Weakness (CWE)
CWE-922: Insecure Storage of Sensitive Information
The product stores sensitive information without properly limiting read or write access by unauthorized actors.
Source: MITRE CWE-922
304 results · Feed
-
Medium 5.9
Apache StreamPark: Information leakage vulnerability
In Streampark (version < 2.1.4), when a user logged in successfully, the Backend service would return "Authorization" as the front-end authentication credential. User can use this credential to request other users' information, including the administrator's u…
-
Medium 5.1
Symantec Privileged Access Manager Insecure Direct Object Reference vulnerability
The vulnerability allows a malicious low-privileged PAM user to access information about other PAM users and their group memberships.
-
Medium 6.2
In ensureFileColumns of MediaProvider.java, there is a possible disclosure of files owned by another user due to improp…
-
High 7.5
The Avalara for Salesforce CPQ app before 7.0 for Salesforce allows attackers to read an API key. NOTE: the current ver…
-
High 7.5
Advanced File Manager <= 5.2.4 - Sensitive Information Exposure via Directory Listing
The Advanced File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.4 via the 'fma_local_file_system' function. This makes it possible for unauthenticated attackers to extract sensitive data…
-
Medium 4.3
Secret file credentials stored unencrypted in rare cases by Plain Credentials Plugin
In rare cases Jenkins Plain Credentials Plugin 182.v468b_97b_9dcb_8 and earlier stores secret file credentials unencrypted (only Base64 encoded) on the Jenkins controller file system, where they can be viewed by users with access to the Jenkins controller fil…
-
Medium 4.3
Encoded session passwords on session storage for Virtual Fabric platforms
A vulnerability in the web interface in Brocade Fabric OS before v9.2.1, v9.2.0b, and v9.1.1d prints encoded session passwords on session storage for Virtual Fabric platforms. This could allow an authenticated user to view other users' session encoded passwor…
-
Low 3.9
udn News App - Insecure Data Storage
udn News Android APP stores the unencrypted user session in the local database when user log into the application. A malicious APP or an attacker with physical access to the Android device can retrieve this session and use it to log into the news APP and othe…
-
Medium 5.9
An issue in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers to access sensitive information in …
-
Medium 6.1
An issue in BAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE, AV-02IDR, AV-02IPD…
-
Medium 6.5
When browsing private tabs, some data related to location history or webpage thumbnails could be persisted incorrectly …
-
Medium 6.5
Elasticsearch Remote Cluster Search Cross Cluster API Key insufficient restrictions
It was identified that if a cross-cluster API key https://www.elastic.co/guide/en/elasticsearch/reference/8.14/security-api-create-cross-cluster-api-key.html#security-api-create-cross-cluster-api-key-request-body restricts search for a given index using the …
-
Medium 5.3
Advanced Contact form 7 DB <= 2.0.2 - Sensitive Information Exposure
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.2 via the wp-content/uploads/advanced-cf7-upload directory. This makes it possible for unauthenticated attackers to e…
-
Medium 4.3
Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.5.0 to 6.0.0, which may allow a user …
-
Medium 6.5
Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.0.0 to 5.15.0. If this vulnerability …
-
Medium 5.9
Netgear WNR614 JNR1010V2 N300-V1.1.0.54_1.0.1 does not properly set the HTTPOnly flag for cookies. This allows attacker…
-
High 7.5
FileOrganizer <= 1.0.7 - Sensitive Information Exposure via Directory Listing
The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.7 via the 'fileorganizer_ajax_handler' function. This makes it possible for unauthenticated a…
-
Medium 4.7
Sensitive Data Leakage in sklearn.feature_extraction.text.TfidfVectorizer in scikit-learn/scikit-learn
A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises from the unexpected storage of all tokens present in …
-
High 7.5
Keycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookie
A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR). Client-provided parameters were found to be included in plain text in the KC_RESTART cookie returned by the authorization server's HTTP response to a `request_uri` authorization re…
-
Low 3.3
Yubico YubiKey 5 Series before 5.7.0, Security Key Series before 5.7.0, YubiKey Bio Series before 5.6.4, and YubiKey 5 …
-
Medium 5.0
WordPress Defender Security plugin <= 3.3.2 - Broken Authentication vulnerability
Insecure Storage of Sensitive Information vulnerability in WPMU DEV Defender Security allows : Screen Temporary Files for Sensitive Information.This issue affects Defender Security: from n/a through 3.3.2.
-
Medium 4.3
Insecure Storage vulnerability in SAP BusinessObjects Business Intelligence Platform (Webservices)
SAP Business Objects Business Intelligence Platform is vulnerable to Insecure Storage as dynamic web pages are getting cached even after logging out. On successful exploitation, the attacker can see the sensitive information through cache and can open the pag…
-
Medium 5.5
This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Monterey 12.7.5…
-
Medium 5.3
A logic issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, macOS Monterey 1…
-
Medium 5.3
Shopping Cart & eCommerce Store <= 5.6.4 - Sensitive Information Exposure
The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.6.4 via the order report functionality. This makes it possible for unauthenticated attackers to extract sensitive …
-
Medium 4.4
BIG-IP NEXT CNF vulnerability
Exposure of Sensitive Information vulnerability exists in the GSLB container, which may allow an authenticated attacker with local access to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evalua…
-
Medium 5.3
Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.7.7 - Sensitive Information Exposure
The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.7.7 via the '/wp-content/uploads/wp_dndcf7_uploads/wpcf7-files' directory. This makes it pos…
-
Medium 5.5
An issue in LOGINT LoMag Inventory Management v1.0.20.120 and before allows a local attacker to obtain sensitive inform…
-
Low 3.5
An issue in CmsEasy v.7.7 and before allows a remote attacker to obtain sensitive information via the update function i…
-
High 7.5
An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to cause a Denial of Service (DoS) …
-
High 7.7
SQL Table names, column names, and SQL queries are collected in DR standby Supportsave
An information disclosure vulnerability exists in Brocade SANnav before v2.3.1 and v2.3.0a when Brocade SANnav instances are configured in disaster recovery mode. SQL Table names, column names, and SQL queries are collected in DR standby Supportsave. This cou…
-
Medium 6.8
Insecure backup
In Brocade SANnav before v2.3.1, and v2.3.0a, it is possible to back up the appliance from the web interface or the command line interface ("SSH"). The resulting backups are world-readable. A local attacker can recover backup files, restore them to a new mali…
-
Medium 5.3
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). Sup…
-
Medium 4.3
HCL DevOps Deploy / HCL Launch is vulnerable to sensitive information disclosure vulnerability
HCL DevOps Deploy / HCL Launch is vulnerable to sensitive information disclosure vulnerability due to insufficient obfuscation of sensitive values.
-
Medium 5.5
An issue was discovered in eProsima FastDDS v.2.14.0 and before, allows a local attacker to cause a denial of service (…
-
Medium 6.0
In modem driver, there is a possible system crash due to improper input validation. This could lead to local informatio…
-
Medium 5.5
In asn1_ec_pkey_parse of asn1_common.c, there is a possible OOB read due to a missing null check. This could lead to lo…
-
Medium 4.4
In flashc, there is a possible information disclosure due to an uncaught exception. This could lead to local informatio…
-
High 8.8
This issue was addressed through improved state management. This issue is fixed in macOS Sonoma 14.2. Remote Login sess…
-
Medium 6.5
Insecure storage of LDAP passwords in the authentication functionality of AVSystem Unified Management Platform (UMP) 23…