Common Weakness Enumeration
CWE-922
Allowed-with-ReviewInsecure Storage of Sensitive Information
Abstraction: Class · Status: Incomplete
The product stores sensitive information without properly limiting read or write access by unauthorized actors.
454 vulnerabilities reference this CWE, most recent first.
GHSA-G77X-HH5W-QPW7
Vulnerability from github – Published: 2024-04-08 03:30 – Updated: 2024-11-27 18:34
VLAI
Details
In modem driver, there is a possible system crash due to improper input validation. This could lead to local information disclosure with System execution privileges needed
Severity
6.0 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-52345"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-08T03:15:08Z",
"severity": "MODERATE"
},
"details": "In modem driver, there is a possible system crash due to improper input validation. This could lead to local information disclosure with System execution privileges needed",
"id": "GHSA-g77x-hh5w-qpw7",
"modified": "2024-11-27T18:34:00Z",
"published": "2024-04-08T03:30:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52345"
},
{
"type": "WEB",
"url": "https://www.unisoc.com/en_us/secy/announcementDetail/1777143682512781313"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G789-9H8J-6WHM
Vulnerability from github – Published: 2025-08-26 15:31 – Updated: 2025-08-26 18:31
VLAI
Details
Incorrect access control in the EEPROM component of Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 allows attackers to replace password hashes stored in the EEPROM with hashes of their own, leading to the escalation of privileges to root.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-25732"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-26T15:15:42Z",
"severity": "MODERATE"
},
"details": "Incorrect access control in the EEPROM component of Kapsch TrafficCom RIS-9160 \u0026 RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 allows attackers to replace password hashes stored in the EEPROM with hashes of their own, leading to the escalation of privileges to root.",
"id": "GHSA-g789-9h8j-6whm",
"modified": "2025-08-26T18:31:15Z",
"published": "2025-08-26T15:31:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25732"
},
{
"type": "WEB",
"url": "https://cwe.mitre.org/data/definitions/922.html"
},
{
"type": "WEB",
"url": "https://phrack.org/issues/72/16_md"
},
{
"type": "WEB",
"url": "https://www.kapsch.net/_Resources/Persistent/3d251a8445e0bf50093903ad70b3dbed34dec7e7/KTC-CVS_RIS-9260_DataSheet.pdf"
},
{
"type": "WEB",
"url": "https://www.kapsch.net/_Resources/Persistent/55fb8d0fb279262809eac88d457894db1b3efcd5/Kapsch_RIS-9160_Datasheet_EN.pdf"
},
{
"type": "WEB",
"url": "https://www.kapsch.net/en"
},
{
"type": "WEB",
"url": "https://www.kapsch.net/en/press/releases/ktc-20200813-pr-en"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-G9M6-GVQR-98XQ
Vulnerability from github – Published: 2025-01-09 21:31 – Updated: 2025-01-23 18:31
VLAI
Details
Smart Toilet Lab - Motius 1.3.11 is running with debug mode turned on (DEBUG = True) and exposing sensitive information defined in Django settings file through verbose error page.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2024-56113"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-09T20:15:39Z",
"severity": "HIGH"
},
"details": "Smart Toilet Lab - Motius 1.3.11 is running with debug mode turned on (DEBUG = True) and exposing sensitive information defined in Django settings file through verbose error page.",
"id": "GHSA-g9m6-gvqr-98xq",
"modified": "2025-01-23T18:31:14Z",
"published": "2025-01-09T21:31:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56113"
},
{
"type": "WEB",
"url": "https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2024-56113"
},
{
"type": "WEB",
"url": "https://smarttoilet.pratt.duke.edu"
},
{
"type": "WEB",
"url": "https://www.motius.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GH2G-9GCC-7CPV
Vulnerability from github – Published: 2022-05-13 01:46 – Updated: 2022-05-13 01:46
VLAI
Details
USB Pratirodh is prone to sensitive information disclosure. It stores sensitive information such as username and password in simple usb.xml. An attacker with physical access to the system can modify the file according his own requirements that may aid in further attack.
