CWE-922 (page 3)
Page 3 of 4 — CVEs classified under CWE-922, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-27232 | Medium | 5.5 | 2024-04-05 | In asn1_ec_pkey_parse of asn1_common.c, there is a possible OOB read due to a missing null check. This could lead to local information disclosure with no addit… |
CVE-2024-20050 | Medium | 4.4 | 2024-04-01 | In flashc, there is a possible information disclosure due to an uncaught exception. This could lead to local information disclosure with System execution privi… |
CVE-2023-42913 | High | 8.8 | 2024-03-28 | This issue was addressed through improved state management. This issue is fixed in macOS Sonoma 14.2. Remote Login sessions may be able to obtain full disk acc… |
CVE-2024-25655 | Medium | 6.5 | 2024-03-18 | Insecure storage of LDAP passwords in the authentication functionality of AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS allows members (with rea… |
CVE-2024-28069 | High | 7.5 | 2024-03-16 | A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct an informat… |
CVE-2024-23290 | Medium | 5.5 | 2024-03-08 | A logic issue was addressed with improved restrictions. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, watchOS 10.4. An app may… |
CVE-2024-23241 | Medium | 5.5 | 2024-03-08 | This issue was addressed through improved state management. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4. An app may be able t… |
CVE-2024-23232 | Low | 3.3 | 2024-03-08 | A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sonoma 14.4. An app may be able to capture a user's scree… |
CVE-2024-23205 | Medium | 5.5 | 2024-03-08 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4. An app… |
CVE-2024-1936 | High | 7.5 | 2024-03-04 | The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitrary other email message in Thunderbird's local cache. Conse… |
CVE-2024-21826 | Medium | 4.3 | 2024-03-04 | in OpenHarmony v3.2.4 and prior versions allow a local attacker cause sensitive information leak through insecure storage. |
CVE-2023-6565 | Medium | 5.9 | 2024-02-29 | The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.12.3 via the multi-call back… |
CVE-2024-26559 | Medium | 5.3 | 2024-02-28 | An issue in uverif v.2.0 allows a remote attacker to obtain sensitive information. |
CVE-2023-45859 | High | 7.6 | 2024-02-28 | In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client operations don't ch… |
CVE-2024-22371 | Low | 2.9 | 2024-02-26 | Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Ap… |
CVE-2023-37540 | Low | 3.9 | 2024-02-23 | Sametime Connect desktop chat client includes, but does not use or require, the use of an Eclipse feature called Secure Storage. Using this Eclipse feature to… |
CVE-2023-42878 | Medium | 5.5 | 2024-02-21 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in watchOS 10.1, macOS Sonoma 14.1, iOS 17.1 and iPadOS… |
CVE-2023-42840 | Medium | 5.5 | 2024-02-21 | The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. An app may be able to acce… |
CVE-2023-42839 | Medium | 5.5 | 2024-02-21 | This issue was addressed with improved state management. This issue is fixed in tvOS 17.1, watchOS 10.1, macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1. An app ma… |
CVE-2023-42823 | Medium | 5.5 | 2024-02-21 | The issue was resolved by sanitizing logging This issue is fixed in watchOS 10.1, macOS Sonoma 14.1, tvOS 17.1, macOS Monterey 12.7.1, iOS 16.7.2 and iPadOS 16… |
CVE-2024-0037 | Low | 3.3 | 2024-02-16 | In applyCustomDescription of SaveUi.java, there is a possible way to view images belonging to a different user due to a missing permission check. This could le… |
CVE-2023-40093 | Medium | 5.5 | 2024-02-16 | In multiple files, there is a possible way that trimmed content could be included in PDF output due to a logic error in the code. This could lead to local info… |
CVE-2024-25940 | Medium | 6.3 | 2024-02-15 | `bhyveload -h <host-path>` may be used to grant loader access to the <host-path> directory tree on the host. Affected versions of bhyveload(8) do not make any… |
CVE-2024-25360 | Medium | 5.3 | 2024-02-12 | A hidden interface in Motorola CX2L Router firmware v1.0.1 leaks information regarding the SystemWizardStatus component via sending a crafted request to device… |
CVE-2024-25728 | High | 7.5 | 2024-02-11 | ExpressVPN before 12.73.0 on Windows, when split tunneling is used, sends DNS requests according to the Windows configuration (e.g., sends them to DNS servers… |
CVE-2023-50298 | High | 7.5 | 2024-02-09 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 b… |
