CWE-922 (page 4)
Page 4 of 4 — CVEs classified under CWE-922, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-25524 | Medium | 4.0 | 2021-12-08 | Insecure storage of device information in Contacts prior to version 12.7.05.24 allows attacker to get Samsung Account ID. |
CVE-2021-25523 | Medium | 4.0 | 2021-12-08 | Insecure storage of device information in Samsung Dialer prior to version 12.7.05.24 allows attacker to get Samsung Account ID. |
CVE-2021-25522 | Medium | 5.3 | 2021-12-08 | Insecure storage of sensitive information vulnerability in Smart Capture prior to version 4.8.02.10 allows attacker to access victim's captured images without… |
CVE-2021-42371 | Critical | 9.8 | 2021-11-08 | lpar2rrd is a hardcoded system account in XoruX LPAR2RRD and STOR2RRD before 7.30. |
CVE-2020-4809 | Low | 3.3 | 2021-09-23 | IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189633. |
CVE-2020-4805 | Low | 3.3 | 2021-09-23 | IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189539. |
CVE-2020-4803 | Low | 3.3 | 2021-09-23 | IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189535. |
CVE-2021-28813 | Critical | 9.6 | 2021-09-10 | A vulnerability involving insecure storage of sensitive information has been reported to affect QSW-M2116P-2T2S and QNAP switches running QuNetSwitch. If explo… |
CVE-2021-0639 | Medium | 5.5 | 2021-08-17 | In multiple functions of libl3oemcrypto.cpp, there is a possible weakness in the existing obfuscation mechanism due to the way sensitive data is handled. This… |
CVE-2021-36786 | High | 7.5 | 2021-08-13 | The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows Sensitive Data Exposure of API credentials and private keys. |
CVE-2021-36127 | Medium | 4.3 | 2021-07-02 | An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. The Special:GlobalUserRights page provided search results which, for a suppress… |
CVE-2021-22914 | High | 7.5 | 2021-06-16 | Citrix Cloud Connector before 6.31.0.62192 suffers from insecure storage of sensitive information due to sensitive information being stored in the Citrix Cloud… |
CVE-2021-28815 | Medium | 6.0 | 2021-06-16 | Insecure storage of sensitive information has been reported to affect QNAP NAS running myQNAPcloud Link. If exploited, this vulnerability allows remote attacke… |
CVE-2021-25406 | Medium | 6.5 | 2021-06-11 | Information exposure vulnerability in Gear S Plugin prior to version 2.2.05.20122441 allows unstrusted applications to access connected BT device information. |
CVE-2021-25404 | Low | 3.3 | 2021-06-11 | Information Exposure vulnerability in SmartThings prior to version 1.7.64.21 allows attacker to access user information via log. |
CVE-2021-25402 | Low | 3.3 | 2021-06-11 | Information Exposure vulnerability in Samsung Notes prior to version 4.2.04.27 allows attacker to access s pen latency information. |
CVE-2021-20396 | Low | 3.3 | 2021-06-11 | IBM QRadar Analyst Workflow App 1.0 through 1.18.0 for IBM QRadar SIEM allows web pages to be stored locally which can be read by another user on the system. I… |
CVE-2020-5008 | Medium | 5.3 | 2021-06-07 | IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.14 stores sensitive information in GET request parameters. This may lead to inf… |
CVE-2021-20575 | Low | 3.3 | 2021-06-01 | IBM Security Verify Access 20.07 allows web pages to be stored locally which can be read by another user on the system. X-Force ID: 199278. |
CVE-2020-28911 | Medium | 6.5 | 2021-05-24 | Incorrect Access Control in Nagios Fusion 4.1.8 and earlier allows low-privileged authenticated users to extract passwords used to manage fused servers via the… |
CVE-2020-4765 | Low | 3.3 | 2021-05-19 | IBM Cloud Pak for Multicloud Management prior to 2.3 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 188… |
CVE-2021-20391 | Low | 3.3 | 2021-05-14 | IBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 1… |
CVE-2021-28653 | Medium | 6.5 | 2021-03-19 | The iOS and macOS apps before 1.4.1 for the Western Digital G-Technology ArmorLock NVMe SSD store keys insecurely. They choose a non-preferred storage mechanis… |
CVE-2020-4726 | Low | 3.3 | 2021-03-02 | The IBM Application Performance Monitoring UI (IBM Cloud APM 8.1.4) allows web pages to be stored locally which can be read by another user on the system. IBM… |
CVE-2021-27170 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. By default, there are no firewall rules for IPv6 connectivity, exposing the internal manag… |
CVE-2021-25776 | High | 7.5 | 2021-02-03 | In JetBrains TeamCity before 2020.2, an ECR token could be exposed in a build's parameters. |
