CWE-922— Insecure Storage of Sensitive Information
The product stores sensitive information without properly limiting read or write access by unauthorized actors.— MITRE CWE catalog
417 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-922page 3 of 9
- CVE-2020-26104HIGHCVSS 7.5EG 7.52020-09-25
In cPanel before 88.0.3, an insecure SRS secret is used on a templated VM (SEC-552).
- CVE-2020-15775HIGHCVSS 7.5EG 7.52020-09-18
An issue was discovered in Gradle Enterprise 2017.1 - 2020.2.4. The /usage page of Gradle Enterprise conveys high level build information such as project names and build counts over time. This page is incorrectly viewable anonymously.
- CVE-2020-7000HIGHCVSS 7.5EG 7.52020-04-03
VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow an unauthenticated attacker to discover the cryptographic key from the web server and gain information about the login and the encryption/decryption mechanism, which…
- CVE-2019-20060HIGHCVSS 7.5EG 7.52020-02-10
MFScripts YetiShare v3.5.2 through v4.5.4 places sensitive information in the Referer header. If this leaks, then third parties may discover password-reset hashes, file-delete links, or other sensitive information.
- CVE-2019-12914HIGHCVSS 7.5EG 7.52019-07-17
Redbrick Shift through 3.4.3 allows an attacker to extract authentication tokens of services (such as Gmail, Outlook, etc.) used in the application.
- CVE-2019-12911HIGHCVSS 7.5EG 7.52019-07-17
Redbrick Shift through 3.4.3 allows an attacker to extract authentication tokens of services (such as Gmail, Outlook, etc.) used in the application.
- CVE-2023-37879HIGHCVSS 6.5EG 7.52023-09-12
Insecure storage of sensitive information in Wing FTP Server (User Web Client) allows information elicitation.This issue affects Wing FTP Server: <= 7.2.0.
- CVE-2023-22687HIGHCVSS 3.7EG 7.52023-04-16
Insecure Storage of Sensitive Information vulnerability in Jose Mortellaro Freesoul Deactivate Plugins – Plugin manager and cleanup plugin <= 1.9.4.0 versions.
- CVE-2023-45182HIGHCVSS 6.5EG 7.42023-12-14
IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 is vulnerable to having its key for an encrypted password decoded. By somehow gaining access to the encrypted password, a local attacker could exploit this vuln…
- CVE-2026-89075HIGHCVSS 7.3EG 7.32026-10-14
Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
- CVE-2025-61482HIGHCVSS 7.2EG 7.22025-10-27
Improper handling of OTP/TOTP/HOTP values in NetKnights GmbH privacyIDEA Authenticator v.4.3.0 on Android allows local attackers with root access to bypass two factor authentication. By hooking into app crypto routines and intercepting dec…
- CVE-2024-57436HIGHCVSS 7.2EG 7.22025-01-29
RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can allow attackers to impersonate Admin users via using a crafted cookie.
- CVE-2025-29809HIGHCVSS 7.1EG 7.12025-04-08
Insecure storage of sensitive information in Windows Kerberos allows an authorized attacker to bypass a security feature locally.
- CVE-2025-21299HIGHCVSS 7.1EG 7.12025-01-14
Windows Kerberos Security Feature Bypass Vulnerability
- CVE-2021-25276HIGHCVSS 7.1EG 7.12021-02-03
In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' password hashes) that is world readable and writable. An unprivileged Windows user (having access to the server's filesyst…
- CVE-2019-5625HIGHCVSS 7.1EG 7.12019-05-22
The Android mobile application Halo Home before 1.11.0 stores OAuth authentication and refresh access tokens in a clear text file. This file persists until the user logs out of the application and reboots the device. This vulnerability can…
- CVE-2026-26152HIGHCVSS 7.0EG 7.02026-04-14
Insecure storage of sensitive information in Windows Cryptographic Services allows an authorized attacker to elevate privileges locally.
