The load_script function in fs/binfmt_script.c in the Linux kernel before 3.7.2 does not properly handle recursion, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.

CVE-2012-4583NONECVSS 0.0EG 0.0

2012-08-22

McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1, allows remote authenticated users to obtain the session tokens of arbitrary users by navigating within th…

CVE-2012-4591NONECVSS 0.0EG 0.0

2012-08-22

About.aspx in the Portal in McAfee Enterprise Mobility Manager (EMM) before 10.0 discloses the name of the user account for an IIS worker process, which allows remote attackers to obtain potentially sensitive information by visiting this p…

CVE-2012-4605NONECVSS 0.0EG 0.0

2012-08-23

The default configuration of the SMTP component in Websense Email Security 6.1 through 7.3 enables weak SSL ciphers in the "SurfControl plc\SuperScout Email Filter\SMTP" registry key, which makes it easier for remote attackers to obtain se…

CVE-2012-4674NONECVSS 0.0EG 0.0

2012-08-26

PluXml before 5.1.6 allows remote attackers to obtain the installation path via the PHPSESSID.

CVE-2012-4698NONECVSS 0.0EG 0.0

2012-12-23

Siemens RuggedCom Rugged Operating System (ROS) before 3.12, ROX I OS through 1.14.5, ROX II OS through 2.3.0, and RuggedMax OS through 4.2.1.4621.22 use hardcoded private keys for SSL and SSH communication, which makes it easier for man-i…

CVE-2012-4832NONECVSS 0.0EG 0.0

2013-01-31

Information Services Framework (ISF) in IBM InfoSphere Information Server 8.1, 8.5 before FP3, and 8.7 and InfoSphere Business Glossary 8.1.1 and 8.1.2 does not have an off autocomplete attribute for the password field on the login page, w…

CVE-2012-4837NONECVSS 0.0EG 0.0

2013-03-05

IBM Cognos Business Intelligence (BI) 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1 allows remote authenticated users to conduct XPath injection attacks, and read arbitrary XML files, via unspecified vectors.

CVE-2012-4846NONECVSS 0.0EG 0.0

2012-12-19

IBM Lotus Notes 8.5.x before 8.5.3 FP3 does not include the HTTPOnly flag in a Set-Cookie header for a web-application cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this…

CVE-2012-4909NONECVSS 0.0EG 0.0

2012-09-13

Google Chrome before 18.0.1025308 on Android allows remote attackers to obtain cookie information via a crafted application.

CVE-2012-4976NONECVSS 0.0EG 0.0

2012-12-12

selectawasset.asp in Layton Helpbox 4.4.0 allows remote attackers to discover ODBC database credentials via an element=sys_asset_id request, which is not properly handled during construction of an error page.

CVE-2012-5172NONECVSS 0.0EG 0.0

2012-11-16

The Asial Monaca Debugger application before 1.4.2 for Android allows remote attackers to obtain sensitive (1) account or (2) session ID information in a system log file via a crafted application.

CVE-2012-5180NONECVSS 0.0EG 0.0

2012-12-26

The Opera Mobile application before 12.1 and Opera Mini application before 7.5 for Android do not properly implement the WebView class, which allows attackers to obtain sensitive information via a crafted application.

CVE-2012-5182NONECVSS 0.0EG 0.0

2012-12-26

The Loctouch application 3.4.6 and earlier for Android does not properly handle implicit intents, which allows attackers to obtain sensitive information about logged locations via a crafted application.

CVE-2012-5183NONECVSS 0.0EG 0.0

2012-12-26

The Loctouch application 3.4.6 and earlier for Android allows attackers to obtain sensitive information about logged locations via a crafted application that leverages read permission for system log files.

CVE-2012-5222NONECVSS 0.0EG 0.0

2013-05-02

HP Service Manager Web Tier 9.31 before 9.31.2004 p2 allows remote attackers to obtain sensitive information via unspecified vectors.

CVE-2012-5473NONECVSS 0.0EG 0.0

2012-11-21

The Database activity module in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and 2.3.x before 2.3.3 allows remote authenticated users to read activity entries of a different group's users via an advanced search.

