The /server/properties resource in Tenable Web UI before 2.3.5 for Nessus 5.2.3 through 5.2.7 allows remote attackers to obtain sensitive information via the token parameter.

CVE-2014-4991HIGHCVSS 7.8EG 7.8

2018-01-10

(1) lib/dataset/database/mysql.rb and (2) lib/dataset/database/postgresql.rb in the codders-dataset gem 1.3.2.1 for Ruby place credentials on the mysqldump command line, which allows local users to obtain sensitive information by listing t…

CVE-2014-4992HIGHCVSS 7.8EG 7.8

2018-01-10

lib/cap-strap/helpers.rb in the cap-strap gem 0.1.5 for Ruby places credentials on the useradd command line, which allows local users to obtain sensitive information by listing the process.

CVE-2014-4993HIGHCVSS 7.8EG 7.8

2018-01-10

(1) lib/backup/cli/utility.rb in the backup-agoddard gem 3.0.28 and (2) lib/backup/cli/utility.rb in the backup_checksum gem 3.0.23 for Ruby place credentials on the openssl command line, which allows local users to obtain sensitive inform…

CVE-2014-4995HIGHCVSS 7.0EG 7.0

2018-01-10

Race condition in lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to obtain sensitive information by reading the MySQL root password from a temporary file before it is removed.

CVE-2014-4997HIGHCVSS 7.8EG 7.8

2018-01-10

lib/commands/setup.rb in the point-cli gem 0.0.1 for Ruby places credentials on the curl command line, which allows local users to obtain sensitive information by listing the process.

CVE-2014-4998HIGHCVSS 7.8EG 7.8

2018-01-10

test/tc_database.rb in the lean-ruport gem 0.3.8 for Ruby places the mysql user password on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.

CVE-2014-4999HIGHCVSS 7.8EG 7.8

2018-01-10

vendor/plugins/dataset/lib/dataset/database/mysql.rb in the kajam gem 1.0.3.rc2 for Ruby places the mysql user password on the (1) mysqldump command line in the capture function and (2) mysql command line in the restore function, which all…

CVE-2014-5000HIGHCVSS 7.8EG 7.8

2018-01-10

The login function in lib/lawn.rb in the lawn-login gem 0.0.7 for Ruby places credentials on the curl command line, which allows local users to obtain sensitive information by listing the process.

CVE-2014-5001HIGHCVSS 7.8EG 7.8

2018-01-10

lib/ksymfony1.rb in the kcapifony gem 2.1.6 for Ruby places database user passwords on the (1) mysqldump, (2) pg_dump, (3) mysql, and (4) psql command lines, which allows local users to obtain sensitive information by listing the processes.

CVE-2014-5004HIGHCVSS 7.8EG 7.8

2018-01-10

lib/brbackup.rb in the brbackup gem 0.1.1 for Ruby places the database password on the mysql command line, which allows local users to obtain sensitive information by listing the process.

CVE-2014-5011MEDIUMCVSS 6.5EG 6.5

2020-01-10

DOMPDF before 0.6.2 allows Information Disclosure.

CVE-2014-5028MEDIUMCVSS 6.5EG 6.5

2018-03-29

The Original File and Patched File resources in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allow remote authenticated users to bypass intended access restrictions and obtain sensitive information from repository files by lever…

CVE-2014-5036NONECVSS 0.0EG 0.0

2014-09-05

The Storage Controller (SC) component in Eucalyptus 3.4.2 through 4.0.x before 4.0.1, when Dell Equallogic SAN is used, logs the CHAP user credentials, which allows local users to obtain sensitive information by reading the logs.

CVE-2014-5037NONECVSS 0.0EG 0.0

2014-11-07

Eucalyptus 4.0.0 through 4.0.1, when the log level is set to INFO, logs user and system passwords, which allows local users to obtain sensitive information by reading cloud-requests.log.

CVE-2014-5038NONECVSS 0.0EG 0.0

2014-11-07

Eucalyptus 3.0.0 through 4.0.1, when the log level is set to DEBUG or lower, logs user and system passwords, which allows local users to obtain sensitive information by reading the cloud log files.

