Common Weakness Enumeration
CWE-922
Allowed-with-ReviewInsecure Storage of Sensitive Information
Abstraction: Class · Status: Incomplete
The product stores sensitive information without properly limiting read or write access by unauthorized actors.
454 vulnerabilities reference this CWE, most recent first.
GHSA-964R-JHC4-WC4H
Vulnerability from github – Published: 2026-10-14 21:33 – Updated: 2026-10-14 21:33
VLAI
Details
Dell OS Recovery Tool, versions prior to 2.4.4, contains an Insecure Storage of Sensitive Information vulnerability. A low privileged attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-82153"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-14T19:17:21Z",
"severity": "LOW"
},
"details": "Dell OS Recovery Tool, versions prior to 2.4.4, contains an Insecure Storage of Sensitive Information vulnerability. A low privileged attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure.",
"id": "GHSA-964r-jhc4-wc4h",
"modified": "2026-10-14T21:33:47Z",
"published": "2026-10-14T21:33:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82153"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000517461/dsa-2026-450-security-update-for-dell-os-recovery-tool-for-an-insecure-storage-of-sensitive-information-vulnerability"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9682-J923-Q58C
Vulnerability from github – Published: 2022-05-24 17:35 – Updated: 2022-05-24 17:35
VLAI
Details
Slurm before 19.05.8 and 20.x before 20.02.6 exposes Sensitive Information to an Unauthorized Actor because xauth for X11 magic cookies is affected by a race condition in a read operation on the /proc filesystem.
Severity
{
"affected": [],
"aliases": [
"CVE-2020-27746"
],
"database_specific": {
"cwe_ids": [
"CWE-362",
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-27T18:15:00Z",
"severity": "MODERATE"
},
"details": "Slurm before 19.05.8 and 20.x before 20.02.6 exposes Sensitive Information to an Unauthorized Actor because xauth for X11 magic cookies is affected by a race condition in a read operation on the /proc filesystem.",
"id": "GHSA-9682-j923-q58c",
"modified": "2022-05-24T17:35:01Z",
"published": "2022-05-24T17:35:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27746"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2021/dsa-4841"
},
{
"type": "WEB",
"url": "https://www.schedmd.com/news.php"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-983X-5446-QC2Q
Vulnerability from github – Published: 2024-01-17 03:30 – Updated: 2024-01-24 18:31
VLAI
Details
Insecure Permissiosn vulnerability in TP Link TC70 and C200 WIFI Camera v.3 firmware v.1.3.4 and fixed in v.1.3.11 allows a physically proximate attacker to obtain sensitive information via a connection to the UART pin components.
Severity
4.6 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-49515"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-17T02:15:06Z",
"severity": "MODERATE"
},
"details": "Insecure Permissiosn vulnerability in TP Link TC70 and C200 WIFI Camera v.3 firmware v.1.3.4 and fixed in v.1.3.11 allows a physically proximate attacker to obtain sensitive information via a connection to the UART pin components.",
"id": "GHSA-983x-5446-qc2q",
"modified": "2024-01-24T18:31:00Z",
"published": "2024-01-17T03:30:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49515"
},
{
"type": "WEB",
"url": "https://github.com/VineethKumarM/TAPO-TC70-Unauthorized-root-access-using-UART"
},
{
"type": "WEB",
"url": "https://github.com/VineethKumarM/TAPO-TC70-Unauthorized-root-access-using-UART/tree/master"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-98H7-6M49-37QG
Vulnerability from github – Published: 2026-08-07 18:31 – Updated: 2026-08-08 03:31
VLAI
Details
The Datadog Android application stores operationally sensitive content in plaintext SQLite databases via Room. Two databases were reviewed: LocalNotificationDatabase (table local_notifications, columns including title, message, recipient, service, tags, and on-call/incident deeplinks) and SearchRecentDatabase (table search_recents, storing every in-app search query the user typed). A repository-wide search for SQLCipher, SupportFactory, openHelperFactory, or any Room encryption configuration returns no matches. Databases are stored as cleartext SQLite files in /data/data/com.datadog.app/databases/. At-rest protection therefore depends solely on the Android application sandbox — the standard Android baseline, adequate for many applications but flagged here as a hardening recommendation because the stored content is operationally sensitive (customer infrastructure monitoring metadata, incident notification recipients, and free-text search queries that may reveal service names, dashboards, and queries of interest). Exploitation paths include rooted or jailbroken devices, adb backup if android:allowBackup is misconfigured for any build flavor, physical-device handover scenarios, and forensic acquisition.
