CWE-922 (page 2)
Page 2 of 4 — CVEs classified under CWE-922, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-54477 | Medium | 5.5 | 2024-12-12 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be able to acces… |
CVE-2024-44200 | Low | 3.3 | 2024-12-12 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1. An app may be a… |
CVE-2024-37144 | High | 8.2 | 2024-12-10 | Dell PowerFlex appliance versions prior to IC 46.381.00 and IC 46.376.00, Dell PowerFlex rack versions prior to RCM 3.8.1.0 (for RCM 3.8.x train) and prior to… |
CVE-2024-47043 | High | 7.5 | 2024-12-06 | Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could enable an attacker to correlate a device serial number and the user's phone number and p… |
CVE-2024-12082 | Medium | 5.5 | 2024-12-03 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause information leak through out-of-bounds Read. |
CVE-2024-8899 | Medium | 4.3 | 2024-11-26 | The Jeg Elementor Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.9 via the render_content f… |
CVE-2024-30896 | Critical | 9.1 | 2024-11-21 | InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with read access to the a… |
CVE-2024-3334 | Medium | 4.3 | 2024-11-15 | A security bypass vulnerability exists in the Removable Media Encryption (RME)component of Digital Guardian Windows Agents prior to version 8.2.0. This allows… |
CVE-2024-52519 | Low | 2.7 | 2024-11-15 | Nextcloud Server is a self hosted personal cloud system. The OAuth2 client secrets were stored in a recoverable way, so that an attacker that got access to a b… |
CVE-2022-20939 | Medium | 4.3 | 2024-11-15 | A vulnerability in the web-based management interface of Cisco Smart Software Manager On-Prem could allow an authenticated, remote attacker to elevate pri… |
CVE-2024-3502 | High | 8.1 | 2024-11-14 | In lunary-ai/lunary versions up to and including 1.2.5, an information disclosure vulnerability exists where account recovery hashes of users are inadvertently… |
CVE-2024-3501 | High | 8.1 | 2024-11-14 | In lunary-ai/lunary versions up to and including 1.2.5, an information disclosure vulnerability exists due to the inclusion of single-use tokens in the respons… |
CVE-2024-10943 | Critical | 9.1 | 2024-11-12 | An authentication bypass vulnerability exists in the affected product. The vulnerability exists due to shared secrets across accounts and could allow a threat … |
CVE-2024-43427 | Low | 3.7 | 2024-11-11 | A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded from the export, whi… |
CVE-2024-48939 | High | 7.5 | 2024-11-11 | Insufficient validation performed on the REST API License file in Paxton Net2 before 6.07.14023.5015 (SR4) enables use of the REST API with an invalid License… |
CVE-2020-10368 | Low | 3.5 | 2024-11-10 | Certain Cypress (and Broadcom) Wireless Combo chips, when a January 2021 firmware update is not present, allow memory read access via a "Spectra" attack. |
CVE-2019-20469 | Medium | 4.6 | 2024-11-07 | An issue was discovered on One2Track 2019-12-08 devices. Confidential information is needlessly stored on the smartwatch. Audio files are stored in .amr format… |
CVE-2024-34677 | Medium | 4.0 | 2024-11-06 | Exposure of sensitive information in System UI prior to SMR Nov-2024 Release 1 allow local attackers to make malicious apps appear as legitimate. |
CVE-2024-10028 | High | 7.5 | 2024-11-06 | The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all ve… |
CVE-2024-48353 | High | 7.5 | 2024-11-01 | Yealink Meeting Server before V26.0.0.67 allows attackers to obtain static key information from a front-end JS file and decrypt the plaintext passwords based o… |
CVE-2024-48352 | High | 7.5 | 2024-11-01 | Yealink Meeting Server before V26.0.0.67 is vulnerable to sensitive data exposure in the server response via sending HTTP request with enterprise ID. |
CVE-2024-51399 | Medium | 5.7 | 2024-11-01 | Altai Technologies Ltd Altai IX500 Indoor 22 802.11ac Wave 2 AP After login, there are file reads in the background, and attackers can obtain sensitive informa… |
CVE-2024-44257 | Medium | 5.5 | 2024-10-28 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1… |
CVE-2024-44216 | Medium | 5.5 | 2024-10-28 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An ap… |
CVE-2024-44275 | Medium | 5.5 | 2024-10-28 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. A malicious application may… |