CVE-2024-22773 | High | 8.1 | 2024-02-06 | Intelbras Action RF 1200 routers 1.2.2 and earlier and Action RG 1200 routers 2.1.7 and earlier expose the Password in Cookie resulting in Login Bypass. |
CVE-2024-22193 | Low | 3.5 | 2024-01-30 | The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). There are n… |
CVE-2024-23217 | Low | 3.3 | 2024-01-23 | A privacy issue was addressed with improved handling of temporary files. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, macOS Ventura 13.6… |
CVE-2023-49515 | Medium | 4.6 | 2024-01-17 | Insecure Permissiosn vulnerability in TP Link TC70 and C200 WIFI Camera v.3 firmware v.1.3.4 and fixed in v.1.3.11 allows a physically proximate attacker to ob… |
CVE-2023-37521 | Low | 2.3 | 2024-01-16 | HCL BigFix Bare OSD Metal Server WebUI version 311.19 or lower can sometimes include sensitive information in a query string which could allow an attacker to e… |
CVE-2023-5879 | Medium | 6.8 | 2024-01-03 | Users’ product account authentication data was stored in clear text in The Genie Company Aladdin Connect Mobile Application Version 5.65 Build 2075 (and below)… |
CVE-2023-23437 | Low | 3.3 | 2023-12-29 | Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak |
CVE-2023-45182 | High | 7.4 | 2023-12-14 | IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 is vulnerable to having its key for an encrypted password decoded. By somehow ga… |
CVE-2023-45184 | Medium | 6.2 | 2023-12-14 | IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 could allow an attacker to obtain a decryption key due to improper authority chec… |
CVE-2023-6460 | Medium | 4.0 | 2023-12-04 | A potential logging of the firestore key via logging within nodejs-firestore exists - Developers who were logging objects through this._settings would be loggi… |
CVE-2023-6253 | Medium | 6.0 | 2023-11-22 | A saved encryption key in the Uninstaller in Digital Guardian's Agent before version 7.9.4 allows a local attacker to retrieve the uninstall key and remove the… |
CVE-2023-41723 | Medium | 4.3 | 2023-11-07 | A vulnerability in Veeam ONE allows a user with the Veeam ONE Read-Only User role to view the Dashboard Schedule. Note: The criticality of this vulnerability i… |
CVE-2023-34056 | Medium | 4.3 | 2023-10-25 | vCenter Server contains a partial information disclosure vulnerability. A malicious actor with non-administrative privileges to vCenter Server may leverage thi… |
CVE-2023-43634 | High | 8.8 | 2023-09-21 | When sealing/unsealing the “vault” key, a list of PCRs is used, which defines which PCRs are used. In a previous project, CYMOTIVE found that the configurati… |
CVE-2023-43633 | High | 8.8 | 2023-09-21 | On boot, the Pillar eve container checks for the existence and content of “/config/GlobalConfig/global.json”. If the file exists, it overrides the existing c… |
CVE-2023-43631 | High | 8.8 | 2023-09-21 | On boot, the Pillar eve container checks for the existence and content of “/config/authorized_keys”. If the file is present, and contains a supported public… |
CVE-2023-43630 | High | 8.8 | 2023-09-20 | PCR14 is not in the list of PCRs that seal/unseal the “vault” key, but due to the change that was implemented in commit “7638364bc0acf8b5c481b5ce5fea11ad44ad7f… |
CVE-2023-32184 | High | 7.8 | 2023-09-19 | A Insecure Storage of Sensitive Information vulnerability in openSUSE opensuse-welcome allows local attackers to execute code as the user that runs opensuse-we… |
CVE-2023-41965 | High | 7.5 | 2023-09-18 | Sending some requests in the web application of the vulnerable device allows information to be obtained due to the lack of security in the authentication proce… |
CVE-2023-40728 | High | 7.3 | 2023-09-12 | A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application stores sensitive application d… |
CVE-2023-37879 | Medium | 6.5 | 2023-09-12 | Insecure storage of sensitive information in Wing FTP Server (User Web Client) allows information elicitation.This issue affects Wing FTP Server: <= 7.2.0. |
CVE-2023-29261 | Medium | 5.1 | 2023-09-05 | IBM Sterling Secure Proxy 6.0.3 and 6.1.0 could allow a local user with specific information about the system to obtain privileged information due to inadequat… |
CVE-2023-37439 | Medium | 6.1 | 2023-08-22 | Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL i… |
CVE-2022-46484 | High | 7.5 | 2023-08-02 | Information disclosure in password protected surveys in Data Illusion Survey Software Solutions NGSurvey v2.4.28 and below allows attackers to view the passwor… |