- CVE-2026-84283MEDIUMCVSS 6.8EG 6.82026-09-24
Secure Folder 1.2 stores files selected for its password-protected vault as unencrypted files in the Android shared-storage tree. A local application or file manager that has access to the relevant shared-storage path can enumerate, copy, …
- CVE-2026-77875MEDIUMCVSS 6.8EG 6.82026-09-18
The application protects access through its calculator-style vault passcode, but the stored data is not bound to that authentication boundary. A local actor who can access shared external storage, such as through an authorized non-root ADB…
- CVE-2025-60856MEDIUMCVSS 6.8EG 6.82025-10-20
Reolink Video Doorbell WiFi DB_566128M5MP_W allows root shell access through an unsecured UART/serial console. An attacker with physical access can connect to the exposed interface and execute arbitrary commands with root privileges. NOTE:…
- CVE-2025-25732MEDIUMCVSS 6.8EG 6.82025-08-26
Incorrect access control in the EEPROM component of Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 allows attackers to replace password hashes stored in the EEPROM with hashes …
- CVE-2025-2489MEDIUMCVSS 6.8EG 6.82025-03-18
Insecure information storage vulnerability in NTFS Tools version 3.5.1. Exploitation of this vulnerability could allow an attacker to know the application password, stored in /Users/user/Library/Application Support/ntfs-tool/config.json.
- CVE-2024-29965MEDIUMCVSS 6.8EG 6.82024-04-19
In Brocade SANnav before v2.3.1, and v2.3.0a, it is possible to back up the appliance from the web interface or the command line interface ("SSH"). The resulting backups are world-readable. A local attacker can recover backup files, resto…
- CVE-2023-5879MEDIUMCVSS 6.8EG 6.82024-01-03
Users’ product account authentication data was stored in clear text in The Genie Company Aladdin Connect Mobile Application Version 5.65 Build 2075 (and below) on Android Devices. This allows the attacker, with access to the android devi…
- CVE-2017-6911MEDIUMCVSS 6.6EG 6.62017-03-23
USB Pratirodh is prone to sensitive information disclosure. It stores sensitive information such as username and password in simple usb.xml. An attacker with physical access to the system can modify the file according his own requirements …
- CVE-2026-109822MEDIUMCVSS 6.5EG 6.52026-10-29
Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with insecure storage of sensitive information. Configuration files generated by the CONFIG file export function may be read by an unauthenticated attacker.
- CVE-2025-10464MEDIUMCVSS 6.5EG 6.52026-02-09
Insecure Storage of Sensitive Information vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Senseway allows Retrieve Embedded Sensitive Data. This issue affects Senseway: through 09022026. NOTE: Because the …
- CVE-2025-53507MEDIUMCVSS 6.5EG 6.52025-08-29
Multiple products provided by iND Co.,Ltd contain an insecure storage of sensitive information vulnerability. If exploited, configuration information, such as admin password, may be disclosed. As for the details of affected product names a…
- CVE-2025-28171MEDIUMCVSS 6.5EG 6.52025-07-29
An issue in Grandstream UCM6510 v.1.0.20.52 and before allows a remote attacker to obtain sensitive information via the Login function at /cgi and /webrtccgi.
- CVE-2024-13954MEDIUMCVSS 6.5EG 6.52025-05-22
Serialized configuration information may be disclosed during device commissioning while using ASPECT's configuration toolsetThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
- CVE-2024-54728MEDIUMCVSS 6.5EG 6.52025-01-27
Incorrect access control in BYD QIN PLUS DM-i Dilink OS 3.0_13.1.7.2204050.1 allows unauthorized attackers to access system logcat logs.
- CVE-2024-56972MEDIUMCVSS 6.5EG 6.52025-01-27
An issue in Midea Group Co., Ltd Midea Home iOS 9.3.12 allows attackers to access sensitive user information via supplying a crafted link.
- CVE-2024-56971MEDIUMCVSS 6.5EG 6.52025-01-27
An issue in Zhiyuan Yuedu (Guangzhou) Literature Information Technology Co., Ltd Shuqi Novel iOS 5.3.8 allows attackers to access sensitive user information via supplying a crafted link.
- CVE-2024-56969MEDIUMCVSS 6.5EG 6.52025-01-27
An issue in Pixocial Technology (Singapore) Pte. Ltd BeautyPlus iOS 7.8.010 allows attackers to access sensitive user information via supplying a crafted link.
