Weakness (CWE)
CWE-922: Insecure Storage of Sensitive Information
The product stores sensitive information without properly limiting read or write access by unauthorized actors.
Source: MITRE CWE-922
304 results · Feed
-
High 7.3
A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected ap…
-
Medium 6.5
Exposed Session Variable in Wing FTP Server <= 7.2.0
Insecure storage of sensitive information in Wing FTP Server (User Web Client) allows information elicitation.This issue affects Wing FTP Server: <= 7.2.0.
-
Medium 5.1
IBM Sterling Secure Proxy information disclosure
IBM Sterling Secure Proxy 6.0.3 and 6.1.0 could allow a local user with specific information about the system to obtain privileged information due to inadequate memory clearing during operations. IBM X-Force ID: 252139.
-
Medium 6.1
Reflected Cross Site Scripting in EdgeConnect SD-WAN Orchestrator Web Management Interface
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit the…
-
Unscored —
ELECOM wireless LAN routers are vulnerable to sensitive information exposure, which allows a network-adjacent unauthori…
-
Medium 5.1
HCL Launch is vulnerable to sensitive information disclosure
HCL Launch could disclose sensitive information if a manual edit of a configuration file has been performed.
-
Unscored —
This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 16.5 and iPadOS 1…
-
Low 3.2
Default permissions for a properties file were too permissive. Local system users could read potentially sensitive info…
-
High 7.8
An issue found in Blue Light Filter v.1.5.5 for Android allows unauthorized apps to cause escalation of privilege attac…
-
High 7.8
An issue found in Twilight v.13.3 for Android allows unauthorized apps to cause escalation of privilege attacks by mani…
-
Critical 9.8
The Call Blocker application 6.6.3 for Android allows unauthorized applications to use exposed components to delete dat…
-
High 7.5
Storage of Sensitive Data in a Mechanism without Access Control in francoisjacquet/rosariosis
Storage of Sensitive Data in a Mechanism without Access Control in GitHub repository francoisjacquet/rosariosis prior to 11.0.
-
Medium 6.0
Insecure storage of sensitive information in the Intel(R) DCM software before version 5.1 may allow an authenticated us…
-
High 8.2
Insecure storage of sensitive information in the Intel(R) DCM software before version 5.1 may allow an authenticated us…
-
Medium 5.5
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, macO…
-
Medium 5.5
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventur…
-
Low 3.3
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 15.7.4 a…
-
Medium 5.1
IBM UrbanCode Deploy (UCD) information disclosure
IBM UrbanCode Deploy (UCD) versions up to 7.3.0.1 could disclose sensitive password information during a manual edit of the agentrelay.properties file. IBM X-Force ID: 240148.
-
Low 3.7
WordPress Freesoul Deactivate Plugins – Plugin manager and cleanup Plugin <= 1.9.4.0 is vulnerable to Sensitive Data Exposure
Insecure Storage of Sensitive Information vulnerability in Jose Mortellaro Freesoul Deactivate Plugins – Plugin manager and cleanup plugin <= 1.9.4.0 versions.
-
Medium 5.4
Information Disclosure vulnerability in My Control System (on-premise)
Insecure Storage of Sensitive Information vulnerability in ABB My Control System (on-premise) allows an attacker who successfully exploited this vulnerability to gain access to the secure application data or take control of the application. Of the services th…
-
Medium 5.5
A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Ventura 13.2.1. A…
-
Medium 6.0
Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard Extensions may al…
-
High 7.5
Incorrect Access Control issue discovered in KiteCMS 1.1 allows remote attackers to view sensitive information via path…
-
Medium 4.6
Insecure Storage of Sensitive Information in publify/publify
Insecure Storage of Sensitive Information in GitHub repository publify/publify prior to 9.2.10.
-
Medium 5.8
Nextcloud Deck card vulnerable to data leak to unauthorized users via reference preview cache
Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. When getting the reference preview for Deck cards the user has no access to, unauthorized user could eventually get the cached da…
-
Medium 6.5
During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a bypass that lea…
-
Medium 5.3
An issue existed with the file paths used to store website data. The issue was resolved by improving how website data i…
-
Medium 4.0
IBM Sterling Partner Engagement Manager information disclosure
IBM Sterling Partner Engagement Manager 2.0 allows encrypted storage of client data to be stored locally which can be read by another user on the system. IBM X-Force ID: 230424.
-
Low 3.3
Improper access control in the Intel(R) WAPI Security software for Windows 10/11 before version 22.2150.0.1 may allow a…
-
High 7.5CVE-2022-41876 Public exploit
ezplatform-graphql GraphQL queries can expose password hashes
ezplatform-graphql is a GraphQL server implementation for Ibexa DXP and Ibexa Open Source. Versions prior to 2.3.12 and 1.0.13 are subject to Insecure Storage of Sensitive Information. Unauthenticated GraphQL queries for user accounts can expose password hash…
-
Low 2.4
This issue was addressed with improved data protection. This issue is fixed in iOS 16, macOS Ventura 13. A user with ph…
-
Medium 6.5
Brocade Fabric OS Web Application services before Brocade Fabric v9.1.0, v9.0.1e, v8.2.3c, v7.4.2j store server and use…
-
Medium 6.5
Veritas System Recovery (VSR) versions 18 and 21 store a network destination password in the Windows registry during co…
-
High 7.6
Insecure Storage of Sensitive Information in chatwoot/chatwoot
Insecure Storage of Sensitive Information in GitHub repository chatwoot/chatwoot prior to 2.6.0.
-
High 8.2
Sensitive Data Exposure Due To Insecure Storage Of Profile Image in polonel/trudesk
Sensitive Data Exposure Due To Insecure Storage Of Profile Image in GitHub repository polonel/trudesk prior to v1.2.1.
-
High 7.5
Insecure password handling vulnerability in Strapi
Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an attacker to access a victim's HTTP request, get the victim's cookie, perform a base64 decode on the victim's cookie, and obta…
-
Medium 6.1CVE-2022-1257 Public exploit
Improper Verification of Cryptographic Signature by McAfee Agent
Insecure storage of sensitive information vulnerability in MA for Linux, macOS, and Windows prior to 5.7.6 allows a local user to gain access to sensitive information through storage in ma.db. The sensitive information has been moved to encrypted database fil…
-
Medium 4.3
Spoofing attack in swagger-ui
Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was originally claimed to be r…
-
High 7.6
Insecure Storage of Sensitive Information in chocobozzz/peertube
Insecure Storage of Sensitive Information in GitHub repository chocobozzz/peertube prior to 4.1.1.
-
Critical 9.1
Insecure Storage of Sensitive Information in microweber/microweber
Insecure Storage of Sensitive Information in GitHub repository microweber/microweber prior to 1.3.