CVE-2020-29603 | Medium | 4.3 | 2021-01-29 | In manage_proj_edit_page.php in MantisBT before 2.24.4, any unprivileged logged-in user can retrieve Private Projects' names via the manage_proj_edit_page.php… |
CVE-2020-4871 | Medium | 5.5 | 2021-01-19 | IBM Planning Analytics 2.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 190834. |
CVE-2020-4674 | Medium | 4.3 | 2021-01-12 | IBM Workload Automation 9.5 stores the server path in URLs that could aid in further attacks against the system. IBM X-Force ID: 186287. |
CVE-2020-4673 | Medium | 4.3 | 2021-01-12 | IBM Workload Automation 9.5 stores sensitive information in HTML comments that could aid in further attacks against the system. IBM X-Force ID: 186286. |
CVE-2020-9202 | Medium | 4.4 | 2020-12-24 | There is an information disclosure vulnerability in TE Mobile software versions V600R006C10,V600R006C10SPC100. Due to the improper storage of some information… |
CVE-2020-26176 | Medium | 4.3 | 2020-12-18 | An issue was discovered in tangro Business Workflow before 1.18.1. No (or broken) access control checks exist on the /api/document/<DocumentID>/attachments API… |
CVE-2020-4906 | Low | 3.3 | 2020-12-16 | IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 allows web pages to be stored locally which can be read by another user on the sy… |
CVE-2019-19561 | Low | 2.4 | 2020-11-16 | A misconfiguration in the debug interface in Mercedes-Benz HERMES 1.5 allows an attacker with direct physical access to device hardware to obtain cellular mode… |
CVE-2019-19557 | Low | 2.4 | 2020-11-16 | A misconfiguration in the debug interface in Mercedes-Benz HERMES 1 allows an attacker with direct physical access to device hardware to obtain cellular modem… |
CVE-2020-4886 | Low | 3.3 | 2020-11-13 | IBM InfoSphere Information Server 11.7 stores sensitive information in the browser's history that could be obtained by a user who has access to the same system… |
CVE-2020-4650 | Low | 3.3 | 2020-11-09 | IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 allows web pages to be stored locally which can be read by another user on the syste… |
CVE-2019-8790 | Medium | 5.5 | 2020-10-27 | This issue was addresses by updating incorrect URLSession file descriptors management logic to match Swift 5.0. This issue is fixed in Swift 5.1.1 for Ubuntu… |
CVE-2020-13937 | Medium | 5.3 | 2020-10-19 | Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-a… |
CVE-2020-26104 | High | 7.5 | 2020-09-25 | In cPanel before 88.0.3, an insecure SRS secret is used on a templated VM (SEC-552). |
CVE-2020-4315 | Medium | 4.3 | 2020-09-21 | IBM Business Automation Content Analyzer on Cloud 1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to ge… |
CVE-2020-15775 | High | 7.5 | 2020-09-18 | An issue was discovered in Gradle Enterprise 2017.1 - 2020.2.4. The /usage page of Gradle Enterprise conveys high level build information such as project names… |
CVE-2020-4344 | Low | 3.3 | 2020-09-15 | IBM Tivoli Business Service Manager 6.2.0.0 - 6.2.0.2 IF 1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force I… |
CVE-2020-4171 | Medium | 4.3 | 2020-08-27 | IBM Security Guardium Insights 2.0.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 174407. |
CVE-2019-4695 | Low | 3.3 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 1719… |
CVE-2020-1493 | Medium | 5.5 | 2020-08-17 | An information disclosure vulnerability exists when attaching files to Outlook messages. This vulnerability could potentially allow users to share attached fil… |
CVE-2020-4371 | Low | 3.3 | 2020-07-22 | IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 contains sensitive information in leftover debug code that could be used aid a local user in further attacks against t… |
CVE-2020-8482 | High | 7.8 | 2020-05-29 | Insecure storage of sensitive information in ABB Device Library Wizard versions 6.0.X, 6.0.3.1 and 6.0.3.2 allows unauthenticated low privilege user to read fi… |
CVE-2020-8481 | Critical | 9.8 | 2020-04-29 | For ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0… |
CVE-2020-7000 | High | 7.5 | 2020-04-03 | VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow an unauthenticated attacker to discover the cryptographic key from the web server and… |
CVE-2020-5262 | High | 7.7 | 2020-03-19 | In EasyBuild before version 4.1.2, the GitHub Personal Access Token (PAT) used by EasyBuild for the GitHub integration features (like `--new-pr`, `--fro,-pr`… |
CVE-2020-4197 | Low | 2.4 | 2020-03-03 | IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 174908. |
