Common Weakness Enumeration
CWE-922
Allowed-with-ReviewInsecure Storage of Sensitive Information
Abstraction: Class · Status: Incomplete
The product stores sensitive information without properly limiting read or write access by unauthorized actors.
444 vulnerabilities reference this CWE, most recent first.
GHSA-5VFX-5JGV-GVWR
Vulnerability from github – Published: 2023-06-05 09:30 – Updated: 2024-04-04 04:31
VLAI
Details
Anonymous user may get the list of existing users managed by the application, that could ease further attacks (see CVE-2023-3065 and 3066)This issue affects Mobatime mobile application AMXGT100 through 1.3.20.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2023-3064"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-05T09:15:09Z",
"severity": "MODERATE"
},
"details": "Anonymous user may get the list of existing users managed by the application, that could ease further attacks (see CVE-2023-3065 and 3066)This issue affects Mobatime mobile application AMXGT100 through 1.3.20.\n\n",
"id": "GHSA-5vfx-5jgv-gvwr",
"modified": "2024-04-04T04:31:41Z",
"published": "2023-06-05T09:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3064"
},
{
"type": "WEB",
"url": "https://borelenzo.github.io/stuff/2023/06/02/cve-2023-3064_65_66.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5WMP-RJ4F-WC26
Vulnerability from github – Published: 2023-08-02 15:30 – Updated: 2024-04-04 06:29
VLAI
Details
Information disclosure in password protected surveys in Data Illusion Survey Software Solutions NGSurvey v2.4.28 and below allows attackers to view the password to access and arbitrarily submit surveys.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2022-46484"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-02T15:15:09Z",
"severity": "HIGH"
},
"details": "Information disclosure in password protected surveys in Data Illusion Survey Software Solutions NGSurvey v2.4.28 and below allows attackers to view the password to access and arbitrarily submit surveys.",
"id": "GHSA-5wmp-rj4f-wc26",
"modified": "2024-04-04T06:29:43Z",
"published": "2023-08-02T15:30:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46484"
},
{
"type": "WEB",
"url": "https://github.com/WodenSec/CVE-2022-46484"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5WX3-HJMF-QCGX
Vulnerability from github – Published: 2025-05-28 18:33 – Updated: 2025-05-28 18:33
VLAI
Details
The TeleMessage service through 2025-05-05 implements authentication through a long-lived credential (e.g., not a token with a short expiration time) that can be reused at a later date if discovered by an adversary, as exploited in the wild in May 2025.
Severity
4.0 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-48929"
],
"database_specific": {
"cwe_ids": [
"CWE-613",
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-28T17:15:25Z",
"severity": "MODERATE"
},
"details": "The TeleMessage service through 2025-05-05 implements authentication through a long-lived credential (e.g., not a token with a short expiration time) that can be reused at a later date if discovered by an adversary, as exploited in the wild in May 2025.",
"id": "GHSA-5wx3-hjmf-qcgx",
"modified": "2025-05-28T18:33:28Z",
"published": "2025-05-28T18:33:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48929"
},
{
"type": "WEB",
"url": "https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-628Q-5GQP-MR86
Vulnerability from github – Published: 2024-06-25 03:31 – Updated: 2024-06-25 03:31
VLAI
Details
udn News Android APP stores the unencrypted user session in the local database when user log into the application. A malicious APP or an attacker with physical access to the Android device can retrieve this session and use it to log into the news APP and other services provided by udn.
Severity
{
"affected": [],
"aliases": [
"CVE-2024-6295"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-25T03:15:10Z",
"severity": "LOW"
},
"details": "udn News Android APP stores the unencrypted user session in the local database when user log into the application. A malicious APP or an attacker with physical access to the Android device can retrieve this session and use it to log into the news APP and other services provided by udn.",
"id": "GHSA-628q-5gqp-mr86",
"modified": "2024-06-25T03:31:07Z",
"published": "2024-06-25T03:31:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6295"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/en/cp-139-7895-80dac-2.html"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/tw/cp-132-7894-aebd8-1.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-676C-P5XH-7HFR
Vulnerability from github – Published: 2024-02-29 00:30 – Updated: 2024-11-15 21:30
VLAI
Details
An issue in uverif v.2.0 allows a remote attacker to obtain sensitive information.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-26559"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-28T23:15:09Z",
"severity": "MODERATE"
},
"details": "An issue in uverif v.2.0 allows a remote attacker to obtain sensitive information.",
"id": "GHSA-676c-p5xh-7hfr",
"modified": "2024-11-15T21:30:45Z",
"published": "2024-02-29T00:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26559"
},
{
"type": "WEB",
"url": "https://syst1m.cn/2024/01/22/U%E9%AA%8C%E8%AF%81%E7%BD%91%E7%BB%9C%E7%94%A8%E6%88%B7%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F_%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-67QP-79MM-XM85
Vulnerability from github – Published: 2023-05-10 15:30 – Updated: 2024-04-04 04:00
VLAI
Details
Insecure storage of sensitive information in the Intel(R) DCM software before version 5.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity
6.0 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-43475"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-10T14:15:24Z",
"severity": "HIGH"
},
"details": "Insecure storage of sensitive information in the Intel(R) DCM software before version 5.1 may allow an authenticated user to potentially enable escalation of privilege via local access.",
"id": "GHSA-67qp-79mm-xm85",
"modified": "2024-04-04T04:00:09Z",
"published": "2023-05-10T15:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43475"
},
{
"type": "WEB",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00806.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-684V-2FJ2-H2CW
Vulnerability from github – Published: 2024-10-28 21:30 – Updated: 2025-11-04 00:31
VLAI
Details
A logic issue was addressed with improved state management. This issue is fixed in iOS 18.1 and iPadOS 18.1. An app may be able to access user-sensitive data.