CVE-2012-5476MEDIUMCVSS 5.5EG 5.5

2019-12-30

Within the RHOS Essex Preview (2012.2) of the OpenStack dashboard package, the file /etc/quantum/quantum.conf is world readable which exposes the admin password and token value.

CVE-2012-5516NONECVSS 0.0EG 0.0

2013-01-04

Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when moving disks between storage domains, does not properly wipe-after-delete, which prevents disks from being securely deleted and might allow local users to obtain sensitive…

CVE-2012-5535HIGHCVSS 7.5EG 7.5

2019-11-25

gnome-system-log polkit policy allows arbitrary files on the system to be read

CVE-2012-5544NONECVSS 0.0EG 0.0

2012-12-03

The Mandrill module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users to obtain password reset links by reading the logs in the Mandrill dashboard.

CVE-2012-5552NONECVSS 0.0EG 0.0

2012-12-03

The Password policy module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to obtain password hashes by sniffing the network, related to "client-side password history checks."

CVE-2012-5554NONECVSS 0.0EG 0.0

2012-12-03

The default configuration for the Webform CiviCRM Integration module 7.x-3.x before 7.x-3.2 has "Enforce Permissions" disabled, which allows remote attackers to obtain contact information by reading webforms.

CVE-2012-5561NONECVSS 0.0EG 0.0

2013-03-01

script/katello-generate-passphrase in Katello 1.1 uses world-readable permissions for /etc/katello/secure/passphrase, which allows local users to obtain the passphrase by reading the file.

CVE-2012-5570MEDIUMCVSS 4.3EG 4.3

2020-02-08

The Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with the "access basic_webmail" permission to read arbitrary users' email addresses.

CVE-2012-5589NONECVSS 0.0EG 0.0

2012-12-26

The MultiLink module 6.x-2.x before 6.x-2.7 and 7.x-2.x before 7.x-2.7 for Drupal does not properly check node permissions when generating an in-content link, which allows remote authenticated users with text-editing permissions to read ar…

CVE-2012-5615NONECVSS 0.0EG 0.0

2012-12-03

Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates different error messages with different time delays depending on whether a user name exists, which all…

CVE-2012-5624NONECVSS 0.0EG 0.0

2013-02-24

The XMLHttpRequest object in Qt before 4.8.4 enables http redirection to the file scheme, which allows man-in-the-middle attackers to force the read of arbitrary local files and possibly obtain sensitive information via a file: URL to a QM…

CVE-2012-5644MEDIUMCVSS 5.5EG 5.5

2019-11-25

libuser has information disclosure when moving user's home directory

CVE-2012-5652NONECVSS 0.0EG 0.0

2013-01-03

Drupal 6.x before 6.27 allows remote attackers to obtain sensitive information about uploaded files via a (1) RSS feed or (2) search result.

CVE-2012-5654NONECVSS 0.0EG 0.0

2013-01-03

The Nodewords: D6 Meta Tags module before 6.x-1.14 for Drupal, when configured to automatically generate description meta tags from node text, does not properly filter node content when creating tags, which might allow remote attackers to …

CVE-2012-5765NONECVSS 0.0EG 0.0

2012-12-20

The Web Client (aka CQ Web) in IBM Rational ClearQuest 7.1.2.x before 7.1.2.9 and 8.0.0.x before 8.0.0.5 allows remote attackers to obtain sensitive information via unspecified vectors that trigger a SQL error message.

CVE-2012-5828MEDIUMCVSS 6.5EG 6.5

2020-02-10

BlackBerry PlayBook before 2.1 has an Information Disclosure Vulnerability via a Web browser component error

CVE-2012-5868NONECVSS 0.0EG 0.0

2012-12-27

WordPress 3.4.2 does not invalidate a wordpress_sec session cookie upon an administrator's logout action, which makes it easier for remote attackers to discover valid session identifiers via a brute-force attack, or modify data via a repla…

CVE-2012-5884NONECVSS 0.0EG 0.0

2012-11-16

The User.get method in Bugzilla/WebService/User.pm in Bugzilla 4.3.2 allows remote attackers to obtain sensitive information about the saved searches of arbitrary users via an XMLRPC request or a JSONRPC request, a different vulnerability …

