In JetBrains Upsource before 2020.1, information disclosure is possible because of an incorrect user matching algorithm.

CVE-2019-1976CRITICALCVSS 9.8EG 9.8

2019-09-05

A vulnerability in the “plug-and-play” services component of Cisco Industrial Network Director (IND) could allow an unauthenticated, remote attacker to access sensitive information on an affected device. The vulnerability is du…

CVE-2019-19799MEDIUMCVSS 5.3EG 5.3

2020-03-13

Zoho ManageEngine Applications Manager before 14600 allows a remote unauthenticated attacker to disclose license related information via WieldFeedServlet servlet.

CVE-2019-19800MEDIUMCVSS 5.3EG 5.3

2020-02-06

Zoho ManageEngine Applications Manager 14 before 14520 allows a remote unauthenticated attacker to disclose OS file names via FailOverHelperServlet.

CVE-2019-19802MEDIUMCVSS 6.5EG 6.5

2020-01-17

In Gallagher Command Centre Server v8.10 prior to v8.10.1134(MR4), v8.00 prior to v8.00.1161(MR5), v7.90 prior to v7.90.991(MR5), v7.80 prior to v7.80.960(MR2) and v7.70 or earlier, an authenticated user connecting to OPCUA can view all da…

CVE-2019-19805MEDIUMCVSS 5.3EG 5.3

2019-12-30

_account_forgot_password.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 takes a different amount of time to return depending on whether an email address is configured for the account name provided. This can be used by an attacker to e…

CVE-2019-19806MEDIUMCVSS 5.3EG 5.3

2019-12-30

_account_forgot_password.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 displays a message indicating whether an email address is configured for the account name provided. This can be used by an attacker to enumerate accounts by guess…

CVE-2019-19837MEDIUMCVSS 5.3EG 5.3

2020-01-23

Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote information disclosure of bin/web.conf via HTTP requests.

CVE-2019-19866HIGHCVSS 7.5EG 7.5

2020-02-21

Atos Unify OpenScape UC Web Client V9 before version V9 R4.31.0 and V10 before version V10 R0.6.0 allows remote attackers to obtain sensitive information. By iterating the value of conferenceId to getMailFunction in the JSON API, one can e…

CVE-2019-19902HIGHCVSS 7.2EG 7.2

2019-12-19

An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It allows the upload of entire-site configuration archives through the user interface or command line. It does not sufficiently check uploaded archives …

CVE-2019-19946MEDIUMCVSS 6.5EG 6.5

2020-03-16

The API in Dradis Pro 3.4.1 allows any user to extract the content of a project, even if this user is not part of the project team.

CVE-2019-19983MEDIUMCVSS 4.3EG 4.3

2019-12-26

In the WordPress plugin, Fast Velocity Minify before 2.7.7, the full web root path to the running WordPress application can be discovered. In order to exploit this vulnerability, FVM Debug Mode needs to be enabled and an admin-ajax request…

CVE-2019-19985MEDIUMCVSS 5.3EG 5.3

2019-12-26

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure.

CVE-2019-19992MEDIUMCVSS 6.5EG 6.5

2020-02-26

An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. A user with valid credentials is able to read XML files on the filesystem via the web interface. The PHP page /common/vam_editXml.php doesn't check the par…

CVE-2019-20028HIGHCVSS 7.5EG 7.5

2020-07-29

Aspire-derived NEC PBXes operating InMail software, including all versions of SV8100, SV9100, SL1100 and SL2100 devices allow unauthenticated read-only access to voicemails, greetings, and voice response system content through a system's W…

CVE-2019-20147MEDIUMCVSS 5.3EG 5.3

2020-01-13

An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 9.1 through 12.6.1. It has Incorrect Access Control.

CVE-2019-20148MEDIUMCVSS 5.3EG 5.3

2020-01-13

An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 8.13 through 12.6.1. It has Incorrect Access Control.

CVE-2019-20213HIGHCVSS 7.5EG 7.5

2020-01-02

D-Link DIR-859 routers before v1.07b03_beta allow Unauthenticated Information Disclosure via the AUTHORIZED_GROUP=1%0a value, as demonstrated by vpnconfig.php.