Severity
4.0 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-44263"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-28T21:15:07Z",
"severity": "MODERATE"
},
"details": "A logic issue was addressed with improved state management. This issue is fixed in iOS 18.1 and iPadOS 18.1. An app may be able to access user-sensitive data.",
"id": "GHSA-684v-2fj2-h2cw",
"modified": "2025-11-04T00:31:50Z",
"published": "2024-10-28T21:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44263"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/121563"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Oct/9"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-68WM-4XJG-6P6M
Vulnerability from github – Published: 2024-04-19 06:30 – Updated: 2025-02-04 18:30
VLAI
Details
In Brocade SANnav before v2.3.1, and v2.3.0a, it is possible to back up the appliance from the web interface or the command line interface ("SSH"). The resulting backups are world-readable. A local attacker can recover backup files, restore them to a new malicious appliance, and retrieve the passwords of all the switches.
Severity
6.8 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-29965"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-19T05:15:49Z",
"severity": "MODERATE"
},
"details": "In Brocade SANnav before v2.3.1, and v2.3.0a, it is possible to back up the appliance from the web interface or the command line interface (\"SSH\"). The resulting backups are world-readable. A local attacker can recover backup files, restore them to a new malicious appliance, and retrieve the passwords of all the switches.",
"id": "GHSA-68wm-4xjg-6p6m",
"modified": "2025-02-04T18:30:44Z",
"published": "2024-04-19T06:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29965"
},
{
"type": "WEB",
"url": "https://support.broadcom.com/external/content/SecurityAdvisories/0/23250"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-69FP-7C8P-CRJR
Vulnerability from github – Published: 2024-06-10 18:36 – Updated: 2024-07-31 14:51
VLAI
Summary
Keycloak exposes sensitive information in Pushed Authorization Requests (PAR)
Details
A flaw was found in Keycloak in the OAuth 2.0 Pushed Authorization Requests (PAR). Client provided parameters were found to be included in plain text in the KC_RESTART cookie returned by the authorization server's HTTP response to a request_uri authorization request. This could lead to an information disclosure vulnerability.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.keycloak:keycloak-services"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "24.0.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-4540"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-922"
],
"github_reviewed": true,
"github_reviewed_at": "2024-06-10T18:36:56Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "A flaw was found in Keycloak in the OAuth 2.0 Pushed Authorization Requests (PAR). Client provided parameters were found to be included in plain text in the KC_RESTART cookie returned by the authorization server\u0027s HTTP response to a request_uri authorization request. This could lead to an information disclosure vulnerability.",
"id": "GHSA-69fp-7c8p-crjr",
"modified": "2024-07-31T14:51:21Z",
"published": "2024-06-10T18:36:56Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-69fp-7c8p-crjr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4540"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/commit/2191cc26ae6deb52eeaf74046027b65804d16fd0"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:3566"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:3567"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:3568"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:3570"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:3572"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:3573"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:3574"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:3575"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:3576"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2024-4540"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2279303"
},
{
"type": "PACKAGE",
"url": "https://github.com/keycloak/keycloak"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Keycloak exposes sensitive information in Pushed Authorization Requests (PAR)"
}
GHSA-6CR3-PFHW-G3C7
Vulnerability from github – Published: 2023-10-25 18:32 – Updated: 2024-10-29 21:30
VLAI
Details
vCenter Server contains a partial information disclosure vulnerability. A malicious actor with non-administrative privileges to vCenter Server may leverage this issue to access unauthorized data.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-34056"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-25T18:17:27Z",
"severity": "MODERATE"
},
"details": "vCenter Server contains a partial information disclosure vulnerability.\u00a0A malicious actor with non-administrative privileges to vCenter Server may leverage this issue to access unauthorized data.",
"id": "GHSA-6cr3-pfhw-g3c7",
"modified": "2024-10-29T21:30:43Z",
"published": "2023-10-25T18:32:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34056"
},
{
"type": "WEB",
"url": "https://www.vmware.com/security/advisories/VMSA-2023-0023.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.