Common Weakness Enumeration
CWE-922
Allowed-with-ReviewInsecure Storage of Sensitive Information
Abstraction: Class · Status: Incomplete
The product stores sensitive information without properly limiting read or write access by unauthorized actors.
444 vulnerabilities reference this CWE, most recent first.
GHSA-QPJ5-F88Q-X7PX
Vulnerability from github – Published: 2022-05-24 17:40 – Updated: 2025-05-30 14:02
VLAI
Summary
MantisBT Insecure Storage in manage_proj_edit_page.php
Details
In manage_proj_edit_page.php in MantisBT before 2.24.4, any unprivileged logged-in user can retrieve Private Projects' names via the manage_proj_edit_page.php project_id parameter, without having access to them.
Severity
4.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "mantisbt/mantisbt"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.24.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-29603"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": true,
"github_reviewed_at": "2025-05-30T14:02:21Z",
"nvd_published_at": "2021-01-29T07:15:00Z",
"severity": "MODERATE"
},
"details": "In manage_proj_edit_page.php in MantisBT before 2.24.4, any unprivileged logged-in user can retrieve Private Projects\u0027 names via the manage_proj_edit_page.php project_id parameter, without having access to them.",
"id": "GHSA-qpj5-f88q-x7px",
"modified": "2025-05-30T14:02:21Z",
"published": "2022-05-24T17:40:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29603"
},
{
"type": "WEB",
"url": "https://github.com/mantisbt/mantisbt/commit/cff10f266f67e2da3060ea4d0b9ecbb29c21b869"
},
{
"type": "PACKAGE",
"url": "https://github.com/mantisbt/mantisbt"
},
{
"type": "WEB",
"url": "https://mantisbt.org/bugs/view.php?id=27357"
},
{
"type": "WEB",
"url": "https://mantisbt.org/bugs/view.php?id=27726"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "MantisBT Insecure Storage in manage_proj_edit_page.php"
}
GHSA-QPXM-689R-3849
Vulnerability from github – Published: 2024-02-26 18:30 – Updated: 2024-10-31 16:57
VLAI
Summary
Apache Camel data exposure vulnerability
Details
Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel. This issue affects Apache Camel: from 3.0.0 through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0.
Users are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.
Severity
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.camel:camel-core"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.21.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.camel:camel-core"
},
"ranges": [
{
"events": [
{
"introduced": "3.22.0"
},
{
"fixed": "3.22.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.22.0"
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.camel:camel-core"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.0.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.camel:camel-core"
},
"ranges": [
{
"events": [
{
"introduced": "4.1.0"
},
{
"fixed": "4.4.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-22371"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-922"
],
"github_reviewed": true,
"github_reviewed_at": "2024-02-26T21:30:37Z",
"nvd_published_at": "2024-02-26T16:27:56Z",
"severity": "LOW"
},
"details": "Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel. This issue affects Apache Camel: from 3.0.0 through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0.\n\nUsers are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.\n\n",
"id": "GHSA-qpxm-689r-3849",
"modified": "2024-10-31T16:57:20Z",
"published": "2024-02-26T18:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22371"
},
{
"type": "WEB",
"url": "https://camel.apache.org/security/CVE-2024-22371.html"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/camel"
},
{
"type": "WEB",
"url": "https://issues.apache.org/jira/browse/CAMEL-20305"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Apache Camel data exposure vulnerability"
}
GHSA-QQ2Q-77MX-9G8P
Vulnerability from github – Published: 2025-02-04 09:31 – Updated: 2025-02-04 09:31
VLAI
Details
Inclusion of sensitive information in test code in softsim TA prior to SMR Jan-2025 Release 1 allows local privileged attackers to get test key.
Severity
4.1 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-20886"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-04T08:15:29Z",
"severity": "MODERATE"
},
"details": "Inclusion of sensitive information in test code in softsim TA prior to SMR Jan-2025 Release 1 allows local privileged attackers to get test key.",
"id": "GHSA-qq2q-77mx-9g8p",
"modified": "2025-02-04T09:31:08Z",
"published": "2025-02-04T09:31:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20886"
},
{
"type": "WEB",
"url": "https://security.samsungmobile.com/securityUpdate.smsb?year=2025\u0026month=01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QQJ9-5C87-9CX7
Vulnerability from github – Published: 2024-10-01 12:30 – Updated: 2024-10-01 12:30
VLAI
Details
HCL Nomad server on Domino did not configure certain HTTP Security headers by default which could allow an attacker to obtain sensitive information via unspecified vectors.
Severity
{
"affected": [],
"aliases": [
"CVE-2024-30132"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-01T12:15:03Z",
"severity": "LOW"
},
"details": "HCL Nomad server on Domino did not configure certain HTTP Security headers by default which could allow an attacker to obtain sensitive information via unspecified vectors.",
"id": "GHSA-qqj9-5c87-9cx7",
"modified": "2024-10-01T12:30:30Z",
"published": "2024-10-01T12:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30132"
},
{
"type": "WEB",
"url": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0116298"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QQR5-9J5G-M238
Vulnerability from github – Published: 2024-02-23 09:30 – Updated: 2024-02-23 09:30
VLAI
Details
Sametime Connect desktop chat client includes, but does not use or require, the use of an Eclipse feature called Secure Storage. Using this Eclipse feature to store sensitive data can lead to exposure of that data.
