cleartext data in a backup of config.xml after offline editing which allows local users to obtain sensitive information by reading this backup file.


Ezboxx Portal System Beta 0.7.6 and earlier allows remote attackers to obtain sensitive information via an invalid cat parameter to boxx/knowledgebase.asp which reveals the path in an error message.


The Cisco Security Monitoring Analysis and Response System (CS-MARS) before 4.2.3 and Adaptive Security Device Manager (ASDM) before 5.2(2.54) do not validate the SSL/TLS certificates or SSH public keys when connecting to devices which allows remote attackers to spoof those devices to obtain sensitive information or generate incorrect information.


Sun Java System Content Delivery Server 5.0 and 5.0 PU1 allows remote attackers to obtain sensitive information regarding \content details\ via unspecified vectors.


The ps (/usr/ucb/ps) command on HP Tru64 UNIX 5.1 1885 allows local users to obtain sensitive information including environment variables of arbitrary processes via the \auxewww\ argument a similar issue to CVE-1999-1587.


index.php in Open-Realty 2.3.4 allows remote attackers to obtain sensitive information (the full path) via an invalid listingID parameter in a listingview action.


Unspecified vulnerability in LifeType before 1.1.6 and 1.2 before 1.2-beta2 allows remote attackers to obtain sensitive information (file contents) via a \crafted URL.\


The WebFoundation framework in Apple Mac OS X 10.3.9 and earlier allows subdomain cookies to be accessed by the parent domain which allows remote attackers to obtain sensitive information.


The admin web console implemented by the Centrality Communications (aka Aredfox) PA168 chipset and firmware 1.54 and earlier as provided by various IP phones does not require passwords or authentication tokens when using HTTP which allows remote attackers to connect to existing superuser sessions and obtain sensitive information (passwords and configuration data).


The LoginToboggan module 7.x-1.x before 7.x-1.4 for Drupal does not properly unset the authorized user role for certain users which allows remote attackers with the pre-authorized role to gain privileges and possibly obtain sensitive information by accessing a Page Not Found (404) page.


tmpfiles.d/systemd.conf in systemd before 214 uses weak permissions for journal files under (1) /run/log/journal/%m and (2) /var/log/journal/%m which allows local users to obtain sensitive information by reading these files.


The ethtool_get_wol function in net/core/ethtool.c in the Linux kernel through 4.7 as used in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices does not initialize a certain data structure which allows local users to obtain sensitive information via a crafted application aka Android internal bug 28803952 and Qualcomm internal bug CR570754.


MantisBT before 1.2.18 does not properly check permissions when sending an email that indicates when a monitored issue is related to another issue which allows remote authenticated users to obtain sensitive information about restricted issues.


NetApp OnCommand Balance before 4.2P3 allows local users to obtain sensitive information via unspecified vectors related to cleartext storage.


drivers/media/media-device.c in the Linux kernel before 3.11 as used in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices does not properly initialize certain data structures which allows local users to obtain sensitive information via a crafted application aka Android internal bug 28750150 and Qualcomm internal bug CR570757 a different vulnerability than CVE-2014-1739.


puppetlabs-rabbitmq 3.0 through 4.1 stores the RabbitMQ Erlang cookie value in the facts of a node which allows local users to obtain sensitive information as demonstrated by using Facter.


drivers/usb/host/ehci-msm2.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5 devices omits certain minimum calculations before copying data which allows attackers to obtain sensitive information via a crafted application aka Android internal bug 28803909 and Qualcomm internal bug CR547910.


system/classes/DbPDO.php in Cmfive through 2015-03-15 when database connectivity malfunctions allows remote attackers to obtain sensitive information (username and password) via any request such as a password reset request.


Jenkins before 1.586 does not set the HttpOnly flag in a Set-Cookie header for session cookies when run on Tomcat 7.0.41 or later which makes it easier for remote attackers to obtain potentially sensitive information via script access to cookies.


in

the

Qualcomm

components

in

Android

before

on

Nexus

devices

allows

attackers

to

obtain

sensitive

information

from

kernel

memory

via

a

crafted

offset

aka

Android

internal

bug

and

Qualcomm

internal

bug


in

the

Qualcomm

components

in

Android

before

on

Nexus

and

devices

does

not

properly

validate

input

parameters

which

allows

attackers

to

obtain

sensitive

information

via

a

crafted

application

aka

Android

internal

bug

and

Qualcomm

internal

bug


The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel before 3.18.2 does not validate a length value in the Extensions Reference (ER) System Use Field which allows local users to obtain sensitive information from kernel memory via a crafted iso9660 image.


Icecast before 2.4.1 transmits the output of the on-connect script which might allow remote attackers to obtain sensitive information related to shared file descriptors.


The default checkout completion rule in the commerce_order module in the Drupal Commerce module 7.x-1.x before 7.x-1.10 for Drupal uses the email address as the username for new accounts created at checkout which allows remote attackers to obtain sensitive information via unspecified vectors.


VDG Security SENSE (formerly DIVA) 2.3.13 stores administrator credentials in cleartext which allows attackers to obtain sensitive information by reading the plugin configuration files.


drivers/misc/qseecom.c in the Qualcomm components in Android before 2016-08-05 on Nexus 7 (2013) devices does not ensure that certain name strings end in a '\\0' character which allows attackers to obtain sensitive information via a crafted application aka Android internal bug 28749708 and Qualcomm internal bug CR545736.


Open-School Community Edition 2.2 does not properly restrict access to the export functionality which allows remote authenticated users to obtain sensitive information via the r parameter with the value export to index.php.


Integer underflow in drivers/char/diag/diag_dci.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices allows attackers to gain privileges or obtain sensitive information via a crafted application aka Android internal bug 28750726 and Qualcomm internal bug CR556860.


Integer underflow in the diag driver in the Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices allows attackers to gain privileges or obtain sensitive information via a crafted application aka Android internal bug 28768146 and Qualcomm internal bug CR549470.


The snd_compr_tstamp function in sound/core/compress_offload.c in the Linux kernel through 4.7 as used in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices does not properly initialize a timestamp data structure which allows attackers to obtain sensitive information via a crafted application aka Android internal bug 28770164 and Qualcomm internal bug CR568717.


The sched_read_attr function in kernel/sched/core.c in the Linux kernel 3.14-rc before 3.14-rc4 uses an incorrect size which allows local users to obtain sensitive information from kernel stack memory via a crafted sched_getattr system call.


Fiyo CMS 2.0.1.8 allows remote attackers to obtain sensitive information via a direct request to the database backup file in .backup/.


Panasonic Arbitrator Back-End Server (BES) MK 2.0 VPU before 9.3.1 build 4.08.003.0 when USB Wi-Fi or Direct LAN is enabled and MK 3.0 VPU before 9.3.1 build 5.06.000.0 when Embedded Wi-Fi or Direct LAN is enabled does not use encryption which allows remote attackers to obtain sensitive information by sniffing the network for client-server traffic as demonstrated by Active Directory credential information.


drivers/char/adsprpc.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices does not properly validate parameters and return values which allows attackers to obtain sensitive information via a crafted application aka Android internal bug 28767593 and Qualcomm internal bug CR551795.


The Ubercart module 7.x-3.x before 7.x-3.7 for Drupal does not properly protect the per-user order history view which allows remote authenticated users with the \view own orders\ permission to obtain sensitive information via unspecified vectors.


Asset Pipeline in ownCloud 7.x before 7.0.3 uses an MD5 hash of the absolute file paths of the original CSS and JS files as the name of the concatenated file which allows remote attackers to obtain sensitive information via a brute force attack.


Netsweeper before 3.1.10 4.0.x before 4.0.9 and 4.1.x before 4.1.2 allows remote attackers to obtain sensitive information by making a request that redirects to the deny page.


drivers/video/msm/mdss/mdss_mdp_pp.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5 devices does not properly determine the size of Gamut LUT data which allows attackers to obtain sensitive information via a crafted application aka Android internal bug 28747914 and Qualcomm internal bug CR542223.


sound/soc/msm/qdsp6v2/msm-lsm-client.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5 devices does not validate certain user-space data which allows attackers to obtain sensitive information via a crafted application aka Android internal bug 28769856 and Qualcomm internal bug CR563752.


The UDF filesystem implementation in the Linux kernel before 3.18.2 does not ensure that space is available for storing a symlink target's name along with a trailing \\0 character which allows local users to obtain sensitive information via a crafted filesystem image related to fs/udf/symlink.c and fs/udf/unicode.c.


The Scribunto extension for MediaWiki allows remote attackers to obtain the rollback token and possibly other sensitive information via a crafted module related to unstripping special page HTML.


The svcauth_gss_accept_sec_context function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (aka krb5) 1.11.x through 1.11.5 1.12.x through 1.12.2 and 1.13.x before 1.13.1 transmits uninitialized interposer data to clients which allows remote attackers to obtain sensitive information from process heap memory by sniffing the network for data in a handle field.


Unspecified vulnerability in JetBrains TeamCity before 8.1 allows remote attackers to obtain sensitive information via unknown vectors.


Hitron CVE-30360 devices use a 578A958E3DD933FC DES key that is shared across different customers' installations which makes it easier for attackers to obtain sensitive information by decrypting a backup configuration file as demonstrated by a password hash in the um_auth_account_password field.


Maian Uploader 4.0 allows remote attackers to obtain sensitive information via a request without the height parameter to load_flv.js.php which reveals the installation path in an error message.


