CWE-922 · Information Disclosure
Insecure Storage of Sensitive Information
311CVEs
0exploited
1with a public check
3likely (EPSS 10%+)
SortMost likely exploited
311 CVEs with CWE-922 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2020-13937CheckApache Kylin - Exposed Configuration FileApache · Apache Kylin · 2020-10-19 | – | 78% | 2020-10-19 |
| CVE-2018-25031Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability…Smartbear · Swagger Ui · CVSS 4.3 · 2022-03-11 | 4.3 | 42% | 2022-03-11 |
| CVE-2021-27170An issue was discovered on FiberHome HG6245D devices through RP2613. By default, there are no firewall rules for IPv6 connectivity, exposing the internal management interfaces to…Fiberhome · Hg6245d Firmware · 2021-02-10 | – | 16% | 2021-02-10 |
| CVE-2023-41723A vulnerability in Veeam ONE allows a user with the Veeam ONE Read-Only User role to view the Dashboard Schedule. Note: The criticality of this vulnerability is reduced because th…Veeam · One · CVSS 4.3 · 2023-11-07 | 4.3 | 13% | 2023-11-07 |
| CVE-2020-1493Microsoft Outlook Information Disclosure VulnerabilityMicrosoft · Microsoft Office 2019 · CVSS 5.5 · 2020-08-17 | 5.5 | 7.3% | 2020-08-17 |
| CVE-2024-30896InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with read access to the authorization resourc…No vendor recorded · CVSS 9.1 · 2024-11-21 | 9.1 | 5.3% | 2024-11-21 |
| CVE-2025-29809Windows Kerberos Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 7.1 · 2025-04-08 | 7.1 | 4.3% | 2025-04-08 |
| CVE-2020-28911Incorrect Access Control in Nagios Fusion 4.1.8 and earlier allows low-privileged authenticated users to extract passwords used to manage fused servers via the test_server command…Nagios · Fusion · 2021-05-24 | – | 3.6% | 2021-05-24 |
| CVE-2017-7253Dahua IP Camera devices 3.200.0001.6 can be exploited via these steps: 1. Use the default low-privilege credentials to list all users via a request to a certain URI. 2. Login to t…Dahuasecurity · Ip Camera Firmware · 2017-03-30 | – | 2.6% | 2017-03-30 |
| CVE-2025-21299Windows Kerberos Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 7.1 · 2025-01-14 | 7.1 | 2.2% | 2025-01-14 |
| CVE-2024-7569An information disclosure vulnerability in Ivanti ITSM on-prem and Neurons for ITSM versions 2023.4 and earlier allows an unauthenticated attacker to obtain the OIDC client secret…Ivanti · ITSM · CVSS 9.6 · 2024-08-13 | 9.6 | 1.7% | 2024-08-13 |
| CVE-2021-28815Insecure Storage of Sensitive Information in myQNAPcloud LinkQNAP Systems Inc. · myQNAPcloud Link · CVSS 6 · 2021-06-16 | 6.0 | 1.7% | 2021-06-16 |
| CVE-2023-45184IBM i Access Client SolutionsIBM · i Access Client Solutions · CVSS 6.2 · 2023-12-14 | 6.2 | 1.6% | 2023-12-14 |
| CVE-2021-42371lpar2rrd is a hardcoded system account in XoruX LPAR2RRD and STOR2RRD before 7.30.Xorux · Lpar2rrd · 2021-11-08 | – | 1.6% | 2021-11-08 |
| CVE-2022-40959During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a bypass that leaked device permissions into untrusted subdocuments. This vul…Mozilla · Firefox ESR · CVSS 6.5 · 2022-12-22 | 6.5 | 1.5% | 2022-12-22 |
| CVE-2019-20060MFScripts YetiShare v3.5.2 through v4.5.4 places sensitive information in the Referer header. If this leaks, then third parties may discover password-reset hashes, file-delete lin…Mfscripts · Yetishare · 2020-02-10 | – | 1.4% | 2020-02-10 |
| CVE-2020-26104In cPanel before 88.0.3, an insecure SRS secret is used on a templated VM (SEC-552).Cpanel · Cpanel · 2020-09-25 | – | 1.4% | 2020-09-25 |
| CVE-2022-0724Insecure Storage of Sensitive Information in microweber/microwebermicroweber · microweber/microweber · CVSS 9.1 · 2022-02-23 | 9.1 | 1.3% | 2022-02-23 |