Severity
4.6 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-47362"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-07T18:17:15Z",
"severity": "MODERATE"
},
"details": "The Datadog Android application stores operationally sensitive content in plaintext SQLite databases via Room. Two databases were reviewed: LocalNotificationDatabase (table local_notifications, columns including title, message, recipient, service, tags, and on-call/incident deeplinks) and SearchRecentDatabase (table search_recents, storing every in-app search query the user typed).\nA repository-wide search for SQLCipher, SupportFactory, openHelperFactory, or any Room encryption configuration returns no matches. Databases are stored as cleartext SQLite files in /data/data/com.datadog.app/databases/. At-rest protection therefore depends solely on the Android application sandbox \u2014 the standard Android baseline, adequate for many applications but flagged here as a hardening recommendation because the stored content is operationally sensitive (customer infrastructure monitoring metadata, incident notification recipients, and free-text search queries that may reveal service names, dashboards, and queries of interest).\nExploitation paths include rooted or jailbroken devices, adb backup if android:allowBackup is misconfigured for any build flavor, physical-device handover scenarios, and forensic acquisition.",
"id": "GHSA-98h7-6m49-37qg",
"modified": "2026-08-08T03:31:12Z",
"published": "2026-08-07T18:31:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47362"
},
{
"type": "WEB",
"url": "https://cwe.mitre.org/data/definitions/922.html"
},
{
"type": "WEB",
"url": "https://trust.datadoghq.com/?tcuUid=2e8b8fa5-39ca-43f4-9f6a-aeafafb440ef"
},
{
"type": "WEB",
"url": "https://www.zetetic.net/sqlcipher/sqlcipher-for-android"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9CP9-P8GV-HVJP
Vulnerability from github – Published: 2022-05-24 17:34 – Updated: 2022-05-24 17:34
VLAI
Details
IBM InfoSphere Information Server 11.7 stores sensitive information in the browser's history that could be obtained by a user who has access to the same system. IBM X-Force ID: 190910.
{
"affected": [],
"aliases": [
"CVE-2020-4886"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-13T15:15:00Z",
"severity": "LOW"
},
"details": "IBM InfoSphere Information Server 11.7 stores sensitive information in the browser\u0027s history that could be obtained by a user who has access to the same system. IBM X-Force ID: 190910.",
"id": "GHSA-9cp9-p8gv-hvjp",
"modified": "2022-05-24T17:34:06Z",
"published": "2022-05-24T17:34:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-4886"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/190910"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6366715"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-9CR4-W78W-P2QR
Vulnerability from github – Published: 2024-05-14 15:32 – Updated: 2026-04-02 21:31
VLAI
Details
This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Monterey 12.7.5, macOS Ventura 13.6.5, macOS Sonoma 14.4. A malicious application may be able to access Find My data.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-23229"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-14T14:58:46Z",
"severity": "MODERATE"
},
"details": "This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Monterey 12.7.5, macOS Ventura 13.6.5, macOS Sonoma 14.4. A malicious application may be able to access Find My data.",
"id": "GHSA-9cr4-w78w-p2qr",
"modified": "2026-04-02T21:31:39Z",
"published": "2024-05-14T15:32:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23229"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/120886"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/120895"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/120899"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT214084"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT214085"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT214105"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT214084"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT214085"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT214105"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/May/14"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9GJV-RXM7-W3WQ
Vulnerability from github – Published: 2024-06-11 06:31 – Updated: 2024-11-21 21:33
VLAI
Details
Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.5.0 to 6.0.0, which may allow a user who can log in to the product to view the data of Scheduler.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-31404"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-11T05:15:53Z",
"severity": "MODERATE"
},
"details": "Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.5.0 to 6.0.0, which may allow a user who can log in to the product to view the data of Scheduler.",
"id": "GHSA-9gjv-rxm7-w3wq",
"modified": "2024-11-21T21:33:30Z",
"published": "2024-06-11T06:31:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31404"
