cve.bz

CWE-922: Insecure Storage of Sensitive Information, page 2

Filter

The product stores sensitive information without properly limiting read or write access by unauthorized actors.

What the weakness is: CWE-922 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

Ask an AI about CWE-922

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-922: Insecure Storage of Sensitive Information and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/922.html and https://cve.bz/cve/cwe/922?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.5CVE-2025-21003EPSS 0.1%

    Insecure storage of sensitive information in Emergency SOS prior to SMR Jul-2025 Release 1 allows local attackers to access sensitive information.

  2. 5.6CVE-2025-42979EPSS 0.1%

    The GuiXT application, which is integrated with SAP GUI for Windows, uses obfuscation algorithms instead of secure symmetric ciphers for storing the credentials of an RFC user on the client PC. This leads to a high impact on confidentialit…

  3. 7.7CVE-2025-37100EPSS 0.5%

    A vulnerability in the APIs of HPE Aruba Networking Private 5G Core could potentially expose sensitive information to unauthorized users. A successful exploitation could allow an attacker to iteratively navigate through the filesystem and…

  4. 9.8CVE-2025-48929EPSS 0.3%

    The TeleMessage service through 2025-05-05 implements authentication through a long-lived credential (e.g., not a token with a short expiration time) that can be reused at a later date if discovered by an adversary.

  5. 5.1CVE-2024-13954EPSS 0.2%

    Serialized configuration information may be disclosed during device commissioning while using ASPECT's configuration toolsetThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

  6. 7.7CVE-2025-45242EPSS 0.4%

    Rhymix v2.1.22 was discovered to contain an arbitrary file deletion vulnerability via the procFileAdminEditImage method in /file/file.admin.controller.php.

  7. 8.2CVE-2025-46627EPSS 0.4%

    Use of weak credentials in the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated attacker to authenticate to the telnet service by calculating the root password based on easily-obtained device information. The password is based on the la…

  8. 4.1CVE-2025-2440EPSS 0.2%

    CWE-922: Insecure Storage of Sensitive Information vulnerability exists that could potentially lead to unauthorized access of confidential data when a malicious user, having physical access and advanced information on the file system, sets…

  9. 7.1CVE-2025-29809EPSS 4.3%

    Insecure storage of sensitive information in Windows Kerberos allows an authorized attacker to bypass a security feature locally.

  10. 6.2CVE-2025-20945EPSS 0.2%

    Improper access control in Galaxy Watch prior to SMR Apr-2025 Release 1 allows local attackers to access sensitive information of Galaxy watch.

  11. 6.8CVE-2025-2489EPSS 0.2%

    Insecure information storage vulnerability in NTFS Tools version 3.5.1. Exploitation of this vulnerability could allow an attacker to know the application password, stored in /Users/user/Library/Application Support/ntfs-tool/config.json.

  12. 8.2CVE-2025-2241EPSS 0.5%

    A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. User…

  13. 3.3CVE-2025-2157EPSS 0.2%

    A flaw was found in Foreman/Red Hat Satellite. Improper file permissions allow low-privileged OS users to monitor and access temporary files under /var/tmp, exposing sensitive command outputs, such as /etc/shadow. This issue can lead to in…

  14. 6.2CVE-2025-20912EPSS 0.2%

    Incorrect default permission in DiagMonAgent prior to SMR Mar-2025 Release 1 allows local attackers to access data within Galaxy Watch.

  15. 5.5CVE-2025-21098EPSS 0.2%

    in OpenHarmony v5.0.2 and prior versions allow a local attacker cause information leak through out-of-bounds read bypass permission check.

  16. 6.3CVE-2025-22492EPSS 0.2%

    The connection string visible to users with access to FRSCore database on Foreseer Reporting Software (FRS) VM, this string can be used for gaining administrative access to the 4crXref database. This vulnerability has been resolved in the …

  17. 7.5CVE-2024-12315EPSS 0.5%

    The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.3 via the exports directory. This makes it possible for unauthenticated …

  18. 4.4CVE-2025-20886EPSS 0.1%

    Inclusion of sensitive information in test code in softsim trustlet prior to SMR Jan-2025 Release 1 allows local privileged attackers to get test key.

  19. 7.2CVE-2024-57436EPSS 0.6%

    RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can allow attackers to impersonate Admin users via using a crafted cookie.

  20. 7.5CVE-2024-57546EPSS 0.6%

    An issue in CMSimple v.5.16 allows a remote attacker to obtain sensitive information via a crafted script to the validate link function.

  21. 6.5CVE-2024-54728EPSS 0.3%

    Incorrect access control in BYD QIN PLUS DM-i Dilink OS 3.0_13.1.7.2204050.1 allows unauthorized attackers to access system logcat logs.

  22. 5.5CVE-2025-24117EPSS 0.3%

    This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, visionOS 2.3, watchOS 11.3. An app may be able to fingerprint the user.

  23. 5.5CVE-2025-24101EPSS 0.2%

    This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.3. An app may be able to access user-sensitive data.

  24. 5.5CVE-2024-54549EPSS 0.2%

    This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.2. An app may be able to access user-sensitive data.

  25. 5.5CVE-2024-54541EPSS 0.2%

    This issue was addressed through improved state management. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. An app may be able to access…

  26. 6.5CVE-2024-56972EPSS 0.3%

    An issue in Midea Group Co., Ltd Midea Home iOS 9.3.12 allows attackers to access sensitive user information via supplying a crafted link.

