Weaknesses of type CWE-922

293 results

Armazenamento inseguro de informações sensíveis

É quando dados críticos (senhas, tokens, chaves criptográficas, PII) são guardados em local ou formato que qualquer pessoa com acesso ao sistema consegue ler. O risco: um atacante com acesso ao disco, memória ou arquivo de configuração rouba os dados sem esforço, comprometendo usuários e a aplicação inteira.

Example

Um app grava a senha do usuário em texto plano dentro de um arquivo .txt na raiz do projeto, ou armazena token de API em um cookie sem criptografia. Se o servidor for invadido ou o cliente roubado, as credenciais caem na mão de quem não deveria ter.

How to mitigate

Use criptografia forte (AES-256) para dados em repouso, aplique hash com salt (bcrypt, Argon2) em senhas, armazene segredos em vaults dedicados (AWS Secrets Manager, HashiCorp Vault), e nunca commita chaves ou credenciais no código. Revise regularmente o que é guardado e onde.

CVE-2024-54477MEDIUMThe issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app mEPSS 0.3%CVE-2025-24117MEDIUMThis issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, mEPSS 0.3%CVE-2024-42677MEDIUMAn issue in Huizhi enterprise resource management system v.1.0 and before allows a local attacker to obtain sensitive information via the /nEPSS 0.3%CVE-2024-36788MEDIUMNetgear WNR614 JNR1010V2 N300-V1.1.0.54_1.0.1 does not properly set the HTTPOnly flag for cookies. This allows attackers to possibly interceEPSS 0.3%CVE-2024-10041MEDIUMPam: libpam: libpam vulnerable to read hashed passwordEPSS 0.3%CVE-2024-22193LOWvantage6 unencrypted task can be created in encrypted collaborationEPSS 0.3%CVE-2024-46635MEDIUMAn issue in the API endpoint /AccountMaster/GetCurrentUserInfo of INROAD before v202402060 allows attackers to access sensitive information EPSS 0.3%CVE-2025-34189MEDIUMVasion Print (formerly PrinterLogic) Insecure Inter-Process Communication Allows Local Session HijackingEPSS 0.3%CVE-2023-23542MEDIUMA privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventura 13.3, macOS MontereEPSS 0.3%CVE-2023-32415—This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 16.5 and iPadOS 16.5, tvOS 16.5, macOEPSS 0.3%CVE-2024-38496MEDIUMSymantec Privileged Access Manager Insecure Direct Object Reference vulnerabilityEPSS 0.3%CVE-2022-38090MEDIUMImproper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard Extensions may allow a privileged userEPSS 0.2%CVE-2023-27942MEDIUMThe issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, macOS Big Sur 11.7.5, macEPSS 0.2%CVE-2026-87951LOWSAML SSO - Service Provider - Moderately critical - Information disclosure - SA-CONTRIB-2026-149EPSS 0.2%CVE-2024-44222LOWThis issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, mEPSS 0.2%CVE-2024-33004MEDIUMInsecure Storage vulnerability in SAP BusinessObjects Business Intelligence Platform (Webservices)EPSS 0.2%CVE-2021-25404—Information Exposure vulnerability in SmartThings prior to version 1.7.64.21 allows attacker to access user information via log.EPSS 0.2%CVE-2026-47362MEDIUMIn versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LEPSS 0.2%CVE-2024-37654MEDIUMAn issue in BAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE, AV-02IDR, AV-02IPD, AV-02FDE, AV-02FDR,EPSS 0.2%CVE-2025-59320MEDIUMCPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 stores TPM2.0 secrets in a serialized format within unused disk sectors. An unauthentEPSS 0.2%