CWE-922: Insecure Storage of Sensitive Information, page 7
Filter
The product stores sensitive information without properly limiting read or write access by unauthorized actors.
What the weakness is: CWE-922 at MITRE. OWASP Top 10: A01:2025 Broken Access Control
Ask an AI about CWE-922
Show the prompt
Explain CWE-922: Insecure Storage of Sensitive Information and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/922.html and https://cve.bz/cve/cwe/922?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 4.3CVE-2022-30740EPSS 0.2%
Improper auto-fill algorithm in Samsung Internet prior to version 17.0.1.69 allows physical attackers to guess stored credit card numbers.
- 5.5CVE-2021-43512EPSS 0.3%
An issue was discovered in FlightRadar24 v8.9.0, v8.10.0, v8.10.2, v8.10.3, v8.10.4 for Android, allows attackers to cause unspecified consequences due to being able to decompile a local application and extract their API keys.
- 6.5CVE-2022-1044EPSS 0.9%
Sensitive Data Exposure Due To Insecure Storage Of Profile Image in GitHub repository polonel/trudesk prior to v1.2.1.
- 3.9CVE-2021-25266EPSS 0.2%
An insecure data storage vulnerability allows a physical attacker with root privileges to retrieve TOTP secret keys from unlocked phones in Sophos Authenticator for Android version 3.4 and older, and Intercept X for Mobile (Android) before…
- 5.5CVE-2022-1257ExploitEPSS 0.6%
Insecure storage of sensitive information vulnerability in MA for Linux, macOS, and Windows prior to 5.7.6 allows a local user to gain access to sensitive information through storage in ma.db. The sensitive information has been moved to en…
- 2.4CVE-2021-27456EPSS 0.2%
Philips Gemini PET/CT family software stores sensitive information in a removable media device that does not have built-in access control.
- 4.3CVE-2018-25031EPSS 42%
Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was origin…
- 6.5CVE-2022-0881EPSS 1.1%
Insecure Storage of Sensitive Information in GitHub repository chocobozzz/peertube prior to 4.1.1.
- 7.5CVE-2022-25264EPSS 1.0%
In JetBrains TeamCity before 2021.2.3, environment variables of the "password" type could be logged in some cases.
- 6.5CVE-2022-0724EPSS 1.3%
Insecure Storage of Sensitive Information in GitHub repository microweber/microweber prior to 1.3.
- 5.5CVE-2022-21823EPSS 0.4%
A insecure storage of sensitive information vulnerability exists in Ivanti Workspace Control <2021.2 (10.7.30.0) that could allow an attacker with locally authenticated low privileges to obtain key information due to an unspecified attack …
- 5.5CVE-2017-13909EPSS 0.2%
An issue existed in the storage of sensitive tokens. This issue was addressed by placing the tokens in Keychain. This issue is fixed in macOS High Sierra 10.13. A local attacker may gain access to iCloud authentication tokens.
- 3.3CVE-2021-25524EPSS 0.2%
Insecure storage of device information in Contacts prior to version 12.7.05.24 allows attacker to get Samsung Account ID.
- 3.3CVE-2021-25523EPSS 0.2%
Insecure storage of device information in Samsung Dialer prior to version 12.7.05.24 allows attacker to get Samsung Account ID.
- 3.3CVE-2021-25522EPSS 0.2%
Insecure storage of sensitive information vulnerability in Smart Capture prior to version 4.8.02.10 allows attacker to access victim's captured images without permission.
- 9.8CVE-2021-42371EPSS 1.6%
lpar2rrd is a hardcoded system account in XoruX LPAR2RRD and STOR2RRD before 7.30.
- 3.3CVE-2020-4809EPSS 0.2%
IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189633.
- 3.3CVE-2020-4805EPSS 0.2%
IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189539.
- 3.3CVE-2020-4803EPSS 0.2%
IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189535.
- 7.5CVE-2021-28813EPSS 1.1%
A vulnerability involving insecure storage of sensitive information has been reported to affect QSW-M2116P-2T2S and QNAP switches running QuNetSwitch. If exploited, this vulnerability allows remote attackers to read sensitive information b…
- 5.5CVE-2021-0639EPSS 0.1%
In multiple functions of libl3oemcrypto.cpp, there is a possible weakness in the existing obfuscation mechanism due to the way sensitive data is handled. This could lead to local information disclosure with no additional execution privileg…
- 7.5CVE-2021-36786EPSS 1.0%
The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows Sensitive Data Exposure of API credentials and private keys.
- 4.3CVE-2021-36127EPSS 0.7%
An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. The Special:GlobalUserRights page provided search results which, for a suppressed MediaWiki user, were different than for any other user, thus easily disclosin…
- 7.5CVE-2021-22914EPSS 1.0%
Citrix Cloud Connector before 6.31.0.62192 suffers from insecure storage of sensitive information due to sensitive information being stored in the Citrix Cloud Connector installation log files. Such information could be used by an maliciou…
- 4.9CVE-2021-28815EPSS 1.7%
Insecure storage of sensitive information has been reported to affect QNAP NAS running myQNAPcloud Link. If exploited, this vulnerability allows remote attackers to read sensitive information by accessing the unrestricted storage mechanism…
- 6.5CVE-2021-25406EPSS 0.4%
Information exposure vulnerability in Gear S Plugin prior to version 2.2.05.20122441 allows unstrusted applications to access connected BT device information.
