CWE-922: Insecure Storage of Sensitive Information
The product stores sensitive information without properly limiting read or write access by unauthorized actors.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- ezsystems ezplatform-graphqlezplatform-graphql GraphQL queries can expose password hashes7.5 High
- apple macos, iphone os +1 moreThis issue was addressed with improved data protection. This issue is fixed in iOS 16, macOS...2.4 Low
- mozilla firefoxLogins saved by Firefox should be managed by the Password Manager component which uses encryption...3.3 Low
- brocade fabric os, broadcom fabric operating system +1 moreBrocade Fabric OS Web Application services before Brocade Fabric v9.1.0, v9.0.1e, v8.2.3c, v7.4...6.5 Medium
- veritas system recoveryVeritas System Recovery (VSR) versions 18 and 21 store a network destination password in the...6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreDuring iframe navigation, certain pages did not have their FeaturePolicy fully initialized...6.5 Medium
- torguard vpnTorguard VPN 4.8, has a vulnerability that allows an attacker to dump sensitive information, such...7.5 High
- blink1 blink1control2Blink1Control2 uses weak password encryption7.5 High
- chatwoot, chatwoot chatwoot/chatwoot +1 moreInsecure Storage of Sensitive Information in chatwoot/chatwoot7.6 High
- broadcom sannavIn Brocade SANnav before Brocade SANnav v2.2.0.2 and Brocade SANnav2.1.1.8, encoded scp-server...7.5 High
- broadcom sannavBrocade SANnav before Brocade SANvav v. 2.2.0.2 and Brocade SANanv v.2.1.1.8 logs the Brocade...6.5 Medium
- samsung internetImproper auto-fill algorithm in Samsung Internet prior to version 17.0.1.69 allows physical...4.1 Medium
- flightradar24 flight trackerAn issue was discovered in FlightRadar24 v8.9.0, v8.10.0, v8.10.2, v8.10.3, v8.10.4 for Android,...5.5 Medium
- polonel polonel/trudesk, trudesk project trudesk +1 moreSensitive Data Exposure Due To Insecure Storage Of Profile Image in polonel/trudesk8.2 High
- strapiInsecure password handling vulnerability in Strapi7.5 High
- sophos authenticator, intercept x for mobile (android), intercept x +1 more +3 moreAn insecure data storage vulnerability allows a physical attacker with root privileges to...3.9 Low
- mcafee agent, mcafee,llc mcafee agent +1 moreImproper Verification of Cryptographic Signature by McAfee Agent6.1 Medium
- philips gemini 16 slice, gemini dual, gemini gxl 10 slice +19 more +21 morePhilips Gemini PET/CT Storage of Sensitive Data in a Mechanism Without Access Control2.4 Low
- smartbear swagger uiSpoofing attack in swagger-ui4.3 Medium
- chocobozzz chocobozzz/peertube, framasoft peertube +1 moreInsecure Storage of Sensitive Information in chocobozzz/peertube7.6 High
- jetbrains teamcityIn JetBrains TeamCity before 2021.2.3, environment variables of the "password" type could be...7.5 High
- microweber, microweber microweber/microweber +1 moreInsecure Storage of Sensitive Information in microweber/microweber9.1 Critical
- ivanti workspace controlA insecure storage of sensitive information vulnerability exists in Ivanti Workspace Control ...5.5 Medium
- apple macos, mac os x +1 moreAn issue existed in the storage of sensitive tokens. This issue was addressed by placing the...5.5 Medium
- samsung syncthru web serviceThe SyncThru Web Service on Samsung SCX-6x55X printers allows an attacker to gain access to a...7.5 High
- samsung contactsInsecure storage of device information in Contacts prior to version 12.7.05.24 allows attacker to...4.0 Medium
- samsung dialer, samsung mobile samsungdialer +1 moreInsecure storage of device information in Samsung Dialer prior to version 12.7.05.24 allows...4.0 Medium
- samsung smart capture, samsung mobile capture +1 moreInsecure storage of sensitive information vulnerability in Smart Capture prior to version 4.8.02...5.3 Medium
- xorux lpar2rrd, stor2rrd +1 morelpar2rrd is a hardcoded system account in XoruX LPAR2RRD and STOR2RRD before 7.30.9.8 Critical
- netapp ontap system managerSystem Manager 9.x versions 9.7 and higher prior to 9.7P16, 9.8P7 and 9.9.1P2 are susceptible to...5.5 Medium
- aveva edge, ibm edge application manager +1 moreIBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the...4.0 Medium
- aveva edge, ibm edge application manager +1 moreIBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the...4.0 Medium
- aveva edge, ibm edge application manager +1 moreIBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the...4.0 Medium
- qnap qunetswitch, qnap systems inc. qsw-m2116p-2t2s, qnap qsw-m2116p-2t2s firmware +2 moreInsufficiently Protected Credentials Vulnerability in QSW-M2116P-2T2S and QuNetSwitch9.6 Critical
- netmodule router softwareCertain NetModule devices have Insecure Password Handling (cleartext or reversible encryption),...7.5 High
- miniorange samlSensitive Data Exposure in miniorange_saml7.5 High
- wal-g project wal-gImproper use of cryptographic key in wal-g7.5 High
- cpanelIn cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584).5.5 Medium
- google androidIn multiple functions of libl3oemcrypto.cpp, there is a possible weakness in the existing...5.5 Medium
- dlink dir-3040 firmwareAn information disclosure vulnerability exists in the Syslog functionality of D-LINK DIR-3040 1...6.5 Medium
- mediawikiAn issue was discovered in the CentralAuth extension in MediaWiki through 1.36. The Special...4.3 Medium
- citrix cloud connectorCitrix Cloud Connector before 6.31.0.62192 suffers from insecure storage of sensitive information...7.5 High
- qnap myqnapcloud linkInsecure Storage of Sensitive Information in myQNAPcloud Link6.0 Medium
- samsung gear s, samsung mobile gear s plugin +1 moreInformation exposure vulnerability in Gear S Plugin prior to version 2.2.05.20122441 allows...6.5 Medium
- samsung smartthings, smartthings firmware +1 moreInformation Exposure vulnerability in SmartThings prior to version 1.7.64.21 allows attacker to...3.3 Low
- samsung notesInformation Exposure vulnerability in Samsung Notes prior to version 4.2.04.27 allows attacker to...3.3 Low
- ibm qradar analyst workflow, security qradar analyst workflow +1 moreIBM QRadar Analyst Workflow App 1.0 through 1.18.0 for IBM QRadar SIEM allows web pages to be...4.0 Medium
- ibm datapower gatewayIBM DataPower Gateway 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.14 stores...3.7 Low
- ibm security verify access, application gateway +1 moreIBM Security Verify Access 20.07 allows web pages to be stored locally which can be read by...4.0 Medium
- nagios fusionIncorrect Access Control in Nagios Fusion 4.1.8 and earlier allows low-privileged authenticated...6.5 Medium
- Show moreLoading…