Common Weakness Enumeration
CWE-922
Allowed-with-ReviewInsecure Storage of Sensitive Information
Abstraction: Class · Status: Incomplete
The product stores sensitive information without properly limiting read or write access by unauthorized actors.
444 vulnerabilities reference this CWE, most recent first.
GHSA-G6F3-67V4-98VV
Vulnerability from github – Published: 2024-10-11 21:31 – Updated: 2024-10-15 18:30
VLAI
Details
An issue in Plug n Play Camera com.wisdomcity.zwave 1.1.0 allows a remote attacker to obtain sensitive information via the firmware update process.
Severity
8.2 (High)
{
"affected": [],
"aliases": [
"CVE-2024-48770"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-11T20:15:05Z",
"severity": "HIGH"
},
"details": "An issue in Plug n Play Camera com.wisdomcity.zwave 1.1.0 allows a remote attacker to obtain sensitive information via the firmware update process.",
"id": "GHSA-g6f3-67v4-98vv",
"modified": "2024-10-15T18:30:49Z",
"published": "2024-10-11T21:31:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48770"
},
{
"type": "WEB",
"url": "https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.wisdomcity.zwave/com.wisdomcity.zwave.md"
},
{
"type": "WEB",
"url": "http://comwisdomcityzwave.com"
},
{
"type": "WEB",
"url": "http://plug.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-G774-VX5R-X2VG
Vulnerability from github – Published: 2024-10-28 21:30 – Updated: 2026-04-02 21:31
VLAI
Details
This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. An app may be able to read sensitive location information.
Severity
{
"affected": [],
"aliases": [
"CVE-2024-44222"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-28T21:15:06Z",
"severity": "LOW"
},
"details": "This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. An app may be able to read sensitive location information.",
"id": "GHSA-g774-vx5r-x2vg",
"modified": "2026-04-02T21:31:59Z",
"published": "2024-10-28T21:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44222"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/121564"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/121568"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/121570"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Oct/11"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Oct/12"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Oct/13"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-G77X-HH5W-QPW7
Vulnerability from github – Published: 2024-04-08 03:30 – Updated: 2024-11-27 18:34
VLAI
Details
In modem driver, there is a possible system crash due to improper input validation. This could lead to local information disclosure with System execution privileges needed
Severity
6.0 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-52345"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-08T03:15:08Z",
"severity": "MODERATE"
},
"details": "In modem driver, there is a possible system crash due to improper input validation. This could lead to local information disclosure with System execution privileges needed",
"id": "GHSA-g77x-hh5w-qpw7",
"modified": "2024-11-27T18:34:00Z",
"published": "2024-04-08T03:30:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52345"
},
{
"type": "WEB",
"url": "https://www.unisoc.com/en_us/secy/announcementDetail/1777143682512781313"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G789-9H8J-6WHM
Vulnerability from github – Published: 2025-08-26 15:31 – Updated: 2025-08-26 18:31
VLAI
Details
Incorrect access control in the EEPROM component of Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 allows attackers to replace password hashes stored in the EEPROM with hashes of their own, leading to the escalation of privileges to root.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-25732"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-26T15:15:42Z",
"severity": "MODERATE"
},
"details": "Incorrect access control in the EEPROM component of Kapsch TrafficCom RIS-9160 \u0026 RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 allows attackers to replace password hashes stored in the EEPROM with hashes of their own, leading to the escalation of privileges to root.",
"id": "GHSA-g789-9h8j-6whm",
"modified": "2025-08-26T18:31:15Z",
"published": "2025-08-26T15:31:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25732"
},
{
"type": "WEB",
"url": "https://cwe.mitre.org/data/definitions/922.html"
},
{
"type": "WEB",
"url": "https://phrack.org/issues/72/16_md"
},
{
"type": "WEB",
"url": "https://www.kapsch.net/_Resources/Persistent/3d251a8445e0bf50093903ad70b3dbed34dec7e7/KTC-CVS_RIS-9260_DataSheet.pdf"
},
{
"type": "WEB",
"url": "https://www.kapsch.net/_Resources/Persistent/55fb8d0fb279262809eac88d457894db1b3efcd5/Kapsch_RIS-9160_Datasheet_EN.pdf"
},
{
"type": "WEB",
"url": "https://www.kapsch.net/en"
},
{
"type": "WEB",
"url": "https://www.kapsch.net/en/press/releases/ktc-20200813-pr-en"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-G9M6-GVQR-98XQ
Vulnerability from github – Published: 2025-01-09 21:31 – Updated: 2025-01-23 18:31
VLAI
Details
Smart Toilet Lab - Motius 1.3.11 is running with debug mode turned on (DEBUG = True) and exposing sensitive information defined in Django settings file through verbose error page.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2024-56113"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-09T20:15:39Z",
"severity": "HIGH"
},
"details": "Smart Toilet Lab - Motius 1.3.11 is running with debug mode turned on (DEBUG = True) and exposing sensitive information defined in Django settings file through verbose error page.",
"id": "GHSA-g9m6-gvqr-98xq",
"modified": "2025-01-23T18:31:14Z",
"published": "2025-01-09T21:31:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56113"
},
{
"type": "WEB",
"url": "https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2024-56113"
},
{
"type": "WEB",
"url": "https://smarttoilet.pratt.duke.edu"
},
{
"type": "WEB",
"url": "https://www.motius.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GH2G-9GCC-7CPV
Vulnerability from github – Published: 2022-05-13 01:46 – Updated: 2022-05-13 01:46
VLAI
Details
USB Pratirodh is prone to sensitive information disclosure. It stores sensitive information such as username and password in simple usb.xml. An attacker with physical access to the system can modify the file according his own requirements that may aid in further attack.