CVE-2024-44263 | Medium | 5.5 | 2024-10-28 | A logic issue was addressed with improved state management. This issue is fixed in iOS 18.1 and iPadOS 18.1. An app may be able to access user-sensitive data. |
CVE-2024-44222 | Low | 3.3 | 2024-10-28 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1… |
CVE-2024-44213 | Medium | 5.9 | 2024-10-28 | An issue existed in the parsing of URLs. This issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7… |
CVE-2024-44175 | Medium | 5.5 | 2024-10-28 | This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7.1. An app may be able to access sensi… |
CVE-2024-44174 | Medium | 5.5 | 2024-10-28 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15. An attacker may be able to view restricted content from the lock screen. |
CVE-2022-30361 | Medium | 5.3 | 2024-10-25 | OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserType. No authentication is required. The… |
CVE-2022-30359 | Medium | 4.3 | 2024-10-25 | OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserList. Authentication is required. The inf… |
CVE-2024-30122 | Medium | 5.8 | 2024-10-23 | HCL Sametime is impacted by misconfigured security related HTTP headers. It was identified that some HTTP headers were missing on web service responses. This w… |
CVE-2024-10041 | Medium | 4.7 | 2024-10-23 | A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending character… |
CVE-2024-20462 | Medium | 5.5 | 2024-10-16 | A vulnerability in the web-based management interface of Cisco ATA 190 Series Multiplatform Analog Telephone Adapter firmware could allow an authenticated, loc… |
CVE-2023-32191 | Critical | 9.9 | 2024-10-16 | When RKE provisions a cluster, it stores the cluster state in a configmap called `full-cluster-state` inside the `kube-system` namespace of the cluster itself… |
CVE-2024-48783 | High | 7.5 | 2024-10-15 | An issue in Ruijie NBR3000D-E Gateway allows a remote attacker to obtain sensitive information via the /tool/shell/postgresql.conf component. |
CVE-2024-21258 | Medium | 5.3 | 2024-10-15 | Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.2.3-12… |
CVE-2024-21211 | Low | 3.7 | 2024-10-15 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Compiler). Supported vers… |
CVE-2024-48770 | High | 8.2 | 2024-10-11 | An issue in Plug n Play Camera com.wisdomcity.zwave 1.1.0 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-42018 | High | 7.7 | 2024-10-11 | An issue was discovered in Atos Eviden SMC xScale before 1.6.6. During initialization of nodes, some configuration parameters are retrieved from management nod… |
CVE-2024-30132 | Low | 3.7 | 2024-10-01 | HCL Nomad server on Domino did not configure certain HTTP Security headers by default which could allow an attacker to obtain sensitive information via unspeci… |
CVE-2024-28808 | Low | 2.7 | 2024-09-30 | An issue was discovered in Infinera hiT 7300 5.60.50. Hidden functionality in the web interface allows a remote authenticated attacker to access reserved infor… |
CVE-2024-46635 | Medium | 5.9 | 2024-09-30 | An issue in the API endpoint /AccountMaster/GetCurrentUserInfo of INROAD before v202402060 allows attackers to access sensitive information via a crafted paylo… |
CVE-2024-47122 | Medium | 4.3 | 2024-09-26 | In the goTenna Pro App, the encryption keys are stored along with a static IV on the End User Device (EUD). This allows for complete decryption of keys store… |
CVE-2024-45374 | Medium | 5.3 | 2024-09-26 | The goTenna Pro ATAK plugin uses a weak password for sharing encryption keys via the key broadcast method. If the broadcasted encryption key is captured over… |
CVE-2024-43694 | Medium | 4.3 | 2024-09-26 | In the goTenna Pro ATAK Plugin application, the encryption keys are stored along with a static IV on the device. This allows for complete decryption of keys… |
CVE-2024-47197 | High | 7.5 | 2024-09-26 | Exposure of Sensitive Information to an Unauthorized Actor, Insecure Storage of Sensitive Information vulnerability in Maven Archetype Plugin. This issue affe… |
CVE-2024-39339 | High | 7.5 | 2024-09-18 | A vulnerability has been discovered in all versions of Smartplay headunits, which are widely used in Suzuki and Toyota cars. This misconfiguration can lead to… |
CVE-2024-37728 | High | 7.5 | 2024-09-10 | Arbitrary File Read vulnerability in Xi'an Daxi Information Technology Co., Ltd OfficeWeb365 v.7.18.23.0 and v8.6.1.0 allows a remote attacker to obtain sensit… |