Citrix XenMobile MDX Toolkit before 9.0.4 when used to wrap iOS 8 applications does not properly encrypt cached application data which allows context-dependent attackers to obtain sensitive information by reading the cache.


The

function

in

in

MantisBT

before

allows

remote

attackers

to

obtain

sensitive

information

via

a

or

SOAP

request.


An unspecified JavaScript API in Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allows attackers to obtain sensitive information via unknown vectors a different vulnerability than CVE-2014-8448.


Linksys SMART WiFi firmware on EA2700 and EA3500 devices; before 2.1.41 build 162351 on E4200v2 and EA4500 devices; before 1.1.41 build 162599 on EA6200 devices; before 1.1.40 build 160989 on EA6300 EA6400 EA6500 and EA6700 devices; and before 1.1.42 build 161129 on EA6900 devices allows remote attackers to obtain sensitive information or modify data via a JNAP action in a JNAP/ HTTP request.


Mozilla Firefox before 35.0 and SeaMonkey before 2.32 do not properly initialize memory for BMP images which allows remote attackers to obtain sensitive information from process memory via a crafted web page that triggers the rendering of malformed BMP data within a CANVAS element.


SAP BusinessObjects Edge 4.0 allows remote attackers to obtain sensitive information via an InfoStore query to a CORBA listener.


The Bad Behavior module 6.x-2.x before 6.x-2.2216 and 7.x-2.x before 7.x-2.2216 for Drupal logs usernames and passwords which allows remote authenticated users with the \administer bad behavior\ permission to obtain sensitive information by reading a log file.


The (1) IBM Tivoli Identity Manager Active Directory adapter before 5.1.24 and (2) IBM Security Identity Manager Active Directory adapter before 6.0.14 for IBM Security Identity Manager on Windows when certain log and trace levels are configured store the cleartext administrator password in a log file which allows local users to obtain sensitive information by reading a file.


McAfee Network Data Loss Prevention (NDLP) before 9.3 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.


IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27 6.1.5 through 6.1.5.3 CF27 7.0.0 through 7.0.0.2 CF29 8.0.0 through 8.0.0.1 CF18 and 8.5.0 before CF08 improperly restricts resource access which allows remote attackers to obtain sensitive information via unspecified vectors as demonstrated by configuration information.


389 Directory Server before 1.3.2.27 and 1.3.3.x before 1.3.3.9 does not properly restrict access to the \cn=changelog\ LDAP sub-tree which allows remote attackers to obtain sensitive information from the changelog via unspecified vectors.


Wonder CMS 2014 allows remote attackers to obtain sensitive information by viewing /files/password which reveals the unsalted MD5 hashed password.


The SAP Business Intelligence Development Workbench allows remote attackers to obtain sensitive information by reading unspecified files.


The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! provides the MySQL username and password on the command line which allows local users to obtain sensitive information via the ps command.


Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information (names and details of projects) by visiting the /update.log URI.


Schrack Technik microControl with firmware before 1.7.0 (937) stores sensitive information under the web root with insufficient access control which allows remote attackers to obtain access data for the ftp and telnet services via a direct request for ZTPUsrDtls.txt.


Unspecified vulnerability in the Java Virtual Machine (JVM) in IBM SDK Java Technology Edition 5.0 before SR16-FP9 6 before SR16-FP3 6R1 before SR8-FP3 7 before SR8-FP10 and 7R1 before SR2-FP10 allows remote attackers to bypass intended access permissions and obtain sensitive information via unspecified vectors related to the security manager.


Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12 Acrobat and Acrobat Reader DC Classic before 2015.006.30060 and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors a different vulnerability than CVE-2015-4449 CVE-2015-4450 CVE-2015-5088 CVE-2015-5089 and CVE-2015-5092.


Adobe Digital Editions (DE) 4 does not use encryption for transmission of data to adelogs.adobe.com which allows remote attackers to obtain sensitive information by sniffing the network as demonstrated by book-navigation information.


An unspecified JavaScript API in Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allows attackers to obtain sensitive information via unknown vectors a different vulnerability than CVE-2014-8451.


(1) wp-dbmanager.php and (2) database-manage.php in the WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress place credentials on the mysqldump command line which allows local users to obtain sensitive information by listing the process.


The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH have a default password of (1) admin for the admin account and (2) compalbn for the root account which makes it easier for remote attackers to obtain access to certain sensitive information via unspecified vectors.


The XML Import/Export plugin in MantisBT 1.2.x does not restrict access which allows remote attackers to (1) upload arbitrary XML files via the import page or (2) obtain sensitive information via the export page. NOTE: this issue can be combined with CVE-2014-7146 to execute arbitrary PHP code.


Business Warehouse (BW) in SAP Netweaver AS ABAP 7.31 allows remote authenticated users to obtain sensitive information via a request to the RSDU_CCMS_GET_PROFILE_PARAM RFC function.


The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! stores database backup files with predictable names under the web root with insufficient access control which allows remote attackers to obtain sensitive information via a direct request to a backup file in administrators/backups/.


GleamTech FileVista before 6.1 allows remote authenticated users to obtain sensitive information via a crafted path when saving a zip file which reveals the installation path in an error message.


Lexiglot through 2014-11-20 allows local users to obtain sensitive information by listing a process because the username and password are on the command line.


The fal_sftp extension before 0.2.6 for TYPO3 uses weak permissions for sFTP driver files and folders which allows remote authenticated users to obtain sensitive information via unspecified vectors.


The API in the Guest Server in Cisco Jabber when HTML5 is used allows remote attackers to obtain sensitive information by sniffing the network during an HTTP (1) GET or (2) POST response aka Bug ID CSCus19801.


Unspecified vulnerability in McAfee Network Data Loss Prevention before (NDLP) before 9.3 allows local users to obtain sensitive information and impact integrity via unknown vectors related to partition mounting.


GetSimple

CMS

allows

remote

attackers

to

obtain

sensitive

information

via

a

direct

request

to

data/users/<username>.xml

backups/users/<username>.xml.bak

or


The indexing functionality in Spotlight in Apple OS X before 10.10.2 writes memory contents to an external hard drive which allows local users to obtain sensitive information by reading from this drive.


389 Directory Server 1.3.1.x 1.3.2.x before 1.3.2.27 and 1.3.3.x before 1.3.3.9 stores \unhashed\ passwords even when the nsslapd-unhashed-pw-switch option is set to off which allows remote authenticated users to obtain sensitive information by reading the Changelog.


The Web interface in Sendio before 7.2.4 does not properly handle sessions which allows remote authenticated users to obtain sensitive information from other users' sessions via a large number of requests.


Mozilla Firefox before 35.0 and SeaMonkey before 2.32 do not consider the id-pkix-ocsp-nocheck extension in deciding whether to trust an OCSP responder which makes it easier for remote attackers to obtain sensitive information by sniffing the network during a session in which there was an incorrect decision to accept a compromised and revoked certificate.


MODX Revolution 2.x before 2.2.15 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.


The API in the Guest Server in Cisco Jabber when the HTML5 CORS feature is used allows remote attackers to obtain sensitive information by sniffing the network during an HTTP (1) GET or (2) POST request aka Bug ID CSCus19789.


Dropbox SDK for Android before 1.6.2 might allow remote attackers to obtain sensitive information via crafted malware or via a drive-by download attack.


GetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to (1) plugins/anonymous_data.php or (2) plugins/InnovationPlugin.php which reveals the installation path in an error message.


KDE KMail does not encrypt attachments in emails when \automatic encryption\ is enabled which allows remote attackers to obtain sensitive information by sniffing the network.


lib/functions/database.class.php in TestLink before 1.9.13 allows remote attackers to obtain sensitive information via unspecified vectors which reveals the installation path in an error message.


The Management subsystem in Cisco Unified Computing System 2.1(3f) and earlier allows remote attackers to obtain sensitive information by reading log files aka Bug ID CSCur99239.


Wonder CMS 2014 allows remote attackers to obtain sensitive information by logging into the application with an array for the password which reveals the installation path in an error message.


The setlogin function in FreeBSD 8.4 through 10.1-RC4 does not initialize the buffer used to store the login name which allows local users to obtain sensitive information from kernel memory via a call to getlogin which returns the entire buffer.


EntryPass N5200 Active Network Control Panel does not properly restrict access which allows remote attackers to obtain the administrator username and password and possibly other sensitive information via a request to /4.


The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! returns the MySQL password in cleartext to a text box in the configuration panel which allows remote attackers to obtain sensitive information via unspecified vectors.


Pluck CMS 4.7.2 allows remote attackers to obtain sensitive information by (1) changing \PHPSESSID\ to an array; (2) adding non-alphanumeric chars to \PHPSESSID\; (3) changing the image parameter to an array; or (4) changing the image parameter to a string which reveals the installation path in an error message.


The ke_questionnaire extension 2.5.2 and earlier for TYPO3 uses predictable names for the questionnaire answer forms which makes it easier for remote attackers to obtain sensitive information via a direct request.


Lexiglot

through

allows

remote

attackers

to

obtain

sensitive

information

(full

path)

via

an

request

if

PHP

has

a

non-recommended

configuration

that

produces

warning

messages.


The nfs_can_extend_write function in fs/nfs/write.c in the Linux kernel before 3.13.3 relies on a write delegation to extend a write operation without a certain up-to-date verification which allows local users to obtain sensitive information from kernel memory in opportunistic circumstances by writing to a file in an NFS filesystem and then reading the same file.


