Insecure Storage of Sensitive Information

Every one of the 311 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Apache Kylin - Exposed Configuration FileCVE-2020-13937Apache Kylin · 78% likely
2. Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability…CVE-2018-25031CVSS 4.3 · 42% likely
3. An issue was discovered on FiberHome HG6245D devices through RP2613. By default, there are no firewall rules for IPv6 connectivity, exposing the internal management interfaces to…CVE-2021-2717016% likely
4. A vulnerability in Veeam ONE allows a user with the Veeam ONE Read-Only User role to view the Dashboard Schedule. Note: The criticality of this vulnerability is reduced because th…CVE-2023-41723Veeam · CVSS 4.3 · 13% likely

   Veeam

5. Microsoft Outlook Information Disclosure VulnerabilityCVE-2020-1493Microsoft · CVSS 5.5 · 7.3% likely

   Microsoft

6. InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with read access to the authorization resourc…CVE-2024-30896CVSS 9.1 · 5.3% likely
7. Windows Kerberos Security Feature Bypass VulnerabilityCVE-2025-29809Microsoft · CVSS 7.1 · 4.3% likely

   Microsoft

8. Incorrect Access Control in Nagios Fusion 4.1.8 and earlier allows low-privileged authenticated users to extract passwords used to manage fused servers via the test_server command…CVE-2020-289113.6% likely
9. Dahua IP Camera devices 3.200.0001.6 can be exploited via these steps: 1. Use the default low-privilege credentials to list all users via a request to a certain URI. 2. Login to t…CVE-2017-72532.6% likely
10. Windows Kerberos Security Feature Bypass VulnerabilityCVE-2025-21299Microsoft · CVSS 7.1 · 2.2% likely

    Microsoft

11. An information disclosure vulnerability in Ivanti ITSM on-prem and Neurons for ITSM versions 2023.4 and earlier allows an unauthenticated attacker to obtain the OIDC client secret…CVE-2024-7569Ivanti · CVSS 9.6 · 1.7% likely

    Ivanti

12. Insecure Storage of Sensitive Information in myQNAPcloud LinkCVE-2021-28815QNAP Systems Inc. · CVSS 6 · 1.7% likely

    QNAP

13. IBM i Access Client SolutionsCVE-2023-45184IBM · CVSS 6.2 · 1.6% likely

    IBM

14. lpar2rrd is a hardcoded system account in XoruX LPAR2RRD and STOR2RRD before 7.30.CVE-2021-423711.6% likely
15. During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a bypass that leaked device permissions into untrusted subdocuments. This vul…CVE-2022-40959Mozilla · CVSS 6.5 · 1.5% likely

    Mozilla

16. MFScripts YetiShare v3.5.2 through v4.5.4 places sensitive information in the Referer header. If this leaks, then third parties may discover password-reset hashes, file-delete lin…CVE-2019-200601.4% likely
17. In cPanel before 88.0.3, an insecure SRS secret is used on a templated VM (SEC-552).CVE-2020-261041.4% likely
18. Insecure Storage of Sensitive Information in microweber/microweberCVE-2022-0724microweber · CVSS 9.1 · 1.3% likely

    Microweber

19. IBM Security Directory Server 6.4.0 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 1659…CVE-2019-4549IBM · CVSS 5.3 · 1.3% likely

    IBM

20. Redbrick Shift through 3.4.3 allows an attacker to extract authentication tokens of services (such as Gmail, Outlook, etc.) used in the application.CVE-2019-129141.2% likely
21. Redbrick Shift through 3.4.3 allows an attacker to extract authentication tokens of services (such as Gmail, Outlook, etc.) used in the application.CVE-2019-129111.2% likely
22. An issue was discovered in Gradle Enterprise 2017.1 - 2020.2.4. The /usage page of Gradle Enterprise conveys high level build information such as project names and build counts ov…CVE-2020-157751.2% likely
23. IBM Business Automation Content Analyzer on Cloud 1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values…CVE-2020-4315IBM · CVSS 4.3 · 1.2% likely

    IBM

24. The Call Blocker application 6.6.3 for Android allows unauthorized applications to use exposed components to delete data stored in its database that is related to user privacy set…CVE-2023-29727CVSS 9.8 · 1.2% likely
25. Incorrect security UI in full screen mode in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to hide security UI via a crafted HTML page.CVE-2019-13719Google · 1.2% likely

    Google

26. VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow an unauthenticated attacker to discover the cryptographic key from the web server and gain information ab…CVE-2020-7000VISAM · 1.1% likely

    VISAM

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.