CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Related To CWE-200

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Copy Results Download Results Select Table
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2013-3507 200 +Info 2013-05-08 2013-05-08
4.0
 None Remote Low Single system Partial None None
The NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to obtain sensitive information via a direct request for (1) a configuration file, (2) a database dump, or (3) the Tomcat status context.
2 CVE-2013-3237 200 +Info 2013-04-22 2013-04-22
4.9
 None Local Low Not required Complete None None
The vsock_stream_sendmsg function in net/vmw_vsock/af_vsock.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
3 CVE-2013-3236 200 +Info 2013-04-22 2013-04-22
4.9
 None Local Low Not required Complete None None
The vmci_transport_dgram_dequeue function in net/vmw_vsock/vmci_transport.c in the Linux kernel before 3.9-rc7 does not properly initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
4 CVE-2013-3235 200 +Info 2013-04-22 2013-04-22
4.9
 None Local Low Not required Complete None None
net/tipc/socket.c in the Linux kernel before 3.9-rc7 does not initialize a certain data structure and a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
5 CVE-2013-3234 200 +Info 2013-04-22 2013-04-22
4.9
 None Local Low Not required Complete None None
The rose_recvmsg function in net/rose/af_rose.c in the Linux kernel before 3.9-rc7 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
6 CVE-2013-3233 200 +Info 2013-04-22 2013-04-22
4.9
 None Local Low Not required Complete None None
The llcp_sock_recvmsg function in net/nfc/llcp/sock.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable and a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
7 CVE-2013-3232 200 +Info 2013-04-22 2013-04-22
4.9
 None Local Low Not required Complete None None
The nr_recvmsg function in net/netrom/af_netrom.c in the Linux kernel before 3.9-rc7 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
8 CVE-2013-3231 200 +Info 2013-04-22 2013-04-22
4.7
 None Local Medium Not required Complete None None
The llc_ui_recvmsg function in net/llc/af_llc.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
9 CVE-2013-3230 200 +Info 2013-04-22 2013-04-22
4.9
 None Local Low Not required Complete None None
The l2tp_ip6_recvmsg function in net/l2tp/l2tp_ip6.c in the Linux kernel before 3.9-rc7 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
10 CVE-2013-3229 200 +Info 2013-04-22 2013-04-22
4.9
 None Local Low Not required Complete None None
The iucv_sock_recvmsg function in net/iucv/af_iucv.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
11 CVE-2013-3228 200 +Info 2013-04-22 2013-04-22
4.9
 None Local Low Not required Complete None None
The irda_recvmsg_dgram function in net/irda/af_irda.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
12 CVE-2013-3227 200 +Info 2013-04-22 2013-04-22
4.9
 None Local Low Not required Complete None None
The caif_seqpkt_recvmsg function in net/caif/caif_socket.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
13 CVE-2013-3226 200 +Info 2013-04-22 2013-04-22
4.9
 None Local Low Not required Complete None None
The sco_sock_recvmsg function in net/bluetooth/sco.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
14 CVE-2013-3225 200 +Info 2013-04-22 2013-04-22
4.9
 None Local Low Not required Complete None None
The rfcomm_sock_recvmsg function in net/bluetooth/rfcomm/sock.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
15 CVE-2013-3224 200 +Info 2013-04-22 2013-04-22
4.9
 None Local Low Not required Complete None None
The bt_sock_recvmsg function in net/bluetooth/af_bluetooth.c in the Linux kernel before 3.9-rc7 does not properly initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
16 CVE-2013-3223 200 +Info 2013-04-22 2013-04-22
4.9
 None Local Low Not required Complete None None
The ax25_recvmsg function in net/ax25/af_ax25.c in the Linux kernel before 3.9-rc7 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
17 CVE-2013-3222 200 +Info 2013-04-22 2013-04-22
4.9
 None Local Low Not required Complete None None
The vcc_recvmsg function in net/atm/common.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
18 CVE-2013-3210 200 +Info 2013-04-19 2013-04-22
5.0
 None Remote Low Not required Partial None None
Opera before 12.15 does not properly block top-level domains in Set-Cookie headers, which allows remote attackers to obtain sensitive information by leveraging control of a different web site in the same top-level domain.
19 CVE-2013-3076 200 +Info 2013-04-22 2013-04-22
4.9
 None Local Low Not required Complete None None
The crypto API in the Linux kernel through 3.9-rc8 does not initialize certain length variables, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call, related to the hash_recvmsg function in crypto/algif_hash.c and the skcipher_recvmsg function in crypto/algif_skcipher.c.
20 CVE-2013-2744 200 +Info 2013-04-02 2013-04-02
5.0
 None Remote Low Not required Partial None None
importbuddy.php in the BackupBuddy plugin 2.2.25 for WordPress allows remote attackers to obtain configuration information via a step 0 phpinfo action, which calls the phpinfo function.
21 CVE-2013-2737 200 +Info 2013-05-16 2013-05-16
5.0
 None Remote Low Not required Partial None None
A JavaScript API in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to obtain sensitive information via unspecified vectors.
22 CVE-2013-2371 200 +Info 2013-03-15 2013-03-18
5.0
 None Remote Low Not required Partial None None
The Web API in the Statistics Server in TIBCO Spotfire Statistics Services 3.3.x before 3.3.1, 4.5.x before 4.5.1, and 5.0.x before 5.0.1 allows remote attackers to obtain sensitive information via an unspecified HTTP request.
23 CVE-2013-2308 200 Bypass +Info 2013-05-09 2013-05-09
4.0
 None Remote Low Single system Partial None None
The (1) OWA Helper and (2) OSG Lite programs in SoftBank Online Service Gate allow remote authenticated users to discover their own passwords, and consequently bypass an Office 365 restriction, via unspecified vectors.
24 CVE-2013-2302 200 +Info 2013-04-04 2013-04-05
1.9
 None Local Medium Not required Partial None None
TransWARE Active! mail 6, when an external public interface is used, allows local users to obtain sensitive information belonging to arbitrary users by leveraging shell access, as demonstrated by a TELNET or SSH session to the server.
25 CVE-2013-2273 200 +Info 2013-03-12 2013-03-18
5.0
 None Remote Low Not required Partial None None
bitcoind and Bitcoin-Qt before 0.4.9rc1, 0.5.x before 0.5.8rc1, 0.6.0 before 0.6.0.11rc1, 0.6.1 through 0.6.5 before 0.6.5rc1, and 0.7.x before 0.7.3rc1 make it easier for remote attackers to obtain potentially sensitive information about returned change by leveraging certain predictability in the outputs of a Bitcoin transaction.
26 CVE-2013-2272 200 +Info 2013-03-12 2013-03-18
5.0
 None Remote Low Not required Partial None None
The penny-flooding protection mechanism in the CTxMemPool::accept method in bitcoind and Bitcoin-Qt before 0.4.9rc1, 0.5.x before 0.5.8rc1, 0.6.0 before 0.6.0.11rc1, 0.6.1 through 0.6.5 before 0.6.5rc1, and 0.7.x before 0.7.3rc1 allows remote attackers to determine associations between wallet addresses and IP addresses via a series of large Bitcoin transactions with insufficient fees.
27 CVE-2013-2264 200 +Info 2013-04-01 2013-04-01
5.0
 None Remote Low Not required Partial None None
The SIP channel driver in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15 before 1.8.15-cert2; Asterisk Business Edition (BE) C.3.x before C.3.8.1; and Asterisk Digiumphones 10.x-digiumphones before 10.12.2-digiumphones exhibits different behavior for invalid INVITE, SUBSCRIBE, and REGISTER transactions depending on whether the user account exists, which allows remote attackers to enumerate account names by (1) reading HTTP status codes, (2) reading additional text in a 403 (aka Forbidden) response, or (3) observing whether certain retransmissions occur.
28 CVE-2013-1944 200 +Info 2013-04-29 2013-04-30
5.0
 None Remote Low Not required Partial None None
The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL.
29 CVE-2013-1928 200 +Info 2013-04-29 2013-04-29
4.7
 None Local Medium Not required Complete None None
The do_video_set_spu_palette function in fs/compat_ioctl.c in the Linux kernel before 3.6.5 on unspecified architectures lacks a certain error check, which might allow local users to obtain sensitive information from kernel stack memory via a crafted VIDEO_SET_SPU_PALETTE ioctl call on a /dev/dvb device.
30 CVE-2013-1840 200 +Info 2013-03-22 2013-04-10
3.5
 None Remote Medium Single system Partial None None
The v1 API in OpenStack Glance Essex (2012.1), Folsom (2012.2), and Grizzly, when using the single-tenant Swift or S3 store, reports the location field, which allows remote authenticated users to obtain the operator's backend credentials via a request for a cached image.
31 CVE-2013-1835 200 +Info 2013-03-25 2013-03-26
3.5
 None Remote Medium Single system Partial None None
Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote authenticated administrators to obtain sensitive information from the external repositories of arbitrary users by leveraging the login_as feature.
32 CVE-2013-1832 200 +Info 2013-03-25 2013-03-26
4.0
 None Remote Low Single system Partial None None
repository/webdav/lib.php in Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 includes the WebDAV password in the configuration form, which allows remote authenticated administrators to obtain sensitive information by configuring an instance.
33 CVE-2013-1831 200 +Info 2013-03-25 2013-03-26
5.0
 None Remote Low Not required Partial None None
lib/setuplib.php in Moodle through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the absolute path in an exception message.
34 CVE-2013-1829 200 +Info 2013-03-25 2013-03-26
4.0
 None Remote Low Single system Partial None None
calendar/managesubscriptions.php in Moodle 2.4.x before 2.4.2 does not consider capability requirements before displaying calendar subscriptions, which allows remote authenticated users to obtain potentially sensitive information by leveraging the student role.