The IP Manager Assistant (IPMA) component in Cisco Unified Communications Manager (Unified CM) allows remote attackers to obtain sensitive information via a crafted URL aka Bug ID CSCun74352.


The mPAY24 payment module before 1.6 for PrestaShop allows remote attackers to obtain credentials the installation path and other sensitive information via a direct request to api/curllog.log.


ext/gd/gd.c in PHP 5.5.x before 5.5.9 does not check data types which might allow remote attackers to obtain sensitive information by using a (1) string or (2) array data type in place of a numeric data type as demonstrated by an imagecrop function call with a string for the x dimension value a different vulnerability than CVE-2013-7226.


cgi-bin/rpcBridge in the web interface 1.1 on Broadcom Ltd PIPA C211 rev2 does not properly restrict access which allows remote attackers to (1) obtain credentials and other sensitive information via a certain request to the config.getValuesHashExcludePaths method or (2) modify the firmware via unspecified vectors.


TIBCO Managed File Transfer Internet Server before 7.2.2 Managed File Transfer Command Center before 7.2.2 Slingshot before 1.9.1 and Vault before 1.0.1 allow remote attackers to obtain sensitive information via a crafted HTTP request.


The Rendezvous Daemon (rvd) Rendezvous Routing Daemon (rvrd) Rendezvous Secure Daemon (rvsd) and Rendezvous Secure Routing Daemon (rvsrd) in TIBCO Rendezvous before 8.4.2 Messaging Appliance before 8.7.1 and Substation ES before 2.8.1 do not properly implement access control which allows remote attackers to obtain sensitive information or modify transmitted information via unspecified vectors.


The make_temporary_filename function in perltidy 20120701-1 and earlier allows local users to obtain sensitive information or write to arbitrary files via a symlink attack related to use of the tmpnam function.


Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 uses weak encryption which allows remote attackers to obtain sensitive information by reading a credential file.


Use-after-free vulnerability in the nfqnl_zcopy function in net/netfilter/nfnetlink_queue_core.c in the Linux kernel through 3.13.6 allows attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation. NOTE: the affected code was moved to the skb_zerocopy function in net/core/skbuff.c before the vulnerability was announced.


The HANA ICM process in SAP HANA allows remote attackers to obtain the platform version host name instance number and possibly other sensitive information via a malformed HTTP GET request.


The ProcessVolumeDeviceControlIrp function in Ntdriver.c in TrueCrypt 7.1a allows local users to bypass access restrictions and obtain sensitive information about arbitrary files via a (1) TC_IOCTL_OPEN_TEST or (2) TC_IOCTL_GET_SYSTEM_DRIVE_CONFIG IOCTL call.


The NTT 050 plus application before 4.2.1 for Android allows attackers to obtain sensitive information by leveraging the ability to read system log files.


The FileUploadController servlet in EMC Connectrix Manager Converged Network Edition (CMCNE) before 12.1.5 does not properly restrict additions to the Connectrix Manager repository which allows remote attackers to obtain sensitive information by importing a crafted firmware file.


OleumTech Wireless Sensor Network devices allow remote attackers to obtain sensitive information about sensor nodes or spoof devices by reading cleartext protocol data.


Cisco Unified Contact Center Express (Unified CCX) does not properly restrict the content of the CCMConfig page which allows remote authenticated users to obtain sensitive information by examining this content aka Bug ID CSCum95575.


Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 uses weak encryption which allows local users to obtain sensitive information by reading a credential file.


The WebVPN portal in Cisco Adaptive Security Appliance (ASA) Software 8.4(.7.15) and earlier allows remote authenticated users to obtain sensitive information via a crafted JavaScript file aka Bug ID CSCui04520.


The Call Detail Records (CDR) Management component in Cisco Unified Communications Manager (Unified CM) allows remote authenticated users to obtain sensitive information by reading extraneous fields in an HTML document aka Bug ID CSCun74374.


Unspecified vulnerability on HP 8/20q switches SN6000 switches and 8Gb Simple SAN Connection Kit with firmware before 8.0.14.08.00 allows remote authenticated users to obtain sensitive information via unknown vectors.


The remember me feature in portal/scr_authentif.php in POSH (aka Posh portal or Portaneo) 3.0 3.2.1 3.3.0 and earlier stores the username and MD5 digest of the password in cleartext in a cookie which allows attackers to obtain sensitive information by reading this cookie.


The backend in Open-Xchange (OX) AppSuite 7.4.2 before 7.4.2-rev9 allows remote attackers to obtain sensitive information about user email addresses in opportunistic circumstances by leveraging a failure in e-mail auto configuration for external accounts.


Amtelco miSecureMessages (aka MSM) 6.2 does not properly manage sessions which allows remote authenticated users to obtain sensitive information via a modified message request.


in

MediaWiki

before

and

before

and

before

does

not

properly

handle

a

correctly

authenticated

but

unintended

login

attempt

which

makes

it

easier

for

remote

authenticated

users

to

obtain

sensitive

information

by

arranging

for

a

victim

to

login

to

the

attacker's

account

as

demonstrated

by

tracking

the

victim's

activity

related

to

a

\login

CSRF\

issue.


Unspecified vulnerability in HP Intelligent Management Center (iMC) before 7.0 E02020P03 and Branch Intelligent Management System (BIMS) before 7.0 E0201P02 allows remote authenticated users to obtain sensitive information or modify data via unknown vectors aka ZDI-CAN-2312.


Datum Systems SnIP on PSM-500 and PSM-4500 devices does not require authentication for FTP sessions which allows remote attackers to obtain sensitive information via RETR commands.


The doIndex function in hudson/util/RemotingDiagnostics.java in CloudBees Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users with the ADMINISTER permission to obtain sensitive information via vectors related to heapDump.


/sbin/pppoectl in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to obtain sensitive information by reading \bad parameter\ lines in error messages as demonstrated by reading the root password hash in /etc/shadow.


Innominate mGuard before 7.6.4 and 8.x before 8.0.3 does not require authentication for snapshot downloads which allows remote attackers to obtain sensitive information via a crafted HTTPS request.


The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 does not properly restrict access to files in the META-INF directory which allows remote attackers to obtain sensitive information via a direct request. NOTE: this issue was SPLIT from CVE-2014-0053 due to different researchers per ADT5.


The GetHTMLRunDir function in the scan-build utility in Clang 3.5 and earlier allows local users to obtain sensitive information or overwrite arbitrary files via a symlink attack on temporary directories with predictable names.


The E-Mail autoconfiguration feature in Open-Xchange AppSuite before 7.2.2-rev20 7.4.1 before 7.4.1-rev11 and 7.4.2 before 7.4.2-rev13 places a password in a GET request which allows remote attackers to obtain sensitive information by reading (1) web-server access logs (2) web-server Referer logs or (3) the browser history.


The Encrypt Files feature in ConeXware PowerArchiver before 14.02.05 uses legacy ZIP encryption even if the AES 256-bit selection is chosen which makes it easier for context-dependent attackers to obtain sensitive information via a known-plaintext attack.


Google V8 as used in Google Chrome before 38.0.2125.101 does not properly track JavaScript heap-memory allocations as allocations of uninitialized memory and does not properly concatenate arrays of double-precision floating-point numbers which allows remote attackers to obtain sensitive information via crafted JavaScript code related to the PagedSpace::AllocateRaw and NewSpace::AllocateRaw functions in heap/spaces-inl.h the LargeObjectSpace::AllocateRaw function in heap/spaces.cc and the Runtime_ArrayConcat function in runtime.cc.


IBM PowerVC 1.2.0 before FP3 and 1.2.1 before FP2 uses cleartext passwords in (1) api-paste.ini (2) debug logs (3) the installation process (4) environment checks (5) powervc-ldap-config (6) powervc-restore and (7) powervc-diag which allows local users to obtain sensitive information by entering a ps command or reading a file.


FreeBSD 8.4 before p14 9.1 before p17 9.2 before p10 and 10.0 before p7 does not properly initialize the buffer between the header and data of a control message which allows local users to obtain sensitive information from kernel memory via unspecified vectors.


Cougar-LG stores sensitive information under the web root with insufficient access control which allows remote attackers to obtain credentials.


lg.pl in Cistron-LG 1.01 stores sensitive information under the web root with insufficient access controls which allows remote attackers to obtain IP addresses and other unspecified router credentials.


user.php in Cisco WebEx Meetings Server 1.5(.1.131) and earlier does not properly implement the token timer for authenticated encryption which allows remote attackers to obtain sensitive information via a crafted URL aka Bug ID CSCuj81708.


The rhevm-log-collector package in Red Hat Enterprise Virtualization 3.4 uses the PostgreSQL database password on the command line when calling sosreport which allows local users to obtain sensitive information by listing the processes.


Cisco Intelligent Automation for Cloud (aka Cisco Cloud Portal) does not properly consider whether a session is a problematic NULL session which allows remote attackers to obtain sensitive information via crafted packets aka Bug IDs CSCuh87398 and CSCuh87380.


Cisco Intelligent Automation for Cloud in Cisco Cloud Portal does not properly restrict the content of MyServices action URLs which allows remote authenticated users to obtain sensitive information by reading (1) web-server access logs (2) web-server Referer logs or (3) the browser history aka Bug IDs CSCui36937 CSCui37004 and CSCui36927.