CVE-2018-13313 | Medium | 6.5 | 2020-02-24 | In TOTOLINK A3002RU 1.0.8, the router provides a page that allows the user to change their account name and password. This page, password.htm, contains JavaScr… |
CVE-2019-12825 | Medium | 4.3 | 2020-02-17 | Unauthorized Access to the Container Registry of other groups was discovered in GitLab Enterprise 12.0.0-pre. In other words, authenticated remote attackers ca… |
CVE-2019-20060 | High | 7.5 | 2020-02-10 | MFScripts YetiShare v3.5.2 through v4.5.4 places sensitive information in the Referer header. If this leaks, then third parties may discover password-reset has… |
CVE-2019-13719 | Medium | 4.3 | 2019-11-25 | Incorrect security UI in full screen mode in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to hide security UI via a crafted HTML page. |
CVE-2019-13717 | Medium | 4.3 | 2019-11-25 | Incorrect security UI in full screen mode in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to hide security UI via a crafted HTML page. |
CVE-2019-4265 | Low | 2.4 | 2019-10-10 | IBM Maximo Anywhere 7.6.0, 7.6.1, 7.6.2, and 7.6.3 does not have device root detection which could result in an attacker gaining sensitive information about th… |
CVE-2019-4549 | Medium | 5.3 | 2019-10-02 | IBM Security Directory Server 6.4.0 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system… |
CVE-2019-14957 | Medium | 5.3 | 2019-10-01 | The JetBrains Vim plugin before version 0.52 was storing individual project data in the global vim_settings.xml file. This xml file could be synchronized to a… |
CVE-2019-9253 | Medium | 4.4 | 2019-09-27 | In KeyStore, there is a possible storage of symmetric keys in the TEE instead of the strongbox due to a missing strongbox flag. This could lead to local inform… |
CVE-2019-5633 | Medium | 5.5 | 2019-08-22 | An insecure storage of sensitive information vulnerability is present in Hickory Smart for iOS mobile devices from Belwith Products, LLC. The application's dat… |
CVE-2019-5632 | Medium | 5.5 | 2019-08-22 | An insecure storage of sensitive information vulnerability is present in Hickory Smart for Android mobile devices from Belwith Products, LLC. The application's… |
CVE-2018-20886 | Medium | 5.3 | 2019-08-01 | cPanel before 74.0.0 insecurely stores phpMyAdmin session files (SEC-418). |
CVE-2019-12914 | High | 7.5 | 2019-07-17 | Redbrick Shift through 3.4.3 allows an attacker to extract authentication tokens of services (such as Gmail, Outlook, etc.) used in the application. |
CVE-2019-12911 | High | 7.5 | 2019-07-17 | Redbrick Shift through 3.4.3 allows an attacker to extract authentication tokens of services (such as Gmail, Outlook, etc.) used in the application. |
CVE-2019-5627 | High | 7.8 | 2019-05-22 | The iOS mobile application BlueCats Reveal before 5.14 stores the username and password in the app cache as base64 encoded strings, i.e. clear text. These pers… |
CVE-2019-5626 | High | 7.8 | 2019-05-22 | The Android mobile application BlueCats Reveal before 3.0.19 stores the username and password in a clear text file. This file persists until the user logs out… |
CVE-2019-5625 | High | 7.1 | 2019-05-22 | The Android mobile application Halo Home before 1.11.0 stores OAuth authentication and refresh access tokens in a clear text file. This file persists until the… |
CVE-2019-3684 | Medium | 5.9 | 2019-05-13 | SUSE Manager until version 4.0.7 and Uyuni until commit 1b426ad5ed0a7191a6fb46bb83e98ae4b99a5ade created world-readable swap files on systems that don't have a… |
CVE-2017-5250 | Critical | 9.8 | 2018-02-22 | In version 1.9.7 and prior of Insteon's Insteon for Hub Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and… |
CVE-2017-5249 | Critical | 9.8 | 2018-02-22 | In version 6.1.0.19 and prior of Wink Labs's Wink - Smart Home Android app, the OAuth token used by the app to authorize user access is not stored in an encryp… |
CVE-2017-16560 | Medium | 4.3 | 2017-11-16 | SanDisk Secure Access 3.01 vault decrypts and copies encrypted files to a temporary folder, where they can remain indefinitely in certain situations, such as i… |
CVE-2017-0493 | Medium | 5.5 | 2017-05-12 | An information disclosure vulnerability in File-Based Encryption could enable a local malicious attacker to bypass operating system protections for the lock sc… |
CVE-2017-7253 | High | 8.8 | 2017-03-30 | Dahua IP Camera devices 3.200.0001.6 can be exploited via these steps: 1. Use the default low-privilege credentials to list all users via a request to a certai… |
CVE-2017-6911 | Medium | 6.6 | 2017-03-23 | USB Pratirodh is prone to sensitive information disclosure. It stores sensitive information such as username and password in simple usb.xml. An attacker with p… |