Insecure Storage of Sensitive Information

The product stores sensitive information without properly limiting read or write access by unauthorized actors.

CVEs (377)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-33973 1Intel 1Wlan Authentication And Privacy Infrastructure Jun 17, 2026 Nov 11, 2022 N/A· v4 3.3 LOW· v3 N/A· v2 Improper access control in the Intel(R) WAPI Security software for Windows 10/11 before version 22.2150.0.1 may allow an authenticated user to potentially enable information disclosure via local access.
CVE-2022-41876 1Ibexa 1Ezplatform Graphql Jun 17, 2026 Nov 10, 2022 N/A· v4 5.3 MEDIUM· v3 N/A· v2 ezplatform-graphql is a GraphQL server implementation for Ibexa DXP and Ibexa Open Source. Versions prior to 2.3.12 and 1.0.13 are subject to Insecure Storage of Sensitive Information. Unauthenticated GraphQL queries for...Show more ezplatform-graphql is a GraphQL server implementation for Ibexa DXP and Ibexa Open Source. Versions prior to 2.3.12 and 1.0.13 are subject to Insecure Storage of Sensitive Information. Unauthenticated GraphQL queries for user accounts can expose password hashes of users that have created or modified content, typically administrators and editors. This issue has been patched in versions 2.3.12, and 1.0.13 on the 1.X branch. Users unable to upgrade can remove the "passwordHash" entry from "src/bundle/Resources/config/graphql/User.types.yaml" in the GraphQL package, and other properties like hash type, email, login if you prefer.Show less
CVE-2022-32867 1Apple 2Iphone Os Macos Jun 17, 2026 Nov 1, 2022 N/A· v4 2.4 LOW· v3 N/A· v2 This issue was addressed with improved data protection. This issue is fixed in iOS 16, macOS Ventura 13. A user with physical access to an iOS device may be able to read past diagnostic logs.
CVE-2022-28170 1Broadcom 1Fabric Operating System Jun 17, 2026 Oct 25, 2022 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Brocade Fabric OS Web Application services before Brocade Fabric v9.1.0, v9.0.1e, v8.2.3c, v7.4.2j store server and user passwords in the debug statements. This could allow a local user to extract the passwords from a de...Show more Brocade Fabric OS Web Application services before Brocade Fabric v9.1.0, v9.0.1e, v8.2.3c, v7.4.2j store server and user passwords in the debug statements. This could allow a local user to extract the passwords from a debug file.Show less
CVE-2022-41320 1Veritas 1System Recovery Jun 17, 2026 Sep 23, 2022 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Veritas System Recovery (VSR) versions 18 and 21 store a network destination password in the Windows registry during configuration of the backup configuration. This vulnerability could provide a Windows user (who has suf...Show more Veritas System Recovery (VSR) versions 18 and 21 store a network destination password in the Windows registry during configuration of the backup configuration. This vulnerability could provide a Windows user (who has sufficient privileges) to access a network file system that they were not authorized to access.Show less
CVE-2022-37835 1Torguard 1Vpn Jun 17, 2026 Sep 12, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 Torguard VPN 4.8, has a vulnerability that allows an attacker to dump sensitive information, such as credentials and information about the server, without admin privileges.
CVE-2022-35513 1Blink1 1Blink1control2 Jun 17, 2026 Sep 7, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 The Blink1Control2 application <= 2.2.7 uses weak password encryption and an insecure method of storage.
CVE-2022-1021 1Chatwoot 1Chatwoot Jun 17, 2026 Aug 19, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Insecure Storage of Sensitive Information in GitHub repository chatwoot/chatwoot prior to 2.6.0.
CVE-2022-28168 1Broadcom 1Sannav Jun 17, 2026 Jun 27, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In Brocade SANnav before Brocade SANnav v2.2.0.2 and Brocade SANnav2.1.1.8, encoded scp-server passwords are stored using Base64 encoding, which could allow an attacker able to access log files to easily decode the passw...Show more In Brocade SANnav before Brocade SANnav v2.2.0.2 and Brocade SANnav2.1.1.8, encoded scp-server passwords are stored using Base64 encoding, which could allow an attacker able to access log files to easily decode the passwords.Show less