CVE-2014-5076NONECVSS 0.0EG 0.0

2014-09-02

The La Banque Postale application before 3.2.6 for Android does not prevent the launching of an activity by a component of another application, which allows attackers to obtain sensitive cached banking information via crafted intents, as d…

CVE-2014-5094NONECVSS 0.0EG 0.0

2014-10-20

Status2k allows remote attackers to obtain configuration information via a phpinfo action in a request to status/index.php, which calls the phpinfo function.

CVE-2014-5107NONECVSS 0.0EG 0.0

2014-07-28

concrete5 before 5.6.3 allows remote attackers to obtain the installation path via a direct request to (1) system/basics/editor.php, (2) system/view.php, (3) system/environment/file_storage_locations.php, (4) system/mail/importers.php, (5)…

CVE-2014-5128NONECVSS 0.0EG 0.0

2014-08-29

Innovative Interfaces Encore Discovery Solution 4.3 places a session token in the URI, which might allow remote attackers to obtain sensitive information via unspecified vectors.

CVE-2014-5130MEDIUMCVSS 6.5EG 6.5

2018-03-27

Avolve Software ProjectDox 8.1 allows remote authenticated users to obtain sensitive information from other users via vectors involving a direct access token.

CVE-2014-5131MEDIUMCVSS 6.5EG 6.5

2018-03-27

Avolve Software ProjectDox 8.1 makes it easier for remote authenticated users to obtain sensitive information by leveraging ciphertext reuse.

CVE-2014-5132MEDIUMCVSS 4.3EG 4.3

2018-03-27

Avolve Software ProjectDox 8.1 allows remote attackers to enumerate users via vectors related to email addresses.

CVE-2014-5137NONECVSS 0.0EG 0.0

2014-09-02

Innovative Interfaces Sierra Library Services Platform 1.2_3 provides different responses for login request depending on whether the user account exists, which allows remote attackers to enumerate account names via a series of login reques…

CVE-2014-5209MEDIUMCVSS 5.3EG 5.3

2020-01-08

An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET_RESTRICT control message, which could let a malicious user obtain sensitive information.

CVE-2014-5213NONECVSS 0.0EG 0.0

2014-12-19

nds/files/opt/novell/eDirectory/lib64/ndsimon/public/images in iMonitor in Novell eDirectory before 8.8 SP8 Patch 4 allows remote authenticated users to obtain sensitive information from process memory via a direct request.

CVE-2014-5215NONECVSS 0.0EG 0.0

2014-12-23

NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allows remote authenticated administrators to discover service-account passwords via a request to (1) roma/jsp/volsc/monitoring/dev_services.jsp or (2) roma/jsp/debug/debug.jsp.

CVE-2014-5231NONECVSS 0.0EG 0.0

2015-01-14

The Siemens SIMATIC WinCC Sm@rtClient app before 1.0.2 for iOS allows physically proximate attackers to extract the password from storage via unspecified vectors.

CVE-2014-5233NONECVSS 0.0EG 0.0

2015-01-14

The Siemens SIMATIC WinCC Sm@rtClient app before 1.0.2 for iOS allows physically proximate attackers to discover Sm@rtServer credentials by leveraging an error in the credential-processing mechanism.

CVE-2014-5270NONECVSS 0.0EG 0.0

2014-10-10

Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext randomization, which makes it easier for physically proximate attackers to conduct key-extraction attacks by lev…

CVE-2014-5320NONECVSS 0.0EG 0.0

2014-09-22

The Bump application for Android does not properly handle implicit intents, which allows attackers to obtain sensitive owner-name information via a crafted application.

CVE-2014-5341NONECVSS 0.0EG 0.0

2015-02-04

The SFTP external storage driver (files_external) in ownCloud Server before 6.0.5 validates the RSA Host key after login, which allows remote attackers to obtain sensitive information by sniffing the network.

CVE-2014-5377NONECVSS 0.0EG 0.0

2014-09-04

ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 allows remote attackers to obtain user account credentials via a direct request.

