Weakness (CWE)
CWE-922: Insecure Storage of Sensitive Information
The product stores sensitive information without properly limiting read or write access by unauthorized actors.
Source: MITRE CWE-922
38 results · Clear filters · Feed
-
Low 3.1
AI (Artificial Intelligence) - Less critical - Information Disclosure - SA-CONTRIB-2026-271
Insecure Storage of Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Retrieve Embedded Sensitive Data. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
-
Low 3.3
Content Sync (content-sync.io) - Moderately critical - Information disclosure - SA-CONTRIB-2026-291
Insecure Storage of Sensitive Information vulnerability in Drupal Content Sync (content-sync.io) allows Retrieve Embedded Sensitive Data. This issue affects Content Sync (content-sync.io) versions: from 0.0.0 to 3.2.2.
-
Low 3.8
SAML SSO - Service Provider - Moderately critical - Information disclosure - SA-CONTRIB-2026-149
Insecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
-
Low 3.1
Vulnerability in the Oracle JavaFX product of Oracle Java SE (component: JavaFX). Supported versions that are affected …
-
Low 2.2
Dell OS Recovery Tool, versions prior to 2.4.4, contains an Insecure Storage of Sensitive Information vulnerability. A …
-
Low 2.4
Tomofun Furbo Mobile App Authentication Token sensitive information
A security vulnerability has been detected in Tomofun Furbo Mobile App up to 7.57.0a on Android. This affects an unknown part of the component Authentication Token Handler. The manipulation leads to insecure storage of sensitive information. It is possible to…
-
Low 2.0
Tomofun Furbo 360/Furbo Mini UART sensitive information
A weakness has been identified in Tomofun Furbo 360 and Furbo Mini. Affected by this issue is some unknown functionality of the component UART Interface. Executing manipulation can lead to insecure storage of sensitive information. The physical device can be …
-
Low 3.3
Tomofun Furbo 360/Furbo Mini Debug Log S3 Bucket collect_logs.sh sensitive information
A vulnerability has been found in Tomofun Furbo 360 and Furbo Mini. The impacted element is an unknown function of the file collect_logs.sh of the component Debug Log S3 Bucket Handler. The manipulation leads to insecure storage of sensitive information. An a…
-
Low 3.3
Foreman: disclosure of executed commands and outputs in foreman / red hat satellite
A flaw was found in Foreman/Red Hat Satellite. Improper file permissions allow low-privileged OS users to monitor and access temporary files under /var/tmp, exposing sensitive command outputs, such as /etc/shadow. This issue can lead to information disclosure…
-
Low 2.7
Nextcloud Server's OAuth2 client secrets were stored in a recoverable way
Nextcloud Server is a self hosted personal cloud system. The OAuth2 client secrets were stored in a recoverable way, so that an attacker that got access to a backup of the database and the Nextcloud config file, would be able to decrypt them. It is recommende…
-
Low 3.7
Moodle: admin presets export tool includes some secrets that should not be exported
A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded from the export, which could result in them unintentionally being leaked if the presets are shared with a third party.
-
Low 3.5
Certain Cypress (and Broadcom) Wireless Combo chips, when a January 2021 firmware update is not present, allow memory r…
-
Low 3.3
This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.1, m…
-
Low 3.3
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ven…
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
Low 3.7
Missing default HTTP security headers affect HCL Nomad server on Domino
HCL Nomad server on Domino did not configure certain HTTP Security headers by default which could allow an attacker to obtain sensitive information via unspecified vectors.
-
Low 2.7
An issue was discovered in Infinera hiT 7300 5.60.50. Hidden functionality in the web interface allows a remote authent…
-
Low 3.3
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.6. An app may be able to view a co…
-
Low 3.9
udn News App - Insecure Data Storage
udn News Android APP stores the unencrypted user session in the local database when user log into the application. A malicious APP or an attacker with physical access to the Android device can retrieve this session and use it to log into the news APP and othe…
-
Low 3.3
Yubico YubiKey 5 Series before 5.7.0, Security Key Series before 5.7.0, YubiKey Bio Series before 5.6.4, and YubiKey 5 …
-
Low 3.5
An issue in CmsEasy v.7.7 and before allows a remote attacker to obtain sensitive information via the update function i…
-
Low 3.3
A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sonoma 14.4. An a…
-
Low 2.9CVE-2024-22371 Public exploit
Apache Camel issue on ExchangeCreatedEvent
Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel.This issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, …
-
Low 3.9
HCL Sametime Chat is affected by an unimplemented feature in the UI
Sametime Connect desktop chat client includes, but does not use or require, the use of an Eclipse feature called Secure Storage. Using this Eclipse feature to store sensitive data can lead to exposure of that data.
-
Low 2.7
The issue was resolved by sanitizing logging This issue is fixed in watchOS 10.1, macOS Sonoma 14.1, tvOS 17.1, macOS M…
-
Low 3.3
In applyCustomDescription of SaveUi.java, there is a possible way to view images belonging to a different user due to a…
-
Low 3.5
vantage6 unencrypted task can be created in encrypted collaboration
The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). There are no checks on whether the input is encrypted if a task is created in an encrypted collaboration. There…
-
Low 3.3
A privacy issue was addressed with improved handling of temporary files. This issue is fixed in iOS 17.3 and iPadOS 17.…
-
Low 2.3
HCL BigFix OSD Bare Metal Server WebUI is affected by sensitive information disclosure
HCL BigFix Bare OSD Metal Server WebUI version 311.19 or lower can sometimes include sensitive information in a query string which could allow an attacker to execute a malicious attack.
-
Low 3.3
Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information…
-
Low 3.2
Default permissions for a properties file were too permissive. Local system users could read potentially sensitive info…
-
Low 3.3
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 15.7.4 a…
-
Low 3.7
WordPress Freesoul Deactivate Plugins – Plugin manager and cleanup Plugin <= 1.9.4.0 is vulnerable to Sensitive Data Exposure
Insecure Storage of Sensitive Information vulnerability in Jose Mortellaro Freesoul Deactivate Plugins – Plugin manager and cleanup plugin <= 1.9.4.0 versions.
-
Low 3.3
Improper access control in the Intel(R) WAPI Security software for Windows 10/11 before version 22.2150.0.1 may allow a…
-
Low 2.4
This issue was addressed with improved data protection. This issue is fixed in iOS 16, macOS Ventura 13. A user with ph…
-
Low 2.8
BlueCats Reveal iOS App Insecure Storage
The iOS mobile application BlueCats Reveal before 5.14 stores the username and password in the app cache as base64 encoded strings, i.e. clear text. These persist in the cache even if the user logs out. This can allow an attacker to compromise the affected Bl…
-
Low 2.8
BlueCats Reveal Android App Insecure Storage
The Android mobile application BlueCats Reveal before 3.0.19 stores the username and password in a clear text file. This file persists until the user logs out or the session times out from non-usage (30 days of no user activity). This can allow an attacker to…
-
Low 2.8
Eaton Halo Home Android App Insecure Storage
The Android mobile application Halo Home before 1.11.0 stores OAuth authentication and refresh access tokens in a clear text file. This file persists until the user logs out of the application and reboots the device. This vulnerability can allow an attacker t…