cve.bz

CWE-922: Insecure Storage of Sensitive Information, page 8

Filter

The product stores sensitive information without properly limiting read or write access by unauthorized actors.

What the weakness is: CWE-922 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

Ask an AI about CWE-922

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-922: Insecure Storage of Sensitive Information and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/922.html and https://cve.bz/cve/cwe/922?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.3CVE-2020-13937ExploitEPSS 78%

    Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha has one restful api w…

  2. 7.5CVE-2020-26104EPSS 1.4%

    In cPanel before 88.0.3, an insecure SRS secret is used on a templated VM (SEC-552).

  3. 4.3CVE-2020-4315EPSS 1.2%

    IBM Business Automation Content Analyzer on Cloud 1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link…

  4. 7.5CVE-2020-15775EPSS 1.2%

    An issue was discovered in Gradle Enterprise 2017.1 - 2020.2.4. The /usage page of Gradle Enterprise conveys high level build information such as project names and build counts over time. This page is incorrectly viewable anonymously.

  5. 3.3CVE-2020-4344EPSS 0.3%

    IBM Tivoli Business Service Manager 6.2.0.0 - 6.2.0.2 IF 1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 178247.

  6. 4.3CVE-2020-4171EPSS 1.0%

    IBM Security Guardium Insights 2.0.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 174407.

  7. 3.3CVE-2019-4695EPSS 0.2%

    IBM Security Guardium Data Encryption (GDE) 3.0.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 171926.

  8. 5.5CVE-2020-1493EPSS 7.3%

    An information disclosure vulnerability exists when attaching files to Outlook messages. This vulnerability could potentially allow users to share attached files such that they are accessible by anonymous users where they should be restric…

  9. 3.3CVE-2020-4371EPSS 0.3%

    IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 contains sensitive information in leftover debug code that could be used aid a local user in further attacks against the system. IBM X-Force ID: 179008.

  10. 5.5CVE-2020-8482EPSS 0.3%

    Insecure storage of sensitive information in ABB Device Library Wizard versions 6.0.X, 6.0.3.1 and 6.0.3.2 allows unauthenticated low privilege user to read file that contains confidential data

  11. 9.8CVE-2020-8481EPSS 1.9%

    For ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineer…

  12. 7.5CVE-2020-7000EPSS 1.1%

    VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow an unauthenticated attacker to discover the cryptographic key from the web server and gain information about the login and the encryption/decryption mechanism, which…

  13. 5.5CVE-2020-5262EPSS 0.5%

    In EasyBuild before version 4.1.2, the GitHub Personal Access Token (PAT) used by EasyBuild for the GitHub integration features (like `--new-pr`, `--fro,-pr`, etc.) is shown in plain text in EasyBuild debug log files. This issue is fixed i…

  14. 2.4CVE-2020-4197EPSS 0.3%

    IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 174908.

  15. 6.5CVE-2018-13313EPSS 1.0%

    In TOTOLINK A3002RU 1.0.8, the router provides a page that allows the user to change their account name and password. This page, password.htm, contains JavaScript which is used to confirm the user knows their current password before allowi…

  16. 4.3CVE-2019-12825EPSS 1.1%

    Unauthorized Access to the Container Registry of other groups was discovered in GitLab Enterprise 12.0.0-pre. In other words, authenticated remote attackers can read Docker registries of other groups. When a legitimate user changes the pat…

  17. 7.5CVE-2019-20060EPSS 1.4%

    MFScripts YetiShare v3.5.2 through v4.5.4 places sensitive information in the Referer header. If this leaks, then third parties may discover password-reset hashes, file-delete links, or other sensitive information.

  18. 4.3CVE-2019-13719EPSS 1.2%

    Incorrect security UI in full screen mode in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to hide security UI via a crafted HTML page.

  19. 4.3CVE-2019-13717EPSS 1.0%

    Incorrect security UI in full screen mode in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to hide security UI via a crafted HTML page.

  20. 2.4CVE-2019-4265EPSS 0.4%

    IBM Maximo Anywhere 7.6.0, 7.6.1, 7.6.2, and 7.6.3 does not have device root detection which could result in an attacker gaining sensitive information about the device. IBM X-Force ID: 160198.