FreeBSD

before

before

before

and

before

does

not

properly

initialize

certain

data

structures

which

allows

local

users

to

obtain

sensitive

information

from

kernel

memory

via

a

or

SCTP

cmsg

or

a

or

notification.


The web framework in Cisco WebEx Meetings Server does not properly restrict the content of query strings which allows remote attackers to obtain sensitive information by reading (1) web-server access logs (2) web-server Referer logs or (3) the browser history aka Bug ID CSCuj81713.


IBM SONAS and System Storage Storwize V7000 Unified (aka V7000U) 1.3.x and 1.4.x before 1.4.3.4 store the chkauth password in the audit log which allows local users to obtain sensitive information by reading this log file.


Cisco Intelligent Automation for Cloud (aka Cisco Cloud Portal) does not properly implement URL redirection which allows remote authenticated users to obtain sensitive information via a crafted URL aka Bug ID CSCuh84870.


The reverse-proxy feature in IBM Security Access Manager (ISAM) for Web 8.0 with firmware 8.0.0.2 and 8.0.0.3 interprets the jct-nist-compliance parameter in the opposite of the intended manner which makes it easier for remote attackers to obtain sensitive information by leveraging weak SSL encryption settings that lack NIST SP 800-131A compliance.


SAP Background Processing does not properly restrict access which allows remote authenticated users to obtain sensitive information via an unspecified RFC function related to SAP Solution Manager 7.1.


The Unified Task List (UTL) Portlet for IBM WebSphere Portal 7.x and 8.x through 8.0.0.1 CF12 allows remote attackers to obtain potentially sensitive information about environment variables and JAR versions via unspecified vectors.


The Juniper Junos Pulse Secure Access Service (SSL VPN) devices with IVE OS before 7.4r5 and 8.x before 8.0r1 and Junos Pulse Access Control Service (UAC) before 4.4r5 and 5.x before 5.0r1 enable cipher suites with weak encryption algorithms which make it easier for remote attackers to obtain sensitive information by sniffing the network.


sosreport in Red Hat sos 1.7 and earlier on Red Hat Enterprise Linux (RHEL) 5 produces an archive with an fstab file potentially containing cleartext passwords and lacks a warning about reviewing this archive to detect included passwords which might allow remote attackers to obtain sensitive information by leveraging access to a technical-support data stream.


The oVirt storage backend in Red Hat Enterprise Virtualization 3.4 does not wipe memory snapshots when deleting a VM even when wipe-after-delete (WAD) is configured for the VM's disk which allows remote authenticated users with certain credentials to read portions of the deleted VM's memory and obtain sensitive information via an uninitialized storage volume.


The web framework in Cisco WebEx Meeting Server does not properly restrict the content of reply messages which allows remote attackers to obtain sensitive information via a crafted URL aka Bug IDs CSCuj81685 CSCuj81688 CSCuj81665 CSCuj81744 and CSCuj81661.


The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck directive which might allow remote attackers to obtain sensitive information via a revoked certificate when a Puppet master runs with Apache 2.4.


The ProfileAction controller in Cisco WebEx Meetings Server (CWMS) 1.5(.1.131) and earlier allows remote attackers to obtain sensitive information by reading stack traces in returned messages aka Bug ID CSCuj81700.


The Clientless SSL VPN portal in Cisco ASA Software 8.2 before 8.2(5.51) 8.3 before 8.3(2.42) 8.4 before 8.4(7.23) 8.6 before 8.6(1.15) 9.0 before 9.0(4.24) 9.1 before 9.1(5.12) 9.2 before 9.2(2.8) and 9.3 before 9.3(1.1) allows remote attackers to obtain sensitive information from process memory or modify memory contents via crafted parameters aka Bug ID CSCuq29136.


Cisco WebEx Meeting Server does not properly restrict the content of URLs which allows remote authenticated users to obtain sensitive information by reading (1) web-server access logs (2) web-server Referer logs or (3) the browser history aka Bug ID CSCuj81691.


Cisco Intelligent Automation for Cloud (aka Cisco Cloud Portal) 2008.3_SP9 and earlier does not properly consider whether a session is a problematic NULL session which allows remote attackers to obtain sensitive information via crafted packets related to an \iFrame vulnerability \ aka Bug ID CSCuh84801.


Form Data Viewer in Cisco Intelligent Automation for Cloud in Cisco Cloud Portal places passwords in form data which allows remote authenticated users to obtain sensitive information by reading HTML source code aka Bug ID CSCui36976.


The OBJ_obj2txt function in crypto/objects/obj_dat.c in OpenSSL 0.9.8 before 0.9.8zb 1.0.0 before 1.0.0n and 1.0.1 before 1.0.1i when pretty printing is used does not ensure the presence of '\\0' characters which allows context-dependent attackers to obtain sensitive information from process stack memory by reading output from X509_name_oneline X509_name_print_ex and unspecified other functions.


The CLI in Cisco IOS XR allows remote authenticated users to obtain sensitive information via unspecified commands aka Bug IDs CSCuq42336 CSCuq76853 CSCuq76873 and CSCuq45383.


The Monitoring plugin before 1.53.0 for Jenkins allows remote attackers to obtain sensitive information by accessing unspecified pages.


The RDS Java Client library in IBM Rational Directory Server (RDS) 5.1.1.x before 5.1.1.2 iFix004 and 5.2.x before 5.2.1 iFix003 and Rational Directory Administrator (RDA) 6.0 before iFix002 includes the cleartext root password which allows local users to obtain sensitive information by reading a library file.


The MySQL server in Juniper Networks Junos Space before 13.3R1.8 has an unspecified account with a hardcoded password which allows remote attackers to obtain sensitive information and consequently obtain administrative control by leveraging database access.


The NavigationScheduler::schedulePageBlock function in core/loader/NavigationScheduler.cpp in Blink as used in Google Chrome before 38.0.2125.101 does not properly provide substitute data for pages blocked by the XSS auditor which allows remote attackers to obtain sensitive information via a crafted web site.


The default configuration for the Command Line Interface in Red Hat Enterprise Application Platform before 6.4.0 and WildFly (formerly JBoss Application Server) uses weak permissions for .jboss-cli-history which allows local users to obtain sensitive information via unspecified vectors.


The Public Key Pinning (PKP) implementation in Google Chrome before 36.0.1985.143 on Windows OS X and Linux and before 36.0.1985.135 on Android does not correctly consider the properties of SPDY connections which allows remote attackers to obtain sensitive information by leveraging the use of multiple domain names.


SAP Profile Maintenance does not properly restrict access which allows remote authenticated users to obtain sensitive information via an unspecified RFC function related to SAP Solution Manager 7.1.


The Java Server Pages in the Software Lifecycle Manager (SLM) in SAP NetWeaver allows remote attackers to obtain sensitive information via a crafted request related to SAP Solution Manager 7.1.


Sitepark Information Enterprise Server (IES) 2.9 before 2.9.6 when upgraded from an earlier version does not properly restrict access which allows remote attackers to change the manager account password and obtain sensitive information via a request to install/.


The ktrace utility in the FreeBSD kernel 8.4 before p11 9.1 before p14 9.2 before p7 and 9.3-BETA1 before p1 uses an incorrect page fault kernel trace entry size which allows local users to obtain sensitive information from kernel memory via a kernel process trace.


Puppet Enterprise 2.8.x before 2.8.7 allows remote attackers to obtain sensitive information via vectors involving hiding and unhiding nodes.


The jabber_idn_validate function in jutil.c in the Jabber protocol plugin in libpurple in Pidgin before 2.10.10 allows remote attackers to obtain sensitive information from process memory via a crafted XMPP message.


The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 does not include the HTTPOnly flag in a Set-Cookie header for an unspecified cookie which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie a different vulnerability than CVE-2013-3984.


IBM Scale Out Network Attached Storage (SONAS) 1.3.x and 1.4.x before 1.4.3.3 places an administrative password in the shell history upon use of the -p option to chuser which allows local users to obtain sensitive information by leveraging root access.


Pyplate 0.08 does not include the HTTPOnly flag in a Set-Cookie header for the id cookie which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.


The application link interface in the NTT DOCOMO sp mode mail application 6100 through 6300 for Android 4.0.x and 6130 through 6700 for Android 4.1 through 4.4 writes message content to the SD card during e-mail composition which allows attackers to obtain sensitive information via a crafted application.


Apple TV before 6.1 does not properly restrict logging which allows local users to obtain sensitive information by reading log data.


Mozilla Firefox before 31.1 on Android does not properly restrict copying of local files onto the SD card during processing of file: URLs which allows attackers to obtain sensitive information from the Firefox profile directory via a crafted application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1515.


The Solution Manager in SAP NetWeaver does not properly restrict access which allows remote attackers to obtain sensitive information via unspecified vectors.


The media_device_enum_entities function in drivers/media/media-device.c in the Linux kernel before 3.14.6 does not initialize a certain data structure which allows local users to obtain sensitive information from kernel memory by leveraging /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call.


The wanxl_ioctl function in drivers/net/wan/wanxl.c in the Linux kernel before 3.11.7 does not properly initialize a certain data structure which allows local users to obtain sensitive information from kernel memory via an ioctl call.


The Citrix GoToMeeting application 5.0.799.1238 for Android logs HTTP requests containing sensitive information which allows attackers to obtain user IDs meeting details and authentication tokens via an application that reads the system log file.


content/base/src/nsDocument.cpp in Mozilla Firefox before 33.0 Firefox ESR 31.x before 31.2 and Thunderbird 31.x before 31.2 does not consider whether WebRTC video sharing is occurring which allows remote attackers to obtain sensitive information from the local camera in certain IFRAME situations by maintaining a session after the user temporarily navigates away.


