Exposure of Sensitive Information to an Unauthorized Actor in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow a privileged user to potentially enable e…

CVE-2021-0170MEDIUMCVSS 5.5EG 5.5

2022-02-09

Exposure of Sensitive Information to an Unauthorized Actor in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow an authenticated user to potentially enab…

CVE-2021-0204HIGHCVSS 7.8EG 7.8

2021-01-15

A sensitive information disclosure vulnerability in delta-export configuration utility (dexp) of Juniper Networks Junos OS may allow a locally authenticated shell user the ability to create and read database files generated by the dexp uti…

CVE-2021-0210MEDIUMCVSS 6.8EG 6.8

2021-01-15

An Information Exposure vulnerability in J-Web of Juniper Networks Junos OS allows an unauthenticated attacker to elevate their privileges over the target system through opportunistic use of an authenticated users session. This issue affec…

CVE-2021-0212MEDIUMCVSS 5.0EG 5.0

2021-01-15

An Information Exposure vulnerability in Juniper Networks Contrail Networking allows a locally authenticated attacker able to read files to retrieve administrator credentials stored in plaintext thereby elevating their privileges over the …

CVE-2021-0291MEDIUMCVSS 6.5EG 6.5

2021-07-15

An Exposure of System Data vulnerability in Juniper Networks Junos OS and Junos OS Evolved, where a sensitive system-level resource is not being sufficiently protected, allows a network-based unauthenticated attacker to send specific traff…

CVE-2021-0321MEDIUMCVSS 5.5EG 5.5

2021-01-11

In enforceDumpPermissionForPackage of ActivityManagerService.java, there is a possible way to determine if a package is installed due to side channel information disclosure. This could lead to local information disclosure with no additiona…

CVE-2021-0403MEDIUMCVSS 4.4EG 4.4

2021-02-26

In netdiag, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Product: An…

CVE-2021-0404MEDIUMCVSS 4.4EG 4.4

2021-02-26

In mobile_log_d, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Product…

CVE-2021-0518MEDIUMCVSS 5.5EG 5.5

2021-07-14

In Wi-Fi, there is a possible leak of location-sensitive data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitatio…

CVE-2021-0602HIGHCVSS 7.8EG 7.8

2021-07-14

In onCreateOptionsMenu of WifiNetworkDetailsFragment.java, there is a possible way for guest users to view and modify Wi-Fi settings for all configured APs due to a permissions bypass. This could lead to local escalation of privilege with …

CVE-2021-0644MEDIUMCVSS 5.5EG 5.5

2021-10-06

In conditionallyRemoveIdentifiers of SubscriptionController.java, there is a possible way to retrieve a trackable identifier due to a missing permission check. This could lead to local information disclosure with User execution privileges …

CVE-2021-0676MEDIUMCVSS 4.4EG 4.4

2021-12-17

In geniezone driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch I…

CVE-2021-0983LOWCVSS 3.3EG 3.3

2021-12-15

In createAdminSupportIntent of DevicePolicyManagerService.java, there is a possible disclosure of information about installed device/profile owner package name due to side channel information disclosure. This could lead to local informatio…

CVE-2021-1023MEDIUMCVSS 5.0EG 5.0

2021-12-15

In onCreate of RequestIgnoreBatteryOptimizations.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure…

CVE-2021-1087MEDIUMCVSS 5.5EG 5.5

2021-04-29

NVIDIA vGPU driver contains a vulnerability in the Virtual GPU Manager (vGPU plugin), which could allow an attacker to retrieve information that could lead to a Address Space Layout Randomization (ASLR) bypass. This affects vGPU version 12…

CVE-2021-1406MEDIUMCVSS 4.9EG 4.9

2021-04-08

A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to access sensitive information on an a…

CVE-2021-1417CRITICALCVSS 9.9EG 6.5

2021-03-24

Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system with elevated privileges, access s…

CVE-2021-1562MEDIUMCVSS 4.3EG 4.3

2021-07-08

A vulnerability in the XSI-Actions interface of Cisco BroadWorks Application Server could allow an authenticated, remote attacker to access sensitive information on an affected system. This vulnerability is due to improper input validation…

CVE-2021-1663MEDIUMCVSS 5.5EG 5.5

2021-01-12

Windows Projected File System FS Filter Driver Information Disclosure Vulnerability

CVE-2021-1734HIGHCVSS 7.5EG 7.5

2021-02-25

Windows Remote Procedure Call Information Disclosure Vulnerability

CVE-2021-20018MEDIUMCVSS 4.9EG 4.9

2021-03-13

A post-authenticated vulnerability in SonicWall SMA100 allows an attacker to export the configuration file to the specified email address. This vulnerability impacts SMA100 version 10.2.0.5 and earlier.

CVE-2021-20019HIGHCVSS 7.5EG 7.5

2021-06-23

A vulnerability in SonicOS where the HTTP server response leaks partial memory by sending a crafted HTTP request, this can potentially lead to an internal sensitive data disclosure vulnerability.

CVE-2021-20049HIGHCVSS 7.5EG 7.5

2021-12-23

A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration based on the server responses. This vulnerability impacts 10.2.1.2-24sv, 10.2.0.8-37sv and earlier 10.x…

CVE-2021-20067MEDIUMCVSS 5.3EG 5.3

2021-02-16

Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to view sensitive syslog events without authentication.

CVE-2021-20092HIGHCVSS 7.5EG 7.5

2021-04-29

The web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 do not properly restrict access to sensitive information from an unauthorized actor.

CVE-2021-20114HIGHCVSS 7.5EG 7.5

2021-07-30

When installed following the default/recommended settings, TCExam <= 14.8.1 allowed unauthenticated users to access the /cache/backup/ directory, which included sensitive database backup files.