| CVE-2019-4549IBM Security Directory Server 6.4.0 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 1659…IBM · Security Directory Server · CVSS 5.3 · 2019-10-02 | 5.3 | 1.3% | 2019-10-02 |
| CVE-2019-12914Redbrick Shift through 3.4.3 allows an attacker to extract authentication tokens of services (such as Gmail, Outlook, etc.) used in the application.Rdbrck · Shift · 2019-07-17 | – | 1.2% | 2019-07-17 |
| CVE-2019-12911Redbrick Shift through 3.4.3 allows an attacker to extract authentication tokens of services (such as Gmail, Outlook, etc.) used in the application.Rdbrck · Shift · 2019-07-17 | – | 1.2% | 2019-07-17 |
| CVE-2020-15775An issue was discovered in Gradle Enterprise 2017.1 - 2020.2.4. The /usage page of Gradle Enterprise conveys high level build information such as project names and build counts ov…Gradle · Enterprise · 2020-09-18 | – | 1.2% | 2020-09-18 |
| CVE-2020-4315IBM Business Automation Content Analyzer on Cloud 1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values…IBM · Business Automation Content Analyzer on Cloud · CVSS 4.3 · 2020-09-21 | 4.3 | 1.2% | 2020-09-21 |
| CVE-2023-29727The Call Blocker application 6.6.3 for Android allows unauthorized applications to use exposed components to delete data stored in its database that is related to user privacy set…Applika · Call Blocker · CVSS 9.8 · 2023-05-30 | 9.8 | 1.2% | 2023-05-30 |
| CVE-2019-13719Incorrect security UI in full screen mode in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to hide security UI via a crafted HTML page.Google · Chrome · 2019-11-25 | – | 1.2% | 2019-11-25 |
| CVE-2020-7000VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow an unauthenticated attacker to discover the cryptographic key from the web server and gain information ab…VISAM · VBASE Editor · 2020-04-03 | – | 1.1% | 2020-04-03 |
| CVE-2025-12539TNC Toolbox: Web Performance <= 1.4.2 - Unauthenticated Sensitive Information Exposure to Privilege Escalation/cPanel Account Takeoverleopardhost · TNC Toolbox: Web Performance · CVSS 10 · 2025-11-11 | 10.0 | 1.1% | 2025-11-11 |
| CVE-2019-12825Unauthorized Access to the Container Registry of other groups was discovered in GitLab Enterprise 12.0.0-pre. In other words, authenticated remote attackers can read Docker regist…Gitlab · Gitlab · 2020-02-17 | – | 1.1% | 2020-02-17 |
| CVE-2021-25776In JetBrains TeamCity before 2020.2, an ECR token could be exposed in a build's parameters.Jetbrains · Teamcity · 2021-02-03 | – | 1.1% | 2021-02-03 |
| CVE-2022-0881Insecure Storage of Sensitive Information in chocobozzz/peertubechocobozzz · chocobozzz/peertube · CVSS 7.6 · 2022-03-09 | 7.6 | 1.1% | 2022-03-09 |
| CVE-2019-14957The JetBrains Vim plugin before version 0.52 was storing individual project data in the global vim_settings.xml file. This xml file could be synchronized to a publicly accessible…Jetbrains · Vim · 2019-10-01 | – | 1.1% | 2019-10-01 |
| CVE-2020-29603In manage_proj_edit_page.php in MantisBT before 2.24.4, any unprivileged logged-in user can retrieve Private Projects' names via the manage_proj_edit_page.php project_id parameter…Mantisbt · Mantisbt · 2021-01-29 | – | 1.1% | 2021-01-29 |
| CVE-2019-13717Incorrect security UI in full screen mode in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to hide security UI via a crafted HTML page.Google · Chrome · 2019-11-25 | – | 1.0% | 2019-11-25 |
| CVE-2021-22914Citrix Cloud Connector before 6.31.0.62192 suffers from insecure storage of sensitive information due to sensitive information being stored in the Citrix Cloud Connector installat…Citrix · Citrix Cloud Connector · 2021-06-16 | – | 1.0% | 2021-06-16 |
| CVE-2018-13313Admin Password returned in password.htmTotolink · A3002ru Firmware · 2020-02-24 | – | 1.0% | 2020-02-24 |
| CVE-2020-4171IBM Security Guardium Insights 2.0.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 174407.IBM · Security Guardium Insights · CVSS 4.3 · 2020-08-27 | 4.3 | 1.0% | 2020-08-27 |
| CVE-2021-36786The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows Sensitive Data Exposure of API credentials and private keys.Miniorange · Saml · 2021-08-13 | – | 1.0% | 2021-08-13 |
| CVE-2024-22773Intelbras Action RF 1200 routers 1.2.2 and earlier and Action RG 1200 routers 2.1.7 and earlier expose the Password in Cookie resulting in Login Bypass.Intelbras · Action Rf 1200 Firmware · CVSS 8.1 · 2024-02-06 | 8.1 | 1.0% | 2024-02-06 |
| CVE-2022-25264In JetBrains TeamCity before 2021.2.3, environment variables of the "password" type could be logged in some cases.Jetbrains · Teamcity · 2022-02-25 | – | 1.0% | 2022-02-25 |
| CVE-2022-28168In Brocade SANnav before Brocade SANnav v2.2.0.2 and Brocade SANnav2.1.1.8, encoded scp-server passwords are stored using Base64 encoding, which could allow an attacker able to ac…Broadcom · Brocade SANnav · 2022-06-27 | – | 0.9% | 2022-06-27 |
| CVE-2021-28653The iOS and macOS apps before 1.4.1 for the Western Digital G-Technology ArmorLock NVMe SSD store keys insecurely. They choose a non-preferred storage mechanism if the device has…Westerndigital · Armorlock · 2021-03-18 | – | 0.9% | 2021-03-18 |
| CVE-2021-36546Incorrect Access Control issue discovered in KiteCMS 1.1 allows remote attackers to view sensitive information via path in application URL.Kitesky · Kitecms · CVSS 7.5 · 2023-02-03 | 7.5 | 0.9% | 2023-02-03 |
| CVE-2022-1044Sensitive Data Exposure Due To Insecure Storage Of Profile Image in polonel/trudeskpolonel · polonel/trudesk · CVSS 8.2 · 2022-05-12 | 8.2 | 0.9% | 2022-05-12 |
| CVE-2020-5008IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.14 stores sensitive information in GET request parameters. This may lead to information disclosure…IBM · DataPower Gateway · CVSS 3.7 · 2021-06-07 | 3.7 | 0.9% | 2021-06-07 |
| CVE-2017-5249In version 6.1.0.19 and prior of Wink Labs's Wink - Smart Home Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and secure manne…Wink Labs Inc · Wink - Smart Home · 2018-02-22 | – | 0.9% | 2018-02-22 |
| CVE-2022-46484Information disclosure in password protected surveys in Data Illusion Survey Software Solutions NGSurvey v2.4.28 and below allows attackers to view the password to access and arbi…Ngsurvey · Ngsurvey · 2023-08-02 | – | 0.9% | 2023-08-02 |
| CVE-2020-4674IBM Workload Automation 9.5 stores the server path in URLs that could aid in further attacks against the system. IBM X-Force ID: 186287.IBM · Workload Automation · CVSS 4.3 · 2021-01-12 | 4.3 | 0.8% | 2021-01-12 |
| CVE-2020-4673IBM Workload Automation 9.5 stores sensitive information in HTML comments that could aid in further attacks against the system. IBM X-Force ID: 186286.IBM · Workload Automation · CVSS 4.3 · 2021-01-12 | 4.3 | 0.8% | 2021-01-12 |
| CVE-2022-1021Insecure Storage of Sensitive Information in chatwoot/chatwootchatwoot · chatwoot/chatwoot · CVSS 7.6 · 2022-08-19 | 7.6 | 0.8% | 2022-08-19 |
| CVE-2025-8699Some "Stored Value" Unattended Payment Solutions of KioSoft use vulnerable NFC cards. Attackers could potentially use this vulnerability to change the balance on the cards and gen…KioSoft · Stored Value Unattended Payment Solution · CVSS 9.1 · 2025-09-12 | 9.1 | 0.8% | 2025-09-12 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.