  27. 6.5CVE-2024-56971EPSS 0.3%

    An issue in Zhiyuan Yuedu (Guangzhou) Literature Information Technology Co., Ltd Shuqi Novel iOS 5.3.8 allows attackers to access sensitive user information via supplying a crafted link.

  28. 6.5CVE-2024-56969EPSS 0.3%

    An issue in Pixocial Technology (Singapore) Pte. Ltd BeautyPlus iOS 7.8.010 allows attackers to access sensitive user information via supplying a crafted link.

  29. 6.5CVE-2024-56968EPSS 0.3%

    An issue in Shenzhen Intellirocks Tech Co. Ltd Govee Home iOS 6.5.01 allows attackers to access sensitive user information via supplying a crafted payload.

  30. 6.5CVE-2024-56967EPSS 0.3%

    An issue in Cloud Whale Interactive Technology LLC. PolyBuzz iOS 2.0.20 allows attackers to access sensitive user information via supplying a crafted link.

  31. 6.5CVE-2024-56966EPSS 0.3%

    An issue in Shanghai Xuan Ting Entertainment Information & Technology Co., Ltd Qidian Reader iOS 5.9.384 allows attackers to access sensitive user information via supplying a crafted link.

  32. 6.5CVE-2024-56965EPSS 0.3%

    An issue in Shanghai Shizhi Information Technology Co., Ltd Shihuo iOS 8.16.0 allows attackers to access sensitive user information via supplying a crafted link.

  33. 6.5CVE-2024-56964EPSS 0.3%

    An issue in Che Hao Duo Used Automobile Agency (Beijing) Co., Ltd Guazi Used Car iOS 10.15.1 allows attackers to access sensitive user information via supplying a crafted link.

  34. 6.5CVE-2024-56963EPSS 0.3%

    An issue in Beijing Sogou Technology Development Co., Ltd Sogou Input iOS 12.2.0 allows attackers to access sensitive user information via supplying a crafted link.

  35. 6.5CVE-2024-56962EPSS 0.3%

    An issue in Tencent Technology (Shanghai) Co., Ltd WeSing iOS v9.3.39 allows attackers to access sensitive user information via supplying a crafted link.

  36. 6.5CVE-2024-56960EPSS 0.3%

    An issue in Tianjin Xiaowu Information technology Co., Ltd BeiKe Holdings iOS 1.3.50 allows attackers to access sensitive user information via supplying a crafted link.

  37. 6.5CVE-2024-56959EPSS 0.3%

    An issue in Mashang Consumer Finance Co., Ltd Anyihua iOS 3.6.2 allows attackers to access sensitive user information via supplying a crafted link.

  38. 6.5CVE-2024-56957EPSS 0.3%

    An issue in Kingsoft Office Software Corporation Limited WPS Office iOS 12.20.0 allows attackers to access sensitive user information via supplying a crafted link.

  39. 6.5CVE-2024-56955EPSS 0.3%

    An issue in Tencent Technology (Shenzhen) Company Limited QQMail iOS 6.6.4 allows attackers to access sensitive user information via supplying a crafted link.

  40. 6.5CVE-2024-56954EPSS 0.3%

    An issue in Beijing Baidu Netcom Science & Technology Co Ltd Haokan Video iOS 7.70.0 allows attackers to access sensitive user information via supplying a crafted link.

  41. 6.5CVE-2024-56953EPSS 0.3%

    An issue in Baidu (China) Co Ltd Baidu Input Method (iOS version) v12.6.13 allows attackers to access user information via supplying a crafted link.

  42. 6.5CVE-2024-56952EPSS 0.3%

    An issue in Beijing Baidu Netcom Science & Technology Co Ltd Baidu Lite app (iOS version) 6.40.0 allows attackers to access user information via supplying a crafted link.

  43. 6.5CVE-2024-56951EPSS 0.3%

    An issue in Hangzhou Bobo Technology Co Ltd UU Game Booster iOS 10.6.13 allows attackers to access sensitive user information via supplying a crafted link.

  44. 6.5CVE-2024-56950EPSS 0.3%

    An issue in KuGou Technology Co., Ltd KuGou Concept iOS 4.0.61 allows attackers to access sensitive user information via supplying a crafted link.

  45. 6.5CVE-2024-56949EPSS 0.3%

    An issue in Guangzhou Polar Future Culture Technology Co., Ltd University Search iOS 2.27.0 allows attackers to access sensitive user information via supplying a crafted link.

  46. 6.5CVE-2024-56948EPSS 0.3%

    An issue in KuGou Technology CO. LTD KuGou Music iOS v20.0.0 allows attackers to access sensitive user information via supplying a crafted link.

  47. 6.5CVE-2024-56947EPSS 0.3%

    An issue in Xiamen Meitu Technology Co., Ltd. BeautyCam iOS v12.3.60 allows attackers to access sensitive user information via supplying a crafted link.

  48. 6.5CVE-2024-55931EPSS 0.4%

    Xerox Workplace Suite stores tokens in session storage, which may expose them to potential access if a user's session is compromised.  The patch for this vulnerability will be included in a future release of Workplace Suite, and customers…

  49. 4.9CVE-2021-42718EPSS 0.4%

    Information Disclosure in API in Replicated Replicated Classic versions prior to 2.53.1 on all platforms allows authenticated users with Admin Console access to retrieve sensitive data, including application secrets, via accessing containe…

  50. 7.8CVE-2025-21299EPSS 2.2%

    Windows Kerberos Security Feature Bypass Vulnerability