CVE-2023-28864 | Medium | 5.5 | 2023-07-17 | Progress Chef Infra Server before 15.7 allows a local attacker to exploit a /var/opt/opscode/local-mode-cache/backup world-readable temporary backup path to ac… |
CVE-2023-37563 | Medium | 6.5 | 2023-07-13 | ELECOM wireless LAN routers are vulnerable to sensitive information exposure, which allows a network-adjacent unauthorized attacker to obtain sensitive informa… |
CVE-2023-23348 | Medium | 5.1 | 2023-07-10 | HCL Launch could disclose sensitive information if a manual edit of a configuration file has been performed. |
CVE-2023-32415 | Medium | 5.5 | 2023-06-23 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 16.5 and iPadOS 16.5, tvOS 16.5, macOS Ventura 13.4. An… |
CVE-2023-26427 | Low | 3.2 | 2023-06-20 | Default permissions for a properties file were too permissive. Local system users could read potentially sensitive information. We updated the default permissi… |
CVE-2023-29757 | High | 7.8 | 2023-06-09 | An issue found in Blue Light Filter v.1.5.5 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the SharedPreference… |
CVE-2023-29755 | High | 7.8 | 2023-06-09 | An issue found in Twilight v.13.3 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the SharedPreference files. |
CVE-2023-3064 | High | 7.5 | 2023-06-05 | Anonymous user may get the list of existing users managed by the application, that could ease further attacks (see CVE-2023-3065 and 3066)This issue affects Mo… |
CVE-2023-29727 | Critical | 9.8 | 2023-05-30 | The Call Blocker application 6.6.3 for Android allows unauthorized applications to use exposed components to delete data stored in its database that is related… |
CVE-2023-2665 | High | 7.5 | 2023-05-12 | Storage of Sensitive Data in a Mechanism without Access Control in GitHub repository francoisjacquet/rosariosis prior to 11.0. |
CVE-2023-31150 | High | 8.0 | 2023-05-10 | A Storing Passwords in a Recoverable Format vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) database syste… |
CVE-2022-44619 | High | 8.2 | 2023-05-10 | Insecure storage of sensitive information in the Intel(R) DCM software before version 5.1 may allow an authenticated user to potentially enable escalation of p… |
CVE-2022-43475 | Medium | 6.0 | 2023-05-10 | Insecure storage of sensitive information in the Intel(R) DCM software before version 5.1 may allow an authenticated user to potentially enable escalation of p… |
CVE-2023-27942 | Medium | 5.5 | 2023-05-08 | The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, macOS Big Sur 11.7.5, macOS Monterey 12.6.4… |
CVE-2023-23542 | Medium | 5.5 | 2023-05-08 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big… |
CVE-2023-23541 | Low | 3.3 | 2023-05-08 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 15.7.4 and iPadOS 15.7.4, iOS 16.4 and iPadOS 16… |
CVE-2022-43877 | Medium | 5.1 | 2023-05-06 | IBM UrbanCode Deploy (UCD) versions up to 7.3.0.1 could disclose sensitive password information during a manual edit of the agentrelay.properties file. IBM X-… |
CVE-2023-22687 | Low | 3.7 | 2023-04-16 | Insecure Storage of Sensitive Information vulnerability in Jose Mortellaro Freesoul Deactivate Plugins – Plugin manager and cleanup plugin <= 1.9.4.0 versions. |
CVE-2023-0580 | Medium | 5.4 | 2023-04-06 | Insecure Storage of Sensitive Information vulnerability in ABB My Control System (on-premise) allows an attacker who successfully exploited this vulnerability… |
CVE-2022-39043 | Low | 2.4 | 2023-03-27 | Juiker app stores debug logs which contains sensitive information to mobile external storage. An unauthenticated physical attacker can access these files to ac… |
CVE-2023-23522 | Medium | 5.5 | 2023-02-27 | A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Ventura 13.2.1. An app may be able to observe unprotected… |
CVE-2022-38090 | Medium | 6.0 | 2023-02-16 | Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard Extensions may allow a privileged user to potentially ena… |
CVE-2021-36546 | High | 7.5 | 2023-02-03 | Incorrect Access Control issue discovered in KiteCMS 1.1 allows remote attackers to view sensitive information via path in application URL. |
CVE-2022-2815 | Medium | 6.5 | 2023-01-14 | Insecure Storage of Sensitive Information in GitHub repository publify/publify prior to 9.2.10. |
CVE-2023-22469 | Medium | 5.8 | 2023-01-10 | Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. When getting the reference pr… |
