Fallos del tipo CWE-922

293 resultados

Armazenamento inseguro de informações sensíveis

Ocorre quando dados sensíveis (senhas, tokens, chaves, dados pessoais) são armazenados sem proteção adequada — em texto plano, em cache, em arquivos acessíveis ou em memória não cifrada. Um atacante que ganha acesso ao sistema consegue recuperar essas informações diretamente, comprometendo contas, autenticação e privacidade.

Ejemplo

Uma aplicação móvel salva o token de autenticação em SharedPreferences (Android) ou UserDefaults (iOS) sem encriptação; ou um servidor escreve senhas em arquivos de log; ou credenciais ficam em variáveis de ambiente em histórico de shell — tudo recuperável por quem tiver acesso ao dispositivo ou servidor.

Cómo mitigar

Use APIs de armazenamento seguro: Keychain (iOS), Keystore (Android), DPAPI (Windows), ou cofres de secrets (Vault, AWS Secrets Manager). Nunca registre dados sensíveis em logs. Cifre dados em repouso com padrões reconhecidos (AES-256) e remova do histórico e cache tudo que não for necessário manter.

CVE-2024-42018HIGHAn issue was discovered in Atos Eviden SMC xScale before 1.6.6. During initialization of nodes, some configuration parameters are retrieved EPSS 0.4%CVE-2025-28171MEDIUMAn issue in Grandstream UCM6510 v.1.0.20.52 and before allows a remote attacker to obtain sensitive information via the Login function at /cEPSS 0.4%CVE-2019-5633MEDIUMHickory Smart Lock Insecure Storage on iOSEPSS 0.4%CVE-2019-5627LOWBlueCats Reveal iOS App Insecure StorageEPSS 0.4%CVE-2019-5626LOWBlueCats Reveal Android App Insecure StorageEPSS 0.4%CVE-2019-5632MEDIUMHickory Smart Lock Insecure Storage on AndroidEPSS 0.4%CVE-2024-43427LOWMoodle: admin presets export tool includes some secrets that should not be exportedEPSS 0.3%CVE-2023-37563—ELECOM wireless LAN routers are vulnerable to sensitive information exposure, which allows a network-adjacent unauthorized attacker to obtaiEPSS 0.3%CVE-2025-48929MEDIUMThe TeleMessage service through 2025-05-05 implements authentication through a long-lived credential (e.g., not a token with a short expiratEPSS 0.3%CVE-2024-54728MEDIUMIncorrect access control in BYD QIN PLUS DM-i Dilink OS 3.0_13.1.7.2204050.1 allows unauthorized attackers to access system logcat logs.EPSS 0.3%CVE-2023-26427LOWDefault permissions for a properties file were too permissive. Local system users could read potentially sensitive information. We updated tEPSS 0.3%CVE-2024-56949MEDIUMAn issue in Guangzhou Polar Future Culture Technology Co., Ltd University Search iOS 2.27.0 allows attackers to access sensitive user informEPSS 0.3%CVE-2024-56960MEDIUMAn issue in Tianjin Xiaowu Information technology Co., Ltd BeiKe Holdings iOS 1.3.50 allows attackers to access sensitive user information vEPSS 0.3%CVE-2024-56964MEDIUMAn issue in Che Hao Duo Used Automobile Agency (Beijing) Co., Ltd Guazi Used Car iOS 10.15.1 allows attackers to access sensitive user inforEPSS 0.3%CVE-2024-56968MEDIUMAn issue in Shenzhen Intellirocks Tech Co. Ltd Govee Home iOS 6.5.01 allows attackers to access sensitive user information via supplying a cEPSS 0.3%CVE-2024-56965MEDIUMAn issue in Shanghai Shizhi Information Technology Co., Ltd Shihuo iOS 8.16.0 allows attackers to access sensitive user information via suppEPSS 0.3%CVE-2024-56947MEDIUMAn issue in Xiamen Meitu Technology Co., Ltd. BeautyCam iOS v12.3.60 allows attackers to access sensitive user information via supplying a cEPSS 0.3%CVE-2024-56971MEDIUMAn issue in Zhiyuan Yuedu (Guangzhou) Literature Information Technology Co., Ltd Shuqi Novel iOS 5.3.8 allows attackers to access sensitive EPSS 0.3%CVE-2024-56951MEDIUMAn issue in Hangzhou Bobo Technology Co Ltd UU Game Booster iOS 10.6.13 allows attackers to access sensitive user information via supplying EPSS 0.3%CVE-2024-56948MEDIUMAn issue in KuGou Technology CO. LTD KuGou Music iOS v20.0.0 allows attackers to access sensitive user information via supplying a crafted lEPSS 0.3%