CWE-591 Sensitive Data Storage in Improperly Locked Memory

variant

The product stores sensitive data in memory that is not locked, or that has been incorrectly locked, which might cause the memory to be written to swap files on disk by the virtual memory manager. This can make the data more accessible to external actors.

übergeordnete Schwächen

Übergeordnete Klassen, zu denen dies gehört.

CWE-413Improper Resource Locking

Schwachstellen (78)

Zugehörige CVEs.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2024-38106US	—OT kritisch	6.34% (94th)	KEV	2024-08-13
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-28229US	—OT kritisch	1.67% (77th)	KEV	2023-04-11
Windows CNG Key Isolation Service Elevation of Privilege Vulnerability
CVE-2023-36005US	high8.1	23.9% (98th)	—	2023-12-12
Windows Telephony Server Elevation of Privilege Vulnerability
CVE-2023-36403US	high7.0	0.53% (45th)	—	2023-11-14
Windows Kernel Elevation of Privilege Vulnerability
CVE-2025-30394US	—	34.2% (98th)	—	2025-05-13
Sensitive data storage in improperly locked memory in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network.
CVE-2025-24035US	—	1.72% (77th)	Exploit	2025-03-11
Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
CVE-2025-26686US	—	1.40% (72nd)	Exploit	2025-04-08
Sensitive data storage in improperly locked memory in Windows TCP/IP allows an unauthorized attacker to execute code over a network.
CVE-2023-21766US	—	0.90% (59th)	Exploit	2023-01-10
Windows Overlay Filter Information Disclosure Vulnerability
CVE-2023-21739US	—	0.58% (47th)	Exploit	2023-01-10
Windows Bluetooth Driver Elevation of Privilege Vulnerability
CVE-2025-21309US	—	15.1% (97th)	—	2025-01-14
Windows Remote Desktop Services Remote Code Execution Vulnerability
CVE-2023-28220US	—	15.0% (97th)	—	2023-04-11
Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
CVE-2023-28219US	—	15.0% (97th)	—	2023-04-11
Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
CVE-2023-38159US	—	4.39% (91st)	—	2023-10-10
Windows Graphics Component Elevation of Privilege Vulnerability
CVE-2025-27482US	—	1.62% (76th)	—	2025-04-08
Sensitive data storage in improperly locked memory in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
CVE-2025-21224US	—	1.94% (80th)	—	2025-01-14
Windows Line Printer Daemon (LPD) Service Remote Code Execution Vulnerability
CVE-2024-49091US	—	1.70% (77th)	—	2024-12-12
Windows Domain Name Service Remote Code Execution Vulnerability
CVE-2025-11711US	—	0.23% (14th)	—	2025-10-14
There was a way to change the value of JavaScript Object properties that were supposed to be non-writeable. This vulnerability was fixed in Firefox 144, Firefox ESR 115.29, Firefox…
CVE-2025-48819US	—	0.39% (33rd)	—	2025-07-08
Sensitive data storage in improperly locked memory in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges over an adjacent networ…
CVE-2025-27732US	—	0.34% (27th)	—	2025-04-08
Sensitive data storage in improperly locked memory in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
CVE-2025-27484US	—	0.81% (57th)	—	2025-04-08
Sensitive data storage in improperly locked memory in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges over a network.

Quelle

Wo diese Definition veröffentlicht ist.

MITREUS

scry

Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan