Fallos del tipo CWE-922

293 resultados

Armazenamento inseguro de informações sensíveis

Ocorre quando dados sensíveis (senhas, tokens, chaves, dados pessoais) são armazenados sem proteção adequada — em texto plano, em cache, em arquivos acessíveis ou em memória não cifrada. Um atacante que ganha acesso ao sistema consegue recuperar essas informações diretamente, comprometendo contas, autenticação e privacidade.

Ejemplo

Uma aplicação móvel salva o token de autenticação em SharedPreferences (Android) ou UserDefaults (iOS) sem encriptação; ou um servidor escreve senhas em arquivos de log; ou credenciais ficam em variáveis de ambiente em histórico de shell — tudo recuperável por quem tiver acesso ao dispositivo ou servidor.

Cómo mitigar

Use APIs de armazenamento seguro: Keychain (iOS), Keystore (Android), DPAPI (Windows), ou cofres de secrets (Vault, AWS Secrets Manager). Nunca registre dados sensíveis em logs. Cifre dados em repouso com padrões reconhecidos (AES-256) e remova do histórico e cache tudo que não for necessário manter.

CVE-2025-2157LOWForeman: disclosure of executed commands and outputs in foreman / red hat satelliteEPSS 0.2%CVE-2024-20462MEDIUMCisco ATA 190 Series Analog Telephone Adapter Muliplatform Firmware Information Disclosure VulnerabilityEPSS 0.2%CVE-2023-23348MEDIUMHCL Launch is vulnerable to sensitive information disclosureEPSS 0.2%CVE-2025-37110MEDIUMSensitive Credential Information stored insecurely in System DatabaseEPSS 0.2%CVE-2024-35311LOWYubico YubiKey 5 Series before 5.7.0, Security Key Series before 5.7.0, YubiKey Bio Series before 5.6.4, and YubiKey 5 FIPS before 5.7.2 havEPSS 0.2%CVE-2024-12082MEDIUMAbility Runtime has an out-of-bounds read permission bypass vulnerabilityEPSS 0.2%CVE-2024-39612MEDIUMBackground Task Manager has an out-of-bounds read permission bypass vulnerabilityEPSS 0.2%CVE-2024-38382MEDIUMAbility Runtime has an out-of-bounds read permission bypass vulnerabilityEPSS 0.2%CVE-2026-44629HIGHImproper access control to the Synergis Softwire installation folder. This vulnerability affects Streamvault all-in-one appliances (SV-100E EPSS 0.1%CVE-2025-61482HIGHImproper handling of OTP/TOTP/HOTP values in NetKnights GmbH privacyIDEA Authenticator v.4.3.0 on Android allows local attackers with root aEPSS 0.1%CVE-2025-42979MEDIUMInsecure Key & Secret Management vulnerability in SAP GUI for WindowsEPSS 0.1%CVE-2024-3334MEDIUMUSB Security Feature Bypass in Digital Guardian Windows Agent Prior to version 8.2.0EPSS 0.1%CVE-2026-20629MEDIUMA privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Tahoe 26.3. An app may be able to acceEPSS 0.1%CVE-2026-118568LOWContent Sync (content-sync.io) - Moderately critical - Information disclosure - SA-CONTRIB-2026-291EPSS 0.1%CVE-2024-47122MEDIUMInsecure Storage of Sensitive Information in goTenna ProEPSS 0.1%CVE-2025-14376HIGHVerve Asset Manager – Plaintext Storage VulnerabilitiesEPSS 0.1%CVE-2024-43694MEDIUMgoTenna Pro ATAK Plugin Insecure Storage of Sensitive InformationEPSS 0.1%CVE-2026-20705MEDIUMInsecure storage of sensitive information in the Intel(R) TDX module for some Intel(R) platform within Ring 0: Trust Domain may allow informEPSS 0.1%CVE-2023-40093MEDIUMIn multiple files, there is a possible way that trimmed content could be included in PDF output due to a logic error in the code. This couldEPSS 0.1%CVE-2025-10971HIGHInsecure Storage of Sensitive InformationEPSS 0.1%