Weakness (CWE)
CWE-922: Insecure Storage of Sensitive Information
The product stores sensitive information without properly limiting read or write access by unauthorized actors.
Source: MITRE CWE-922
171 results · Clear filters · Feed
-
Medium 6.0
In modem driver, there is a possible system crash due to improper input validation. This could lead to local informatio…
-
Medium 5.5
In asn1_ec_pkey_parse of asn1_common.c, there is a possible OOB read due to a missing null check. This could lead to lo…
-
Medium 4.4
In flashc, there is a possible information disclosure due to an uncaught exception. This could lead to local informatio…
-
Medium 6.5
Insecure storage of LDAP passwords in the authentication functionality of AVSystem Unified Management Platform (UMP) 23…
-
Medium 5.3
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 1…
-
Medium 5.5
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 17.4 and…
-
Medium 6.5
This issue was addressed through improved state management. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sono…
-
Medium 4.3
Huks has an insecure storage of sensitive information vulnerability
in OpenHarmony v3.2.4 and prior versions allow a local attacker cause sensitive information leak through insecure storage.
-
Medium 5.3
An issue in uverif v.2.0 allows a remote attacker to obtain sensitive information.
-
Medium 5.5
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in watchOS 10.1…
-
Medium 6.2
This issue was addressed with improved state management. This issue is fixed in tvOS 17.1, watchOS 10.1, macOS Sonoma 1…
-
Medium 4.3
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ve…
-
Medium 5.9
InfiniteWP Client <= 1.12.3 - Unauthenticated Sensitive Information Exposure
The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.12.3 via the multi-call backup option. This makes it possible for unauthenticated attackers to extract sensitive data from a tem…
-
Medium 5.5
In multiple files, there is a possible way that trimmed content could be included in PDF output due to a logic error in…
-
Medium 6.3
bhyveload(8) host file access
`bhyveload -h <host-path>` may be used to grant loader access to the <host-path> directory tree on the host. Affected versions of bhyveload(8) do not make any attempt to restrict loader's access to <host-path>, allowing the loader to read any file the host us…
-
Medium 5.3
A hidden interface in Motorola CX2L Router firmware v1.0.1 leaks information regarding the SystemWizardStatus component…
-
Medium 4.6
Insecure Permissiosn vulnerability in TP Link TC70 and C200 WIFI Camera v.3 firmware v.1.3.4 and fixed in v.1.3.11 allo…
-
Medium 6.8
Aladdin Connect Android Application Insecure Storage
Users’ product account authentication data was stored in clear text in The Genie Company Aladdin Connect Mobile Application Version 5.65 Build 2075 (and below) on Android Devices. This allows the attacker, with access to the android device, to potentially ret…
-
Medium 6.2CVE-2023-45184 Public exploit
IBM i Access Client Solutions
IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 could allow an attacker to obtain a decryption key due to improper authority checks. IBM X-Force ID: 268270.
-
Medium 4.0
Information leak in nodejs-firestore
A potential logging of the firestore key via logging within nodejs-firestore exists - Developers who were logging objects through this._settings would be logging the firestore key as well potentially exposing it to anyone with logs read access. We recommend u…
-
Medium 4.3CVE-2023-41723 EPSS 13%
A vulnerability in Veeam ONE allows a user with the Veeam ONE Read-Only User role to view the Dashboard Schedule. Note:…
-
Medium 4.3
VMware vCenter Server Partial Information Disclosure Vulnerability
vCenter Server contains a partial information disclosure vulnerability. A malicious actor with non-administrative privileges to vCenter Server may leverage this issue to access unauthorized data.
-
Medium 6.5
Exposed Session Variable in Wing FTP Server <= 7.2.0
Insecure storage of sensitive information in Wing FTP Server (User Web Client) allows information elicitation.This issue affects Wing FTP Server: <= 7.2.0.
-
Medium 5.1
IBM Sterling Secure Proxy information disclosure
IBM Sterling Secure Proxy 6.0.3 and 6.1.0 could allow a local user with specific information about the system to obtain privileged information due to inadequate memory clearing during operations. IBM X-Force ID: 252139.
-
Medium 6.1
Reflected Cross Site Scripting in EdgeConnect SD-WAN Orchestrator Web Management Interface
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit the…
-
Medium 5.1
HCL Launch is vulnerable to sensitive information disclosure
HCL Launch could disclose sensitive information if a manual edit of a configuration file has been performed.
-
Medium 6.0
Insecure storage of sensitive information in the Intel(R) DCM software before version 5.1 may allow an authenticated us…
-
Medium 5.5
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, macO…
-
Medium 5.5
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventur…
-
Medium 5.1
IBM UrbanCode Deploy (UCD) information disclosure
IBM UrbanCode Deploy (UCD) versions up to 7.3.0.1 could disclose sensitive password information during a manual edit of the agentrelay.properties file. IBM X-Force ID: 240148.
-
Medium 5.4
Information Disclosure vulnerability in My Control System (on-premise)
Insecure Storage of Sensitive Information vulnerability in ABB My Control System (on-premise) allows an attacker who successfully exploited this vulnerability to gain access to the secure application data or take control of the application. Of the services th…
-
Medium 5.5
A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Ventura 13.2.1. A…
-
Medium 6.0
Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard Extensions may al…
-
Medium 4.6
Insecure Storage of Sensitive Information in publify/publify
Insecure Storage of Sensitive Information in GitHub repository publify/publify prior to 9.2.10.
-
Medium 5.8
Nextcloud Deck card vulnerable to data leak to unauthorized users via reference preview cache
Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. When getting the reference preview for Deck cards the user has no access to, unauthorized user could eventually get the cached da…
-
Medium 6.5
During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a bypass that lea…
-
Medium 5.3
An issue existed with the file paths used to store website data. The issue was resolved by improving how website data i…
-
Medium 4.0
IBM Sterling Partner Engagement Manager information disclosure
IBM Sterling Partner Engagement Manager 2.0 allows encrypted storage of client data to be stored locally which can be read by another user on the system. IBM X-Force ID: 230424.
-
Medium 6.5
Brocade Fabric OS Web Application services before Brocade Fabric v9.1.0, v9.0.1e, v8.2.3c, v7.4.2j store server and use…
-
Medium 6.5
Veritas System Recovery (VSR) versions 18 and 21 store a network destination password in the Windows registry during co…