- CVE-2024-56968MEDIUMCVSS 6.5EG 6.52025-01-27
An issue in Shenzhen Intellirocks Tech Co. Ltd Govee Home iOS 6.5.01 allows attackers to access sensitive user information via supplying a crafted payload.
- CVE-2024-56967MEDIUMCVSS 6.5EG 6.52025-01-27
An issue in Cloud Whale Interactive Technology LLC. PolyBuzz iOS 2.0.20 allows attackers to access sensitive user information via supplying a crafted link.
- CVE-2024-56966MEDIUMCVSS 6.5EG 6.52025-01-27
An issue in Shanghai Xuan Ting Entertainment Information & Technology Co., Ltd Qidian Reader iOS 5.9.384 allows attackers to access sensitive user information via supplying a crafted link.
- CVE-2024-56965MEDIUMCVSS 6.5EG 6.52025-01-27
An issue in Shanghai Shizhi Information Technology Co., Ltd Shihuo iOS 8.16.0 allows attackers to access sensitive user information via supplying a crafted link.
- CVE-2024-56964MEDIUMCVSS 6.5EG 6.52025-01-27
An issue in Che Hao Duo Used Automobile Agency (Beijing) Co., Ltd Guazi Used Car iOS 10.15.1 allows attackers to access sensitive user information via supplying a crafted link.
- CVE-2024-56963MEDIUMCVSS 6.5EG 6.52025-01-27
An issue in Beijing Sogou Technology Development Co., Ltd Sogou Input iOS 12.2.0 allows attackers to access sensitive user information via supplying a crafted link.
- CVE-2024-56962MEDIUMCVSS 6.5EG 6.52025-01-27
An issue in Tencent Technology (Shanghai) Co., Ltd WeSing iOS v9.3.39 allows attackers to access sensitive user information via supplying a crafted link.
- CVE-2024-56960MEDIUMCVSS 6.5EG 6.52025-01-27
An issue in Tianjin Xiaowu Information technology Co., Ltd BeiKe Holdings iOS 1.3.50 allows attackers to access sensitive user information via supplying a crafted link.
- CVE-2024-56959MEDIUMCVSS 6.5EG 6.52025-01-27
An issue in Mashang Consumer Finance Co., Ltd Anyihua iOS 3.6.2 allows attackers to access sensitive user information via supplying a crafted link.
- CVE-2024-56957MEDIUMCVSS 6.5EG 6.52025-01-27
An issue in Kingsoft Office Software Corporation Limited WPS Office iOS 12.20.0 allows attackers to access sensitive user information via supplying a crafted link.
- CVE-2024-56955MEDIUMCVSS 6.5EG 6.52025-01-27
An issue in Tencent Technology (Shenzhen) Company Limited QQMail iOS 6.6.4 allows attackers to access sensitive user information via supplying a crafted link.
- CVE-2024-56954MEDIUMCVSS 6.5EG 6.52025-01-27
An issue in Beijing Baidu Netcom Science & Technology Co Ltd Haokan Video iOS 7.70.0 allows attackers to access sensitive user information via supplying a crafted link.
- CVE-2024-56953MEDIUMCVSS 6.5EG 6.52025-01-27
An issue in Baidu (China) Co Ltd Baidu Input Method (iOS version) v12.6.13 allows attackers to access user information via supplying a crafted link.
- CVE-2024-56952MEDIUMCVSS 6.5EG 6.52025-01-27
An issue in Beijing Baidu Netcom Science & Technology Co Ltd Baidu Lite app (iOS version) 6.40.0 allows attackers to access user information via supplying a crafted link.
- CVE-2024-56951MEDIUMCVSS 6.5EG 6.52025-01-27
An issue in Hangzhou Bobo Technology Co Ltd UU Game Booster iOS 10.6.13 allows attackers to access sensitive user information via supplying a crafted link.
- CVE-2024-56950MEDIUMCVSS 6.5EG 6.52025-01-27
An issue in KuGou Technology Co., Ltd KuGou Concept iOS 4.0.61 allows attackers to access sensitive user information via supplying a crafted link.
Map vulnerabilities like CWE-922 to your infrastructure
EchelonGraph correlates every CVE — across CWE-922 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →