CWE-922
Allowed-with-ReviewInsecure Storage of Sensitive Information
Abstraction: Class · Status: Incomplete
The product stores sensitive information without properly limiting read or write access by unauthorized actors.
442 vulnerabilities reference this CWE, most recent first.
GHSA-XXCM-4V4P-F9RR
Vulnerability from github – Published: 2025-07-31 21:31 – Updated: 2025-07-31 21:31A vulnerability was discovered in the storage policy for certain sets of sensitive credential information in the HPE Telco Network Function Virtual Orchestrator. Successful Exploitation could lead to unauthorized parties gaining access to sensitive system information.
{
"affected": [],
"aliases": [
"CVE-2025-37110"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-31T20:15:32Z",
"severity": "MODERATE"
},
"details": "A vulnerability was discovered in the storage policy for certain sets of sensitive credential information in the HPE Telco Network Function Virtual Orchestrator. Successful Exploitation could lead to unauthorized parties gaining access to sensitive system information.",
"id": "GHSA-xxcm-4v4p-f9rr",
"modified": "2025-07-31T21:31:54Z",
"published": "2025-07-31T21:31:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37110"
},
{
"type": "WEB",
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04891en_us"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XXWQ-5H7X-MM4X
Vulnerability from github – Published: 2024-07-19 12:31 – Updated: 2024-07-19 12:31A vulnerability in Zowe CLI allows local, privileged actors to display securely stored properties in cleartext within a terminal using the '--show-inputs-only' flag.
{
"affected": [],
"aliases": [
"CVE-2024-6916"
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-19T11:15:04Z",
"severity": "MODERATE"
},
"details": "A vulnerability in Zowe CLI allows local, privileged actors to display securely stored properties in cleartext within a terminal using the \u0027--show-inputs-only\u0027 flag.",
"id": "GHSA-xxwq-5h7x-mm4x",
"modified": "2024-07-19T12:31:28Z",
"published": "2024-07-19T12:31:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6916"
},
{
"type": "WEB",
"url": "https://github.com/zowe/zowe-cli/packages/imperative"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.