35 CVE-2013-1814 200 1 +Info 2013-03-13 2013-03-19
4.0
 None Remote Low Single system Partial None None
The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response.
36 CVE-2013-1665 200 +Info 2013-04-02 2013-05-14
5.0
 None Remote Low Not required Partial None None
The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack.
37 CVE-2013-1643 200 +Info 2013-03-06 2013-04-10
5.0
 None Remote Low Not required Partial None None
The SOAP parser in PHP before 5.3.22 and 5.4.x before 5.4.13 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue in the soap_xmlParseFile and soap_xmlParseMemory functions.
38 CVE-2013-1455 200 +Info 2013-02-12 2013-02-13
5.0
 None Remote Low Not required Partial None None
Joomla! 3.0.x through 3.0.2 allows attackers to obtain sensitive information via unspecified vectors related to an "Undefined variable."
39 CVE-2013-1454 200 +Info 2013-02-12 2013-03-26
5.0
 None Remote Low Not required Partial None None
Joomla! 3.0.x through 3.0.2 allows attackers to obtain sensitive information via unspecified vectors related to "Coding errors."
40 CVE-2013-1453 200 Sql +Info 2013-02-12 2013-03-06
5.0
 None Remote Low Not required Partial None None
plugins/system/highlight/highlight.php in Joomla! 3.0.x through 3.0.2 and 2.5.x through 2.5.8 allows attackers to unserialize arbitrary PHP objects to obtain sensitive information, delete arbitrary directories, conduct SQL injection attacks, and possibly have other impacts via the highlight parameter. Note: it was originally reported that this issue only allowed attackers to obtain sensitive information, but later analysis demonstrated that other attacks exist.
41 CVE-2013-1402 200 +Info 2013-02-14 2013-02-15
5.0
 None Remote Low Not required Partial None None
DigiLIBE 3.4 and possibly other versions sends a redirect but does not exit, which allows remote attackers to obtain sensitive configuration information via a direct request to configuration/general_configuration.html.
42 CVE-2013-1301 200 +Info 2013-05-14 2013-05-15
4.3
 None Remote Medium Not required Partial None None
Microsoft Visio 2003 SP3 2007 SP3, and 2010 SP1 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, aka "XML External Entities Resolution Vulnerability."
43 CVE-2013-1297 200 +Info 2013-05-14 2013-05-15
4.3
 None Remote Medium Not required Partial None None
Microsoft Internet Explorer 6 through 8 does not properly restrict data access by VBScript, which allows remote attackers to perform cross-domain reading of JSON files via a crafted web site, aka "JSON Array Information Disclosure Vulnerability."
44 CVE-2013-1216 200 DoS +Info 2013-04-29 2013-05-01
4.0
 None Remote Low Single system None None Partial
Memory leak in the SNMP module in Cisco IOS XR allows remote authenticated users to cause a denial of service (memory consumption and process restart) via crafted SNMP packets, aka Bug ID CSCue31546.
45 CVE-2013-1194 200 +Info 2013-04-18 2013-04-19
5.0
 None Remote Low Not required Partial None None
The ISAKMP implementation on Cisco Adaptive Security Appliances (ASA) devices generates different responses for IKE aggressive-mode messages depending on whether invalid VPN groups are specified, which allows remote attackers to enumerate groups via a series of messages, aka Bug ID CSCue73708.
46 CVE-2013-1185 200 +Info 2013-04-25 2013-04-25
9.3
 None Remote Medium Not required Complete Complete Complete
The web interface in the Manager component in Cisco Unified Computing System (UCS) 1.x and 2.x before 2.0(2m) allows remote attackers to obtain sensitive information by reading a (1) technical-support bundle file or (2) on-device configuration backup, aka Bug ID CSCtq86543.
47 CVE-2013-1140 200 +Info 2013-03-06 2013-03-06
4.3
 None Remote Medium Not required Partial None None
The XML parser in Cisco Security Monitoring, Analysis, and Response System (MARS) allows remote attackers to read arbitrary files via an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, aka Bug ID CSCue55093.
48 CVE-2013-1107 200 +Info 2013-02-06 2013-02-07
4.0
 None Remote Low Single system Partial None None
The search function in Cisco Webex Social (formerly Cisco Quad) allows remote authenticated users to read files via unspecified parameters, aka Bug ID CSCud40235.
49 CVE-2013-0978 200 Bypass +Info 2013-03-20 2013-03-21
2.1
 None Local Low Not required Partial None None
The ARM prefetch abort handler in the kernel in Apple iOS before 6.1.3 and Apple TV before 5.2.1 does not ensure that it has been invoked in an abort context, which makes it easier for local users to bypass the ASLR protection mechanism via crafted code.
50 CVE-2013-0944 200 +Info 2013-05-03 2013-05-03
3.5
 None Remote Medium Single system Partial None None
The web-based file-restore interface in EMC Avamar Server before 6.1.0 allows remote authenticated users to read arbitrary files via a crafted URL.
Total number of vulnerabilities : 1295   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.