CVE-2021-20148MEDIUMCVSS 4.3EG 4.3

2022-01-03

ManageEngine ADSelfService Plus below build 6116 stores the password policy file for each domain under the html/ web root with a predictable filename based on the domain name. When ADSSP is configured with multiple Windows domains, a user …

CVE-2021-20228HIGHCVSS 7.5EG 7.5

2021-04-29

A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature when using the sub-option feature of the basic.py module. This flaw allows an attacker to obtain sensit…

CVE-2021-20239LOWCVSS 3.3EG 3.3

2021-05-28

A flaw was found in the Linux kernel in versions before 5.4.92 in the BPF protocol. This flaw allows an attacker with a local account to leak information about kernel internal addresses. The highest threat from this vulnerability is to con…

CVE-2021-20250MEDIUMCVSS 4.3EG 4.3

2021-05-13

A flaw was found in wildfly. The JBoss EJB client has publicly accessible privileged actions which may lead to information disclosure on the server it is deployed on. The highest threat from this vulnerability is to data confidentiality.

CVE-2021-20256MEDIUMCVSS 5.3EG 5.3

2021-02-23

A flaw was found in Red Hat Satellite. The BMC interface exposes the password through the API to an authenticated local attacker with view_hosts permission. The highest threat from this vulnerability is to data confidentiality and integrit…

CVE-2021-20259HIGHCVSS 7.8EG 7.8

2021-06-07

A flaw was found in the Foreman project. The Proxmox compute resource exposes the password through the API to an authenticated local attacker with view_hosts permission. The highest threat from this vulnerability is to data confidentiality…

CVE-2021-20260HIGHCVSS 7.8EG 7.8

2022-08-26

A flaw was found in the Foreman project. The Datacenter plugin exposes the password through the API to an authenticated local attacker with view_hosts permission. The highest threat from this vulnerability is to data confidentiality and in…

CVE-2021-20281MEDIUMCVSS 5.3EG 5.3

2021-03-15

It was possible for some users without permission to view other users' full names to do so via the online users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

CVE-2021-20313HIGHCVSS 7.5EG 7.5

2021-05-11

A flaw was found in ImageMagick in versions before 7.0.11. A potential cipher leak when the calculate signatures in TransformSignature is possible. The highest threat from this vulnerability is to data confidentiality.

CVE-2021-20320MEDIUMCVSS 5.5EG 5.5

2022-02-18

A flaw was found in s390 eBPF JIT in bpf_jit_insn in arch/s390/net/bpf_jit_comp.c in the Linux kernel. In this flaw, a local attacker with special user privilege can circumvent the verifier and may lead to a confidentiality problem.

CVE-2021-20331MEDIUMCVSS 4.2EG 4.2

2021-05-13

Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when commands suc…

CVE-2021-20332MEDIUMCVSS 4.2EG 4.2

2021-08-02

Specific MongoDB Rust Driver versions can include credentials used by the connection pool to authenticate connections in the monitoring event that is emitted when the pool is created. The user's logging infrastructure could then potentiall…

CVE-2021-20376MEDIUMCVSS 4.3EG 4.3

2021-10-07

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated attacker to enumerate usernames due to there being an observable discrepancy in returned messages. IBM X-Force ID: 195568.

CVE-2021-20409MEDIUMCVSS 5.9EG 7.5

2021-02-12

IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to o…

CVE-2021-20422HIGHCVSS 7.5EG 7.5

2021-07-13

IBM Cloud Pak for Applications 4.3 could disclose sensitive information to a malicious attacker by accessing data stored in memory. IBM X-Force ID: 196304.

CVE-2021-20478LOWCVSS 3.3EG 3.3

2021-07-20

IBM Cloud Pak System 2.3 could allow a local user in some situations to view the artifacts of another user in self service console. IBM X-Force ID: 197497.

CVE-2021-20486MEDIUMCVSS 6.5EG 6.5

2021-05-26

IBM Cloud Pak for Data 3.0 could allow an authenticated user to obtain sensitive information when installed with additional plugins. IBM X-Force ID: 197668.

CVE-2021-20498MEDIUMCVSS 5.3EG 5.3

2021-07-15

IBM Security Verify Access Docker 10.0.0 reveals version information in HTTP requests that could be used in further attacks against the system. IBM X-Force ID: 197972.

CVE-2021-20529MEDIUMCVSS 5.3EG 5.3

2021-05-19

IBM Control Center 6.2.0.0 could allow a user to obtain sensitive version information that could be used in further attacks against the system. IBM X-Force ID: 198763.

CVE-2021-20563MEDIUMCVSS 4.3EG 4.3

2021-09-23

IBM Sterling File Gateway 2.2.0.0 through 6.1.0.3 could allow a remote authenciated user to obtain sensitive information. By sending a specially crafted request, the user could disclose a valid filepath on the server which could be used in…

CVE-2021-20564MEDIUMCVSS 5.9EG 5.9

2021-05-14

IBM Cloud Pak for Security (CP4S) 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exp…

CVE-2021-20579MEDIUMCVSS 6.5EG 6.5

2021-06-24

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a user who can create a view or inline SQL function to obtain sensitive information when AUTO_REVAL is set to DEFFERED_FORCE. IBM…

CVE-2021-20582MEDIUMCVSS 5.3EG 5.3

2021-09-14

IBM Security Secret Server up to 11.0 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force …

CWE-200— Exposure of Sensitive Information to an Unauthorized Actor

CVEs classified under CWE-200page 99 of 174

Map vulnerabilities like CWE-200 to your infrastructure