Insecure Storage of Sensitive Information
CWE-922
The product stores sensitive information without properly limiting read or write access by unauthorized actors.
We track 70 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.1.
Latest Insecure Storage of Sensitive Information vulnerabilities
- 9.8 Critical severity
Defender Security: Insecure Storage of Sensitive Information
Insecure Storage of Sensitive Information vulnerability in WPMU DEV Defender Security allows : Screen Temporary Files for Sensitive Information.This issue affects Defender Security: from n/a through 3.3.2.
- 7.5 High severity
Drag and Drop Multiple File Upload for Contact…: Insecure Storage of Sensitive Information
The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.7.7 via the '/wp-content/uploads/wp_dndcf7_uploads/wpcf7-files' directory. This makes it poss
- 7.5 High severity
pilotpath_controller: Insecure Storage of Sensitive Information
An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to cause a Denial of Service (DoS) by disrupting the communication between the PathPilot controller and the CNC router via overwriting the card's name in the device memory.
- 8.8 High severity
macOS: Insecure Storage of Sensitive Information
This issue was addressed through improved state management. This issue is fixed in macOS Sonoma 14.2. Remote Login sessions may be able to obtain full disk access permissions.
- 7.5 High severity
micontact_center_business: Insecure Storage of Sensitive Information
A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct an information disclosure attack due to improper configuration. A successful exploit could allow an attacker to
- 7.5 High severity
Thunderbird: Insecure Storage of Sensitive Information
The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitrary other email message in Thunderbird's local cache. Consequently, when replying to the contaminated email message, the user might accidentally leak the confid
- 7.6 High severity
Hazelcast: Insecure Storage of Sensitive Information
In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client operations don't check permissions properly, allowing authenticated users to access data stored in the cluster.
- 7.5 High severity
Apache Camel: Insecure Storage of Sensitive Information
Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel.This issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, f
- 7.5 High severity
expressvpn: Insecure Storage of Sensitive Information
ExpressVPN before 12.73.0 on Windows, when split tunneling is used, sends DNS requests according to the Windows configuration (e.g., sends them to DNS servers operated by the user's ISP instead of to the ExpressVPN DNS servers), which may allow remote attacker
- 7.5 High severity
Apache Solr: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1. Solr Streaming Expressions allows users to extract data from other Solr Clouds, using a
- 8.1 High severity
Action Rf 1200 Firmware: Insecure Storage of Sensitive Information
Intelbras Action RF 1200 routers 1.2.2 and earlier and Action RG 1200 routers 2.1.7 and earlier expose the Password in Cookie resulting in Login Bypass.
- 7.5 High severity
i Access Client Solutions: Insecure Storage of Sensitive Information
IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 could allow an attacker to obtain a decryption key due to improper authority checks. IBM X-Force ID: 268270.
- 8.8 High severity
EVE OS: Insufficiently Protected Credentials
When sealing/unsealing the “vault” key, a list of PCRs is used, which defines which PCRs are used. In a previous project, CYMOTIVE found that the configuration is not protected by the secure boot, and in response Zededa implemented measurements on the config p
- 8.8 High severity
EVE OS: Insufficiently Protected Credentials
On boot, the Pillar eve container checks for the existence and content of “/config/GlobalConfig/global.json”. If the file exists, it overrides the existing configuration on the device on boot. This allows an attacker to change the system’s configuration, which
- 8.8 High severity
EVE OS: Insufficiently Protected Credentials
On boot, the Pillar eve container checks for the existence and content of “/config/authorized_keys”. If the file is present, and contains a supported public key, the container will go on to open port 22 and enable sshd with the given keys as the authorized key
- 8.8 High severity
EVE OS: Insufficiently Protected Credentials
PCR14 is not in the list of PCRs that seal/unseal the “vault” key, but due to the change that was implemented in commit “7638364bc0acf8b5c481b5ce5fea11ad44ad7fd4”, fixing this issue alone would not solve the problem of the config partition not being measured c
- 7.8 High severity
opensuse-welcome: Insecure Storage of Sensitive Information
A Insecure Storage of Sensitive Information vulnerability in openSUSE opensuse-welcome allows local attackers to execute code as the user that runs opensuse-welcome if a custom layout is chosen This issue affects opensuse-welcome: from 0.1 before 0.1.9+git.35.
- 7.5 High severity
MODULYS GP (MOD3GP-SY-120K): Insecure Storage of Sensitive Information
Sending some requests in the web application of the vulnerable device allows information to be obtained due to the lack of security in the authentication process.
- 7.8 High severity
QMS Automotive: Insecure Storage of Sensitive Information
A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application stores sensitive application data in an external insecure storage. This could allow an attacker to alter content, leading to arbitr
- 7.5 High severity
Wing FTP Server: Insecure Storage of Sensitive Information
Insecure storage of sensitive information in Wing FTP Server (User Web Client) allows information elicitation.This issue affects Wing FTP Server: <= 7.2.0.
- 7.5 High severity
Ngsurvey: Insecure Storage of Sensitive Information
Information disclosure in password protected surveys in Data Illusion Survey Software Solutions NGSurvey v2.4.28 and below allows attackers to view the password to access and arbitrarily submit surveys.
- 7.8 High severity
Blue Light Filter: Insecure Storage of Sensitive Information
An issue found in Blue Light Filter v.1.5.5 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the SharedPreference files.
- 7.8 High severity
Twilight: Insecure Storage of Sensitive Information
An issue found in Twilight v.13.3 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the SharedPreference files.
- 9.8 Critical severity
Call Blocker: Insecure Storage of Sensitive Information
The Call Blocker application 6.6.3 for Android allows unauthorized applications to use exposed components to delete data stored in its database that is related to user privacy settings and affects the implementation of the normal functionality of the applicati
- 7.8 High severity
Intel(R) DCM software: Insecure Storage of Sensitive Information
Insecure storage of sensitive information in the Intel(R) DCM software before version 5.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.8 High severity
Intel(R) DCM software: Insecure Storage of Sensitive Information
Insecure storage of sensitive information in the Intel(R) DCM software before version 5.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.5 High severity
Freesoul Deactivate Plugins – Plugin manager…: Insecure Storage of Sensitive Information
Insecure Storage of Sensitive Information vulnerability in Jose Mortellaro Freesoul Deactivate Plugins – Plugin manager and cleanup plugin <= 1.9.4.0 versions.
- 9.8 Critical severity
My Control System (on-premise): Insecure Storage of Sensitive Information
Insecure Storage of Sensitive Information vulnerability in ABB My Control System (on-premise) allows an attacker who successfully exploited this vulnerability to gain access to the secure application data or take control of the application. Of the services tha
- 7.5 High severity
VPN: Insecure Storage of Sensitive Information
Torguard VPN 4.8, has a vulnerability that allows an attacker to dump sensitive information, such as credentials and information about the server, without admin privileges.
- 7.5 High severity
Brocade SANnav: Insecure Storage of Sensitive Information
In Brocade SANnav before Brocade SANnav v2.2.0.2 and Brocade SANnav2.1.1.8, encoded scp-server passwords are stored using Base64 encoding, which could allow an attacker able to access log files to easily decode the passwords.