- 3.3CVE-2021-25404EPSS 0.2%
Information Exposure vulnerability in SmartThings prior to version 1.7.64.21 allows attacker to access user information via log.
- 3.3CVE-2021-25402EPSS 0.2%
Information Exposure vulnerability in Samsung Notes prior to version 4.2.04.27 allows attacker to access s pen latency information.
- 3.3CVE-2021-20396EPSS 0.2%
IBM QRadar Analyst Workflow App 1.0 through 1.18.0 for IBM QRadar SIEM allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 196009.
- 5.3CVE-2020-5008EPSS 0.9%
IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.14 stores sensitive information in GET request parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server l…
- 3.3CVE-2021-20575EPSS 0.3%
IBM Security Verify Access 20.07 allows web pages to be stored locally which can be read by another user on the system. X-Force ID: 199278.
- 6.5CVE-2020-28911EPSS 3.6%
Incorrect Access Control in Nagios Fusion 4.1.8 and earlier allows low-privileged authenticated users to extract passwords used to manage fused servers via the test_server command in ajaxhelper.php.
- 3.3CVE-2020-4765EPSS 0.2%
IBM Cloud Pak for Multicloud Management prior to 2.3 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 188902.
- 3.3CVE-2021-20391EPSS 0.2%
IBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 195999.
- 6.5CVE-2021-28653EPSS 0.9%
The iOS and macOS apps before 1.4.1 for the Western Digital G-Technology ArmorLock NVMe SSD store keys insecurely. They choose a non-preferred storage mechanism if the device has Secure Enclave support but lacks biometric authentication ha…
- 3.3CVE-2020-4726EPSS 0.3%
The IBM Application Performance Monitoring UI (IBM Cloud APM 8.1.4) allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 187975.
- 9.8CVE-2021-27170EPSS 16%
An issue was discovered on FiberHome HG6245D devices through RP2613. By default, there are no firewall rules for IPv6 connectivity, exposing the internal management interfaces to the Internet.
- 7.5CVE-2021-25776EPSS 1.1%
In JetBrains TeamCity before 2020.2, an ECR token could be exposed in a build's parameters.
- 4.3CVE-2020-29603EPSS 1.1%
In manage_proj_edit_page.php in MantisBT before 2.24.4, any unprivileged logged-in user can retrieve Private Projects' names via the manage_proj_edit_page.php project_id parameter, without having access to them.
- 5.5CVE-2020-4871EPSS 0.3%
IBM Planning Analytics 2.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 190834.
- 4.3CVE-2020-4674EPSS 0.8%
IBM Workload Automation 9.5 stores the server path in URLs that could aid in further attacks against the system. IBM X-Force ID: 186287.
- 4.3CVE-2020-4673EPSS 0.8%
IBM Workload Automation 9.5 stores sensitive information in HTML comments that could aid in further attacks against the system. IBM X-Force ID: 186286.
- 4.4CVE-2020-9202EPSS 0.2%
There is an information disclosure vulnerability in TE Mobile software versions V600R006C10,V600R006C10SPC100. Due to the improper storage of some information in certain specific scenario, the attacker can gain information in the victim's …
- 4.3CVE-2020-26176EPSS 0.8%
An issue was discovered in tangro Business Workflow before 1.18.1. No (or broken) access control checks exist on the /api/document/<DocumentID>/attachments API endpoint. Knowing a document ID, an attacker can list all the attachments of a …
- 3.3CVE-2020-4906EPSS 0.3%
IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 allows web pages to be stored locally which can be read by another user on the system.
- 2.4CVE-2019-19561EPSS 0.4%
A misconfiguration in the debug interface in Mercedes-Benz HERMES 1.5 allows an attacker with direct physical access to device hardware to obtain cellular modem information.
- 2.4CVE-2019-19557EPSS 0.4%
A misconfiguration in the debug interface in Mercedes-Benz HERMES 1 allows an attacker with direct physical access to device hardware to obtain cellular modem information.
- 3.3CVE-2020-4886EPSS 0.3%
IBM InfoSphere Information Server 11.7 stores sensitive information in the browser's history that could be obtained by a user who has access to the same system. IBM X-Force ID: 190910.
- 3.3CVE-2020-4650EPSS 0.3%
IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 186023.
- 5.5CVE-2019-8790EPSS 0.4%
This issue was addresses by updating incorrect URLSession file descriptors management logic to match Swift 5.0. This issue is fixed in Swift 5.1.1 for Ubuntu. Incorrect management of file descriptors in URLSession could lead to inadvertent…