CVE-2019-20403MEDIUMCVSS 5.3EG 5.3

2020-02-06

The API in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to determine if a Jira project key exists or not via an information disclosure vulnerability.

CVE-2019-20410MEDIUMCVSS 6.5EG 6.5

2020-06-29

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view sensitive information via an Information Disclosure vulnerability in the comment restriction feature. The affected versions are before version 7.6.17…

CVE-2019-20495MEDIUMCVSS 6.5EG 6.5

2020-03-17

cPanel before 82.0.18 allows attackers to read an arbitrary database via MySQL dump streaming (SEC-531).

CVE-2019-20529HIGHCVSS 7.5EG 7.5

2020-03-18

In core/doctype/prepared_report/prepared_report.py in Frappe 11 and 12, data files generated with Prepared Report were being stored as public files (no authentication is required to access; having a link is sufficient) instead of private f…

CVE-2019-20534LOWCVSS 2.4EG 2.4

2020-03-24

An issue was discovered on Samsung mobile devices with P(9.0) software. Attackers can view home-screen wallpaper by adjusting the brightness of a locked screen. The Samsung ID is SVE-2019-15540 (December 2019).

CVE-2019-20547MEDIUMCVSS 5.3EG 5.3

2020-03-24

An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) software. Data may leak via a Bluetooth debug command. The Samsung ID is SVE-2019-15398 (November 2019).

CVE-2019-20550MEDIUMCVSS 5.5EG 5.5

2020-03-24

An issue was discovered on Samsung mobile devices with O(8.x) (released in China and India) software. The S Secure app can access the content of a locked app without a password. The Samsung ID is SVE-2019-13805 (October 2019).

CVE-2019-20555MEDIUMCVSS 5.3EG 5.3

2020-03-24

An issue was discovered on Samsung mobile devices with N(7.x) software. The Gallery app allows attackers to view all pictures of a locked device. The Samsung ID is SVE-2019-15189 (October 2019).

CVE-2019-20559LOWCVSS 2.4EG 2.4

2020-03-24

An issue was discovered on Samsung mobile devices with P(9.0) software. Gallery allows viewing of photos on the lock screen. The Samsung ID is SVE-2019-15055 (October 2019).

CVE-2019-2056MEDIUMCVSS 5.5EG 5.5

2020-04-17

There is a possible disclosure of RAM using a shared crypto key due to improperly used crypto. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.…

CVE-2019-20579LOWCVSS 2.4EG 2.4

2020-03-24

An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) software. Gallery allows attackers to enable Location information sharing from the lock screen. The Samsung ID is SVE-2019-14462 (August 2019).

CVE-2019-20580MEDIUMCVSS 5.3EG 5.3

2020-03-24

An issue was discovered on Samsung mobile devices with P(9.0) software. The Motion photo player allows attackers to bypass the Secure Folder feature to view images. The Samsung ID is SVE-2019-14653 (August 2019).

CVE-2019-20593MEDIUMCVSS 5.3EG 5.3

2020-03-24

An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. Gallery leaks Private Mode thumbnails. The Samsung ID is SVE-2019-14208 (July 2019).

CVE-2019-20597CRITICALCVSS 9.1EG 9.1

2020-03-24

An issue was discovered on Samsung mobile devices with N(7.1), O(8.x), and P(9.0) software. SPENgesture allows arbitrary applications to read or modify user-input logs. The Samsung ID is SVE-2019-14170 (June 2019).

CVE-2019-20598LOWCVSS 2.4EG 2.4

2020-03-24

An issue was discovered on Samsung mobile devices with O(8.x) software. Bixby leaks the keyboard's learned words, and the clipboard contents, via the lock screen. The Samsung IDs are SVE-2018-12896, SVE-2018-12897 (May 2019).

CVE-2019-20609MEDIUMCVSS 6.5EG 6.5

2020-03-24

An issue was discovered on Samsung mobile devices with P(9.0) software. Attackers can use Smartwatch to view Secure Folder notification content. The Samsung ID is SVE-2019-13899 (April 2019).

