CWE-922

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/lf-edge/eve"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20220708121648-5fef4d92e758"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-43631"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-522",
      "CWE-922"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-04T20:46:16Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nOn boot, the Pillar container checks for /config/authorized_keys. If present with a valid public key, it enables SSH on port 22 with root login. The /config partition is not protected by measured boot, is mutable and unencrypted.\n\nThis enables an attacker with physical access to the device to take out the disk, modify the /config partition using a separate server, then insert it, without the inserted key being flagged as an integrity voilation my measured boot and remote attestation.\n\n### Patches\n\nPatched in 9.4.3-lts\n\n### Workarounds\n\nNone (apart from preventing physical access to the device)",
  "id": "GHSA-3mq9-xhgq-r7gj",
  "modified": "2026-02-04T20:46:16Z",
  "published": "2026-02-04T20:46:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/lf-edge/eve/security/advisories/GHSA-3mq9-xhgq-r7gj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43631"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lf-edge/eve/commit/5fef4d92e75838cc78010edaed5247dfbdae1889"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lf-edge/eve/commit/aa3501d6c57206ced222c33aea15a9169d629141"
    },
    {
      "type": "WEB",
      "url": "https://asrg.io/security-advisories/cve-2023-43631"
    },
    {
      "type": "WEB",
      "url": "https://asrg.io/security-advisories/ssh-as-root-unlockable-without-triggering-measured-boot"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lf-edge/eve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "EVE: SSH as Root Unlockable Without Triggering Measured Boot"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-42979"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-922"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-08T01:15:25Z",
    "severity": "MODERATE"
  },
  "details": "The GuiXT application, which is integrated with SAP GUI for Windows, uses obfuscation algorithms instead of secure symmetric ciphers for storing the credentials of an RFC user on the client PC. This leads to a high impact on confidentiality because any attacker who gains access to the user hive of this user\ufffds windows registry could recreate the original password. There is no impact on integrity or availability of the application",
  "id": "GHSA-3px8-gf2c-qqrh",
  "modified": "2025-07-08T03:31:01Z",
  "published": "2025-07-08T03:31:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42979"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/3607513"
    },
    {
      "type": "WEB",
      "url": "https://url.sap/sapsecuritypatchday"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-33973"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-922"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-11-11T16:15:00Z",
    "severity": "LOW"
  },
  "details": "Improper access control in the Intel(R) WAPI Security software for Windows 10/11 before version 22.2150.0.1 may allow an authenticated user to potentially enable information disclosure via local access.",
  "id": "GHSA-3vvh-6qrh-25vg",
  "modified": "2022-11-16T19:00:25Z",
  "published": "2022-11-11T19:00:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-33973"
    },
    {
      "type": "WEB",
      "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00720.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-4803"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-922"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-09-23T17:15:00Z",
    "severity": "LOW"
  },
  "details": "IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189535.",
  "id": "GHSA-446j-vwvf-m2wj",
  "modified": "2022-05-24T19:15:32Z",
  "published": "2022-05-24T19:15:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-4803"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/189535"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/6491625"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-0639"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-922"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-08-17T19:15:00Z",
    "severity": "MODERATE"
  },
  "details": "In multiple functions of libl3oemcrypto.cpp, there is a possible weakness in the existing obfuscation mechanism due to the way sensitive data is handled. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-190724551",
  "id": "GHSA-45mp-7qc4-gj8v",
  "modified": "2022-05-24T19:11:24Z",
  "published": "2022-05-24T19:11:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-0639"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/2021-08-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-6748"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862",
      "CWE-922"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-11T03:15:09Z",
    "severity": "MODERATE"
  },
  "details": "The Custom Field Template plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 via the \u0027cft\u0027 shortcode. This makes it possible for authenticated attackers with contributor access and above, to extract sensitive data including arbitrary post metadata.",
  "id": "GHSA-4947-94mr-v96v",
  "modified": "2024-06-11T03:30:58Z",
  "published": "2024-06-11T03:30:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6748"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3069937%40custom-field-template\u0026new=3069937%40custom-field-template\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7fcd0410-9423-4349-8d1c-3551de38a7c7?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-20939"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-922"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-15T16:15:24Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in the web-based management interface of Cisco\u0026nbsp;Smart Software Manager On-Prem could allow an authenticated, remote attacker to elevate privileges on an affected system.\nThis vulnerability is due to inadequate protection of sensitive user information. An attacker could exploit this vulnerability by accessing certain logs on an affected system. A successful exploit could allow the attacker to use the obtained information to elevate privileges to System Admin.Cisco\u0026nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.",
  "id": "GHSA-497w-6wcv-pw45",
  "modified": "2024-11-15T18:30:50Z",
  "published": "2024-11-15T18:30:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-20939"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-thinrcpt-xss-gSj4CecU"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-priv-esc-SEjz69dv"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-20469"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-922"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-07T21:15:05Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered on One2Track 2019-12-08 devices. Confidential information is needlessly stored on the smartwatch. Audio files are stored in .amr format, in the audior directory. An attacker who has physical access can retrieve all audio files by connecting via a USB cable.",
  "id": "GHSA-49c3-p2r5-5493",
  "modified": "2025-11-04T18:31:30Z",
  "published": "2024-11-07T21:31:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20469"
    },
    {
      "type": "WEB",
      "url": "https://seclists.org/fulldisclosure/2024/Jul/14"
    },
    {
      "type": "WEB",
      "url": "https://www.one2track.nl"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2024/Jul/14"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/lf-edge/eve"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20220708121648-5fef4d92e758"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-43633"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-522",
      "CWE-922"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-04T21:36:42Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nOn boot, Pillar checks for /config/GlobalConfig/global.json and overrides system configuration if present. This allows enabling debug functions like SSH (debug.enable.ssh), USB keyboard (debug.enable.usb), and VNC access (app.allow.vnc) without triggering the measured boot. Thus, a user with physical access can take out the disk and modify the content of this file in the /config partition and then re-insert the disk.\n\n### Patches\n\nFixed in \u200b\u200b10.1.0 and 9.4.3-lts\n\n### Workarounds\n\nNone",
  "id": "GHSA-4c4v-42hc-72p6",
  "modified": "2026-02-04T21:36:42Z",
  "published": "2026-02-04T21:36:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/lf-edge/eve/security/advisories/GHSA-4c4v-42hc-72p6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43633"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lf-edge/eve/commit/5fef4d92e75838cc78010edaed5247dfbdae1889"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lf-edge/eve/commit/aa3501d6c57206ced222c33aea15a9169d629141"
    },
    {
      "type": "WEB",
      "url": "https://asrg.io/security-advisories/cve-2023-43633"
    },
    {
      "type": "WEB",
      "url": "https://asrg.io/security-advisories/debug-functions-unlockable-without-triggering-measured-boot"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lf-edge/eve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "EVE\u0027s Debug Functions Unlockable Without Triggering Measured Boot"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-29809"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-922"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-08T18:16:06Z",
    "severity": "HIGH"
  },
  "details": "Insecure storage of sensitive information in Windows Kerberos allows an authorized attacker to bypass a security feature locally.",
  "id": "GHSA-4f8x-f25f-pp6r",
  "modified": "2025-04-08T18:34:57Z",
  "published": "2025-04-08T18:34:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29809"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29809"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}