Severity
6.6 (Medium)
{
"affected": [],
"aliases": [
"CVE-2017-6911"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-03-23T20:59:00Z",
"severity": "MODERATE"
},
"details": "USB Pratirodh is prone to sensitive information disclosure. It stores sensitive information such as username and password in simple usb.xml. An attacker with physical access to the system can modify the file according his own requirements that may aid in further attack.",
"id": "GHSA-gh2g-9gcc-7cpv",
"modified": "2022-05-13T01:46:47Z",
"published": "2022-05-13T01:46:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6911"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/141651/USB-Pratirodh-Insecure-Password-Storage.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2017/Mar/43"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/540289/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/96970"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GH7H-R3FF-2VQ6
Vulnerability from github – Published: 2023-09-15 00:30 – Updated: 2024-04-04 07:41
VLAI
Details
Insecure storage of sensitive information in Wing FTP Server (User Web Client) allows information elicitation.This issue affects Wing FTP Server: <= 7.2.0.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2023-37879"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-12T09:15:08Z",
"severity": "HIGH"
},
"details": "Insecure storage of sensitive information in Wing FTP Server (User Web Client) allows information elicitation.This issue affects Wing FTP Server: \u003c= 7.2.0.\n\n",
"id": "GHSA-gh7h-r3ff-2vq6",
"modified": "2024-04-04T07:41:29Z",
"published": "2023-09-15T00:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37879"
},
{
"type": "WEB",
"url": "https://www.wftpserver.com/serverhistory.htm"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GRQ3-9M83-RGPR
Vulnerability from github – Published: 2024-12-12 03:33 – Updated: 2026-04-02 21:32
VLAI
Details
This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.1 and iPadOS 18.1. An app may be able to read sensitive location information.
Severity
{
"affected": [],
"aliases": [
"CVE-2024-44200"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-12T02:15:23Z",
"severity": "LOW"
},
"details": "This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.1 and iPadOS 18.1. An app may be able to read sensitive location information.",
"id": "GHSA-grq3-9m83-rgpr",
"modified": "2026-04-02T21:32:01Z",
"published": "2024-12-12T03:33:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44200"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/121563"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/121564"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GVXW-CJ6R-74WG
Vulnerability from github – Published: 2025-08-06 21:31 – Updated: 2025-08-06 21:31
VLAI
Details
An issue was discovered in 4C Strategies Exonaut 21.6. Passwords, stored in the database, are hashed without a salt.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-46660"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-06T21:15:29Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in 4C Strategies Exonaut 21.6. Passwords, stored in the database, are hashed without a salt.",
"id": "GHSA-gvxw-cj6r-74wg",
"modified": "2025-08-06T21:31:40Z",
"published": "2025-08-06T21:31:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46660"
},
{
"type": "WEB",
"url": "https://gist.github.com/Jowu73/b8a2a267804dbfb17876dbedbbbfb28f"
},
{
"type": "WEB",
"url": "https://www.4cstrategies.com/solutions/exonaut"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GXHQ-4CHX-5R72
Vulnerability from github – Published: 2022-05-24 17:37 – Updated: 2022-05-24 17:37
VLAI
Details
There is an information disclosure vulnerability in TE Mobile software versions V600R006C10,V600R006C10SPC100. Due to the improper storage of some information in certain specific scenario, the attacker can gain information in the victim's device to launch the attack, successful exploit could cause information disclosure.
{
"affected": [],
"aliases": [
"CVE-2020-9202"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-12-24T16:15:00Z",
"severity": "MODERATE"
},
"details": "There is an information disclosure vulnerability in TE Mobile software versions V600R006C10,V600R006C10SPC100. Due to the improper storage of some information in certain specific scenario, the attacker can gain information in the victim\u0027s device to launch the attack, successful exploit could cause information disclosure.",
"id": "GHSA-gxhq-4chx-5r72",
"modified": "2022-05-24T17:37:17Z",
"published": "2022-05-24T17:37:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9202"
},
{
"type": "WEB",
"url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201209-01-informationleak-en"
}
],
"schema_version": "1.4.0",
"severity": []
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.