Weakness (CWE)
CWE-922: Insecure Storage of Sensitive Information
The product stores sensitive information without properly limiting read or write access by unauthorized actors.
Source: MITRE CWE-922
171 results · Clear filters · Feed
-
Medium 4.0
Insecure storage of sensitive information issue exists in SS1 provided by DOS Co., Ltd. Sensitive information used by t…
-
Medium 6.5
Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with insecure storage of sensitive i…
-
Medium 6.8
FluteCode Secure Folder 1.2 -Plaintext vault files in shared storage bypass the PIN gate
Secure Folder 1.2 stores files selected for its password-protected vault as unencrypted files in the Android shared-storage tree. A local application or file manager that has access to the relevant shared-storage path can enumerate, copy, and open those files…
-
Medium 6.8
Hide Photos - Secure vault 4.1.0 - Insecure storage of vault media and wallet records in shared external storage
The application protects access through its calculator-style vault passcode, but the stored data is not bound to that authentication boundary. A local actor who can access shared external storage, such as through an authorized non-root ADB shell or another lo…
-
Medium 4.6
CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 stores TPM2.0 secrets in a serialized format within unused disk …
-
Medium 6.8
Insecure storage of sensitive information in the Intel(R) TDX module for some Intel(R) platform within Ring 0: Trust Do…
-
Medium 4.6
In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive co…
-
Medium 5.5
Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Insecure Storage of Sensitive Information vulnerability. A lo…
-
Medium 4.0
Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Insecure Storage of Sensitive Information vulnerability. An u…
-
Medium 4.4
** UNSUPPORTED WHEN ASSIGNED ** An insecure storage of sensitive information vulnerability in the configuration file of…
-
Medium 5.3
code-projects Online FIR System SQL Database Backup File complaints.sql sensitive information
A vulnerability was detected in code-projects Online FIR System 1.0. Affected by this issue is some unknown functionality of the file /complaints.sql of the component SQL Database Backup File Handler. The manipulation results in insecure storage of sensitive …
-
Medium 5.3
code-projects Online Application System for Admission oas.sql sensitive information
A vulnerability was found in code-projects Online Application System for Admission 1.0. Impacted is an unknown function of the file /enrollment/database/oas.sql. Performing a manipulation results in insecure storage of sensitive information. The attack is pos…
-
Medium 5.3
ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Sensitive Information Exposure
The ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.12 via the syncedData function. This m…
-
Medium 5.5
A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Tahoe 26.3. An ap…
-
Medium 6.5
Cleartext password storage in Birtech Information Technologies' Sensaway
Insecure Storage of Sensitive Information vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Senseway allows Retrieve Embedded Sensitive Data. This issue affects Senseway: through 09022026. NOTE: Because the product was developed us…
-
Medium 5.3
wlc may leak API keys due to an insecure API key configuration
wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be leaked to dif…
-
Medium 6.8
Reolink Video Doorbell WiFi DB_566128M5MP_W allows root shell access through an unsecured UART/serial console. An attac…
-
Medium 5.3
Newforma Info Exchange (NIX) insufficiently protected credentials
Newforma Info Exchange (NIX) stores credentials used to configure NPCS in 'HKLM\Software\WOW6432Node\Newforma\<version>\Credentials'. The credentials are encrypted but the encryption key is stored in the same registry location. Authenticated users can access …
-
Medium 6.9
Vasion Print (formerly PrinterLogic) Insecure Inter-Process Communication Allows Local Session Hijacking
Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 1.0.735 and Application versions prior to 20.0.1330 (macOS/Linux client deployments) contain a vulnerability in the local inter-process communication (IPC) mechanism. The software s…
-
Medium 4.0
The issue was addressed with improved handling of caches. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and i…
-
Medium 5.1
Calix GigaCenter ONT firmware - Sensitive Information Disclosure
Insecure Storage of Sensitive Information vulnerability in Calix GigaCenter ONT (Quantenna SoC modules) allows admin access to the web interface.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE.
-
Medium 6.5
Multiple products provided by iND Co.,Ltd contain an insecure storage of sensitive information vulnerability. If exploi…
-
Medium 6.8
Incorrect access control in the EEPROM component of Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.…
-
Medium 5.3
An issue was discovered in 4C Strategies Exonaut 21.6. Passwords, stored in the database, are hashed without a salt.
-
Medium 6.0
Sensitive Credential Information stored insecurely in System Database
A vulnerability was discovered in the storage policy for certain sets of sensitive credential information in the HPE Telco Network Function Virtual Orchestrator. Successful Exploitation could lead to unauthorized parties gaining access to sensitive system inf…
-
Medium 6.5
An issue in Grandstream UCM6510 v.1.0.20.52 and before allows a remote attacker to obtain sensitive information via the…
-
Medium 5.6
Insecure Key & Secret Management vulnerability in SAP GUI for Windows
The GuiXT application, which is integrated with SAP GUI for Windows, uses obfuscation algorithms instead of secure symmetric ciphers for storing the credentials of an RFC user on the client PC. This leads to a high impact on confidentiality because any attack…
-
Medium 4.0
The TeleMessage service through 2025-05-05 implements authentication through a long-lived credential (e.g., not a token…
-
Medium 6.5
Serialization / Deserialization of configuration data
Serialized configuration information may be disclosed during device commissioning while using ASPECT's configuration toolsetThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
-
Medium 4.2
CWE-922: Insecure Storage of Sensitive Information vulnerability exists that could potentially lead to unauthorized acc…
-
Medium 6.8
Insecure storage of sensitive information in NTFS Tool
Insecure information storage vulnerability in NTFS Tools version 3.5.1. Exploitation of this vulnerability could allow an attacker to know the application password, stored in /Users/user/Library/Application Support/ntfs-tool/config.json.
-
Medium 5.5
Liteos-A has an insecure storage of sensitive information vulnerability
in OpenHarmony v5.0.2 and prior versions allow a local attacker cause information leak through out-of-bounds read bypass permission check.
-
Medium 6.3
Insecure storage of connection strings in FRS
The connection string visible to users with access to FRSCore database on Foreseer Reporting Software (FRS) VM, this string can be used for gaining administrative access to the 4crXref database. This vulnerability has been resolved in the latest version 1.5.1…
-
Medium 5.5
This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.2. A…
-
Medium 5.5
This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.3 and iPadOS 1…
-
Medium 5.5
This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.3. A…
-
Medium 5.5
This issue was addressed through improved state management. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequ…
-
Medium 6.5
Token stored in session storage
Xerox Workplace Suite stores tokens in session storage, which may expose them to potential access if a user's session is compromised. The patch for this vulnerability will be included in a future release of Workplace Suite, and customers will be notified thr…
-
Medium 6.5
Incorrect access control in BYD QIN PLUS DM-i Dilink OS 3.0_13.1.7.2204050.1 allows unauthorized attackers to access sy…
-
Medium 6.5
An issue in Baidu (China) Co Ltd Baidu Input Method (iOS version) v12.6.13 allows attackers to access user information …