Falhas do tipo CWE-922

293 resultados

Armazenamento inseguro de informações sensíveis

A aplicação armazena dados sensíveis (senhas, tokens, chaves, PII) em locais acessíveis sem proteção adequada — memória não criptografada, logs, cache, arquivos de configuração ou banco de dados sem cifra. Um atacante com acesso ao sistema de arquivos, memória ou backups consegue ler essas informações diretamente.

Exemplo

Uma app de e-commerce salva números de cartão de crédito em texto plano em um arquivo SQLite local no dispositivo móvel. Um usuário com acesso físico ao telefone, malware ou análise forense do aparelho consegue extrair os cartões intactos. Outro caso comum: API que registra em log toda requisição incluindo o Bearer token do usuário.

Como mitigar

Criptografe dados sensíveis em repouso (AES-256 para arquivos, TDE para BD). Nunca armazene senhas — use hash + salt (PBKDF2, bcrypt, Argon2). Remova dados sensíveis de logs e memória assim que desnecessários. Para mobile, use Keychain (iOS) ou Keystore (Android). Revise configurações, backups e caches periodicamente.

CVE-2025-2157LOWForeman: disclosure of executed commands and outputs in foreman / red hat satelliteEPSS 0.2%CVE-2024-20462MEDIUMCisco ATA 190 Series Analog Telephone Adapter Muliplatform Firmware Information Disclosure VulnerabilityEPSS 0.2%CVE-2023-23348MEDIUMHCL Launch is vulnerable to sensitive information disclosureEPSS 0.2%CVE-2025-37110MEDIUMSensitive Credential Information stored insecurely in System DatabaseEPSS 0.2%CVE-2024-35311LOWYubico YubiKey 5 Series before 5.7.0, Security Key Series before 5.7.0, YubiKey Bio Series before 5.6.4, and YubiKey 5 FIPS before 5.7.2 havEPSS 0.2%CVE-2024-12082MEDIUMAbility Runtime has an out-of-bounds read permission bypass vulnerabilityEPSS 0.2%CVE-2024-39612MEDIUMBackground Task Manager has an out-of-bounds read permission bypass vulnerabilityEPSS 0.2%CVE-2024-38382MEDIUMAbility Runtime has an out-of-bounds read permission bypass vulnerabilityEPSS 0.2%CVE-2026-44629HIGHImproper access control to the Synergis Softwire installation folder. This vulnerability affects Streamvault all-in-one appliances (SV-100E EPSS 0.1%CVE-2025-61482HIGHImproper handling of OTP/TOTP/HOTP values in NetKnights GmbH privacyIDEA Authenticator v.4.3.0 on Android allows local attackers with root aEPSS 0.1%CVE-2025-42979MEDIUMInsecure Key & Secret Management vulnerability in SAP GUI for WindowsEPSS 0.1%CVE-2024-3334MEDIUMUSB Security Feature Bypass in Digital Guardian Windows Agent Prior to version 8.2.0EPSS 0.1%CVE-2026-20629MEDIUMA privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Tahoe 26.3. An app may be able to acceEPSS 0.1%CVE-2026-118568LOWContent Sync (content-sync.io) - Moderately critical - Information disclosure - SA-CONTRIB-2026-291EPSS 0.1%CVE-2024-47122MEDIUMInsecure Storage of Sensitive Information in goTenna ProEPSS 0.1%CVE-2025-14376HIGHVerve Asset Manager – Plaintext Storage VulnerabilitiesEPSS 0.1%CVE-2024-43694MEDIUMgoTenna Pro ATAK Plugin Insecure Storage of Sensitive InformationEPSS 0.1%CVE-2026-20705MEDIUMInsecure storage of sensitive information in the Intel(R) TDX module for some Intel(R) platform within Ring 0: Trust Domain may allow informEPSS 0.1%CVE-2023-40093MEDIUMIn multiple files, there is a possible way that trimmed content could be included in PDF output due to a logic error in the code. This couldEPSS 0.1%CVE-2025-10971HIGHInsecure Storage of Sensitive InformationEPSS 0.1%