CVE-2024-39775 | Medium | 6.5 | 2024-09-02 | in OpenHarmony v4.1.0 and prior versions allow a remote attacker cause information leak through out-of-bounds Read. |
CVE-2024-39612 | Medium | 5.5 | 2024-09-02 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause information leak through out-of-bounds Read. |
CVE-2024-38382 | Medium | 5.5 | 2024-09-02 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause information leak through out-of-bounds Read. |
CVE-2024-5288 | Medium | 5.1 | 2024-08-27 | An issue was discovered in wolfSSL before 5.7.0. A safe-error attack via Rowhammer, namely FAULT+PROBE, leads to ECDSA key disclosure. When WOLFSSL_CHECK_SIG_F… |
CVE-2024-42677 | Medium | 5.5 | 2024-08-15 | An issue in Huizhi enterprise resource management system v.1.0 and before allows a local attacker to obtain sensitive information via the /nssys/common/filehan… |
CVE-2024-7569 | Critical | 9.6 | 2024-08-13 | An information disclosure vulnerability in Ivanti ITSM on-prem and Neurons for ITSM versions 2023.4 and earlier allows an unauthenticated attacker to obtain th… |
CVE-2024-40832 | Low | 3.3 | 2024-07-29 | The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.6. An app may be able to view a contact's phone number in system logs. |
CVE-2024-40813 | Medium | 4.6 | 2024-07-29 | A lock screen issue was addressed with improved state management. This issue is fixed in iOS 17.6 and iPadOS 17.6, watchOS 10.6. An attacker with physical acce… |
CVE-2024-6916 | Medium | 5.9 | 2024-07-19 | A vulnerability in Zowe CLI allows local, privileged actors to display securely stored properties in cleartext within a terminal using the '--show-inputs-only'… |
CVE-2024-29120 | Medium | 5.9 | 2024-07-17 | In Streampark (version < 2.1.4), when a user logged in successfully, the Backend service would return "Authorization" as the front-end authentication credentia… |
CVE-2024-38496 | | 2024-07-15 | The vulnerability allows a malicious low-privileged PAM user to access information about other PAM users and their group memberships. | |
CVE-2024-34721 | Medium | 5.5 | 2024-07-09 | In ensureFileColumns of MediaProvider.java, there is a possible disclosure of files owned by another user due to improper input validation. This could lead to… |
CVE-2024-38453 | High | 7.5 | 2024-07-03 | The Avalara for Salesforce CPQ app before 7.0 for Salesforce allows attackers to read an API key. NOTE: the current version is 11 as of mid-2024. |
CVE-2024-5598 | High | 7.5 | 2024-06-29 | The Advanced File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.4 via the 'fma_local_f… |
CVE-2024-39459 | Medium | 4.3 | 2024-06-26 | In rare cases Jenkins Plain Credentials Plugin 182.v468b_97b_9dcb_8 and earlier stores secret file credentials unencrypted (only Base64 encoded) on the Jenkins… |
CVE-2024-29953 | Medium | 4.3 | 2024-06-26 | A vulnerability in the web interface in Brocade Fabric OS before v9.2.1, v9.2.0b, and v9.1.1d prints encoded session passwords on session storage for Virtual F… |
CVE-2024-35526 | Medium | 5.9 | 2024-06-25 | An issue in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers to access sensitive information in the /facade directory. |
CVE-2024-6295 | Low | 3.9 | 2024-06-25 | udn News Android APP stores the unencrypted user session in the local database when user log into the application. A malicious APP or an attacker with physical… |
CVE-2024-37654 | Medium | 6.1 | 2024-06-21 | An issue in BAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE, AV-02IDR, AV-02IPD, AV-02FDE, AV-02FDR, AV-03D, AV-03BD, A… |
CVE-2024-38312 | Medium | 6.5 | 2024-06-13 | When browsing private tabs, some data related to location history or webpage thumbnails could be persisted incorrectly within the sandboxed app bundle after ap… |
CVE-2024-23445 | Medium | 6.5 | 2024-06-12 | It was identified that if a cross-cluster API key https://www.elastic.co/guide/en/elasticsearch/reference/8.14/security-api-create-cross-cluster-api-key.html#… |
CVE-2024-3723 | Medium | 5.3 | 2024-06-11 | The Advanced Contact form 7 DB plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.2 via the wp-cont… |
CVE-2024-31404 | Medium | 4.3 | 2024-06-11 | Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.5.0 to 6.0.0, which may allow a user who can log in to the product to view th… |
CVE-2024-31400 | Medium | 6.5 | 2024-06-11 | Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.0.0 to 5.15.0. If this vulnerability is exploited, unintended data may be lef… |
