Fallos del tipo CWE-922

293 resultados

Armazenamento inseguro de informações sensíveis

Ocorre quando dados sensíveis (senhas, tokens, chaves, dados pessoais) são armazenados sem proteção adequada — em texto plano, em cache, em arquivos acessíveis ou em memória não cifrada. Um atacante que ganha acesso ao sistema consegue recuperar essas informações diretamente, comprometendo contas, autenticação e privacidade.

Ejemplo

Uma aplicação móvel salva o token de autenticação em SharedPreferences (Android) ou UserDefaults (iOS) sem encriptação; ou um servidor escreve senhas em arquivos de log; ou credenciais ficam em variáveis de ambiente em histórico de shell — tudo recuperável por quem tiver acesso ao dispositivo ou servidor.

Cómo mitigar

Use APIs de armazenamento seguro: Keychain (iOS), Keystore (Android), DPAPI (Windows), ou cofres de secrets (Vault, AWS Secrets Manager). Nunca registre dados sensíveis em logs. Cifre dados em repouso com padrões reconhecidos (AES-256) e remova do histórico e cache tudo que não for necessário manter.

CVE-2024-35526MEDIUMAn issue in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers to access sensitive information in the /facade directoryEPSS 0.2%CVE-2024-23232LOWA privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sonoma 14.4. An app may be able to capEPSS 0.2%CVE-2024-44263MEDIUMA logic issue was addressed with improved state management. This issue is fixed in iOS 18.1 and iPadOS 18.1. An app may be able to access usEPSS 0.2%CVE-2024-23205MEDIUMA privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS SEPSS 0.2%CVE-2024-48883MEDIUMAn issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200,EPSS 0.2%CVE-2024-44298MEDIUMA privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.1. An app may beEPSS 0.2%CVE-2024-6295LOWudn News App - Insecure Data StorageEPSS 0.2%CVE-2024-54504MEDIUMA privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.2. An app may beEPSS 0.2%CVE-2025-54083MEDIUMCalix GigaCenter ONT firmware - Sensitive Information DisclosureEPSS 0.2%CVE-2024-54541MEDIUMThis issue was addressed through improved state management. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, macOS SonomEPSS 0.2%CVE-2024-13954MEDIUMSerialization / Deserialization of configuration dataEPSS 0.2%CVE-2023-42839MEDIUMThis issue was addressed with improved state management. This issue is fixed in tvOS 17.1, watchOS 10.1, macOS Sonoma 14.1, iOS 17.1 and iPaEPSS 0.2%CVE-2022-34354MEDIUMIBM Sterling Partner Engagement Manager information disclosureEPSS 0.2%CVE-2023-40728HIGHA vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application stores sensEPSS 0.2%CVE-2022-44619HIGHInsecure storage of sensitive information in the Intel(R) DCM software before version 5.1 may allow an authenticated user to potentially enaEPSS 0.2%CVE-2024-21826MEDIUMHuks has an insecure storage of sensitive information vulnerabilityEPSS 0.2%CVE-2026-5047HIGHA vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encoded passwords and  authentication tokens in log files. The vulnerabilitEPSS 0.2%CVE-2025-2440MEDIUMCWE-922: Insecure Storage of Sensitive Information vulnerability exists that could potentially lead to unauthorized access of confidential dEPSS 0.2%CVE-2024-44174MEDIUMThe issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15. An attacker may be able to view restricted content frEPSS 0.2%CVE-2024-54549MEDIUMThis issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.2. An app may be able to EPSS 0.2%