Common Weakness Enumeration
CWE-922
Allowed-with-ReviewInsecure Storage of Sensitive Information
Abstraction: Class · Status: Incomplete
The product stores sensitive information without properly limiting read or write access by unauthorized actors.
444 vulnerabilities reference this CWE, most recent first.
GHSA-CR3Q-PQGQ-M8C2
Vulnerability from github – Published: 2022-03-12 00:00 – Updated: 2025-09-02 22:23
VLAI
Summary
Spoofing attack in swagger-ui
Details
Swagger UI before 4.1.3 could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions.
Severity
4.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "swagger-ui"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.webjars:swagger-ui"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-25031"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-918",
"CWE-922"
],
"github_reviewed": true,
"github_reviewed_at": "2022-03-14T23:31:48Z",
"nvd_published_at": "2022-03-11T07:15:00Z",
"severity": "MODERATE"
},
"details": "Swagger UI before 4.1.3 could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions.",
"id": "GHSA-cr3q-pqgq-m8c2",
"modified": "2025-09-02T22:23:59Z",
"published": "2022-03-12T00:00:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25031"
},
{
"type": "WEB",
"url": "https://github.com/swagger-api/swagger-ui/issues/4872"
},
{
"type": "WEB",
"url": "https://github.com/swagger-api/swagger-ui/pull/7697"
},
{
"type": "PACKAGE",
"url": "https://github.com/swagger-api/swagger-ui"
},
{
"type": "WEB",
"url": "https://github.com/swagger-api/swagger-ui/releases/tag/v4.1.3"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20220407-0004"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JS-SWAGGERUI-2314885"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Spoofing attack in swagger-ui"
}
GHSA-CVMF-9FRC-7XWX
Vulnerability from github – Published: 2021-12-24 00:00 – Updated: 2022-01-06 00:01
VLAI
Details
An issue existed in the storage of sensitive tokens. This issue was addressed by placing the tokens in Keychain. This issue is fixed in macOS High Sierra 10.13. A local attacker may gain access to iCloud authentication tokens.
{
"affected": [],
"aliases": [
"CVE-2017-13909"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-23T20:15:00Z",
"severity": "MODERATE"
},
"details": "An issue existed in the storage of sensitive tokens. This issue was addressed by placing the tokens in Keychain. This issue is fixed in macOS High Sierra 10.13. A local attacker may gain access to iCloud authentication tokens.",
"id": "GHSA-cvmf-9frc-7xwx",
"modified": "2022-01-06T00:01:19Z",
"published": "2021-12-24T00:00:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-13909"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT208144"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-F324-3FXJ-HH78
Vulnerability from github – Published: 2025-03-15 09:30 – Updated: 2025-03-15 09:30
VLAI
Details
A flaw was found in Foreman/Red Hat Satellite. Improper file permissions allow low-privileged OS users to monitor and access temporary files under /var/tmp, exposing sensitive command outputs, such as /etc/shadow. This issue can lead to information disclosure and privilege escalation if exploited effectively.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-2157"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-15T07:15:34Z",
"severity": "LOW"
},
"details": "A flaw was found in Foreman/Red Hat Satellite. Improper file permissions allow low-privileged OS users to monitor and access temporary files under /var/tmp, exposing sensitive command outputs, such as /etc/shadow. This issue can lead to information disclosure and privilege escalation if exploited effectively.",
"id": "GHSA-f324-3fxj-hh78",
"modified": "2025-03-15T09:30:18Z",
"published": "2025-03-15T09:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2157"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-2157"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2351092"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F3WG-X6PW-J7FX
Vulnerability from github – Published: 2022-05-24 19:05 – Updated: 2022-05-24 19:05
VLAI
Details
Information Exposure vulnerability in Samsung Notes prior to version 4.2.04.27 allows attacker to access s pen latency information.