Mozilla Firefox before 28.0.1 on Android processes a file: URL by copying a local file onto the SD card which allows attackers to obtain sensitive information from the Firefox profile directory via a crafted application.


The help function in net/netfilter/nf_nat_irc.c in the Linux kernel before 3.12.8 allows remote attackers to obtain sensitive information from kernel memory by establishing an IRC DCC session in which incorrect packet data is transmitted during use of the NAT mangle feature.


BlackBerry Enterprise Server 5.x before 5.0.4 MR7 and Enterprise Service 10.x before 10.2.2 log cleartext credentials during exception handling which allows local users to obtain sensitive information by reading the exception log file.


The fst_get_iface function in drivers/net/wan/farsync.c in the Linux kernel before 3.11.7 does not properly initialize a certain data structure which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability for an SIOCWANDEV ioctl call.


Graphics Driver in Apple OS X before 10.9.4 does not properly restrict read operations during processing of an unspecified system call which allows local users to obtain sensitive information from kernel memory and bypass the ASLR protection mechanism via a crafted call.


Mozilla Firefox before 27.0 on Android 4.2 and earlier creates system-log entries containing profile paths which allows attackers to obtain sensitive information via a crafted application.


OpenStack Image Registry and Delivery Service (Glance) 2013.2 through 2013.2.1 and Icehouse before icehouse-2 logs a URL containing the Swift store backend password when authentication fails and WARNING level logging is enabled which allows local users to obtain sensitive information by reading the log.


The (1) load_djpeg function in JpegImagePlugin.py (2) Ghostscript function in EpsImagePlugin.py (3) load function in IptcImagePlugin.py and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file.


The raw_cmd_copyout function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly restrict access to certain pointers during processing of an FDRAWCMD ioctl call which allows local users to obtain sensitive information from kernel heap memory by leveraging write access to a /dev/fd device.


Requests (aka python-requests) before 2.3.0 allows remote servers to obtain sensitive information by reading the Proxy-Authorization header in a redirected request.


The login form in Bugzilla 2.x 3.x 4.x before 4.4.3 and 4.5.x before 4.5.3 does not properly handle a correctly authenticated but unintended login attempt which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account and then submit a vulnerability report related to a \login CSRF\ issue.


Mozilla Firefox before 33.0 does not properly initialize memory for GIF images which allows remote attackers to obtain sensitive information from process memory via a crafted web page that triggers a sequence of rendering operations for truncated GIF data within a CANVAS element.


The yam_ioctl function in drivers/net/hamradio/yam.c in the Linux kernel before 3.12.8 does not initialize a certain structure member which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability for an SIOCYAMGCFG ioctl call.


The NTT DOCOMO sp mode mail application 6300 and earlier for Android 4.0.x and 6700 and earlier for Android 4.1 through 4.4 uses weak permissions for attachments during processing of incoming e-mail messages which allows attackers to obtain sensitive information via a crafted application.


Check Point Session Authentication Agent allows remote attackers to obtain sensitive information (user credentials) via unspecified vectors.


Visibility Software Cyber Recruiter before 8.1.00 does not use the appropriate combination of HTTPS transport and response headers to prevent access to (1) AppSelfService.aspx and (2) AgencyPortal.aspx in the browser history which allows remote attackers to obtain sensitive information by leveraging an unattended workstation.


BlackBerry Enterprise Service 10 before 10.2.1 Universal Device Service 6 Enterprise Server Express for Domino through 5.0.4 Enterprise Server Express for Exchange through 5.0.4 Enterprise Server for Domino through 5.0.4 MR6 Enterprise Server for Exchange through 5.0.4 MR6 and Enterprise Server for GroupWise through 5.0.4 MR6 log cleartext credentials during exception handling which might allow context-dependent attackers to obtain sensitive information by reading a log file.


Technicolor TC7200 with firmware STD6.01.12 could allow remote attackers to obtain sensitive information.


Django 1.4 before 1.4.13 1.5 before 1.5.8 1.6 before 1.6.5 and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers.


Mozilla Firefox before 34.0 Firefox ESR 31.x before 31.3 and Thunderbird before 31.3 on Apple OS X 10.10 omit a CoreGraphics disable-logging action that is needed by jemalloc-based applications which allows local users to obtain sensitive information by reading /tmp files as demonstrated by credential information.


Mozilla Firefox before 32.0 Firefox ESR 31.x before 31.1 and Thunderbird 31.x before 31.1 do not properly initialize memory for GIF rendering which allows remote attackers to obtain sensitive information from process memory via crafted web script that interacts with a CANVAS element associated with a malformed GIF image.


Gwsync in SAP CRM 7.02 EHP 2 allows remote attackers to obtain sensitive information via unspecified vectors related to an XML External Entity (XXE) issue.


Secure Transport in Apple iOS before 7.1.2 Apple OS X before 10.9.4 and Apple TV before 6.1.2 does not ensure that a DTLS message is accepted only for a DTLS connection which allows remote attackers to obtain potentially sensitive information from uninitialized process memory by providing a DTLS message within a TLS connection.


Mozilla Firefox 33.0 and SeaMonkey before 2.31 include path strings in CSP violation reports which allows remote attackers to obtain sensitive information via a web site that receives a report after a redirect.


Mail in Apple iOS before 7.1.2 advertises the availability of data protection for attachments but stores cleartext attachments under mobile/Library/Mail/ which makes it easier for physically proximate attackers to obtain sensitive information by mounting the data partition.


The WebRTC video-sharing feature in dom/media/MediaManager.cpp in Mozilla Firefox before 33.0 Firefox ESR 31.x before 31.2 and Thunderbird 31.x before 31.2 does not properly recognize Stop Sharing actions for videos in IFRAME elements which allows remote attackers to obtain sensitive information from the local camera by maintaining a session after the user tries to discontinue streaming.


The error-handling feature in (1) bp.php (2) videowhisper_streaming.php and (3) ls/rtmp.inc.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to obtain sensitive information via a direct request which reveals the full path in an error message.


Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allow remote attackers to bypass the Same Origin Policy and obtain sensitive information by using an IFRAME element in conjunction with certain timing measurements involving the document.caretPositionFromPoint and document.elementFromPoint functions.


iBooks Commerce in Apple OS X before 10.9.4 places Apple ID credentials in the iBooks log which allows local users to obtain sensitive information by reading this file.


The Taxonomy module in Drupal 7.x before 7.26 when upgraded from an earlier version of Drupal does not properly restrict access to unpublished content which allows remote authenticated users to obtain sensitive information via a listing page.


Foreman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews which allows remote attackers to obtain sensitive information via the hostname parameter related to \spoof.\


Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux Adobe AIR before 13.0.0.83 on Android Adobe AIR SDK before 13.0.0.83 and Adobe AIR SDK & Compiler before 13.0.0.83 allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors.


The installation process in IBM Security Key Lifecycle Manager 2.5 stores unencrypted credentials which might allow local users to obtain sensitive information by leveraging root access. IBM X-Force ID: 90988.


Sendio before 7.2.4 includes the session identifier in URLs in emails which allows remote attackers to obtain sensitive information and hijack sessions by reading the jsessionid parameter in the Referrer HTTP header.


WebEx Meeting Center in Cisco WebEx Business Suite does not properly compose URLs for HTTP GET requests which allows remote attackers to obtain sensitive information by reading (1) web-server access logs (2) web-server Referer logs or (3) a browser's history aka Bug ID CSCul98272.


EMC Cloud Tiering Appliance (CTA) 9.x through 10 SP1 and File Management Appliance (FMA) 7.x store DES password hashes for the root super and admin accounts which makes it easier for context-dependent attackers to obtain sensitive information via a brute-force attack.


The RAND_bytes function in libssh before 0.6.3 when forking is enabled does not properly reset the state of the OpenSSL pseudo-random number generator (PRNG) which causes the state to be shared between children processes and allows local users to obtain sensitive information by leveraging a pid collision.


The identity-reporting implementations in mod/forum/renderer.php and mod/quiz/override_form.php in Moodle through 2.3.11 2.4.x before 2.4.9 2.5.x before 2.5.5 and 2.6.x before 2.6.2 do not properly restrict the display of e-mail addresses which allows remote authenticated users to obtain sensitive information by using the (1) Forum or (2) Quiz module.


RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics sends cleartext credentials over HTTP which allows remote attackers to obtain sensitive information by sniffing the network.


The Administrative Console in IBM WebSphere Application Server (WAS) 8.x before 8.0.0.9 and 8.5.x before 8.5.5.2 allows remote authenticated users to obtain sensitive information via a crafted request.


IBM Security AppScan Source 8.0 through 9.0 when the publish-assessment permission is not properly restricted for the configured database server transmits cleartext assessment data which allows remote attackers to obtain sensitive information by sniffing the network.


The disaster recovery system (DRS) in Cisco Unified Contact Center Express (Unified CCX) allows remote authenticated users to obtain sensitive information by reading extraneous fields in an HTML document aka Bug ID CSCum95536.


The setup script in ovirt-engine-dwh as used in the Red Hat Enterprise Virtualization Manager data warehouse (rhevm-dwh) package before 3.3.3 stores the history database password in cleartext which allows local users to obtain sensitive information by reading an unspecified file.


JBoss SX and PicketBox as used in Red Hat JBoss Enterprise Application Platform (EAP) before 6.2.3 use world-readable permissions on audit.log which allows local users to obtain sensitive information by reading this file.


The account-creation functionality in IBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.x before 6.6.1 places the new user's default password within the creation page which allows remote attackers to obtain sensitive information by reading the HTML source code.


The RBAC implementation in Cisco Identity Services Engine (ISE) Software does not properly verify privileges for support-bundle downloads which allows remote authenticated users to obtain sensitive information via a download action as demonstrated by obtaining read access to the user database aka Bug ID CSCul83904.


The My Home implementation in the block_html_pluginfile function in blocks/html/lib.php in Moodle through 2.3.11 2.4.x before 2.4.10 2.5.x before 2.5.6 and 2.6.x before 2.6.3 does not properly restrict file access which allows remote attackers to obtain sensitive information by visiting an HTML block.


Kafo before 0.3.17 and 0.4.x before 0.5.2 as used by Foreman uses world-readable permissions for default_values.yaml which allows local users to obtain passwords and other sensitive information by reading the file.


The

Connect

client

in

IBM

Sametime

and

when

a

certain

com.ibm.collaboration.realtime.telephony.*.level

setting

is

used

logs

cleartext

passwords

during

Audio/Video

chat

sessions

which

allows

local

users

to

obtain

sensitive

information

by

reading

a

log

file.


The setup script in ovirt-engine-reports as used in the Red Hat Enterprise Virtualization reports (rhevm-reports) package before 3.3.3 stores the reports database password in cleartext which allows local users to obtain sensitive information by reading an unspecified file.


IBM DB2 9.5 through 10.5 on Linux UNIX and Windows stores passwords during the processing of certain SQL statements by the monitoring and audit facilities which allows remote authenticated users to obtain sensitive information via commands associated with these facilities.


lib/adminlib.php in Moodle through 2.3.11 2.4.x before 2.4.8 2.5.x before 2.5.4 and 2.6.x before 2.6.1 logs cleartext passwords which allows remote authenticated administrators to obtain sensitive information by reading the Config Changes Report.


The Red Hat Enterprise Virtualization Manager reports (rhevm-reports) package before 3.3.3-1 uses world-readable permissions on the datasource configuration file (js-jboss7-ds.xml) which allows local users to obtain sensitive information by reading the file.


Cumin (aka MRG Management Console) as used in Red Hat Enterprise MRG 2.5 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.


Samba 3.6.6 through 3.6.23 4.0.x before 4.0.18 and 4.1.x before 4.1.8 when a certain vfs shadow copy configuration is enabled does not properly initialize the SRV_SNAPSHOT_ARRAY response field which allows remote authenticated users to obtain potentially sensitive information from process memory via a (1) FSCTL_GET_SHADOW_COPY_DATA or (2) FSCTL_SRV_ENUMERATE_SNAPSHOTS request.


EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 does not include the HTTPOnly flag in a Set-Cookie header for an unspecified cookie which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.


The RES Console in Rule Execution Server in IBM Operational Decision Manager 7.5 before FP3 IF37 8.0 before MP1 FP2 and 8.5 before MP1 IF26 does not send appropriate Cache-Control HTTP headers which allows remote attackers to obtain sensitive information by leveraging an unattended workstation.


The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10 when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken transmits the UsernameToken in cleartext which allows remote attackers to obtain sensitive information by sniffing the network.


Unspecified vulnerability in Oracle Java SE 5.0u55 6u65 and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that this issue allows remote attackers to obtain sensitive information about encryption keys via a timing discrepancy during the TLS/SSL handshake.


IBM SPSS Analytic Server 1.0 before IF002 and 1.0.1 before IF004 logs cleartext passwords which allows remote authenticated users to obtain sensitive information via unspecified vectors.


openshift-origin-broker-util as used in Red Hat OpenShift Enterprise 1.2.7 and 2.0.5 uses world-readable permissions for the mcollective client.cfg configuration file which allows local users to obtain credentials and other sensitive information by reading the file.


SOSreport stores the md5 hash of the GRUB bootloader password in an archive which allows local users to obtain sensitive information by reading the archive.


WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext which allows local Apache users to obtain sensitive information by reading the PHP session files.


mod_wsgi module before 3.4 for Apache when used in embedded mode might allow remote attackers to obtain sensitive information via the Content-Type header which is generated from memory that may have been freed and then overwritten by a separate thread.


Rockwell Automation RSLogix 5000 7 through 20.01 and 21.0 does not properly implement password protection for .ACD files (aka project files) which allows local users to obtain sensitive information or modify data via unspecified vectors.


The User Attribute implementation in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2 8.0.x through 8.0.1.2 and 8.5.x through 8.5.0.1 does not verify authorization for read or write access to attribute values which allows remote authenticated users to obtain sensitive information configure e-mail notifications or modify task assignments via REST API calls.


The administrative interface (contrib.admin) in Django before 1.4.14 1.5.x before 1.5.9 1.6.x before 1.6.6 and 1.7 before release candidate 3 does not check if a field represents a relationship between models which allows remote authenticated users to obtain sensitive information via a to_field parameter in a popup action to an admin change form page as demonstrated by a /admin/auth/user/?pop=1&t=password URI.


oVirt Engine before 3.5.0 does not include the HTTPOnly flag in a Set-Cookie header for the session IDs which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.


EMC Documentum TaskSpace (TSP) 6.7SP1 before P25 and 6.7SP2 before P11 does not properly handle the interaction between the dm_world group and the dm_superusers_dynamic group which allows remote authenticated users to obtain sensitive information and gain privileges in opportunistic circumstances by leveraging an incorrect group-addition implementation.


The default configuration of IBM 4690 OS as used in Toshiba Global Commerce Solutions 4690 POS and other products hashes passwords with the ADXCRYPT algorithm which makes it easier for context-dependent attackers to obtain sensitive information via unspecified cryptanalysis of an ADXCSOUF.DAT file.


Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 logs the root password when deploying a VM which allows local users to obtain sensitive information by reading the evm.log file.


The installation process in IBM Security AppScan Enterprise 8.x before 8.6.0.2 iFix 003 8.7.x before 8.7.0.1 iFix 003 8.8.x before 8.8.0.1 iFix 002 and 9.0.x before 9.0.0.1 iFix 001 on Linux places a cleartext password in a temporary file which allows local users to obtain sensitive information by reading this file.


Apple iOS before 8.1.1 and OS X before 10.10.1 include location data during establishment of a Spotlight Suggestions server connection by Spotlight or Safari which might allow remote attackers to obtain sensitive information via unspecified vectors.


The NETGEAR ProSafe Plus Configuration Utility creates configuration backup files containing cleartext passwords which might allow remote attackers to obtain sensitive information by reading a file.


(1) lib/backup/cli/utility.rb in the backup-agoddard gem 3.0.28 and (2) lib/backup/cli/utility.rb in the backup_checksum gem 3.0.23 for Ruby place credentials on the openssl command line which allows local users to obtain sensitive information by listing the process.


Microsoft .NET Framework 2.0 SP2 3.5 and 3.5.1 omits the ASLR protection mechanism which allows remote attackers to obtain potentially sensitive information about memory addresses by leveraging the predictability of an executable image's location aka \.NET ASLR Vulnerability.\


The Saved Search Admin component in the Process Admin Console in IBM Business Process Manager (BPM) 8.0 through 8.5.5 does not properly restrict task and instance listings in result sets which allows remote authenticated users to bypass authorization checks and obtain sensitive information by executing a saved search.


lib/commands/setup.rb in the point-cli gem 0.0.1 for Ruby places credentials on the curl command line which allows local users to obtain sensitive information by listing the process.


An unspecified Ajax service in the Content Management toolkit in IBM Business Process Manager (BPM) 8.5.x through 8.5.5 allows remote authenticated users to obtain sensitive information by performing a document-attachment search and then reading document properties in the search results.


ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK stores sensitive information under the web root with insufficient access control which allows remote attackers to obtain the PPPoE/PPPoA password via a direct request for basic/tc2wanfun.js.


Mail in Apple OS X before 10.10 does not properly recognize the removal of a recipient address from a message which makes it easier for remote attackers to obtain sensitive information in opportunistic circumstances by reading a message intended exclusively for other recipients.


The installer in IBM Security AppScan Source 8.x and 9.x through 9.0.1 has an open network port for a debug service which allows remote attackers to obtain sensitive information by connecting to this port.


The check_icmp plugin in Nagios Plugins before 2.0.2 allows local users to obtain sensitive information from INI configuration files via the extra-opts flag a different vulnerability than CVE-2014-4701.


pfSense before 2.1.4 when HTTP is used does not include the HTTPOnly flag in a Set-Cookie header for the session cookie which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.


IBM Emptoris Sourcing Portfolio 9.5.x before 9.5.1.3 10.0.0.x before 10.0.0.1 10.0.1.x before 10.0.1.3 and 10.0.2.x before 10.0.2.4 and Emptoris Spend Analysis 9.5.x before 9.5.0.4 10.0.1.x before 10.0.1.3 and 10.0.2.x before 10.0.2.4 do not properly restrict use of FRAME elements which allows remote authenticated users to conduct phishing attacks and bypass intended access restrictions or obtain sensitive information via a crafted web site related to a \frame injection\ issue.


lib/parse_ini.c in Nagios Plugins 2.0.2 allows local users to obtain sensitive information via a symlink attack on the configuration file in the extra-opts flag. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4701.


The EMC NetWorker Module for MEDITECH (aka NMMEDI) 3.0 build 87 through 90 when EMC RecoverPoint and Plink are used stores cleartext RecoverPoint Appliance credentials in nsrmedisv.raw log files which allows local users to obtain sensitive information by reading these files.


The WebNavigator server in Siemens SIMATIC WinCC before 7.3 as used in PCS7 and other products allows remote attackers to obtain sensitive information via an HTTP request.


ppc64-diag 2.6.1 uses 0775 permissions for /tmp/diagSEsnap and does not properly restrict permissions for /tmp/diagSEsnap/snapH.tar.gz which allows local users to obtain sensitive information by reading files in this archive as demonstrated by /var/log/messages and /etc/yaboot.conf.


IBM InfoSphere Master Data Management - Collaborative Edition 10.x before 10.1-FP11 and 11.x before 11.0-FP5 and InfoSphere Master Data Management Server for Product Information Management 9.x before 9.1-FP15 and 10.x and 11.x before 11.3-IF2 do not properly protect credentials which allows remote attackers to obtain sensitive information via unspecified vectors.


Xen 3.2.x through 4.4.x does not properly clean memory pages recovered from guests which allows local guest OS users to obtain sensitive information via unspecified vectors.


EMC Documentum Web Development Kit (WDK) before 6.8 allows remote attackers to conduct frame-injection attacks and obtain sensitive information via unspecified vectors.


vm-support 0.88 in VMware Tools as distributed with VMware Workstation through 10.0.3 and other products uses 0644 permissions for the vm-support archive which allows local users to obtain sensitive information by extracting files from this archive.


lib/cap-strap/helpers.rb in the cap-strap gem 0.1.5 for Ruby places credentials on the useradd command line which allows local users to obtain sensitive information by listing the process.


IBM Initiate Master Data Service 9.5 before 9.5.093013 9.7 before 9.7.093013 10.0 before 10.0.093013 and 10.1 before 10.1.093013 does not properly restrict use of FRAME elements which allows remote attackers to conduct phishing attacks and bypass intended access restrictions or obtain sensitive information via a crafted web site related to a \frame injection\ issue.


The Project administration application in Siemens SIMATIC WinCC before 7.3 as used in PCS7 and other products has a hardcoded encryption key which allows remote attackers to obtain sensitive information by extracting this key from another product installation and then employing this key during the sniffing of network traffic on TCP port 1030.


The \System Profiler About This Mac\ component in Apple OS X before 10.10.1 includes extraneous cookie data in system-model requests which might allow remote attackers to obtain sensitive information via unspecified vectors.


test/tc_database.rb in the lean-ruport gem 0.3.8 for Ruby places the mysql user password on the mysqldump command line which allows local users to obtain sensitive information by listing the process.


The MCX Desktop Config Profiles implementation in Apple OS X before 10.10 retains web-proxy settings from uninstalled mobile-configuration profiles which allows remote attackers to obtain sensitive information in opportunistic circumstances by leveraging access to an unintended proxy server.


The /server/properties resource in Tenable Web UI before 2.3.5 for Nessus 5.2.3 through 5.2.7 allows remote attackers to obtain sensitive information via the token parameter.


Aptexx Resident Anywhere does not require authentication which allows remote attackers to obtain sensitive information or modify data via a direct request.


The kernel-mode drivers in Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 do not properly handle use of the paged kernel pool for allocation of uninitialized memory which allows local users to obtain sensitive information about kernel addresses via a crafted application aka \Windows Kernel Pool Allocation Vulnerability.\


The check_dhcp plugin in Nagios Plugins before 2.0.2 allows local users to obtain sensitive information from INI configuration files via the extra-opts flag a different vulnerability than CVE-2014-4702.


House Arrest in Apple iOS before 8.1 relies on the hardware UID for its encryption key which makes it easier for physically proximate attackers to obtain sensitive information from a Documents directory by obtaining this UID.


IBM DB2 10.5 before FP4 on Linux and AIX creates temporary files during CDE table LOAD operations which allows local users to obtain sensitive information by reading a file while a LOAD is occurring.


IBM Initiate Master Data Service 9.5 before 9.5.093013 9.7 before 9.7.093013 10.0 before 10.0.093013 and 10.1 before 10.1.093013 does not properly restrict use of FRAME elements which allows remote authenticated users to conduct phishing attacks and bypass intended access restrictions or obtain sensitive information via a crafted web site related to a \frame injection\ issue.


IBM Security QRadar SIEM QRM 7.1 MR1 and QRM/QVM 7.2 MR2 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.


The web user interface in IBM WebSphere Message Broker 8.0 before 8.0.0.6 and IBM Integration Bus 9.0 before 9.0.0.3 allows remote authenticated users to obtain sensitive information by reading the error page.


The rd_build_device_space function in drivers/target/target_core_rd.c in the Linux kernel before 3.14 does not properly initialize a certain data structure which allows local users to obtain sensitive information from ramdisk_mcp memory by leveraging access to a SCSI initiator.


IBM ServerGuide before 9.63 UpdateXpress System Packs Installer (UXSPI) before 9.63 and ToolsCenter Suite before 9.63 place credentials in logs which allows local users to obtain sensitive information by reading a file.


snap in powerpc-utils 1.2.20 produces an archive with fstab and yaboot.conf files potentially containing cleartext passwords and lacks a warning about reviewing this archive to detect included passwords which might allow remote attackers to obtain sensitive information by leveraging access to a technical-support data stream.


The alloc_domain_struct function in arch/arm/domain.c in Xen 4.4.x when running on an ARM platform does not properly initialize the structure containing the grant table pages for a domain which allows local guest administrators to obtain sensitive information via the GNTTABOP_setup_table subhypercall.


CFNetwork in Apple iOS before 8.1.1 and OS X before 10.10.1 does not properly clear the browsing cache upon a transition out of private-browsing mode which makes it easier for physically proximate attackers to obtain sensitive information by reading cache files.


(1) lib/dataset/database/mysql.rb and (2) lib/dataset/database/postgresql.rb in the codders-dataset gem 1.3.2.1 for Ruby place credentials on the mysqldump command line which allows local users to obtain sensitive information by listing the process.


Apple iOS before 8 does not follow the intended configuration setting for text-message preview on the lock screen which allows physically proximate attackers to obtain sensitive information by reading this screen.


The phpinfo implementation in ext/standard/info.c in PHP before 5.4.30 and 5.5.x before 5.5.14 does not ensure use of the string data type for the PHP_AUTH_PW PHP_AUTH_TYPE PHP_AUTH_USER and PHP_SELF variables which might allow context-dependent attackers to obtain sensitive information from process memory by using the integer data type with crafted values related to a \type confusion\ vulnerability as demonstrated by reading a private SSL key in an Apache HTTP Server web-hosting environment with mod_ssl and a PHP 5.3.x mod_php.


Address Book in Apple iOS before 8 relies on the hardware UID for its encryption key which makes it easier for physically proximate attackers to obtain sensitive information by obtaining this UID.


Safari in Apple iOS before 8 does not properly restrict the autofilling of passwords in forms which allows remote attackers to obtain sensitive information via (1) an http web site (2) an https web site with an unacceptable X.509 certificate or (3) an IFRAME element.


IBM Sametime Classic Meeting Server 8.0.x and 8.5.x allows remote attackers to obtain sensitive information by reading an exported Record and Playback (RAP) file.


in

the

kajam

gem

for

Ruby

places

the

mysql

user

password

on

the

mysqldump

command

line

in

the

capture

function

and

mysql

command

line

in

the

restore

function

which

allows

local

users

to

obtain

sensitive

information

by

listing

the

process.


The App Store process in CommerceKit Framework in Apple OS X before 10.10.2 places Apple ID credentials in App Store logs which allows local users to obtain sensitive information by reading a file.


The ESET Personal Firewall NDIS filter (EpFwNdis.sys) kernel mode driver aka Personal Firewall module before Build 1212 (20140609) as used in multiple ESET products 5.0 through 7.0 allows local users to obtain sensitive information from kernel memory via crafted IOCTL calls.


Curam Universal Access in IBM Curam Social Program Management (SPM) 6.0 SP2 before EP26 6.0.4 before 6.0.4.6 and 6.0.5 before 6.0.5.5 iFix5 allows remote attackers to obtain sensitive information about internal caseworker usernames via vectors related to a URL.


The lynx gem before 1.0.0 for Ruby places the configured password on command lines which allows local users to obtain sensitive information by listing processes.


Avolve Software ProjectDox 8.1 makes it easier for remote authenticated users to obtain sensitive information by leveraging ciphertext reuse.


Unspecified vulnerability in the Authentication Module in TIBCO Spotfire Server before 4.5.2 5.0.x before 5.0.3 5.5.x before 5.5.2 6.0.x before 6.0.3 and 6.5.x before 6.5.1 allows remote attackers to gain privileges and obtain sensitive information or modify data via unknown vectors.


Zarafa 5.00 uses world-readable permissions for the files in the log directory which allows local users to obtain sensitive information by reading the log files.


Hospira MedNet before 6.1 uses hardcoded cryptographic keys for protection of data transmission from infusion pumps which allows remote attackers to obtain sensitive information by sniffing the network.


Zarafa Collaboration Platform 4.1 uses world-readable permissions for /etc/zarafa/license which allows local users to obtain sensitive information by reading license files.