Severity
{
"affected": [],
"aliases": [
"CVE-2023-37540"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-23T07:15:47Z",
"severity": "LOW"
},
"details": "Sametime Connect desktop chat client includes, but does not use or require, the use of an Eclipse feature called Secure Storage. Using this Eclipse feature to store sensitive data can lead to exposure of that data.\n",
"id": "GHSA-qqr5-9j5g-m238",
"modified": "2024-02-23T09:30:38Z",
"published": "2024-02-23T09:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37540"
},
{
"type": "WEB",
"url": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0109082"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QRCV-JF73-5VRQ
Vulnerability from github – Published: 2024-05-02 18:30 – Updated: 2024-05-02 18:30
VLAI
Details
The WP Meta SEO plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.12 via the meta description. This makes it possible for unauthenticated attackers to disclose potentially sensitive information via the meta description of password-protected posts.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-6962"
],
"database_specific": {
"cwe_ids": [
"CWE-1230",
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-02T17:15:08Z",
"severity": "MODERATE"
},
"details": "The WP Meta SEO plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.12 via the meta description. This makes it possible for unauthenticated attackers to disclose potentially sensitive information via the meta description of password-protected posts.",
"id": "GHSA-qrcv-jf73-5vrq",
"modified": "2024-05-02T18:30:51Z",
"published": "2024-05-02T18:30:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6962"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3071453%40wp-meta-seo%2Ftrunk\u0026old=3068145%40wp-meta-seo%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0323b54b-c15b-4d2d-9e8f-3df87c84dd49?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QRX6-94XM-F6M7
Vulnerability from github – Published: 2022-06-03 00:01 – Updated: 2022-06-11 00:00
VLAI
Details
An issue was discovered in FlightRadar24 v8.9.0, v8.10.0, v8.10.2, v8.10.3, v8.10.4 for Android, allows attackers to cause unspecified consequences due to being able to decompile a local application and extract their API keys.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2021-43512"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-06-02T14:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in FlightRadar24 v8.9.0, v8.10.0, v8.10.2, v8.10.3, v8.10.4 for Android, allows attackers to cause unspecified consequences due to being able to decompile a local application and extract their API keys.",
"id": "GHSA-qrx6-94xm-f6m7",
"modified": "2022-06-11T00:00:27Z",
"published": "2022-06-03T00:01:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43512"
},
{
"type": "WEB",
"url": "https://medium.com/@janmejayaswainofficial/advisory-of-cve-2021-43512-5e54e6a93101"
},
{
"type": "WEB",
"url": "https://www.flightradar24.com"
},
{
"type": "WEB",
"url": "https://www.flightradar24.com.aa"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R5VQ-M2MP-CPFJ
Vulnerability from github – Published: 2024-11-27 18:34 – Updated: 2025-12-19 15:31
VLAI
Details
InfluxDB through 2.7.10 allows allAccess administrators to retrieve all raw tokens via an "influx auth ls" command. NOTE: the supplier indicates that this is intentional but is a "poor design choice" that will be changed in a future release.
Severity
9.1 (Critical)
{
"affected": [],
"aliases": [
"CVE-2024-30896"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-21T11:15:34Z",
"severity": "CRITICAL"
},
"details": "InfluxDB through 2.7.10 allows allAccess administrators to retrieve all raw tokens via an \"influx auth ls\" command. NOTE: the supplier indicates that this is intentional but is a \"poor design choice\" that will be changed in a future release.",
"id": "GHSA-r5vq-m2mp-cpfj",
"modified": "2025-12-19T15:31:17Z",
"published": "2024-11-27T18:34:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30896"
},
{
"type": "WEB",
"url": "https://github.com/influxdata/influxdb/issues/24797"
},
{
"type": "WEB",
"url": "https://github.com/XenoM0rph97/CVE-2024-30896"
},
{
"type": "WEB",
"url": "https://github.com/influxdata/influxdb/releases/tag/v2.8.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-R6XH-2P9X-84PQ
Vulnerability from github – Published: 2024-02-12 18:31 – Updated: 2024-10-10 15:30
VLAI
Details
A hidden interface in Motorola CX2L Router firmware v1.0.1 leaks information regarding the SystemWizardStatus component via sending a crafted request to device_web_ip.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-25360"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-12T16:15:08Z",
"severity": "MODERATE"
},
"details": "A hidden interface in Motorola CX2L Router firmware v1.0.1 leaks information regarding the SystemWizardStatus component via sending a crafted request to device_web_ip.",
"id": "GHSA-r6xh-2p9x-84pq",
"modified": "2024-10-10T15:30:30Z",
"published": "2024-02-12T18:31:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25360"
},
{
"type": "WEB",
"url": "https://github.com/leetsun/Hints/tree/main/moto-CX2L/4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R72F-RMC7-WHWP
Vulnerability from github – Published: 2024-03-08 03:31 – Updated: 2026-04-02 21:31
VLAI
Details
A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, watchOS 10.4. An app may be able to access user-sensitive data.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-23290"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-08T02:15:50Z",
"severity": "MODERATE"
},
"details": "A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, watchOS 10.4. An app may be able to access user-sensitive data.",
"id": "GHSA-r72f-rmc7-whwp",
"modified": "2026-04-02T21:31:39Z",
"published": "2024-03-08T03:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23290"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/120881"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/120882"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/120893"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/120895"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT214081"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT214084"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT214086"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT214088"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT214081"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT214084"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT214086"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT214088"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Mar/21"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Mar/24"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Mar/25"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.