CVE-2014-5394MEDIUMCVSS 5.9EG 5.9

2018-01-08

Multiple Huawei Campus switches allow remote attackers to enumerate usernames via vectors involving use of SSH by the maintenance terminal.

CVE-2014-5400NONECVSS 0.0EG 0.0

2015-04-03

The installation component in Hospira MedNet before 6.1 places cleartext credentials in configuration files, which allows local users to obtain sensitive information by reading a file.

CVE-2014-5405NONECVSS 0.0EG 0.0

2015-04-03

Hospira MedNet before 6.1 uses a hardcoded cleartext password to control SQL database authorization, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password.

CVE-2014-5427NONECVSS 0.0EG 0.0

2015-03-29

Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server (ADS), Extended Application and Data Server (aka ADX), LonWorks Control Server 85 LCS8520, Network Automation Engine (NAE) 55xx-x, Network Integration Engine …

CVE-2014-5447NONECVSS 0.0EG 0.0

2014-10-20

Zarafa WebAccess 7.1.10 and WebApp 1.6 beta uses weak permissions (644) for config.php, which allows local users to obtain sensitive information by reading the PHP session files. NOTE: this vulnerability exists because of an incomplete fi…

CVE-2014-5448NONECVSS 0.0EG 0.0

2014-10-20

Zarafa 5.00 uses world-readable permissions for the files in the log directory, which allows local users to obtain sensitive information by reading the log files.

CVE-2014-5449NONECVSS 0.0EG 0.0

2014-10-20

Zarafa WebAccess 4.1 and WebApp uses world-readable permissions for the files in their tmp directory, which allows local users to obtain sensitive information by reading temporary session data.

CVE-2014-5450MEDIUMCVSS 5.5EG 5.5

2018-03-19

Zarafa Collaboration Platform 4.1 uses world-readable permissions for /etc/zarafa/license, which allows local users to obtain sensitive information by reading license files.

CVE-2014-6038HIGHCVSS 7.5EG 7.5

2020-01-13

Zoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 have a database Information Disclosure Vulnerability. Fixed in EventLog Analyzer 10.0 Build 10000.

CVE-2014-6048MEDIUMCVSS 5.3EG 5.3

2018-08-28

phpMyFAQ before 2.8.13 allows remote attackers to read arbitrary attachments via a direct request.

CVE-2014-6064NONECVSS 0.0EG 0.0

2014-09-02

The Accounts tab in the administrative user interface in McAfee Web Gateway (MWG) before 7.3.2.9 and 7.4.x before 7.4.2 allows remote authenticated users to obtain the hashed user passwords via unspecified vectors.

CVE-2014-6075NONECVSS 0.0EG 0.0

2014-11-28

IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, place credentials in URLs, which allows remote attackers to obtain sensitive i…

CVE-2014-6083NONECVSS 0.0EG 0.0

2014-12-18

IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allow remote attackers to obtain sensitive cookie information by sniffing the network during an HTTP ses…

CVE-2014-6086NONECVSS 0.0EG 0.0

2014-12-18

IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 do not ensure that HTTPS is used, which allows remote attackers to obtain sensitive information by sniff…

CVE-2014-6088NONECVSS 0.0EG 0.0

2014-12-18

IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allow remote attackers to obtain sensitive information by sniffing the network during use of the null SS…

CVE-2014-6107NONECVSS 0.0EG 0.0

2014-11-18

IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to obtain sensitive cookie information by sniffing the network during an HTTP session.

CVE-2014-6108MEDIUMCVSS 5.9EG 5.9

2018-04-20

IBM Tivoli Identity Manager 5.1.x before 5.1.0.15-ISS-TIM-IF0057 and Security Identity Manager 6.0.x before 6.0.0.4-ISS-SIM-IF0001 and 7.0.x before 7.0.0.0-ISS-SIM-IF0003 might allow man-in-the-middle attackers to obtain sensitive informat…

CWE-200— Exposure of Sensitive Information to an Unauthorized Actor

CVEs classified under CWE-200page 37 of 173

Map vulnerabilities like CWE-200 to your infrastructure