Weakness (CWE)
CWE-922: Insecure Storage of Sensitive Information
The product stores sensitive information without properly limiting read or write access by unauthorized actors.
Source: MITRE CWE-922
304 results · Feed
-
Medium 4.0
The issue was addressed with improved handling of caches. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and i…
-
Critical 9.1
Some "Stored Value" Unattended Payment Solutions of KioSoft use vulnerable NFC cards. Attackers could potentially use t…
-
Medium 5.1
Calix GigaCenter ONT firmware - Sensitive Information Disclosure
Insecure Storage of Sensitive Information vulnerability in Calix GigaCenter ONT (Quantenna SoC modules) allows admin access to the web interface.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE.
-
Medium 6.5
Multiple products provided by iND Co.,Ltd contain an insecure storage of sensitive information vulnerability. If exploi…
-
Medium 6.8
Incorrect access control in the EEPROM component of Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.…
-
Medium 5.3
An issue was discovered in 4C Strategies Exonaut 21.6. Passwords, stored in the database, are hashed without a salt.
-
Medium 6.0
Sensitive Credential Information stored insecurely in System Database
A vulnerability was discovered in the storage policy for certain sets of sensitive credential information in the HPE Telco Network Function Virtual Orchestrator. Successful Exploitation could lead to unauthorized parties gaining access to sensitive system inf…
-
Medium 6.5
An issue in Grandstream UCM6510 v.1.0.20.52 and before allows a remote attacker to obtain sensitive information via the…
-
High 8.8
Insecure Permissions vulnerability in the Local Storage in Alteryx Server 2023.1.1.460 allows remote attackers to obtai…
-
Medium 5.6
Insecure Key & Secret Management vulnerability in SAP GUI for Windows
The GuiXT application, which is integrated with SAP GUI for Windows, uses obfuscation algorithms instead of secure symmetric ciphers for storing the credentials of an RFC user on the client PC. This leads to a high impact on confidentiality because any attack…
-
High 7.7
Exposure of Sensitive Information to an Unauthorized User in HPE Aruba Networking Private 5G Core
A vulnerability in the APIs of HPE Aruba Networking Private 5G Core could potentially expose sensitive information to unauthorized users. A successful exploitation could allow an attacker to iteratively navigate through the filesystem and ultimately download …
-
Medium 4.0
The TeleMessage service through 2025-05-05 implements authentication through a long-lived credential (e.g., not a token…
-
Medium 6.5
Serialization / Deserialization of configuration data
Serialized configuration information may be disclosed during device commissioning while using ASPECT's configuration toolsetThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
-
High 7.7
Rhymix v2.1.22 was discovered to contain an arbitrary file deletion vulnerability via the procFileAdminEditImage method…
-
High 8.2
Use of weak credentials in the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated attacker to authenticate to the teln…
-
Medium 4.2
CWE-922: Insecure Storage of Sensitive Information vulnerability exists that could potentially lead to unauthorized acc…
-
High 7.1
Windows Kerberos Security Feature Bypass Vulnerability
Insecure storage of sensitive information in Windows Kerberos allows an authorized attacker to bypass a security feature locally.
-
Medium 6.8
Insecure storage of sensitive information in NTFS Tool
Insecure information storage vulnerability in NTFS Tools version 3.5.1. Exploitation of this vulnerability could allow an attacker to know the application password, stored in /Users/user/Library/Application Support/ntfs-tool/config.json.
-
High 8.2
Hive: exposure of vcenter credentials via clusterprovision in hive / mce / acm
A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access t…
-
Low 3.3
Foreman: disclosure of executed commands and outputs in foreman / red hat satellite
A flaw was found in Foreman/Red Hat Satellite. Improper file permissions allow low-privileged OS users to monitor and access temporary files under /var/tmp, exposing sensitive command outputs, such as /etc/shadow. This issue can lead to information disclosure…
-
Medium 5.5
Liteos-A has an insecure storage of sensitive information vulnerability
in OpenHarmony v5.0.2 and prior versions allow a local attacker cause information leak through out-of-bounds read bypass permission check.
-
Medium 6.3
Insecure storage of connection strings in FRS
The connection string visible to users with access to FRSCore database on Foreseer Reporting Software (FRS) VM, this string can be used for gaining administrative access to the 4crXref database. This vulnerability has been resolved in the latest version 1.5.1…
-
High 7.5
Export All Posts, Products, Orders, Refunds & Users <= 2.9.3 - Information Disclosure Through Unprotected Directory
The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.3 via the exports directory. This makes it possible for unauthenticated attackers to extract…
-
High 7.2
RuoYi allowed unauthorized attackers to view the session ID of the admin in the system monitoring
RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can allow attackers to impersonate Admin users via using a crafted cookie.
-
Medium 5.5
This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.2. A…
-
Medium 5.5
This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.3 and iPadOS 1…
-
Medium 5.5
This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.3. A…
-
Medium 5.5
This issue was addressed through improved state management. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequ…
-
Medium 6.5
Token stored in session storage
Xerox Workplace Suite stores tokens in session storage, which may expose them to potential access if a user's session is compromised. The patch for this vulnerability will be included in a future release of Workplace Suite, and customers will be notified thr…
-
High 7.5
An issue in CMSimple v.5.16 allows a remote attacker to obtain sensitive information via a crafted script to the valida…
-
Medium 6.5
Incorrect access control in BYD QIN PLUS DM-i Dilink OS 3.0_13.1.7.2204050.1 allows unauthorized attackers to access sy…
-
Medium 6.5
An issue in Baidu (China) Co Ltd Baidu Input Method (iOS version) v12.6.13 allows attackers to access user information …
-
Medium 6.5
An issue in Hangzhou Bobo Technology Co Ltd UU Game Booster iOS 10.6.13 allows attackers to access sensitive user infor…
-
Medium 6.5
An issue in Beijing Baidu Netcom Science & Technology Co Ltd Haokan Video iOS 7.70.0 allows attackers to access sensiti…
-
Medium 6.5
An issue in Shenzhen Intellirocks Tech Co. Ltd Govee Home iOS 6.5.01 allows attackers to access sensitive user informat…
-
Medium 6.5
An issue in Shanghai Xuan Ting Entertainment Information & Technology Co., Ltd Qidian Reader iOS 5.9.384 allows attacke…
-
Medium 6.5
An issue in Beijing Baidu Netcom Science & Technology Co Ltd Baidu Lite app (iOS version) 6.40.0 allows attackers to ac…
-
Medium 6.5
An issue in KuGou Technology Co., Ltd KuGou Concept iOS 4.0.61 allows attackers to access sensitive user information vi…
-
Medium 6.5
An issue in Che Hao Duo Used Automobile Agency (Beijing) Co., Ltd Guazi Used Car iOS 10.15.1 allows attackers to access…
-
Medium 6.5
An issue in Mashang Consumer Finance Co., Ltd Anyihua iOS 3.6.2 allows attackers to access sensitive user information v…