  21. 5.3CVE-2019-4549EPSS 1.3%

    IBM Security Directory Server 6.4.0 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 165951.

  22. 5.3CVE-2019-14957EPSS 1.1%

    The JetBrains Vim plugin before version 0.52 was storing individual project data in the global vim_settings.xml file. This xml file could be synchronized to a publicly accessible GitHub repository.

  23. 4.4CVE-2019-9253EPSS 0.2%

    In KeyStore, there is a possible storage of symmetric keys in the TEE instead of the strongbox due to a missing strongbox flag. This could lead to local information disclosure with System execution privileges needed. User interaction is no…

  24. 5.5CVE-2019-5633EPSS 0.4%

    An insecure storage of sensitive information vulnerability is present in Hickory Smart for iOS mobile devices from Belwith Products, LLC. The application's database was found to contain information that could be used to control the lock de…

  25. 5.5CVE-2019-5632EPSS 0.4%

    An insecure storage of sensitive information vulnerability is present in Hickory Smart for Android mobile devices from Belwith Products, LLC. The application's database was found to contain information that could be used to control the loc…

  26. 5.3CVE-2018-20886EPSS 0.3%

    cPanel before 74.0.0 insecurely stores phpMyAdmin session files (SEC-418).

  27. 7.5CVE-2019-12914EPSS 1.2%

    Redbrick Shift through 3.4.3 allows an attacker to extract authentication tokens of services (such as Gmail, Outlook, etc.) used in the application.

  28. 7.5CVE-2019-12911EPSS 1.2%

    Redbrick Shift through 3.4.3 allows an attacker to extract authentication tokens of services (such as Gmail, Outlook, etc.) used in the application.

  29. 7.8CVE-2019-5627EPSS 0.4%

    The iOS mobile application BlueCats Reveal before 5.14 stores the username and password in the app cache as base64 encoded strings, i.e. clear text. These persist in the cache even if the user logs out. This can allow an attacker to compro…

  30. 7.8CVE-2019-5626EPSS 0.4%

    The Android mobile application BlueCats Reveal before 3.0.19 stores the username and password in a clear text file. This file persists until the user logs out or the session times out from non-usage (30 days of no user activity). This can …

  31. 7.1CVE-2019-5625EPSS 0.4%

    The Android mobile application Halo Home before 1.11.0 stores OAuth authentication and refresh access tokens in a clear text file. This file persists until the user logs out of the application and reboots the device. This vulnerability can…

  32. 5.9CVE-2019-3684EPSS 0.7%

    SUSE Manager until version 4.0.7 and Uyuni until commit 1b426ad5ed0a7191a6fb46bb83e98ae4b99a5ade created world-readable swap files on systems that don't have a swap already configured and don't have btrfs as filesystem

  33. 9.8CVE-2017-5250EPSS 0.7%

    In version 1.9.7 and prior of Insteon's Insteon for Hub Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and secure manner.

  34. 9.8CVE-2017-5249EPSS 0.9%

    In version 6.1.0.19 and prior of Wink Labs's Wink - Smart Home Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and secure manner.

  35. 4.3CVE-2017-16560EPSS 0.4%

    SanDisk Secure Access 3.01 vault decrypts and copies encrypted files to a temporary folder, where they can remain indefinitely in certain situations, such as if the file is being edited when the user exits the application or if the applica…

  36. 5.5CVE-2017-0493EPSS 0.3%

    An information disclosure vulnerability in File-Based Encryption could enable a local malicious attacker to bypass operating system protections for the lock screen. This issue is rated as Moderate due to the possibility of bypassing the lo…

  37. 8.8CVE-2017-7253EPSS 2.6%

    Dahua IP Camera devices 3.200.0001.6 can be exploited via these steps: 1. Use the default low-privilege credentials to list all users via a request to a certain URI. 2. Login to the IP camera with admin credentials so as to obtain full con…

  38. 6.6CVE-2017-6911EPSS 0.6%

    USB Pratirodh is prone to sensitive information disclosure. It stores sensitive information such as username and password in simple usb.xml. An attacker with physical access to the system can modify the file according his own requirements …