CVE-2019-20614HIGHCVSS 7.5EG 7.5

2020-03-24

An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) software. Allshare allows attackers to access sensitive information. The Samsung ID is SVE-2018-13453 (March 2019).

CVE-2019-20615MEDIUMCVSS 4.6EG 4.6

2020-03-24

An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. Attackers can bypass Factory Reset Protection (FRP) via SVoice T&C. The Samsung ID is SVE-2018-13547 (March 2019).

CVE-2019-20616MEDIUMCVSS 5.3EG 5.3

2020-03-24

An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. Gallery leaks a thumbnail of Private Mode content. The Samsung ID is SVE-2018-13563 (March 2019).

CVE-2019-20617MEDIUMCVSS 5.3EG 5.3

2020-03-24

An issue was discovered on Samsung mobile devices with P(9.0) software. Secure Folder leaks preview data of recent apps. The Samsung ID is SVE-2018-13764 (March 2019).

CVE-2019-20619HIGHCVSS 7.5EG 7.5

2020-03-24

An issue was discovered on Samsung mobile devices with P(9.0) software. Secure Startup leaks keyboard suggested words. The Samsung ID is SVE-2019-13773 (March 2019).

CVE-2019-20624MEDIUMCVSS 5.3EG 5.3

2020-03-24

An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. S-Voice leaks keyboard learned words via the lock screen. The Samsung ID is SVE-2018-12981 (February 2019).

CVE-2019-20625LOWCVSS 3.3EG 3.3

2020-03-24

An issue was discovered on Samsung mobile devices with N(7.1) and O(8.x) (Exynos chipsets) software. The ion debugfs driver allows information disclosure. The Samsung ID is SVE-2018-13427 (February 2019).

CVE-2019-20637HIGHCVSS 7.5EG 7.5

2020-04-08

An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before 6.3.1. It does not clear a pointer between the handling of one client request and the next request within the same connection. This s…

CVE-2019-20638MEDIUMCVSS 6.5EG 6.5

2020-04-15

NETGEAR MR1100 devices before 12.06.08.00 are affected by disclosure of administrative credentials.

CVE-2019-20643HIGHCVSS 7.5EG 7.5

2020-04-15

NETGEAR RAX40 devices before 1.0.3.64 are affected by disclosure of sensitive information.

CVE-2019-20646CRITICALCVSS 9.8EG 9.8

2020-04-15

NETGEAR RAX40 devices before 1.0.3.64 are affected by disclosure of administrative credentials.

CVE-2019-20649HIGHCVSS 7.5EG 7.5

2020-04-15

NETGEAR MR1100 devices before 12.06.08.00 are affected by disclosure of sensitive information.

CVE-2019-20652MEDIUMCVSS 6.5EG 6.5

2020-04-15

NETGEAR WAC505 devices before 8.2.1.16 are affected by disclosure of sensitive information.

CVE-2019-20658MEDIUMCVSS 6.5EG 6.5

2020-04-15

Certain NETGEAR devices are affected by disclosure of sensitive information. This affects FS728TLP before 1.0.1.26, GS105Ev2 before 1.6.0.4, GS105PE before 1.6.0.4, GS108Ev3 before 2.06.08, GS108PEv3 before 2.06.08, GS110EMX before 1.0.1.4…

CVE-2019-20694HIGHCVSS 7.5EG 7.5

2020-04-16

Certain NETGEAR devices are affected by disclosure of sensitive information. This affects GS728TP before 6.0.0.48, GS728TPPv2 before 6.0.0.48, GS728TPv2 before 6.0.0.48, GS752TPP before 6.0.0.48, and GS752TPv2 before 6.0.0.48.

CVE-2019-20695HIGHCVSS 7.5EG 7.5

2020-04-16

Certain NETGEAR devices are affected by disclosure of sensitive information. This affects SRK60 before 2.3.5.106, SRR60 before 2.3.5.106, and SRS60 before 2.3.5.106.

CWE-200— Exposure of Sensitive Information to an Unauthorized Actor

CVEs classified under CWE-200page 77 of 174

Map vulnerabilities like CWE-200 to your infrastructure