CWE-921 Storage of Sensitive Data in a Mechanism without Access Control
baseThe product stores sensitive information in a file system or device that does not have built-in access control.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (13)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-41965US | high7.5 | — | ||
Sending some requests in the web application of the vulnerable device allows information to be obtained due to the lack of security in the authentication process. | ||||
| CVE-2023-2665US | high7.5 | — | ||
Storage of Sensitive Data in a Mechanism without Access Control in GitHub repository francoisjacquet/rosariosis prior to 11.0. | ||||
| CVE-2022-1706US | medium6.5OT elevated | — | ||
A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products. This issue is only relevant in user envi… | ||||
| CVE-2018-12172US | medium5.5 | — | ||
Improper password hashing in firmware in Intel Server Board (S7200AP,S7200APR) and Intel Compute Module (HNS7200AP, HNS7200AP) may allow a privileged user to potentially disclose f… | ||||
| CVE-2024-5206US | medium4.7 | — | ||
A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in versions up to and including 1.4.1.post1, which was fixed in version 1.5.0.… | ||||
| CVE-2021-27456US | low2.4 | — | ||
Philips Gemini PET/CT family software stores sensitive information in a removable media device that does not have built-in access control. | ||||
| CVE-2025-30016US | — | — | ||
SAP Financial Consolidation allows an unauthenticated attacker to gain unauthorized access to the Admin account. The vulnerability arises due to improper authentication mechanisms,… | ||||
| CVE-2025-24843US | — | — | ||
Insecure file retrieval process that facilitates potential for file manipulation to affect product stability and confidentiality, integrity, authenticity, and attestation of stored… | ||||
| CVE-2024-9334US | —OT elevated | — | ||
Use of Hard-coded Credentials, Storage of Sensitive Data in a Mechanism without Access Control vulnerability in E-Kent Pallium Vehicle Tracking allows Authentication Bypass.
This… | ||||
| CVE-2025-24870US | — | — | ||
SAP GUI for Windows & RFC service credentials are incorrectly stored in the memory of the program allowing an unauthenticated attacker to access information within systems, resulti… | ||||
| CVE-2023-41818US | — | — | ||
An improper use of the SD card for sensitive data vulnerability was reported in the Motorola Device Help application that could allow a local attacker to read system logs.
| ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan