CWE-200— Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.— MITRE CWE catalog

11,534 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-200page 28 of 231

CVE-2013-0568MEDIUMCVSS v2 4.0EG 4.0
2013-07-03
IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to obtain sensitive information about application implementation via unspecified vectors, a different vulnerability than CVE-201…
CVE-2013-0570MEDIUMCVSS 5.3EG 5.3
2018-07-13
The Fibre Channel over Ethernet (FCoE) feature in IBM System Networking and Blade Network Technology (BNT) switches running IBM Networking Operating System (aka NOS, formerly BLADE Operating System) floods data frames with unknown MAC addr…
CVE-2013-0584MEDIUMCVSS v2 5.0EG 5.0
2013-04-23
The Data Replication Dashboard component in IBM InfoSphere Replication Server 9.7 and 10.x before 10.2.0.0-b113 allows remote attackers to obtain a list of all user accounts, along with information about whether each account requires a pas…
CVE-2013-0589HIGHCVSS 7.5EG 7.5
2018-07-11
IBM iNotes before 8.5.3 Fix Pack 6 and 9.x before 9.0.1 allows remote attackers to bypass the remote image filtering mechanism and obtain sensitive information via a crafted e-mail message. IBM X-Force ID: 83371.
CVE-2013-0599MEDIUMCVSS v2 5.0EG 5.0
2013-05-28
IBM Eclipse Help System (IEHS), as used in IBM Rational Directory Server 5.1.1 through 5.1.1.2 and 5.2 through 5.2.1 and other products, allows remote attackers to obtain sensitive information by providing a crafted parameter path and then…
CVE-2013-0631CRITICALCVSS 7.5EG 9.0⚠ KEV
2013-01-09
Adobe ColdFusion 9.0, 9.0.1, and 9.0.2 allows attackers to obtain sensitive information via unspecified vectors, as exploited in the wild in January 2013.
CVE-2013-0632CRITICALCVSS 9.8EG 9.8⚠ KEV
2013-01-17
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this se…
CVE-2013-0637MEDIUMCVSS v2 5.0EG 5.0
2013-02-12
Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x…
CVE-2013-0677MEDIUMCVSS v2 5.8EG 5.8
2013-03-21
The web server in Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, allows remote attackers to obtain sensitive information or cause a denial of service via a crafted project file.
CVE-2013-0693HIGHCVSS v2 10.0EG 10.0
2013-10-03
The kernel in ENEA OSE on the Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with software 1.20 and earlier performs network-beacon broadcasts, which allows …
CVE-2013-0704MEDIUMCVSS v2 4.3EG 4.3
2013-02-15
Directory traversal vulnerability in the GREE application before 1.3.3 for Android allows remote attackers to obtain sensitive information via a crafted URL, which is not properly handled during interaction with other applications.
CVE-2013-0721MEDIUMCVSS v2 5.0EG 5.0
2013-01-02
wp-php-widget.php in the WP PHP widget plugin 1.0.2 for WordPress allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message.
CVE-2013-0748MEDIUMCVSS v2 4.3EG 4.3
2013-01-13
The XBL.__proto__.toString implementation in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2…
CVE-2013-0786MEDIUMCVSS v2 5.0EG 5.0
2013-02-24
The Bugzilla::Search::build_subselect function in Bugzilla 2.x and 3.x before 3.6.13 and 3.7.x and 4.0.x before 4.0.10 generates different error messages for invalid product queries depending on whether a product exists, which allows remot…
CVE-2013-0792MEDIUMCVSS v2 4.3EG 4.3
2013-04-03
Mozilla Firefox before 20.0 and SeaMonkey before 2.17, when gfx.color_management.enablev4 is used, do not properly handle color profiles during PNG rendering, which allows remote attackers to obtain sensitive information from process memor…
CVE-2013-0909MEDIUMCVSS v2 5.0EG 5.0
2013-03-05
The XSS Auditor in Google Chrome before 25.0.1364.152 allows remote attackers to obtain sensitive HTTP Referer information via unspecified vectors.
CVE-2013-0943MEDIUMCVSS v2 4.6EG 4.6
2013-07-31
EMC NetWorker 7.6.x and 8.x before 8.1 allows local users to obtain sensitive configuration information by leveraging operating-system privileges to perform decryption with nsradmin.
CVE-2013-0944LOWCVSS v2 3.5EG 3.5
2013-05-03
The web-based file-restore interface in EMC Avamar Server before 6.1.0 allows remote authenticated users to read arbitrary files via a crafted URL.
CVE-2013-0978LOWCVSS v2 2.1EG 2.1
2013-03-20
The ARM prefetch abort handler in the kernel in Apple iOS before 6.1.3 and Apple TV before 5.2.1 does not ensure that it has been invoked in an abort context, which makes it easier for local users to bypass the ASLR protection mechanism vi…
CVE-2013-0982LOWCVSS v2 1.7EG 1.7
2013-06-05
The Private Browsing feature in CFNetwork in Apple Mac OS X before 10.8.4 does not prevent storage of permanent cookies upon exit from Safari, which might allow physically proximate attackers to bypass cookie-based authentication by levera…
CVE-2013-10007HIGHCVSS 5.3EG 7.5
2023-01-03
A vulnerability classified as problematic has been found in ethitter WP-Print-Friendly up to 0.5.2. This affects an unknown part of the file wp-print-friendly.php. The manipulation leads to information disclosure. It is possible to initiat…
CVE-2013-10024HIGHCVSS 3.5EG 7.5
2023-04-08
A vulnerability has been found in Exit Strategy Plugin 1.55 on WordPress and classified as problematic. Affected by this vulnerability is an unknown functionality of the file exitpage.php. The manipulation leads to information disclosure. …
CVE-2013-10030MEDIUMCVSS 4.3EG 4.3
2023-06-05
A vulnerability, which was classified as problematic, has been found in Exit Box Lite Plugin up to 1.06 on WordPress. Affected by this issue is some unknown functionality of the file wordpress-exit-box-lite.php. The manipulation leads to i…
CVE-2013-1030LOWCVSS v2 2.1EG 2.1
2013-09-16
mdmclient in Mobile Device Management in Apple Mac OS X before 10.8.5 places a password on the command line, which allows local users to obtain sensitive information by listing the process.
CVE-2013-1107MEDIUMCVSS v2 4.0EG 4.0
2013-02-06
The search function in Cisco Webex Social (formerly Cisco Quad) allows remote authenticated users to read files via unspecified parameters, aka Bug ID CSCud40235.
CVE-2013-1140MEDIUMCVSS v2 4.3EG 4.3
2013-03-06
The XML parser in Cisco Security Monitoring, Analysis, and Response System (MARS) allows remote attackers to read arbitrary files via an external entity declaration in conjunction with an entity reference, related to an XML External Entity…
CVE-2013-1185HIGHCVSS v2 9.3EG 9.3
2013-04-25
The web interface in the Manager component in Cisco Unified Computing System (UCS) 1.x and 2.x before 2.0(2m) allows remote attackers to obtain sensitive information by reading a (1) technical-support bundle file or (2) on-device configura…
CVE-2013-1194MEDIUMCVSS v2 5.0EG 5.0
2013-04-18
The ISAKMP implementation on Cisco Adaptive Security Appliances (ASA) devices generates different responses for IKE aggressive-mode messages depending on whether invalid VPN groups are specified, which allows remote attackers to enumerate …
CVE-2013-1216MEDIUMCVSS v2 4.0EG 4.0
2013-04-29
Memory leak in the SNMP module in Cisco IOS XR allows remote authenticated users to cause a denial of service (memory consumption and process restart) via crafted SNMP packets, aka Bug ID CSCue31546.
CVE-2013-1231MEDIUMCVSS v2 5.0EG 5.0
2013-05-03
The HTTP implementation in Cisco WebEx Node for MCS and WebEx Meetings Server allows remote attackers to read cache files via a crafted request, aka Bug IDs CSCue36664 and CSCue36629.
CVE-2013-1297MEDIUMCVSS v2 4.3EG 4.3
2013-05-15
Microsoft Internet Explorer 6 through 8 does not properly restrict data access by VBScript, which allows remote attackers to perform cross-domain reading of JSON files via a crafted web site, aka "JSON Array Information Disclosure Vulnerab…
CVE-2013-1301MEDIUMCVSS v2 4.3EG 4.3
2013-05-15
Microsoft Visio 2003 SP3 2007 SP3, and 2010 SP1 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, aka "XML External Entities Resolution Vu…
CVE-2013-1402MEDIUMCVSS v2 5.0EG 5.0
2013-02-14
DigiLIBE 3.4 and possibly other versions sends a redirect but does not exit, which allows remote attackers to obtain sensitive configuration information via a direct request to configuration/general_configuration.html.
CVE-2013-1442LOWCVSS v2 1.2EG 1.2
2013-09-30
Xen 4.0 through 4.3.x, when using AVX or LWP capable CPUs, does not properly clear previous data from registers when using an XSAVE or XRSTOR to extend the state components of a saved or restored vCPU after touching other restored extended…
CVE-2013-1454MEDIUMCVSS v2 5.0EG 5.0
2013-02-13
Joomla! 3.0.x through 3.0.2 allows attackers to obtain sensitive information via unspecified vectors related to "Coding errors."
CVE-2013-1455MEDIUMCVSS v2 5.0EG 5.0
2013-02-13
Joomla! 3.0.x through 3.0.2 allows attackers to obtain sensitive information via unspecified vectors related to an "Undefined variable."
CVE-2013-1594HIGHCVSS 7.5EG 7.5
2020-01-24
An Information Disclosure vulnerability exists via a GET request in Vivotek PT7135 IP Camera 0300a and 0400a due to wireless keys and 3rd party credentials stored in clear text.
CVE-2013-1601MEDIUMCVSS 5.3EG 5.3
2020-01-28
An Information Disclosure vulnerability exists due to a failure to restrict access on the lums.cgi script when processing a live video stream in D-LINK An Information Disclosure vulnerability exists due to a failure to restrict access on t…
CVE-2013-1602HIGHCVSS 7.5EG 7.5
2020-01-28
An Information Disclosure vulnerability exists due to insufficient validation of authentication cookies for the RTSP session in D-Link DCS-5635 1.01, DCS-1100L 1.04, DCS-1130L 1.04, DCS-1100 1.03/1.04_US, DCS-1130 1.03/1.04_US , DCS-2102 1…
CVE-2013-1615LOWCVSS v2 2.9EG 2.9
2013-07-08
The management console (aka Java console) on the Symantec Security Information Manager (SSIM) appliance 4.7.x and 4.8.x before 4.8.1 allows remote attackers to obtain sensitive information via unspecified web-GUI API calls.
CVE-2013-1631MEDIUMCVSS 5.3EG 5.3
2020-01-30
Verax NMS prior to 2.1.0 leaks connection details when any user executes a Repair Table action
CVE-2013-1643MEDIUMCVSS v2 5.0EG 5.0
2013-03-06
The SOAP parser in PHP before 5.3.23 and 5.4.x before 5.4.13 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML Exte…
CVE-2013-1729LOWCVSS v2 2.6EG 2.6
2013-09-18
The WebGL implementation in Mozilla Firefox before 24.0, when NVIDIA graphics drivers are used on Mac OS X, allows remote attackers to obtain desktop-screenshot data by reading from a CANVAS element.
CVE-2013-1817HIGHCVSS 7.5EG 7.5
2019-11-20
MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive information.
CVE-2013-1818MEDIUMCVSS v2 5.0EG 5.0
2014-06-02
maintenance/mwdoc-filter.php in MediaWiki before 1.20.3 allows remote attackers to read arbitrary files via unspecified vectors.
CVE-2013-1824MEDIUMCVSS v2 4.3EG 4.3
2013-09-16
The SOAP parser in PHP before 5.3.22 and 5.4.x before 5.4.12 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML Exte…
CVE-2013-1829MEDIUMCVSS v2 4.0EG 4.0
2013-03-25
calendar/managesubscriptions.php in Moodle 2.4.x before 2.4.2 does not consider capability requirements before displaying calendar subscriptions, which allows remote authenticated users to obtain potentially sensitive information by levera…
CVE-2013-1923LOWCVSS v2 3.2EG 3.2
2014-01-21
rpc-gssd in nfs-utils before 1.2.8 performs reverse DNS resolution for server names during GSSAPI authentication, which might allow remote attackers to read otherwise-restricted files via DNS spoofing attacks.
CVE-2013-1928MEDIUMCVSS v2 4.7EG 4.7
2013-04-29
The do_video_set_spu_palette function in fs/compat_ioctl.c in the Linux kernel before 3.6.5 on unspecified architectures lacks a certain error check, which might allow local users to obtain sensitive information from kernel stack memory vi…
CVE-2013-1944MEDIUMCVSS v2 5.0EG 5.0
2013-04-29
The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL.

Map vulnerabilities like CWE-200 to your infrastructure

EchelonGraph correlates every CVE — across CWE-200 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →