← Back
CWE-922

373 CVEs • Abstraction: Class

Insecure Storage of Sensitive Information

The product stores sensitive information without properly limiting read or write access by unauthorized actors.

JSON object

Loading...

CVEs (373)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2021-42371
1Xorux
2Lpar2rrd
Stor2rrd
Jun 17, 2026
Nov 8, 2021
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
lpar2rrd is a hardcoded system account in XoruX LPAR2RRD and STOR2RRD before 7.30.
CVE-2020-4809
1Ibm
1Edge Application Manager
Jun 17, 2026
Sep 23, 2021
N/A· v4
3.3 LOW· v3
2.1 LOW· v2
IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189633.
CVE-2020-4805
1Ibm
1Edge Application Manager
Jun 17, 2026
Sep 23, 2021
N/A· v4
3.3 LOW· v3
2.1 LOW· v2
IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189539.
CVE-2020-4803
1Ibm
1Edge Application Manager
Jun 17, 2026
Sep 23, 2021
N/A· v4
3.3 LOW· v3
2.1 LOW· v2
IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189535.
CVE-2021-28813
1Qnap
2Qsw M2116p 2t2s Firmware
Qunetswitch
Jun 17, 2026
Sep 10, 2021
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
A vulnerability involving insecure storage of sensitive information has been reported to affect QSW-M2116P-2T2S and QNAP switches running QuNetSwitch. If exploited, this vulnerability allows remote attackers to read sens...Show more
A vulnerability involving insecure storage of sensitive information has been reported to affect QSW-M2116P-2T2S and QNAP switches running QuNetSwitch. If exploited, this vulnerability allows remote attackers to read sensitive information by accessing the unrestricted storage mechanism.We have already fixed this vulnerability in the following versions: QSW-M2116P-2T2S 1.0.6 build 210713 and later QGD-1600P: QuNetSwitch 1.0.6.1509 and later QGD-1602P: QuNetSwitch 1.0.6.1509 and later QGD-3014PT: QuNetSwitch 1.0.6.1519 and laterShow less
CVE-2021-0639
1Google
1Android
Jun 17, 2026
Aug 17, 2021
N/A· v4
5.5 MEDIUM· v3
2.1 LOW· v2
In multiple functions of libl3oemcrypto.cpp, there is a possible weakness in the existing obfuscation mechanism due to the way sensitive data is handled. This could lead to local information disclosure with no additional...Show more
In multiple functions of libl3oemcrypto.cpp, there is a possible weakness in the existing obfuscation mechanism due to the way sensitive data is handled. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-190724551Show less
CVE-2021-36786
1Miniorange
1Saml
Jun 17, 2026
Aug 13, 2021
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows Sensitive Data Exposure of API credentials and private keys.
CVE-2021-36127
1Mediawiki
1Mediawiki
Jun 17, 2026
Jul 2, 2021
N/A· v4
4.3 MEDIUM· v3
4.0 MEDIUM· v2
An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. The Special:GlobalUserRights page provided search results which, for a suppressed MediaWiki user, were different than for any other user, th...Show more
An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. The Special:GlobalUserRights page provided search results which, for a suppressed MediaWiki user, were different than for any other user, thus easily disclosing suppressed accounts (which are supposed to be completely hidden).Show less
CVE-2021-22914
1Citrix
1Cloud Connector
Jun 17, 2026
Jun 16, 2021
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
Citrix Cloud Connector before 6.31.0.62192 suffers from insecure storage of sensitive information due to sensitive information being stored in the Citrix Cloud Connector installation log files. Such information could be...Show more
Citrix Cloud Connector before 6.31.0.62192 suffers from insecure storage of sensitive information due to sensitive information being stored in the Citrix Cloud Connector installation log files. Such information could be used by an malicious actor to access a Citrix Cloud environment. This issue affects all versions of Citrix Cloud Connector that were installed by passing secure client parameters for installation via the command line. The issue does not affect Citrix Cloud Connector if it was installed using the interactive installer or where a parameter file was used with the command-line installer.Show less