{
"affected": [],
"aliases": [
"CVE-2021-25402"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-11T15:15:00Z",
"severity": "LOW"
},
"details": "Information Exposure vulnerability in Samsung Notes prior to version 4.2.04.27 allows attacker to access s pen latency information.",
"id": "GHSA-f3wg-x6pw-j7fx",
"modified": "2022-05-24T19:05:09Z",
"published": "2022-05-24T19:05:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25402"
},
{
"type": "WEB",
"url": "https://security.samsungmobile.com/serviceWeb.smsb?year=2021\u0026month=5"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-F489-9VF2-C8V9
Vulnerability from github – Published: 2022-05-13 00:01 – Updated: 2022-05-21 00:00
VLAI
Details
Sensitive Data Exposure Due To Insecure Storage Of Profile Image in GitHub repository polonel/trudesk prior to v1.2.1.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-1044"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-12T08:15:00Z",
"severity": "MODERATE"
},
"details": "Sensitive Data Exposure Due To Insecure Storage Of Profile Image in GitHub repository polonel/trudesk prior to v1.2.1.",
"id": "GHSA-f489-9vf2-c8v9",
"modified": "2022-05-21T00:00:40Z",
"published": "2022-05-13T00:01:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1044"
},
{
"type": "WEB",
"url": "https://github.com/polonel/trudesk/commit/097b4823935c4fa524e71ab2dd107cf2056922b0"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/ff878be9-563a-4d0e-99c1-fc3c767f6d3e"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F6CM-FMX2-2V57
Vulnerability from github – Published: 2023-07-10 18:30 – Updated: 2024-04-04 05:53
VLAI
Details
HCL Launch could disclose sensitive information if a manual edit of a configuration file has been performed.
Severity
5.1 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-23348"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-10T18:15:10Z",
"severity": "MODERATE"
},
"details": "HCL Launch could disclose sensitive information if a manual edit of a configuration file has been performed.\n",
"id": "GHSA-f6cm-fmx2-2v57",
"modified": "2024-04-04T05:53:57Z",
"published": "2023-07-10T18:30:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23348"
},
{
"type": "WEB",
"url": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0105978"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F79M-6547-466X
Vulnerability from github – Published: 2024-04-25 18:30 – Updated: 2024-07-03 18:36
VLAI
Details
An issue in CmsEasy v.7.7 and before allows a remote attacker to obtain sensitive information via the update function in the index.php component.
Severity
{
"affected": [],
"aliases": [
"CVE-2024-32236"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-25T17:15:49Z",
"severity": "LOW"
},
"details": "An issue in CmsEasy v.7.7 and before allows a remote attacker to obtain sensitive information via the update function in the index.php component.",
"id": "GHSA-f79m-6547-466x",
"modified": "2024-07-03T18:36:49Z",
"published": "2024-04-25T18:30:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32236"
},
{
"type": "WEB",
"url": "https://github.com/cidengcc/cmseasy/issues/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F8C5-7MVV-CRQ3
Vulnerability from github – Published: 2024-03-18 21:31 – Updated: 2024-08-28 18:31
VLAI
Details
Insecure storage of LDAP passwords in the authentication functionality of AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS allows members (with read access to the application database) to decrypt the LDAP passwords of users who successfully authenticate to web management via LDAP.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-25655"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-18T20:15:08Z",
"severity": "MODERATE"
},
"details": "Insecure storage of LDAP passwords in the authentication functionality of AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS allows members (with read access to the application database) to decrypt the LDAP passwords of users who successfully authenticate to web management via LDAP.",
"id": "GHSA-f8c5-7mvv-crq3",
"modified": "2024-08-28T18:31:53Z",
"published": "2024-03-18T21:31:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25655"
},
{
"type": "WEB",
"url": "https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25655"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F8G5-8CW5-CG9C
Vulnerability from github – Published: 2024-02-29 03:33 – Updated: 2024-02-29 03:33
VLAI
Details
The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.12.3 via the multi-call backup option. This makes it possible for unauthenticated attackers to extract sensitive data from a temporary SQL file via repeated GET requests during the limited time window of the backup process.
Severity
5.9 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-6565"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-29T01:42:39Z",
"severity": "MODERATE"
},
"details": "The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.12.3 via the multi-call backup option. This makes it possible for unauthenticated attackers to extract sensitive data from a temporary SQL file via repeated GET requests during the limited time window of the backup process.",
"id": "GHSA-f8g5-8cw5-cg9c",
"modified": "2024-02-29T03:33:14Z",
"published": "2024-02-29T03:33:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6565"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3007309/iwp-client"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2fdc32a4-adf8-4174-924b-5d0b763d010c?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F8Q5-X5FJ-X8WJ
Vulnerability from github – Published: 2024-03-08 03:31 – Updated: 2026-04-02 21:31
VLAI
Details
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.4, iOS 17.4 and iPadOS 17.4. An app may be able to access sensitive user data.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-23205"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-08T02:15:47Z",
"severity": "MODERATE"
},
"details": "A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.4, iOS 17.4 and iPadOS 17.4. An app may be able to access sensitive user data.",
"id": "GHSA-f8q5-x5fj-x8wj",
"modified": "2026-04-02T21:31:36Z",
"published": "2024-03-08T03:31:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23205"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/120893"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/120895"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT214081"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT214084"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT214081"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT214084"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Mar/21"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.