Zarafa WebAccess 4.1 and WebApp uses world-readable permissions for the files in their tmp directory which allows local users to obtain sensitive information by reading temporary session data.


CareFusion Pyxis SupplyStation 8.1 with hardware test tool before 1.0.16 allows local users to obtain potentially sensitive information by reading a temporary (1) debugging file or (2) developer file.


nds/files/opt/novell/eDirectory/lib64/ndsimon/public/images

in

iMonitor

in

Novell

eDirectory

before

Patch

allows

remote

authenticated

users

to

obtain

sensitive

information

from

process

memory

via

a

direct

request.


GLPI before 0.84.7 does not properly restrict access to cost information which allows remote attackers to obtain sensitive information via the cost criteria in the search bar.


Plack::App::File in Plack before 1.0031 removes trailing slash characters from paths which allows remote attackers to bypass the whitelist of generated files and obtain sensitive information via a crafted path related to Plack::Middleware::Static.


Avolve Software ProjectDox 8.1 allows remote authenticated users to obtain sensitive information from other users via vectors involving a direct access token.


Innovative Interfaces Encore Discovery Solution 4.3 places a session token in the URI which might allow remote attackers to obtain sensitive information via unspecified vectors.


The Storage Controller (SC) component in Eucalyptus 3.4.2 through 4.0.x before 4.0.1 when Dell Equallogic SAN is used logs the CHAP user credentials which allows local users to obtain sensitive information by reading the logs.


The installation component in Hospira MedNet before 6.1 places cleartext credentials in configuration files which allows local users to obtain sensitive information by reading a file.


SAP HANA Extend Application Services (XS) does not encrypt transmissions for applications that enable form based authentication using SSL which allows remote attackers to obtain credentials and other sensitive information by sniffing the network.


The Original File and Patched File resources in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allow remote authenticated users to bypass intended access restrictions and obtain sensitive information from repository files by leveraging knowledge of database ids.


lib/ksymfony1.rb in the kcapifony gem 2.1.6 for Ruby places database user passwords on the (1) mysqldump (2) pg_dump (3) mysql and (4) psql command lines which allows local users to obtain sensitive information by listing the processes.


The freelinking module for Drupal as used in the Freelinking for Case Tracker module does not properly check access permissions for (1) nodes or (2) users which allows remote attackers to obtain sensitive information via a crafted link.


Enigmail 1.7.x before 1.7.2 sends emails in plaintext when encryption is enabled and only BCC recipients are specified which allows remote attackers to obtain sensitive information by sniffing the network.


The ActiveMatrix Policy Manager Authentication module in TIBCO ActiveMatrix Policy Agent 3.x before 3.1.2 ActiveMatrix Policy Manager 3.x before 3.1.2 ActiveMatrix Management Agent 1.x before 1.2.1 for WCF and ActiveMatrix Management Agent 1.x before 1.2.1 for WebSphere allows remote attackers to gain privileges and obtain sensitive information via unspecified vectors.


Zarafa WebAccess 7.1.10 and WebApp 1.6 beta uses weak permissions (644) for config.php which allows local users to obtain sensitive information by reading the PHP session files. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0103.


The login function in lib/lawn.rb in the lawn-login gem 0.0.7 for Ruby places credentials on the curl command line which allows local users to obtain sensitive information by listing the process.


The _UpgradeBeforeConfigurationChange function in lib/client/gnt_cluster.py in Ganeti 2.10.0 before 2.10.7 and 2.11.0 before 2.11.5 uses world-readable permissions for the configuration backup file which allows local users to obtain SSL keys remote API credentials and other sensitive information by reading the file related to the upgrade command.


The SFTP external storage driver (files_external) in ownCloud Server before 6.0.5 validates the RSA Host key after login which allows remote attackers to obtain sensitive information by sniffing the network.


lib/brbackup.rb in the brbackup gem 0.1.1 for Ruby places the database password on the mysql command line which allows local users to obtain sensitive information by listing the process.


The WordPress Mobile Pack plugin before 2.0.2 for WordPress does not properly restrict access to password protected posts which allows remote attackers to obtain sensitive information via an exportarticles action to export/content.php.


The SAP Netweaver Business Warehouse component does not properly restrict access to the functions in the BW-SYS-DB-DB4 function group which allows remote authenticated users to obtain sensitive information via unspecified vectors.


lib/phpunit/bootstrap.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 allows remote attackers to obtain sensitive information via a direct request which reveals the full path in an error message.


LG Electronics Mobile WiFi router L-09C L-03E and L-04D does not restrict access to the web administration interface which allows remote attackers to obtain sensitive information via unspecified vectors.


Spotfire Web Player Engine in TIBCO Spotfire Web Player 6.0.x before 6.0.2 and 6.5.x before 6.5.2 Spotfire Deployment Kit 6.0.x before 6.0.2 and 6.5.x before 6.5.2 and Silver Fabric Enabler for Spotfire Web Player before 1.6.1 allows remote authenticated users to obtain sensitive information via unspecified vectors.


TIBCO Managed File Transfer Internet Server before 7.2.4 Managed File Transfer Command Center before 7.2.4 Slingshot before 1.9.3 and Vault before 1.1.1 allow remote attackers to obtain sensitive information or modify data by leveraging agent access.


mod/data/edit.php in Moodle through 2.4.11 2.5.x before 2.5.9 2.6.x before 2.6.6 and 2.7.x before 2.7.3 sets a certain group ID to zero upon a database-entry change which allows remote authenticated users to obtain sensitive information by accessing the database after an edit by a teacher.


HP Universal CMDB (UCMDB) Probe 9.05 10.01 and 10.11 enables the HTTP TRACE method which allows remote attackers to obtain sensitive information by reading the headers of a response.


The JBoss Application Server (WildFly) JacORB subsystem in Red Hat JBoss Enterprise Application Platform (EAP) before 6.3.3 does not properly assign socket-binding-ref sensitivity classification to the security-domain attribute which allows remote authenticated users to obtain sensitive information by leveraging access to the security-domain attribute.


lib/classes/grades_external.php in Moodle 2.7.x before 2.7.3 does not consider the moodle/grade:viewhidden capability before displaying hidden grades which allows remote authenticated users to obtain sensitive information by leveraging the student role to access the get_grades web service.


The Unified Messaging Service (UMS) in Cisco Unity Connection 10.5 and earlier allows remote authenticated users to obtain sensitive information by reading log files aka Bug ID CSCur06493.


The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912 OpManager 8 through 11.5 build 11400 and IT360 10.5 and earlier does not properly restrict access which allows remote attackers and remote authenticated users to (1) read arbitrary files via the fileName parameter in a copyfile operation or (2) obtain sensitive information via a directory listing in a listdirectory operation to servlet/FailOverHelperServlet.


The Crumb plugin before 3.0.0 for Node.js does not properly restrict token access in situations where a hapi route handler has CORS enabled which allows remote attackers to obtain sensitive information and potentially obtain the ability to spoof requests to non-CORS routes via a crafted web site that is visited by an application consumer.


IBM WebSphere Service Registry and Repository (WSRR) 7.0.x before 7.0.0.5 does not perform access-control checks for contained objects which allows remote authenticated users to obtain sensitive information via unspecified vectors.


IBM Tivoli Identity Manager 5.1.x before 5.1.0.15-ISS-TIM-IF0057 and Security Identity Manager 6.0.x before 6.0.0.4-ISS-SIM-IF0001 and 7.0.x before 7.0.0.0-ISS-SIM-IF0003 make it easier for remote attackers to obtain sensitive information by leveraging support for weak SSL ciphers. IBM X-Force ID: 96184.


The HTTPInput node in IBM WebSphere Message Broker 7.0 before 7.0.0.8 and 8.0 before 8.0.0.6 and IBM Integration Bus 9.0 before 9.0.0.4 allows remote attackers to obtain sensitive information by triggering a SOAP fault.


IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 make it easier for remote attackers to obtain sensitive information by sniffing the network during use of a weak algorithm in an SSL cipher suite.


The HashContext class in hphp/runtime/ext/ext_hash.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 incorrectly expects that a certain key string uses '\\0' for termination which allows remote attackers to obtain sensitive information by leveraging read access beyond the end of the string and makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging truncation of a string containing an internal '\\0' character.


The log viewer in IBM Workload Deployer 3.1 before 3.1.0.7 allows remote attackers to obtain sensitive information via a direct request for the URL of a log document.


IBM Security AppScan Standard 8.x and 9.x before 9.0.1.1 FP1 supports unencrypted sessions which allows remote attackers to obtain sensitive information by sniffing the network.


The command-line scripts in IBM WebSphere Commerce 6.0 through 6.0.0.11 7.0 through 7.0.0.9 and 7.0 Feature Pack 2 through 8 when debugging is configured do not properly restrict the logging of personal data which allows local users to obtain sensitive information by reading a log file.


IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 do not ensure that HTTPS is used which allows remote attackers to obtain sensitive information by sniffing the network during an HTTP session.


Aruba Networks ClearPass before 6.3.6 and 6.4.x before 6.4.1 does not disable the troubleshooting and diagnostics page in production systems which allows remote attackers to obtain version numbers module configuration and other sensitive information by reading the page.


The IBM Notes Traveler application before 9.0.1.3 for Android lacks a warning message during selection of an HTTP session which makes it easier for remote attackers to obtain sensitive information by sniffing the network during a session in which the user had intended to use HTTPS.