Insecure Storage of Sensitive Information

The product stores sensitive information without properly limiting read or write access by unauthorized actors.

CVEs (373)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-41320 1Veritas 1System Recovery Jun 17, 2026 Sep 23, 2022 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Veritas System Recovery (VSR) versions 18 and 21 store a network destination password in the Windows registry during configuration of the backup configuration. This vulnerability could provide a Windows user (who has suf...Show more Veritas System Recovery (VSR) versions 18 and 21 store a network destination password in the Windows registry during configuration of the backup configuration. This vulnerability could provide a Windows user (who has sufficient privileges) to access a network file system that they were not authorized to access.Show less
CVE-2022-37835 1Torguard 1Vpn Jun 17, 2026 Sep 12, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 Torguard VPN 4.8, has a vulnerability that allows an attacker to dump sensitive information, such as credentials and information about the server, without admin privileges.
CVE-2022-35513 1Blink1 1Blink1control2 Jun 17, 2026 Sep 7, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 The Blink1Control2 application <= 2.2.7 uses weak password encryption and an insecure method of storage.
CVE-2022-1021 1Chatwoot 1Chatwoot Jun 17, 2026 Aug 19, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Insecure Storage of Sensitive Information in GitHub repository chatwoot/chatwoot prior to 2.6.0.
CVE-2022-28168 1Broadcom 1Sannav Jun 17, 2026 Jun 27, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In Brocade SANnav before Brocade SANnav v2.2.0.2 and Brocade SANnav2.1.1.8, encoded scp-server passwords are stored using Base64 encoding, which could allow an attacker able to access log files to easily decode the passw...Show more In Brocade SANnav before Brocade SANnav v2.2.0.2 and Brocade SANnav2.1.1.8, encoded scp-server passwords are stored using Base64 encoding, which could allow an attacker able to access log files to easily decode the passwords.Show less
CVE-2022-30740 1Samsung 1Internet Jun 17, 2026 Jun 7, 2022 N/A· v4 4.3 MEDIUM· v3 2.1 LOW· v2 Improper auto-fill algorithm in Samsung Internet prior to version 17.0.1.69 allows physical attackers to guess stored credit card numbers.
CVE-2021-43512 1Flightradar24 1Flightradar24 Flight Tracker Jun 17, 2026 Jun 2, 2022 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 An issue was discovered in FlightRadar24 v8.9.0, v8.10.0, v8.10.2, v8.10.3, v8.10.4 for Android, allows attackers to cause unspecified consequences due to being able to decompile a local application and extract their API...Show more An issue was discovered in FlightRadar24 v8.9.0, v8.10.0, v8.10.2, v8.10.3, v8.10.4 for Android, allows attackers to cause unspecified consequences due to being able to decompile a local application and extract their API keys.Show less
CVE-2022-1044 1Trudesk Project 1Trudesk Jun 17, 2026 May 12, 2022 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Sensitive Data Exposure Due To Insecure Storage Of Profile Image in GitHub repository polonel/trudesk prior to v1.2.1.
CVE-2021-25266 1Sophos 2Authenticator Intercept X Jun 17, 2026 Apr 27, 2022 N/A· v4 3.9 LOW· v3 2.1 LOW· v2 An insecure data storage vulnerability allows a physical attacker with root privileges to retrieve TOTP secret keys from unlocked phones in Sophos Authenticator for Android version 3.4 and older, and Intercept X for Mobi...Show more An insecure data storage vulnerability allows a physical attacker with root privileges to retrieve TOTP secret keys from unlocked phones in Sophos Authenticator for Android version 3.4 and older, and Intercept X for Mobile (Android) before version 9.7.3495.Show less
CVE-2022-1257 1Mcafee 1Agent Jun 17, 2026 Apr 14, 2022 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 Insecure storage of sensitive information vulnerability in MA for Linux, macOS, and Windows prior to 5.7.6 allows a local user to gain access to sensitive information through storage in ma.db. The sensitive information h...Show more Insecure storage of sensitive information vulnerability in MA for Linux, macOS, and Windows prior to 5.7.6 allows a local user to gain access to sensitive information through storage in ma.db. The sensitive information has been moved to encrypted database files.Show less
CVE-2021-27456 1Phillips 11Gemini 882160 Firmware Gemini 882300 FirmwareGemini 882390 Firmware+8 more Jun 17, 2026 Mar 23, 2022 N/A· v4 2.4 LOW· v3 2.1 LOW· v2 Philips Gemini PET/CT family software stores sensitive information in a removable media device that does not have built-in access control.
CVE-2018-25031 1Smartbear 1Swagger Ui Nov 21, 2024 Mar 11, 2022 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. No...Show more Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was originally claimed to be resolved in 4.1.3. However, third parties have indicated this is not resolved in 4.1.3 and even occurs in that version and possibly others.Show less
CVE-2022-0881 1Framasoft 1Peertube Jun 17, 2026 Mar 9, 2022 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 Insecure Storage of Sensitive Information in GitHub repository chocobozzz/peertube prior to 4.1.1.
CVE-2022-25264 1Jetbrains 1Teamcity Jun 17, 2026 Feb 25, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In JetBrains TeamCity before 2021.2.3, environment variables of the "password" type could be logged in some cases.
CVE-2022-0724 1Microweber 1Microweber Jun 17, 2026 Feb 23, 2022 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 Insecure Storage of Sensitive Information in GitHub repository microweber/microweber prior to 1.3.
CVE-2022-21823 1Ivanti 1Workspace Control Jun 17, 2026 Jan 10, 2022 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 A insecure storage of sensitive information vulnerability exists in Ivanti Workspace Control <2021.2 (10.7.30.0) that could allow an attacker with locally authenticated low privileges to obtain key information due to an...Show more A insecure storage of sensitive information vulnerability exists in Ivanti Workspace Control <2021.2 (10.7.30.0) that could allow an attacker with locally authenticated low privileges to obtain key information due to an unspecified attack vector.Show less
CVE-2017-13909 1Apple 1Mac Os X Nov 21, 2024 Dec 23, 2021 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 An issue existed in the storage of sensitive tokens. This issue was addressed by placing the tokens in Keychain. This issue is fixed in macOS High Sierra 10.13. A local attacker may gain access to iCloud authentication t...Show more An issue existed in the storage of sensitive tokens. This issue was addressed by placing the tokens in Keychain. This issue is fixed in macOS High Sierra 10.13. A local attacker may gain access to iCloud authentication tokens.Show less
CVE-2021-25524 1Samsung 1Contacts Jun 17, 2026 Dec 8, 2021 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 Insecure storage of device information in Contacts prior to version 12.7.05.24 allows attacker to get Samsung Account ID.
CVE-2021-25523 1Samsung 1Dialer Jun 17, 2026 Dec 8, 2021 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 Insecure storage of device information in Samsung Dialer prior to version 12.7.05.24 allows attacker to get Samsung Account ID.
CVE-2021-25522 1Samsung 1Smart Capture Jun 17, 2026 Dec 8, 2021 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 Insecure storage of sensitive information vulnerability in Smart Capture prior to version 4.8.02.10 allows attacker to access victim's captured images without permission.

Previous 1...141516...19 Next