},
{
"type": "WEB",
"url": "https://cs.cybozu.co.jp/2024/007901.html"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN28869536"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9GXF-R468-R4C5
Vulnerability from github – Published: 2024-05-14 15:32 – Updated: 2026-04-02 21:31
VLAI
Details
A logic issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, macOS Monterey 12.7.5, macOS Ventura 13.6.7, macOS Sonoma 14.4. An app may be able to access user-sensitive data.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-27789"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-14T15:13:01Z",
"severity": "MODERATE"
},
"details": "A logic issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, macOS Monterey 12.7.5, macOS Ventura 13.6.7, macOS Sonoma 14.4. An app may be able to access user-sensitive data.",
"id": "GHSA-9gxf-r468-r4c5",
"modified": "2026-04-02T21:31:39Z",
"published": "2024-05-14T15:32:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27789"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/120895"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/120898"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/120899"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/120900"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT214084"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT214100"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT214105"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT214107"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT214084"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT214100"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT214105"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT214107"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/May/11"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/May/13"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/May/14"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9RP8-H4G8-8766
Vulnerability from github – Published: 2026-01-12 18:07 – Updated: 2026-01-12 20:07
VLAI
Summary
Weblate wlc has insecure API key configuration
Details
Impact
Historically, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be used against different server.
Patches
- https://github.com/WeblateOrg/wlc/pull/1098
Workarounds
Remove unscoped key from wlc configuration. Only use URL-scoped keys in the [keys] sections.
References
This issue was reported to us by wh1zee via HackerOne.
Severity
5.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "wlc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.17.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-22251"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-922"
],
"github_reviewed": true,
"github_reviewed_at": "2026-01-12T18:07:03Z",
"nvd_published_at": "2026-01-12T18:15:49Z",
"severity": "MODERATE"
},
"details": "### Impact\nHistorically, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be used against different server.\n\n### Patches\n* https://github.com/WeblateOrg/wlc/pull/1098\n\n### Workarounds\nRemove unscoped `key` from wlc configuration. Only use URL-scoped keys in the `[keys]` sections.\n\n### References\nThis issue was reported to us by [wh1zee](https://hackerone.com/wh1zee) via HackerOne.",
"id": "GHSA-9rp8-h4g8-8766",
"modified": "2026-01-12T20:07:26Z",
"published": "2026-01-12T18:07:03Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/WeblateOrg/wlc/security/advisories/GHSA-9rp8-h4g8-8766"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22251"
},
{
"type": "WEB",
"url": "https://github.com/WeblateOrg/wlc/pull/1098"
},
{
"type": "WEB",
"url": "https://github.com/WeblateOrg/wlc/commit/aafdb507a9e66574ade1f68c50c4fe75dbe80797"
},
{
"type": "PACKAGE",
"url": "https://github.com/WeblateOrg/wlc"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Weblate wlc has insecure API key configuration"
}
GHSA-9V34-2JFF-X48J
Vulnerability from github – Published: 2024-10-28 21:30 – Updated: 2026-04-02 21:31
VLAI
Details
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. A malicious application may be able to modify protected parts of the file system.
Severity
{
"affected": [],
"aliases": [
"CVE-2024-44275"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-28T21:15:07Z",
"severity": "LOW"
},
"details": "The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. A malicious application may be able to modify protected parts of the file system.",
"id": "GHSA-9v34-2jff-x48j",
"modified": "2026-04-02T21:31:59Z",
"published": "2024-10-28T21:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44275"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/121564"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/121568"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/121570"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Oct/11"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Oct/12"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Oct/13"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.