CVE-2022-30740 1Samsung 1Internet Jun 17, 2026 Jun 7, 2022 N/A· v4 4.3 MEDIUM· v3 2.1 LOW· v2 Improper auto-fill algorithm in Samsung Internet prior to version 17.0.1.69 allows physical attackers to guess stored credit card numbers.
CVE-2021-43512 1Flightradar24 1Flightradar24 Flight Tracker Jun 17, 2026 Jun 2, 2022 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 An issue was discovered in FlightRadar24 v8.9.0, v8.10.0, v8.10.2, v8.10.3, v8.10.4 for Android, allows attackers to cause unspecified consequences due to being able to decompile a local application and extract their API...Show more An issue was discovered in FlightRadar24 v8.9.0, v8.10.0, v8.10.2, v8.10.3, v8.10.4 for Android, allows attackers to cause unspecified consequences due to being able to decompile a local application and extract their API keys.Show less
CVE-2022-1044 1Trudesk Project 1Trudesk Jun 17, 2026 May 12, 2022 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Sensitive Data Exposure Due To Insecure Storage Of Profile Image in GitHub repository polonel/trudesk prior to v1.2.1.
CVE-2021-25266 1Sophos 2Authenticator Intercept X Jun 17, 2026 Apr 27, 2022 N/A· v4 3.9 LOW· v3 2.1 LOW· v2 An insecure data storage vulnerability allows a physical attacker with root privileges to retrieve TOTP secret keys from unlocked phones in Sophos Authenticator for Android version 3.4 and older, and Intercept X for Mobi...Show more An insecure data storage vulnerability allows a physical attacker with root privileges to retrieve TOTP secret keys from unlocked phones in Sophos Authenticator for Android version 3.4 and older, and Intercept X for Mobile (Android) before version 9.7.3495.Show less
CVE-2022-1257 1Mcafee 1Agent Jun 17, 2026 Apr 14, 2022 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 Insecure storage of sensitive information vulnerability in MA for Linux, macOS, and Windows prior to 5.7.6 allows a local user to gain access to sensitive information through storage in ma.db. The sensitive information h...Show more Insecure storage of sensitive information vulnerability in MA for Linux, macOS, and Windows prior to 5.7.6 allows a local user to gain access to sensitive information through storage in ma.db. The sensitive information has been moved to encrypted database files.Show less
CVE-2021-27456 1Phillips 11Gemini 882160 Firmware Gemini 882300 FirmwareGemini 882390 Firmware+8 more Jun 17, 2026 Mar 23, 2022 N/A· v4 2.4 LOW· v3 2.1 LOW· v2 Philips Gemini PET/CT family software stores sensitive information in a removable media device that does not have built-in access control.
CVE-2018-25031 1Smartbear 1Swagger Ui Nov 21, 2024 Mar 11, 2022 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. No...Show more Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was originally claimed to be resolved in 4.1.3. However, third parties have indicated this is not resolved in 4.1.3 and even occurs in that version and possibly others.Show less
CVE-2022-0881 1Framasoft 1Peertube Jun 17, 2026 Mar 9, 2022 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 Insecure Storage of Sensitive Information in GitHub repository chocobozzz/peertube prior to 4.1.1.
CVE-2022-25264 1Jetbrains 1Teamcity Jun 17, 2026 Feb 25, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In JetBrains TeamCity before 2021.2.3, environment variables of the "password" type could be logged in some cases.
CVE-2022-0724 1Microweber 1Microweber Jun 17, 2026 Feb 23, 2022 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 Insecure Storage of Sensitive Information in GitHub repository microweber/microweber prior to 1.3.
CVE-2022-21823 1Ivanti 1Workspace Control Jun 17, 2026 Jan 10, 2022 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 A insecure storage of sensitive information vulnerability exists in Ivanti Workspace Control <2021.2 (10.7.30.0) that could allow an attacker with locally authenticated low privileges to obtain key information due to an...Show more A insecure storage of sensitive information vulnerability exists in Ivanti Workspace Control <2021.2 (10.7.30.0) that could allow an attacker with locally authenticated low privileges to obtain key information due to an unspecified attack vector.Show less

Previous 1...141516...19 Next