Severity
6.6 (Medium)
{
"affected": [],
"aliases": [
"CVE-2017-6911"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-03-23T20:59:00Z",
"severity": "MODERATE"
},
"details": "USB Pratirodh is prone to sensitive information disclosure. It stores sensitive information such as username and password in simple usb.xml. An attacker with physical access to the system can modify the file according his own requirements that may aid in further attack.",
"id": "GHSA-gh2g-9gcc-7cpv",
"modified": "2022-05-13T01:46:47Z",
"published": "2022-05-13T01:46:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6911"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/141651/USB-Pratirodh-Insecure-Password-Storage.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2017/Mar/43"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/540289/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/96970"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GH7H-R3FF-2VQ6
Vulnerability from github – Published: 2023-09-15 00:30 – Updated: 2024-04-04 07:41
VLAI
Details
Insecure storage of sensitive information in Wing FTP Server (User Web Client) allows information elicitation.This issue affects Wing FTP Server: <= 7.2.0.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2023-37879"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-12T09:15:08Z",
"severity": "HIGH"
},
"details": "Insecure storage of sensitive information in Wing FTP Server (User Web Client) allows information elicitation.This issue affects Wing FTP Server: \u003c= 7.2.0.\n\n",
"id": "GHSA-gh7h-r3ff-2vq6",
"modified": "2024-04-04T07:41:29Z",
"published": "2023-09-15T00:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37879"
},
{
"type": "WEB",
"url": "https://www.wftpserver.com/serverhistory.htm"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GRQ3-9M83-RGPR
Vulnerability from github – Published: 2024-12-12 03:33 – Updated: 2026-04-02 21:32
VLAI
Details
This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.1 and iPadOS 18.1. An app may be able to read sensitive location information.
Severity
{
"affected": [],
"aliases": [
"CVE-2024-44200"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-12T02:15:23Z",
"severity": "LOW"
},
"details": "This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.1 and iPadOS 18.1. An app may be able to read sensitive location information.",
"id": "GHSA-grq3-9m83-rgpr",
"modified": "2026-04-02T21:32:01Z",
"published": "2024-12-12T03:33:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44200"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/121563"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/121564"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GVXW-CJ6R-74WG
Vulnerability from github – Published: 2025-08-06 21:31 – Updated: 2025-08-06 21:31
VLAI
Details
An issue was discovered in 4C Strategies Exonaut 21.6. Passwords, stored in the database, are hashed without a salt.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-46660"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-06T21:15:29Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in 4C Strategies Exonaut 21.6. Passwords, stored in the database, are hashed without a salt.",
"id": "GHSA-gvxw-cj6r-74wg",
"modified": "2025-08-06T21:31:40Z",
"published": "2025-08-06T21:31:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46660"
},
{
"type": "WEB",
"url": "https://gist.github.com/Jowu73/b8a2a267804dbfb17876dbedbbbfb28f"
},
{
"type": "WEB",
"url": "https://www.4cstrategies.com/solutions/exonaut"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GXHQ-4CHX-5R72
Vulnerability from github – Published: 2022-05-24 17:37 – Updated: 2022-05-24 17:37
VLAI
Details
There is an information disclosure vulnerability in TE Mobile software versions V600R006C10,V600R006C10SPC100. Due to the improper storage of some information in certain specific scenario, the attacker can gain information in the victim's device to launch the attack, successful exploit could cause information disclosure.
{
"affected": [],
"aliases": [
"CVE-2020-9202"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-12-24T16:15:00Z",
"severity": "MODERATE"
},
"details": "There is an information disclosure vulnerability in TE Mobile software versions V600R006C10,V600R006C10SPC100. Due to the improper storage of some information in certain specific scenario, the attacker can gain information in the victim\u0027s device to launch the attack, successful exploit could cause information disclosure.",
"id": "GHSA-gxhq-4chx-5r72",
"modified": "2022-05-24T17:37:17Z",
"published": "2022-05-24T17:37:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9202"
},
{
"type": "WEB",
"url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201209-01-informationleak-en"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-H75C-Q767-27J6
Vulnerability from github – Published: 2025-01-28 00:32 – Updated: 2025-01-28 21:31
VLAI
Details
An issue in CMSimple v.5.16 allows a remote attacker to obtain sensitive information via a crafted script to the validate link function.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2024-57546"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-27T23:15:09Z",
"severity": "HIGH"
},
"details": "An issue in CMSimple v.5.16 allows a remote attacker to obtain sensitive information via a crafted script to the validate link function.",
"id": "GHSA-h75c-q767-27j6",
"modified": "2025-01-28T21:31:03Z",
"published": "2025-01-28T00:32:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57546"
},
{
"type": "WEB",
"url": "https://gist.github.com/h4ckr4v3n/afbb87b5a05f283dbee705709c2769eb"
},
{
"type": "WEB",
"url": "https://github.com/h4ckr4v3n/cmsimple5.16_research/blob/main/CMSimple%205.16%20Validate%20links%20SSRF.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-H7QF-G4WG-6F83
Vulnerability from github – Published: 2024-04-15 21:30 – Updated: 2024-04-15 21:30
VLAI
Details
HCL DevOps Deploy / HCL Launch is vulnerable to sensitive information disclosure vulnerability due to insufficient obfuscation of sensitive values.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-23561"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-15T21:15:07Z",
"severity": "MODERATE"
},
"details": "HCL DevOps Deploy / HCL Launch is vulnerable to sensitive information disclosure vulnerability due to insufficient obfuscation of sensitive values. \n",
"id": "GHSA-h7qf-g4wg-6f83",
"modified": "2024-04-15T21:30:46Z",
"published": "2024-04-15T21:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23561"
},
{
"type": "WEB",
"url": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0111926"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.