CVE-2025-51540

EzGED3 3.5.0 stores user passwords using an insecure hashing scheme: md5md5password. This hashing method is cryptographically weak and allows attackers to perform efficient offline brute-force attacks if password hashes are disclosed. The lack of salting and use of a fast, outdated algorithm make...

Active Storage allowed transformation methods that were potentially unsafe

Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters by default. The default allowed list contains three methods allowing for the circumvention of the safe defaults which enables potential command injection vulnerabilities in cases where...

CVE-2024-48916 Ceph is vulnerable to authentication bypass through RadosGW

Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a kno...

CVE-2025-41458

CVE-2025-41458 concerns unencrypted storage in the iOS app Two App Studio Journey v5.5.9, allowing local attackers with direct filesystem access to extract sensitive data. The NVD entry lists a CVSS v3.1 base score 5.5 (MEDIUM) , with LOCAL attack vector, LOW attack complexity, and HIGH confident...

CVE-2025-4570

The CVE-2025-4570 entry concerns ASUS MyASUS and insecure storage of sensitive keys, potentially allowing an unauthorized actor to obtain a token for communicating with certain services. Connected records reiterate the insecure key storage and token leakage, but provide limited technical detail (...

CVE-2025-7215 FNKvision FNK-GU2 wpa_supplicant.conf cleartext storage

A vulnerability, which was classified as problematic, has been found in FNKvision FNK-GU2 up to 40.1.7. Affected by this issue is some unknown functionality of the file /rom/wpasupplicant.conf. The manipulation leads to cleartext storage of sensitive information. It is possible to launch the atta...

CVE-2025-49760 Windows Storage Spoofing Vulnerability

...

Windows Storage Spoofing Vulnerability

External control of file name or path in Windows Storage allows an authorized attacker to perform spoofing over a network...

PT-2025-28631

Name of the Vulnerable Software and Affected Versions Windows versions prior to July 2025 Description A flaw exists in Windows related to the external control of file names or paths within Windows Storage. This issue allows an attacker to perform spoofing attacks over a network. The vulnerability...

CVE-2025-53178

CVE-2025-53178 pertains to Huawei EMUI and HarmonyOS calendar storage module, where a privilege bypass vulnerability enables local exploitation that may affect the schedule reminder function of head units. Root cause identified as a calendar storage module privilege bypass; CVSS 3.1/4.8 (Medium) ...

The vulnerability of the storage mechanism in macOS operating systems allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of macOS storage operations is related to errors in the use of standard permissions. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information remotely...

Be-Tech Mifare Classic cards 安全漏洞

Be-Tech Mifare Classic cards are a line of electronic cards from Be-Tech. A security vulnerability exists in Be-Tech Mifare Classic cards that stems from the explicit storage of data, which could lead to the creation of master key cards...

CVE-2024-25655

Insecure storage of LDAP passwords in the authentication functionality of AVSystem Unified Management Platform UMP 23.07.0.16567LTS allows members with read access to the application database to decrypt the LDAP passwords of users who successfully authenticate to web management via LDAP...

CVE-2024-50570

A Cleartext Storage of Sensitive Information vulnerability CWE-312 in FortiClientWindows 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13 and FortiClientLinux 7.4.0 through 7.4.2, 7.2.0 through 7.2.7, 7.0.0 through 7.0.13 may permit a local authenticated user to retrieve VPN passwor...

CVE-2023-39962

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 19.0.0 and prior to versions 19.0.13.10, 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, a malicious user could delete any personal or global external...

CVE-2023-26204

A plaintext storage of a password vulnerability CWE-256 in FortiSIEM 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions, 6.3 all versions, 6.2 all versions, 6.1 all versions, 5.4 all versions, 5.3 all versions may allow an attacker able to access user DB content to impersonate...

CVE-2023-35699

Cleartext Storage on Disk in the SICK ICR890-4 could allow an unauthenticated attacker with local access to the device to disclose sensitive information by accessing a SD card...

CVE-2021-3179

GGLocker iOS application, contains an insecure data storage of the password hash value which results in an authentication bypass...

CVE-2021-32655

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to convert a Files Drop link to a federated share. This causes an issue on the UI side of the sharing user. When the sharing user opens the sharing panel and...

CVE-2021-26588

A potential security vulnerability has been identified in HPE 3PAR StoreServ, HPE Primera Storage and HPE Alletra 9000 Storage array firmware. An unauthenticated user could remotely exploit the low complexity issue to execute code as administrator. This vulnerability impacts completely the...