CVE-2012-5915NONECVSS 0.0EG 0.0

2012-11-17

Neocrome Seditio build 161 and earlier allows remote attackers to obtain sensitive information via direct request to (1) view.php, (2) plugins/contact/lang/contact.en.lang.php, (3) system/lang/en/main.lang.php, (4) system/lang/en/message.l…

CVE-2012-5916NONECVSS 0.0EG 0.0

2012-11-17

Neocrome Seditio build 161 allows remote attackers to obtain sensitive information via a direct request to (1) docs/new/seditio-createnew-160.sql, (2) docs/upgrade/sedito_convert_to_utf8.optional.sql, or (3) system/install/install.parser.s…

CVE-2012-6049NONECVSS 0.0EG 0.0

2012-11-27

Open Solution Quick.Cart 5.0 allows remote attackers to obtain sensitive information via (1) a long string or (2) invalid characters in a cookie, which reveals the installation path in an error message.

CVE-2012-6052NONECVSS 0.0EG 0.0

2012-12-05

Wireshark 1.8.x before 1.8.4 allows remote attackers to obtain sensitive hostname information by reading pcap-ng files.

CVE-2012-6077HIGHCVSS 7.5EG 7.5

2019-11-22

W3 Total Cache before 0.9.2.5 allows remote attackers to retrieve password hash information due to insecure storage of database cache files.

CVE-2012-6078HIGHCVSS 7.5EG 7.5

2019-11-22

W3 Total Cache before 0.9.2.5 generates hash keys insecurely which allows remote attackers to predict the values of the hashes.

CVE-2012-6079HIGHCVSS 7.5EG 7.5

2019-11-22

W3 Total Cache before 0.9.2.5 exposes sensitive cached database information which allows remote attackers to download this information via their hash keys.

CVE-2012-6091HIGHCVSS 7.5EG 7.5

2020-02-13

Zend_XmlRpc Class in Magento before 1.7.0.2 contains an information disclosure vulnerability.

CVE-2012-6097NONECVSS 0.0EG 0.0

2013-04-09

File descriptor leak in cronie 1.4.8, when running in certain environments, might allow local users to read restricted files, as demonstrated by reading /etc/crontab.

CVE-2012-6104NONECVSS 0.0EG 0.0

2013-01-27

blog/rsslib.php in Moodle 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 allows remote attackers to obtain sensitive information from site-level blogs by leveraging the guest role and reading an RSS feed.

CVE-2012-6105NONECVSS 0.0EG 0.0

2013-01-27

blog/rsslib.php in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 continues to provide a blog RSS feed after blogging is disabled, which allows remote attackers to obtain sensitive information by…

CVE-2012-6113NONECVSS 0.0EG 0.0

2013-01-19

The openssl_encrypt function in ext/openssl/openssl.c in PHP 5.3.9 through 5.3.13 does not initialize a certain variable, which allows remote attackers to obtain sensitive information from process memory by providing zero bytes of input da…

CVE-2012-6140NONECVSS 0.0EG 0.0

2013-04-24

pam_google_authenticator.c in the PAM module in Google Authenticator before 1.0 requires user-readable permissions for the secret file, which allows local users to bypass intended access restrictions and discover a shared secret via standa…

CVE-2012-6313NONECVSS 0.0EG 0.0

2012-12-11

simple-gmail-login.php in the Simple Gmail Login plugin before 1.1.4 for WordPress allows remote attackers to obtain sensitive information via a request that lacks a timezone, leading to disclosure of the installation path in a stack trace.

CVE-2012-6325NONECVSS 0.0EG 0.0

2012-12-21

VMware vCenter Server Appliance (vCSA) 5.0 before Update 2 does not properly parse XML documents, which allows remote authenticated users to read arbitrary files via unspecified vectors.

CWE-200— Exposure of Sensitive Information to an Unauthorized Actor

CVEs classified under CWE-200page 26 of 173

Map vulnerabilities like CWE-200 to your infrastructure