CVE-2021-28815
1Qnap
1Myqnapcloud Link
Jun 17, 2026
Jun 16, 2021
N/A· v4
4.9 MEDIUM· v3
4.0 MEDIUM· v2
Insecure storage of sensitive information has been reported to affect QNAP NAS running myQNAPcloud Link. If exploited, this vulnerability allows remote attackers to read sensitive information by accessing the unrestricte...Show more
Insecure storage of sensitive information has been reported to affect QNAP NAS running myQNAPcloud Link. If exploited, this vulnerability allows remote attackers to read sensitive information by accessing the unrestricted storage mechanism. This issue affects: QNAP Systems Inc. myQNAPcloud Link versions prior to 2.2.21 on QTS 4.5.3; versions prior to 2.2.21 on QuTS hero h4.5.2; versions prior to 2.2.21 on QuTScloud c4.5.4.Show less
CVE-2021-25406
1Samsung
1Gear S
Jun 17, 2026
Jun 11, 2021
N/A· v4
6.5 MEDIUM· v3
3.3 LOW· v2
Information exposure vulnerability in Gear S Plugin prior to version 2.2.05.20122441 allows unstrusted applications to access connected BT device information.
CVE-2021-25404
1Samsung
1Smartthings Firmware
Jun 17, 2026
Jun 11, 2021
N/A· v4
3.3 LOW· v3
2.1 LOW· v2
Information Exposure vulnerability in SmartThings prior to version 1.7.64.21 allows attacker to access user information via log.
CVE-2021-25402
1Samsung
1Notes
Jun 17, 2026
Jun 11, 2021
N/A· v4
3.3 LOW· v3
2.1 LOW· v2
Information Exposure vulnerability in Samsung Notes prior to version 4.2.04.27 allows attacker to access s pen latency information.
CVE-2021-20396
1Ibm
1Security Qradar Analyst Workflow
Jun 17, 2026
Jun 11, 2021
N/A· v4
3.3 LOW· v3
2.1 LOW· v2
IBM QRadar Analyst Workflow App 1.0 through 1.18.0 for IBM QRadar SIEM allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 196009.
CVE-2020-5008
1Ibm
1Datapower Gateway
Jun 17, 2026
Jun 7, 2021
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.14 stores sensitive information in GET request parameters. This may lead to information disclosure if unauthorized parties have access to th...Show more
IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.14 stores sensitive information in GET request parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 193033.Show less
CVE-2021-20575
1Ibm
2Application Gateway
Security Verify Access
Jun 17, 2026
Jun 1, 2021
N/A· v4
3.3 LOW· v3
2.1 LOW· v2
IBM Security Verify Access 20.07 allows web pages to be stored locally which can be read by another user on the system. X-Force ID: 199278.
CVE-2020-28911
1Nagios
1Fusion
Jun 17, 2026
May 24, 2021
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
Incorrect Access Control in Nagios Fusion 4.1.8 and earlier allows low-privileged authenticated users to extract passwords used to manage fused servers via the test_server command in ajaxhelper.php.
CVE-2020-4765
1Ibm
1Cloud Pak For Multicloud Management
Jun 17, 2026
May 19, 2021
N/A· v4
3.3 LOW· v3
2.1 LOW· v2
IBM Cloud Pak for Multicloud Management prior to 2.3 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 188902.
CVE-2021-20391
1Ibm
1Qradar User Behavior Analytics
Jun 17, 2026
May 14, 2021
N/A· v4
3.3 LOW· v3
2.1 LOW· v2
IBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 195999.
CVE-2021-28653
1Westerndigital
1Armorlock
Jun 17, 2026
Mar 19, 2021
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
The iOS and macOS apps before 1.4.1 for the Western Digital G-Technology ArmorLock NVMe SSD store keys insecurely. They choose a non-preferred storage mechanism if the device has Secure Enclave support but lacks biometri...Show more
The iOS and macOS apps before 1.4.1 for the Western Digital G-Technology ArmorLock NVMe SSD store keys insecurely. They choose a non-preferred storage mechanism if the device has Secure Enclave support but lacks biometric authentication hardware.Show less