CVE-2022-40959 | Medium | 6.5 | 2022-12-22 | During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a bypass that leaked device permissions into untrusted su… |
CVE-2022-32833 | Medium | 5.3 | 2022-12-15 | An issue existed with the file paths used to store website data. The issue was resolved by improving how website data is stored. This issue is fixed in iOS 16… |
CVE-2022-34354 | Medium | 4.0 | 2022-11-16 | IBM Sterling Partner Engagement Manager 2.0 allows encrypted storage of client data to be stored locally which can be read by another user on the system. IBM… |
CVE-2022-34312 | Medium | 4.0 | 2022-11-14 | IBM CICS TX 11.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 229447. |
CVE-2022-33973 | Low | 3.3 | 2022-11-11 | Improper access control in the Intel(R) WAPI Security software for Windows 10/11 before version 22.2150.0.1 may allow an authenticated user to potentially enab… |
CVE-2022-41876 | High | 7.5 | 2022-11-10 | ezplatform-graphql is a GraphQL server implementation for Ibexa DXP and Ibexa Open Source. Versions prior to 2.3.12 and 1.0.13 are subject to Insecure Storage… |
CVE-2022-32867 | Low | 2.4 | 2022-11-01 | This issue was addressed with improved data protection. This issue is fixed in iOS 16, macOS Ventura 13. A user with physical access to an iOS device may be ab… |
CVE-2022-28170 | Medium | 6.5 | 2022-10-25 | Brocade Fabric OS Web Application services before Brocade Fabric v9.1.0, v9.0.1e, v8.2.3c, v7.4.2j store server and user passwords in the debug statements. Thi… |
CVE-2022-41320 | Medium | 6.5 | 2022-09-23 | Veritas System Recovery (VSR) versions 18 and 21 store a network destination password in the Windows registry during configuration of the backup configuration… |
CVE-2022-37835 | High | 7.5 | 2022-09-12 | Torguard VPN 4.8, has a vulnerability that allows an attacker to dump sensitive information, such as credentials and information about the server, without admi… |
CVE-2022-35513 | High | 7.5 | 2022-09-07 | The Blink1Control2 application <= 2.2.7 uses weak password encryption and an insecure method of storage. |
CVE-2022-1021 | Medium | 5.4 | 2022-08-19 | Insecure Storage of Sensitive Information in GitHub repository chatwoot/chatwoot prior to 2.6.0. |
CVE-2022-28168 | High | 7.5 | 2022-06-27 | In Brocade SANnav before Brocade SANnav v2.2.0.2 and Brocade SANnav2.1.1.8, encoded scp-server passwords are stored using Base64 encoding, which could allow an… |
CVE-2022-30740 | Medium | 4.1 | 2022-06-07 | Improper auto-fill algorithm in Samsung Internet prior to version 17.0.1.69 allows physical attackers to guess stored credit card numbers. |
CVE-2021-43512 | Medium | 5.5 | 2022-06-02 | An issue was discovered in FlightRadar24 v8.9.0, v8.10.0, v8.10.2, v8.10.3, v8.10.4 for Android, allows attackers to cause unspecified consequences due to bein… |
CVE-2022-1044 | Medium | 6.5 | 2022-05-12 | Sensitive Data Exposure Due To Insecure Storage Of Profile Image in GitHub repository polonel/trudesk prior to v1.2.1. |
CVE-2021-25266 | Low | 3.9 | 2022-04-27 | An insecure data storage vulnerability allows a physical attacker with root privileges to retrieve TOTP secret keys from unlocked phones in Sophos Authenticato… |
CVE-2022-1257 | Medium | 6.1 | 2022-04-14 | Insecure storage of sensitive information vulnerability in MA for Linux, macOS, and Windows prior to 5.7.6 allows a local user to gain access to sensitive info… |
CVE-2021-27456 | Low | 2.4 | 2022-03-23 | Philips Gemini PET/CT family software stores sensitive information in a removable media device that does not have built-in access control. |
CVE-2018-25031 | Medium | 4.3 | 2022-03-11 | Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit… |
CVE-2022-0881 | Medium | 6.5 | 2022-03-09 | Insecure Storage of Sensitive Information in GitHub repository chocobozzz/peertube prior to 4.1.1. |
CVE-2022-25264 | High | 7.5 | 2022-02-25 | In JetBrains TeamCity before 2021.2.3, environment variables of the "password" type could be logged in some cases. |
CVE-2022-0724 | Medium | 6.5 | 2022-02-23 | Insecure Storage of Sensitive Information in GitHub repository microweber/microweber prior to 1.3. |
CVE-2022-21823 | Medium | 5.5 | 2022-01-10 | A insecure storage of sensitive information vulnerability exists in Ivanti Workspace Control <2021.2 (10.7.30.0) that could allow an attacker with locally auth… |
CVE-2017-13909 | Medium | 5.5 | 2021-12-23 | An issue existed in the storage of sensitive tokens. This issue was addressed by placing the tokens in Keychain. This issue is fixed in macOS High Sierra 10.13… |