Weaknesses of type CWE-922

293 results

Armazenamento inseguro de informações sensíveis

É quando dados críticos (senhas, tokens, chaves criptográficas, PII) são guardados em local ou formato que qualquer pessoa com acesso ao sistema consegue ler. O risco: um atacante com acesso ao disco, memória ou arquivo de configuração rouba os dados sem esforço, comprometendo usuários e a aplicação inteira.

Example

Um app grava a senha do usuário em texto plano dentro de um arquivo .txt na raiz do projeto, ou armazena token de API em um cookie sem criptografia. Se o servidor for invadido ou o cliente roubado, as credenciais caem na mão de quem não deveria ter.

How to mitigate

Use criptografia forte (AES-256) para dados em repouso, aplique hash com salt (bcrypt, Argon2) em senhas, armazene segredos em vaults dedicados (AWS Secrets Manager, HashiCorp Vault), e nunca commita chaves ou credenciais no código. Revise regularmente o que é guardado e onde.

CVE-2023-6460MEDIUMInformation leak in nodejs-firestoreEPSS 0.1%CVE-2026-82153LOWDell OS Recovery Tool, versions prior to 2.4.4, contains an Insecure Storage of Sensitive Information vulnerability. A low privileged attackEPSS 0.1%CVE-2024-0037LOWIn applyCustomDescription of SaveUi.java, there is a possible way to view images belonging to a different user due to a missing permission cEPSS 0.1%CVE-2023-43630HIGHConfig Partition Not Measured From 2 FrontsEPSS 0.1%CVE-2026-7257MEDIUM** UNSUPPORTED WHEN ASSIGNED ** An insecure storage of sensitive information vulnerability in the configuration file of Zyxel WRE6505 v2 firEPSS 0.1%CVE-2024-34721MEDIUMIn ensureFileColumns of MediaProvider.java, there is a possible disclosure of files owned by another user due to improper input validation. EPSS 0.1%CVE-2026-84283MEDIUMFluteCode Secure Folder 1.2 -Plaintext vault files in shared storage bypass the PIN gateEPSS 0.1%CVE-2025-32746MEDIUMDell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Insecure Storage of Sensitive Information vulnerability. An unauthenticated attackEPSS 0.1%CVE-2025-32751MEDIUMDell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Insecure Storage of Sensitive Information vulnerability. A low privileged attackerEPSS 0.1%CVE-2024-20050MEDIUMIn flashc, there is a possible information disclosure due to an uncaught exception. This could lead to local information disclosure with SysEPSS 0.1%CVE-2024-27232MEDIUMIn asn1_ec_pkey_parse of asn1_common.c, there is a possible OOB read due to a missing null check. This could lead to local information disclEPSS 0.1%CVE-2023-52345MEDIUMIn modem driver, there is a possible system crash due to improper input validation. This could lead to local information disclosure with SysEPSS 0.1%CVE-2025-35054MEDIUMNewforma Info Exchange (NIX) insufficiently protected credentialsEPSS 0.1%