Skip to content
Noroxi

CWE-922 · 295 records

Insecure Storage of Sensitive Information

CVEs in this class

295 records

  • CVE-2020-13937
    44Plan

    Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3

    MediumCVSS 5.3Proof of conceptEPSS 78%

    apache · kylinOct 19, 2020

  • CVE-2021-27170
    44Plan

    An issue was discovered on FiberHome HG6245D devices through RP2613.

    CriticalCVSS 9.8No exploitEPSS 15%

    fiberhome · hg6245d firmwareFeb 10, 2021

  • CVE-2025-12539
    40Plan

    TNC Toolbox: Web Performance <= 1.4.2 - Unauthenticated Sensitive Information Exposure to Privilege Escalation/cPanel Account Takeover

    CriticalCVSS 10.0Proof of conceptEPSS 1%

    leopardhost · tnc toolbox: web performanceNov 11, 2025

  • CVE-2021-42371
    39Monitor

    lpar2rrd is a hardcoded system account in XoruX LPAR2RRD and STOR2RRD before 7.30.

    CriticalCVSS 9.8No exploitEPSS 1%

    xorux · lpar2rrdNov 8, 2021

  • CVE-2023-29727
    39Monitor

    The Call Blocker application 6.6.3 for Android allows unauthorized applications to use exposed components to delete data stored in its datab

    CriticalCVSS 9.8No exploitEPSS 1%

    applika · call blockerMay 30, 2023

  • CVE-2017-5249
    39Monitor

    In version 6.1.0.19 and prior of Wink Labs's Wink - Smart Home Android app, the OAuth token used by the app to authorize user access is not

    CriticalCVSS 9.8No exploitEPSS 0%

    wink · winkFeb 22, 2018

  • CVE-2017-5250
    39Monitor

    In version 1.9.7 and prior of Insteon's Insteon for Hub Android app, the OAuth token used by the app to authorize user access is not stored

    CriticalCVSS 9.8No exploitEPSS 0%

    insteon · insteon for hubFeb 22, 2018

  • CVE-2022-44581
    39Monitor

    WordPress Defender Security plugin <= 3.3.2 - Broken Authentication vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    wpmudev · defenderMay 17, 2024

  • CVE-2023-32191
    39Monitor

    rke's credentials are stored in the RKE1 Cluster state ConfigMap

    CriticalCVSS 9.9No exploitEPSS 0%

    suse · rkeOct 16, 2024

  • CVE-2023-0580
    39Monitor

    Information Disclosure vulnerability in My Control System (on-premise)

    CriticalCVSS 9.8No exploitEPSS 0%

    abb · my control systemApr 6, 2023

  • CVE-2025-48929
    39Monitor

    The TeleMessage service through 2025-05-05 implements authentication through a long-lived credential (e.g., not a token with a short expirat

    CriticalCVSS 9.8No exploitEPSS 0%

    smarsh · telemessageMay 28, 2025

  • CVE-2024-30896
    38Monitor

    InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with r

    CriticalCVSS 9.1Proof of conceptEPSS 5%

    Nov 21, 2024

  • CVE-2017-7253
    36Monitor

    Dahua IP Camera devices 3.200.0001.6 can be exploited via these steps: 1.

    HighCVSS 8.8No exploitEPSS 2%

    dahuasecurity · ip camera firmwareMar 30, 2017

  • CVE-2025-8699
    36Monitor

    Some "Stored Value" Unattended Payment Solutions of KioSoft use vulnerable NFC cards.

    CriticalCVSS 9.1No exploitEPSS 0%

    kiosoft · stored value unattended payment solutionSep 12, 2025

  • CVE-2024-10943
    36Monitor

    FactoryTalk® Updater Authentication Bypass

    CriticalCVSS 9.1No exploitEPSS 0%

    rockwell automation · factorytalk updaterNov 12, 2024

  • CVE-2023-42913
    35Monitor

    This issue was addressed through improved state management.

    HighCVSS 8.8No exploitEPSS 0%

    apple · macosMar 28, 2024

  • CVE-2025-28244
    35Monitor

    Insecure Permissions vulnerability in the Local Storage in Alteryx Server 2023.1.1.460 allows remote attackers to obtain valid user session

    HighCVSS 8.8No exploitEPSS 0%

    alteryx · alteryx serverJul 10, 2025

  • CVE-2025-10971
    35Monitor

    Insecure Storage of Sensitive Information

    HighCVSS 8.8No exploitEPSS 0%

    fermax electrónica s.a.u · meetmeDec 2, 2025

  • CVE-2024-47043
    34Monitor

    Ruijie Reyee OS Insecure Storage of Sensitive Information

    HighCVSS 8.7No exploitEPSS 0%

    ruijienetworks · reyee osDec 6, 2024

  • CVE-2025-14376
    34Monitor

    Verve Asset Manager – Plaintext Storage Vulnerabilities

    HighCVSS 8.6No exploitEPSS 0%

    rockwell automation · verve asset managerJan 20, 2026

  • CVE-2025-21299
    32Monitor

    Windows Kerberos Security Feature Bypass Vulnerability

    HighCVSS 7.8No exploitEPSS 2%

    microsoft · windows 10 1507Jan 14, 2025

  • CVE-2024-22773
    32Monitor

    Intelbras Action RF 1200 routers 1.2.2 and earlier and Action RG 1200 routers 2.1.7 and earlier expose the Password in Cookie resulting in L

    HighCVSS 8.1No exploitEPSS 0%

    intelbras · action rf 1200 firmwareFeb 5, 2024

  • CVE-2024-52519
    32Monitor

    Nextcloud Server's OAuth2 client secrets were stored in a recoverable way

    HighCVSS 8.2No exploitEPSS 0%

    nextcloud · nextcloud serverNov 15, 2024

  • CVE-2025-2241
    32Monitor

    Hive: exposure of vcenter credentials via clusterprovision in hive / mce / acm

    HighCVSS 8.2No exploitEPSS 0%

    red hat · multicluster engine for kubernetesMar 17, 2025

  • CVE-2024-48770
    32Monitor

    An issue in Plug n Play Camera com.wisdomcity.zwave 1.1.0 allows a remote attacker to obtain sensitive information via the firmware update p

    HighCVSS 8.2No exploitEPSS 0%

    Oct 11, 2024

All vulnerability classes