Weakness (CWE)
CWE-922: Insecure Storage of Sensitive Information
The product stores sensitive information without properly limiting read or write access by unauthorized actors.
Source: MITRE CWE-922
304 results · Feed
-
Low 3.5
Certain Cypress (and Broadcom) Wireless Combo chips, when a January 2021 firmware update is not present, allow memory r…
-
Medium 4.6
An issue was discovered on One2Track 2019-12-08 devices. Confidential information is needlessly stored on the smartwatc…
-
High 7.5
Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin <= 2.2.13 - Sensitive Invormation Disclosure via procstat Log
The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.13 via the exposed process stats file during the backup process. Th…
-
High 7.5
Yealink Meeting Server before V26.0.0.67 is vulnerable to sensitive data exposure in the server response via sending HT…
-
High 7.5
Yealink Meeting Server before V26.0.0.67 allows attackers to obtain static key information from a front-end JS file and…
-
Medium 5.7
Altai Technologies Ltd Altai IX500 Indoor 22 802.11ac Wave 2 AP After login, there are file reads in the background, an…
-
Medium 6.2
This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.1, m…
-
Medium 6.2
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.1, macOS So…
-
High 7.5
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14…
-
Medium 5.5
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15. An attacker may be able to view …
-
High 7.5
An issue existed in the parsing of URLs. This issue was addressed with improved input validation. This issue is fixed i…
-
Low 3.3
This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.1, m…
-
Medium 4.0
A logic issue was addressed with improved state management. This issue is fixed in iOS 18.1 and iPadOS 18.1. An app may…
-
Low 3.3
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ven…
-
Medium 4.3
OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserT…
-
Medium 5.8
HCL Sametime is impacted by misconfigured security related HTTP headers
HCL Sametime is impacted by misconfigured security related HTTP headers. It was identified that some HTTP headers were missing on web service responses. This will lead to less secure browser default treatment for the policies controlled by these headers.
-
Medium 4.7
Pam: libpam: libpam vulnerable to read hashed password
A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to exec…
-
Medium 5.5
Cisco ATA 190 Series Analog Telephone Adapter Muliplatform Firmware Information Disclosure Vulnerability
A vulnerability in the web-based management interface of Cisco ATA 190 Series Multiplatform Analog Telephone Adapter firmware could allow an authenticated, local attacker with low privileges to view passwords on an affected device. This vulnerability is due t…
-
Critical 9.9
rke's credentials are stored in the RKE1 Cluster state ConfigMap
When RKE provisions a cluster, it stores the cluster state in a configmap called `full-cluster-state` inside the `kube-system` namespace of the cluster itself. The information available in there allows non-admin users to escalate to admin.
-
Medium 5.3
Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: User Interface). Supported ve…
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
Medium 4.3
An issue in Ruijie NBR3000D-E Gateway allows a remote attacker to obtain sensitive information via the /tool/shell/post…
-
High 8.2
An issue in Plug n Play Camera com.wisdomcity.zwave 1.1.0 allows a remote attacker to obtain sensitive information via …
-
High 7.7
An issue was discovered in Atos Eviden SMC xScale before 1.6.6. During initialization of nodes, some configuration para…
-
Low 3.7
Missing default HTTP security headers affect HCL Nomad server on Domino
HCL Nomad server on Domino did not configure certain HTTP Security headers by default which could allow an attacker to obtain sensitive information via unspecified vectors.
-
Low 2.7
An issue was discovered in Infinera hiT 7300 5.60.50. Hidden functionality in the web interface allows a remote authent…
-
Medium 5.9CVE-2024-46635 Public exploit
An issue in the API endpoint /AccountMaster/GetCurrentUserInfo of INROAD before v202402060 allows attackers to access s…
-
Medium 4.3
goTenna Pro ATAK Plugin Insecure Storage of Sensitive Information
In the goTenna Pro ATAK Plugin application, the encryption keys are stored along with a static IV on the device. This allows for complete decryption of keys stored on the device. This allows an attacker to decrypt all encrypted broadcast communications based …
-
Medium 4.3
Insecure Storage of Sensitive Information in goTenna Pro
In the goTenna Pro App, the encryption keys are stored along with a static IV on the End User Device (EUD). This allows for complete decryption of keys stored on the EUD if physically compromised. This allows an attacker to decrypt all encrypted broadcast com…
-
High 7.5
Maven Archetype Plugin: Maven Archetype integration-test may package local settings into the published artifact, possibly containing credentials
Exposure of Sensitive Information to an Unauthorized Actor, Insecure Storage of Sensitive Information vulnerability in Maven Archetype Plugin. This issue affects Maven Archetype Plugin: from 3.2.1 before 3.3.0. Users are recommended to upgrade to version 3.3.…
-
High 7.5
A vulnerability has been discovered in all versions of Smartplay headunits, which are widely used in Suzuki and Toyota …
-
High 7.5CVE-2024-37728 Scanner template
Arbitrary File Read vulnerability in Xi'an Daxi Information Technology Co., Ltd OfficeWeb365 v.7.18.23.0 and v8.6.1.0 a…
-
Medium 6.5
Net Manager has an out-of-bounds read permission bypass vulnerability
in OpenHarmony v4.1.0 and prior versions allow a remote attacker cause information leak through out-of-bounds Read.
-
Medium 5.5
Background Task Manager has an out-of-bounds read permission bypass vulnerability
in OpenHarmony v4.0.0 and prior versions allow a local attacker cause information leak through out-of-bounds Read.
-
Medium 5.5
Ability Runtime has an out-of-bounds read permission bypass vulnerability
in OpenHarmony v4.0.0 and prior versions allow a local attacker cause information leak through out-of-bounds Read.
-
Medium 5.1
Safe-error attack on TLS 1.3 Protocol
An issue was discovered in wolfSSL before 5.7.0. A safe-error attack via Rowhammer, namely FAULT+PROBE, leads to ECDSA key disclosure. When WOLFSSL_CHECK_SIG_FAULTS is used in signing operations with private ECC keys, such as in server-side TLS connections, t…
-
Medium 5.5
An issue in Huizhi enterprise resource management system v.1.0 and before allows a local attacker to obtain sensitive i…
-
Critical 9.6
An information disclosure vulnerability in Ivanti ITSM on-prem and Neurons for ITSM versions 2023.4 and earlier allows …
-
Medium 4.6
A lock screen issue was addressed with improved state management. This issue is fixed in iOS 17.6 and iPadOS 17.6, watc…
-
Low 3.3
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.6. An app may be able to view a co…