CWE-922
Insecure Storage of Sensitive Information
Description
The product stores sensitive information without properly limiting read or write access by unauthorized actors.
Hierarchy (View 1000)
CVEs mapped to this weakness (381)
page 18 of 20| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-4809 | Low | 0.21 | 3.3 | 0.00 | Sep 23, 2021 | IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189633. | ||
| CVE-2020-4805 | Low | 0.21 | 3.3 | 0.00 | Sep 23, 2021 | IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189539. | ||
| CVE-2020-4803 | Low | 0.21 | 3.3 | 0.00 | Sep 23, 2021 | IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189535. | ||
| CVE-2021-25404 | Low | 0.21 | 3.3 | 0.00 | Jun 11, 2021 | Information Exposure vulnerability in SmartThings prior to version 1.7.64.21 allows attacker to access user information via log. | ||
| CVE-2021-25402 | Low | 0.21 | 3.3 | 0.00 | Jun 11, 2021 | Information Exposure vulnerability in Samsung Notes prior to version 4.2.04.27 allows attacker to access s pen latency information. | ||
| CVE-2021-20396 | Low | 0.21 | 3.3 | 0.00 | Jun 11, 2021 | IBM QRadar Analyst Workflow App 1.0 through 1.18.0 for IBM QRadar SIEM allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 196009. | ||
| CVE-2021-20575 | Low | 0.21 | 3.3 | 0.00 | Jun 1, 2021 | IBM Security Verify Access 20.07 allows web pages to be stored locally which can be read by another user on the system. X-Force ID: 199278. | ||
| CVE-2020-4765 | Low | 0.21 | 3.3 | 0.00 | May 19, 2021 | IBM Cloud Pak for Multicloud Management prior to 2.3 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 188902. | ||
| CVE-2021-20391 | Low | 0.21 | 3.3 | 0.00 | May 14, 2021 | IBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 195999. | ||
| CVE-2020-4726 | Low | 0.21 | 3.3 | 0.00 | Mar 2, 2021 | The IBM Application Performance Monitoring UI (IBM Cloud APM 8.1.4) allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 187975. | ||
| CVE-2020-29603 | Med | 0.21 | 4.3 | 0.01 | Jan 29, 2021 | In manage_proj_edit_page.php in MantisBT before 2.24.4, any unprivileged logged-in user can retrieve Private Projects' names via the manage_proj_edit_page.php project_id parameter, without having access to them. | ||
| CVE-2020-4906 | Low | 0.21 | 3.3 | 0.00 | Dec 16, 2020 | IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 allows web pages to be stored locally which can be read by another user on the system. | ||
| CVE-2020-4886 | Low | 0.21 | 3.3 | 0.00 | Nov 13, 2020 | IBM InfoSphere Information Server 11.7 stores sensitive information in the browser's history that could be obtained by a user who has access to the same system. IBM X-Force ID: 190910. | ||
| CVE-2020-4650 | Low | 0.21 | 3.3 | 0.00 | Nov 9, 2020 | IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 186023. | ||
| CVE-2020-4344 | Low | 0.21 | 3.3 | 0.00 | Sep 15, 2020 | IBM Tivoli Business Service Manager 6.2.0.0 - 6.2.0.2 IF 1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 178247. | ||
| CVE-2019-4695 | Low | 0.21 | 3.3 | 0.00 | Aug 26, 2020 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 171926. | ||
| CVE-2020-4371 | Low | 0.21 | 3.3 | 0.00 | Jul 22, 2020 | IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 contains sensitive information in leftover debug code that could be used aid a local user in further attacks against the system. IBM X-Force ID: 179008. | ||
| CVE-2024-22371 | Low | 0.19 | 2.9 | 0.01 | Feb 26, 2024 | Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel.This issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through… | ||
| CVE-2023-6460 | Med | 0.19 | 4.0 | 0.00 | Dec 4, 2023 | A potential logging of the firestore key via logging within nodejs-firestore exists - Developers who were logging objects through this._settings would be logging the firestore key as well potentially exposing it to anyone with logs read access. We recommend upgrading to version… | ||
| CVE-2024-28808 | Low | 0.18 | 2.7 | 0.00 | Sep 30, 2024 | An issue was discovered in Infinera hiT 7300 5.60.50. Hidden functionality in the web interface allows a remote authenticated attacker to access reserved information by accessing undocumented web applications. |
- risk 0.21cvss 3.3epss 0.00
IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189633.
- risk 0.21cvss 3.3epss 0.00
IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189539.
- risk 0.21cvss 3.3epss 0.00
IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189535.
- risk 0.21cvss 3.3epss 0.00
Information Exposure vulnerability in SmartThings prior to version 1.7.64.21 allows attacker to access user information via log.
- risk 0.21cvss 3.3epss 0.00
Information Exposure vulnerability in Samsung Notes prior to version 4.2.04.27 allows attacker to access s pen latency information.
- risk 0.21cvss 3.3epss 0.00
IBM QRadar Analyst Workflow App 1.0 through 1.18.0 for IBM QRadar SIEM allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 196009.
- risk 0.21cvss 3.3epss 0.00
IBM Security Verify Access 20.07 allows web pages to be stored locally which can be read by another user on the system. X-Force ID: 199278.
- risk 0.21cvss 3.3epss 0.00
IBM Cloud Pak for Multicloud Management prior to 2.3 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 188902.
- risk 0.21cvss 3.3epss 0.00
IBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 195999.
- risk 0.21cvss 3.3epss 0.00
The IBM Application Performance Monitoring UI (IBM Cloud APM 8.1.4) allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 187975.
- risk 0.21cvss 4.3epss 0.01
In manage_proj_edit_page.php in MantisBT before 2.24.4, any unprivileged logged-in user can retrieve Private Projects' names via the manage_proj_edit_page.php project_id parameter, without having access to them.
- risk 0.21cvss 3.3epss 0.00
IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 allows web pages to be stored locally which can be read by another user on the system.
- risk 0.21cvss 3.3epss 0.00
IBM InfoSphere Information Server 11.7 stores sensitive information in the browser's history that could be obtained by a user who has access to the same system. IBM X-Force ID: 190910.
- risk 0.21cvss 3.3epss 0.00
IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 186023.
- risk 0.21cvss 3.3epss 0.00
IBM Tivoli Business Service Manager 6.2.0.0 - 6.2.0.2 IF 1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 178247.
- risk 0.21cvss 3.3epss 0.00
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 171926.
- risk 0.21cvss 3.3epss 0.00
IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 contains sensitive information in leftover debug code that could be used aid a local user in further attacks against the system. IBM X-Force ID: 179008.
- risk 0.19cvss 2.9epss 0.01
Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel.This issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through…
- risk 0.19cvss 4.0epss 0.00
A potential logging of the firestore key via logging within nodejs-firestore exists - Developers who were logging objects through this._settings would be logging the firestore key as well potentially exposing it to anyone with logs read access. We recommend upgrading to version…
- risk 0.18cvss 2.7epss 0.00
An issue was discovered in Infinera hiT 7300 5.60.50. Hidden functionality in the web interface allows a remote authenticated attacker to access reserved information by accessing undocumented web applications.