Fallos del tipo CWE-922

293 resultados

Armazenamento inseguro de informações sensíveis

Ocorre quando dados sensíveis (senhas, tokens, chaves, dados pessoais) são armazenados sem proteção adequada — em texto plano, em cache, em arquivos acessíveis ou em memória não cifrada. Um atacante que ganha acesso ao sistema consegue recuperar essas informações diretamente, comprometendo contas, autenticação e privacidade.

Ejemplo

Uma aplicação móvel salva o token de autenticação em SharedPreferences (Android) ou UserDefaults (iOS) sem encriptação; ou um servidor escreve senhas em arquivos de log; ou credenciais ficam em variáveis de ambiente em histórico de shell — tudo recuperável por quem tiver acesso ao dispositivo ou servidor.

Cómo mitigar

Use APIs de armazenamento seguro: Keychain (iOS), Keystore (Android), DPAPI (Windows), ou cofres de secrets (Vault, AWS Secrets Manager). Nunca registre dados sensíveis em logs. Cifre dados em repouso com padrões reconhecidos (AES-256) e remova do histórico e cache tudo que não for necessário manter.

CVE-2024-54477MEDIUMThe issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app mEPSS 0.3%CVE-2025-24117MEDIUMThis issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, mEPSS 0.3%CVE-2024-42677MEDIUMAn issue in Huizhi enterprise resource management system v.1.0 and before allows a local attacker to obtain sensitive information via the /nEPSS 0.3%CVE-2024-36788MEDIUMNetgear WNR614 JNR1010V2 N300-V1.1.0.54_1.0.1 does not properly set the HTTPOnly flag for cookies. This allows attackers to possibly interceEPSS 0.3%CVE-2024-10041MEDIUMPam: libpam: libpam vulnerable to read hashed passwordEPSS 0.3%CVE-2024-22193LOWvantage6 unencrypted task can be created in encrypted collaborationEPSS 0.3%CVE-2024-46635MEDIUMAn issue in the API endpoint /AccountMaster/GetCurrentUserInfo of INROAD before v202402060 allows attackers to access sensitive information EPSS 0.3%CVE-2025-34189MEDIUMVasion Print (formerly PrinterLogic) Insecure Inter-Process Communication Allows Local Session HijackingEPSS 0.3%CVE-2023-23542MEDIUMA privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventura 13.3, macOS MontereEPSS 0.3%CVE-2023-32415—This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 16.5 and iPadOS 16.5, tvOS 16.5, macOEPSS 0.3%CVE-2024-38496MEDIUMSymantec Privileged Access Manager Insecure Direct Object Reference vulnerabilityEPSS 0.3%CVE-2022-38090MEDIUMImproper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard Extensions may allow a privileged userEPSS 0.2%CVE-2023-27942MEDIUMThe issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, macOS Big Sur 11.7.5, macEPSS 0.2%CVE-2026-87951LOWSAML SSO - Service Provider - Moderately critical - Information disclosure - SA-CONTRIB-2026-149EPSS 0.2%CVE-2024-44222LOWThis issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, mEPSS 0.2%CVE-2024-33004MEDIUMInsecure Storage vulnerability in SAP BusinessObjects Business Intelligence Platform (Webservices)EPSS 0.2%CVE-2021-25404—Information Exposure vulnerability in SmartThings prior to version 1.7.64.21 allows attacker to access user information via log.EPSS 0.2%CVE-2026-47362MEDIUMIn versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LEPSS 0.2%CVE-2024-37654MEDIUMAn issue in BAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE, AV-02IDR, AV-02IPD, AV-02FDE, AV-02FDR,EPSS 0.2%CVE-2025-59320MEDIUMCPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 stores TPM2.0 secrets in a serialized format within unused disk sectors. An unauthentEPSS 0.2%