CWE-922: Insecure Storage of Sensitive Information
The product stores sensitive information without properly limiting read or write access by unauthorized actors.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- ovaledgeOvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET...5.3 Medium
- ovaledgeOvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET...4.3 Medium
- hcl sametimeHCL Sametime is impacted by misconfigured security related HTTP headers5.8 Medium
- linux-pam, red hat enterprise linux 10, enterprise linux 7 +3 more +5 morePam: libpam: libpam vulnerable to read hashed password4.7 Medium
- cisco ata 191 firmware, ata 192 firmware, analog telephone adaptor (ata) software +2 moreCisco ATA 190 Series Analog Telephone Adapter Muliplatform Firmware Information Disclosure Vulnerability5.5 Medium
- oracle installed baseVulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: User...5.3 Medium
- oracle graalvm, graalvm for jdk, jdk +3 more +5 moreVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...3.7 Low
- ruijie nbr3000d-e firmwareAn issue in Ruijie NBR3000D-E Gateway allows a remote attacker to obtain sensitive information...7.5 High
- starvedia com.wisdomcity.zwaveAn issue in Plug n Play Camera com.wisdomcity.zwave 1.1.0 allows a remote attacker to obtain...8.2 High
- No product listedAn issue was discovered in Atos Eviden SMC xScale before 1.6.6. During initialization of nodes,...7.7 High
- hcl software nomad server on dominoMissing default HTTP security headers affect HCL Nomad server on Domino3.7 Low
- No product listedAn issue in the API endpoint /AccountMaster/GetCurrentUserInfo of INROAD before v202402060 allows...5.9 Medium
- nokia hit 7300 firmwareAn issue was discovered in Infinera hiT 7300 5.60.50. Hidden functionality in the web interface...2.7 Low
- gotenna atak plugin, pro atak plugin +1 moregoTenna Pro ATAK Plugin Insecure Storage of Sensitive Information5.1 Medium
- emlog proInsecure Storage of Sensitive Information in goTenna Pro5.1 Medium
- gotenna, gotenna pro atak plugin +1 moregoTenna Pro ATAK Plugin Weak Password Requirements6.0 Medium
- apache maven archetype, apache software foundation maven archetype plugin +1 moreMaven Archetype Plugin: Maven Archetype integration-test may package local settings into the published artifact, possibly containing credentials7.5 High
- globalsuzuki smartplay headunit firmwareA vulnerability has been discovered in all versions of Smartplay headunits, which are widely used...7.5 High
- officeweb365Arbitrary File Read vulnerability in Xi'an Daxi Information Technology Co., Ltd OfficeWeb365 v.7...7.5 High
- openatom openharmonyNet Manager has an out-of-bounds read permission bypass vulnerability6.5 Medium
- openatom openharmonyBackground Task Manager has an out-of-bounds read permission bypass vulnerability5.5 Medium
- openatom openharmonyAbility Runtime has an out-of-bounds read permission bypass vulnerability5.5 Medium
- wolfsslSafe-error attack on TLS 1.3 Protocol5.1 Medium
- isellerpal enterprise resource management systemAn issue in Huizhi enterprise resource management system v.1.0 and before allows a local attacker...5.5 Medium
- ivanti itsm, neurons for itsm +1 moreAn information disclosure vulnerability in Ivanti ITSM on-prem and Neurons for ITSM versions 2023...9.6 Critical
- apple ipados, watchos, ios and ipados +1 more +3 moreA lock screen issue was addressed with improved state management. This issue is fixed in watchOS...4.6 Medium
- apple macosThe issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.6. An app...3.3 Low
- zowe cli, open mainframe project zowe cli - imperative +1 moreZowe CLI --show-inputs-only displays securely stored properties5.9 Medium
- apache streamparkApache StreamPark: Information leakage vulnerability5.9 Medium
- broadcom symantec privileged access managementSymantec Privileged Access Manager Insecure Direct Object Reference vulnerability5.1 Medium
- avalara for salesforce cpqThe Avalara for Salesforce CPQ app before 7.0 for Salesforce allows attackers to read an API key....7.5 High
- google androidIn ensureFileColumns of MediaProvider.java, there is a possible disclosure of files owned by...5.5 Medium
- advancedfilemanager advanced file manager, saadiqbal advanced file manager – ultimate file manager for wordpress and document library solution +1 moreAdvanced File Manager <= 5.2.4 - Sensitive Information Exposure via Directory Listing7.5 High
- jenkins plain credentials, jenkins project plain credentials plugin +1 moreSecret file credentials stored unencrypted in rare cases by Plain Credentials Plugin4.3 Medium
- brocade fabric os, broadcom fabric operating system +1 moreEncoded session passwords on session storage for Virtual Fabric platforms4.3 Medium
- udn news appudn News App - Insecure Data Storage3.9 Low
- No product listedAn issue in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers to access...5.9 Medium
- No product listedAn issue in BAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV...6.1 Medium
- suse rkerke's credentials are stored in the RKE1 Cluster state ConfigMap9.9 Critical
- mozilla firefox for ios, firefox mobile +1 moreWhen browsing private tabs, some data related to location history or webpage thumbnails could be...6.5 Medium
- elastic elasticsearchElasticsearch Remote Cluster Search Cross Cluster API Key insufficient restrictions6.5 Medium
- vsourz1td advanced contact form 7 db, vsourz advanced cf7 db +1 moreAdvanced Contact form 7 DB <= 2.0.2 - Sensitive Information Exposure5.3 Medium
- cybozu garoon, cybozu, inc. cybozu garoon +1 moreInsertion of sensitive information into sent data issue exists in Cybozu Garoon 5.5.0 to 6.0.0,...4.3 Medium
- cybozu garoon, cybozu, inc. cybozu garoon +1 moreInsertion of sensitive information into sent data issue exists in Cybozu Garoon 5.0.0 to 5.15.0....6.5 Medium
- hiroaki miyashita custom field templateCustom Field Template <= 2.6.1 - Authenticated(Contributor+) Information Exposure4.3 Medium
- netgear wnr614 firmwareNetgear WNR614 JNR1010V2 N300-V1.1.0.54_1.0.1 does not properly set the HTTPOnly flag for cookies...4.8 Medium
- fileorganizer, softaculous fileorganizer – wordpress file manager +1 moreFileOrganizer <= 1.0.7 - Sensitive Information Exposure via Directory Listing7.5 High
- scikit-learn, scikit-learn scikit-learn/scikit-learn +1 moreSensitive Data Leakage in sklearn.feature_extraction.text.TfidfVectorizer in scikit-learn/scikit-learn4.7 Medium
- red hat build of keycloak, build of keycloak 22, build of keycloak 24 +5 more +7 moreKeycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookie7.5 High
- No product listedYubico YubiKey 5 Series before 5.7.0, Security Key Series before 5.7.0, YubiKey Bio Series before 5.6.4, and YubiKey 5 FIPS before 5.7.2 have Incorrect Access Control.3.3 Low
- Show moreLoading…