Filtered by CWE-219
Total 5 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2002-2024 1 Horde 1 Imp 2024-09-16 5.3 Medium
Horde IMP 2.2.7 allows remote attackers to obtain the full web root pathname via an HTTP request for (1) poppassd.php3, (2) login.php3?reason=chpass2, (3) spelling.php3, and (4) ldap.search.php3?ldap_serv=nonsense which leaks the information in error messages.
CVE-2024-39776 2 Avtec, Avtecinc 5 Outpost 0810, Outpost Uploader Utility, Outpost 0810 and 2 more 2024-09-04 7.5 High
Avtec Outpost stores sensitive information in an insecure location without proper access controls in place.
CVE-2022-36306 1 Airspan 2 Airvelocity 1500, Airvelocity 1500 Firmware 2024-08-03 6.5 Medium
An authenticated attacker can enumerate and download sensitive files, including the eNodeB's web management UI's TLS private key, the web server binary, and the web server configuration file. These vulnerabilities were found in AirVelocity 1500 running software version 9.3.0.01249, were still present in 15.18.00.2511, and may affect other AirVelocity and AirSpeed models.
CVE-2022-21236 1 Reolink 2 Rlc-410w, Rlc-410w Firmware 2024-08-03 7.5 High
An information disclosure vulnerability exists due to a web server misconfiguration in the Reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send an HTTP request to trigger this vulnerability.
CVE-2023-39467 2024-08-02 N/A
Triangle MicroWorks SCADA Data Gateway certificate Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Triangle MicroWorks SCADA Data Gateway. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of certificate web directory. The issue results from the exposure of sensitive information in the application webroot. An attacker can leverage this vulnerability to disclose sensitive information. Was ZDI-CAN-20798.