CWE-922: Insecure Storage of Sensitive Information
The product stores sensitive information without properly limiting read or write access by unauthorized actors.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- ibm cloud pak for multicloud managementIBM Cloud Pak for Multicloud Management prior to 2.3 allows web pages to be stored locally which...4.0 Medium
- ibm qradar user behavior analytics, qradar siem +1 moreIBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 allows web pages to be stored locally...4.0 Medium
- apache tapestryBypass of the fix for CVE-2019-01959.8 Critical
- westerndigital armorlockThe iOS and macOS apps before 1.4.1 for the Western Digital G-Technology ArmorLock NVMe SSD store...6.5 Medium
- ibm cloud apm, cloud application performance management +1 moreThe IBM Application Performance Monitoring UI (IBM Cloud APM 8.1.4) allows web pages to be stored...4.0 Medium
- fiberhome hg6245d firmwareAn issue was discovered on FiberHome HG6245D devices through RP2613. By default, there are no...9.8 Critical
- solarwinds serv-uIn SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files ...7.1 High
- jetbrains teamcityIn JetBrains TeamCity before 2020.2, an ECR token could be exposed in a build's parameters.7.5 High
- mantisbtMantisBT Insecure Storage in manage_proj_edit_page.php4.3 Medium
- ibm planning analyticsIBM Planning Analytics 2.0 allows web pages to be stored locally which can be read by another...4.0 Medium
- hcl software workload automationIBM Workload Automation 9.5 stores the server path in URLs that could aid in further attacks...4.3 Medium
- hcl software workload automationIBM Workload Automation 9.5 stores sensitive information in HTML comments that could aid in...4.3 Medium
- huawei te mobileThere is an information disclosure vulnerability in TE Mobile software versions V600R006C10...4.4 Medium
- tangro business workflowAn issue was discovered in tangro Business Workflow before 1.18.1. No (or broken) access control...4.3 Medium
- ibm financial transaction manager, financial transaction manager for multiplatform +1 moreIBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 allows web pages to...4.0 Medium
- schedmd slurm, debian linux +1 moreSlurm before 19.05.8 and 20.x before 20.02.6 exposes Sensitive Information to an Unauthorized...3.7 Low
- harman hermesA misconfiguration in the debug interface in Mercedes-Benz HERMES 1.5 allows an attacker with...2.4 Low
- harman hermesA misconfiguration in the debug interface in Mercedes-Benz HERMES 1 allows an attacker with...2.4 Low
- harman hermesAn authentication bypass in the debug interface in Mercedes-Benz HERMES 1.5 allows an attacker...4.6 Medium
- harman hermesAn authentication bypass in the debug interface in Mercedes-Benz HERMES 2.1 allows an attacker...4.6 Medium
- ibm infosphere information serverIBM InfoSphere Information Server 11.7 stores sensitive information in the browser's history that...4.0 Medium
- ibm maximo spatial asset managementIBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 allows web pages to be...4.0 Medium
- intel bmc firmware, nvidia dgx servers +1 moreNVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contains a...4.9 Medium
- sectona spectraSectona Spectra before 3.4.0 has a vulnerable SOAP API endpoint that leaks sensitive information...7.5 High
- apple ipados, itunes, safari +4 more +6 moreAn information disclosure issue existed in the handling of the Storage Access API. This issue was...4.3 Medium
- apple ipados, macos, tvos +4 more +6 moreThis issue was resolved by replacing device names with a random identifier. This issue is fixed...2.4 Low
- apple swift, swift for ubuntu +1 moreThis issue was addresses by updating incorrect URLSession file descriptors management logic to...5.5 Medium
- apache kylinAuthentication bypass in Apache Kylin5.3 Medium
- google androidIn constructImportFailureNotification of NotificationImportExportListener.java, there is a...3.3 Low
- cpanelIn cPanel before 88.0.3, an insecure SRS secret is used on a templated VM (SEC-552).7.5 High
- ibm business automation content analyzer on cloudIBM Business Automation Content Analyzer on Cloud 1.0 does not set the secure attribute on...4.3 Medium
- gradle enterpriseAn issue was discovered in Gradle Enterprise 2017.1 - 2020.2.4. Unrestricted access to a high...7.5 High
- ibm tivoli business service managerIBM Tivoli Business Service Manager 6.2.0.0 - 6.2.0.2 IF 1 allows web pages to be stored locally...4.0 Medium
- ibm security guardium insightsIBM Security Guardium Insights 2.0.1 stores sensitive information in URL parameters. This may...3.7 Low
- ibm security guardium insightsIBM Security Guardium Insights 2.0.1 allows web pages to be stored locally which can be read by...4.3 Medium
- ibm guardium data encryption, security guardium data encryption +1 moreIBM Security Guardium Data Encryption (GDE) 3.0.0.2 allows web pages to be stored locally which...4.0 Medium
- microsoft outlook, 365 apps, 365 apps for enterprise +5 more +7 moreMicrosoft Outlook Information Disclosure Vulnerability5.5 Medium
- ibm verify gateway (ivg), verify gateway +1 moreIBM Verify Gateway (IVG) 1.0.0 and 1.0.1 contains sensitive information in leftover debug code...4.0 Medium
- abb device library wizardABB Device Library Wizard Information Disclosure Vulnerability7.8 High
- abb advabuild, central licensing system, compact hmi +15 more +17 moreABB Central Licensing System - Information disclosure9.8 Critical
- visam vbase editor, vbase web-remote module, vbase web-remote +2 moreVISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow an unauthenticated...7.5 High
- easybuild project easybuild, easybuilders easybuild-framework +1 moreGitHub personal access token leaking into temporary EasyBuild (debug) logs7.7 High
- ibm tivoli netcool/omnibus, tivoli netcool\/omnibus +1 moreIBM Tivoli Netcool/OMNIbus_GUI 8.1.0 allows web pages to be stored locally which can be read by...2.4 Low
- totolink a3002ru firmwareAdmin Password returned in password.htm6.5 Medium
- gitlabUnauthorized Access to the Container Registry of other groups was discovered in GitLab Enterprise...4.3 Medium
- mfscripts yetishareMFScripts YetiShare v3.5.2 through v4.5.4 places sensitive information in the Referer header. If...7.5 High
- google chrome, opensuse backports sle +1 moreIncorrect security UI in full screen mode in Google Chrome prior to 78.0.3904.70 allowed a remote...4.3 Medium
- google chrome, opensuse backports sle +1 moreIncorrect security UI in full screen mode in Google Chrome prior to 78.0.3904.70 allowed a remote...4.3 Medium
- ibm maximo anywhereIBM Maximo Anywhere 7.6.0, 7.6.1, 7.6.2, and 7.6.3 does not have device root detection which...2.4 Low
- ibm security directory serverIBM Security Directory Server 6.4.0 discloses sensitive information to unauthorized users. The...5.3 Medium
- Show moreLoading…