CVE-2023-6748 | Medium | 4.3 | 2024-06-11 | The Custom Field Template plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 via the 'cft' shortc… |
CVE-2024-36788 | Medium | 4.8 | 2024-06-07 | Netgear WNR614 JNR1010V2 N300-V1.1.0.54_1.0.1 does not properly set the HTTPOnly flag for cookies. This allows attackers to possibly intercept and access sensi… |
CVE-2024-5599 | High | 7.5 | 2024-06-07 | The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includin… |
CVE-2024-5206 | Medium | 4.7 | 2024-06-06 | A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in versions up to and including 1.4.1.post1, which was fi… |
CVE-2024-35311 | Low | 3.3 | 2024-05-29 | Yubico YubiKey 5 Series before 5.7.0, Security Key Series before 5.7.0, YubiKey Bio Series before 5.6.4, and YubiKey 5 FIPS before 5.7.2 have Incorrect Access… |
CVE-2022-44581 | Medium | 5.0 | 2024-05-17 | Insecure Storage of Sensitive Information vulnerability in WPMU DEV Defender Security allows : Screen Temporary Files for Sensitive Information.This issue affe… |
CVE-2024-33004 | Medium | 4.3 | 2024-05-14 | SAP Business Objects Business Intelligence Platform is vulnerable to Insecure Storage as dynamic web pages are getting cached even after logging out. On succes… |
CVE-2024-4213 | Medium | 5.3 | 2024-05-14 | The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.6.4 via the or… |
CVE-2024-27789 | Medium | 5.5 | 2024-05-14 | A logic issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, macOS Monterey 12.7.5, macOS Sonoma 14.4, macOS Ventura… |
CVE-2024-23229 | Medium | 5.5 | 2024-05-14 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Monterey 12.7.5, macOS Sonoma 14.4, macOS Ventura 13.6… |
CVE-2024-28132 | Medium | 4.4 | 2024-05-08 | Exposure of Sensitive Information vulnerability exists in the GSLB container, which may allow an authenticated attacker with local access to view sensitive in… |
CVE-2024-3717 | Medium | 5.3 | 2024-05-02 | The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includi… |
CVE-2023-6962 | Medium | 5.3 | 2024-05-02 | The WP Meta SEO plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.12 via the meta description. Thi… |
CVE-2024-32211 | Medium | 5.5 | 2024-05-01 | An issue in LOGINT LoMag Inventory Management v1.0.20.120 and before allows a local attacker to obtain sensitive information via the UserClass.cs and Settings… |
CVE-2024-3678 | Medium | 5.3 | 2024-04-26 | The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including… |
CVE-2024-32236 | Low | 3.5 | 2024-04-25 | An issue in CmsEasy v.7.7 and before allows a remote attacker to obtain sensitive information via the update function in the index.php component. |
CVE-2024-3733 | Medium | 5.3 | 2024-04-25 | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Sensitive Information… |
CVE-2024-22808 | High | 7.5 | 2024-04-22 | An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to cause a Denial of Service (DoS) by disrupting the communication between… |
CVE-2024-29968 | High | 7.7 | 2024-04-19 | An information disclosure vulnerability exists in Brocade SANnav before v2.3.1 and v2.3.0a when Brocade SANnav instances are configured in disaster recovery mo… |
CVE-2024-29965 | Medium | 6.8 | 2024-04-19 | In Brocade SANnav before v2.3.1, and v2.3.0a, it is possible to back up the appliance from the web interface or the command line interface ("SSH"). The result… |
CVE-2024-21117 | Medium | 5.3 | 2024-04-16 | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). Supported versions that are affected are 8… |
CVE-2024-23561 | Medium | 4.3 | 2024-04-15 | HCL DevOps Deploy / HCL Launch is vulnerable to sensitive information disclosure vulnerability due to insufficient obfuscation of sensitive values. |
CVE-2024-30917 | Medium | 5.5 | 2024-04-11 | An issue was discovered in eProsima FastDDS v.2.14.0 and before, allows a local attacker to cause a denial of service (DoS) and obtain sensitive information vi… |
CVE-2024-31278 | Medium | 4.3 | 2024-04-10 | Insertion of Sensitive Information Into Sent Data vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor.This issue affects Premium… |
CVE-2024-2974 | Medium | 5.3 | 2024-04-09 | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Sensitive Information… |
CVE-2023-52345 | Medium | 6.0 | 2024-04-08 | In modem driver, there is a possible system crash due to improper input validation. This could lead to local information disclosure with System execution privi… |