CWE-256 · Plaintext Storage of a Password (page 2)
Page 2 of 3 — CVEs classified under CWE-256, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-50956 | Medium | 4.4 | 2024-12-18 | IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.9 could allow a privileged user to obtain highly sensitive user credentials from secret keys that… |
CVE-2024-53292 | High | 7.2 | 2024-12-11 | Dell VxVerify, versions prior to x.40.405, contain a Plain-text Password Storage Vulnerability in the shell wrapper. A local high privileged attacker could pot… |
CVE-2024-11982 | High | 7.2 | 2024-11-29 | Certain models of routers from Billion Electric has a Plaintext Storage of a Password vulnerability. Remote attackers with administrator privileges can access… |
CVE-2024-36464 | Low | 2.7 | 2024-11-27 | When exporting media types, the password is exported in the YAML in plain text. This appears to be a best practices type issue and may have no actual impact. T… |
CVE-2024-29978 | Medium | 5.9 | 2024-11-26 | User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the deta… |
CVE-2024-49351 | Medium | 5.5 | 2024-11-26 | IBM Workload Scheduler 9.5, 10.1, and 10.2 stores user credentials in plain text which can be read by a local user. |
CVE-2024-49370 | Medium | 4.9 | 2024-10-23 | Pimcore is an open source data and experience management platform. When a PortalUserObject is connected to a PimcoreUser and "Use Pimcore Backend Password" is… |
CVE-2024-42496 | Low | 2.4 | 2024-09-30 | Smart-tab Android app installed April 2023 or earlier contains an issue with plaintext storage of a password. If this vulnerability is exploited, an attacker w… |
CVE-2024-31899 | Medium | 4.3 | 2024-09-26 | IBM Cognos Command Center 10.2.4.1 and 10.2.5 could disclose highly sensitive user information to an authenticated user with physical access to the device. |
CVE-2023-41610 | High | 8.8 | 2024-09-18 | Victure PC420 1.1.39 was discovered to contain a hardcoded root password which is stored in plaintext. |
CVE-2024-5960 | Critical | 9.8 | 2024-09-18 | Plaintext Storage of a Password vulnerability in Eliz Software Panel allows : Use of Known Domain Credentials. This issue affects Panel: before v2.3.24. |
CVE-2024-20489 | High | 8.4 | 2024-09-11 | A vulnerability in the storage method of the PON Controller configuration file could allow an authenticated, local attacker with low privileges to obtain the M… |
CVE-2024-44815 | Medium | 4.6 | 2024-09-10 | Vulnerability in Hathway Skyworth Router CM5100 v.4.1.1.24 allows a physically proximate attacker to obtain user credentials via SPI flash Firmware W25Q64JV. |
CVE-2024-45283 | Medium | 6.0 | 2024-09-10 | SAP NetWeaver AS for Java allows an authorized attacker to obtain sensitive information. The attacker could obtain the username and password when creating an R… |
CVE-2024-43378 | High | 7.8 | 2024-08-16 | calamares-nixos-extensions provides Calamares branding and modules for NixOS, a distribution of GNU/Linux. Users who installed NixOS through the graphical inst… |
CVE-2024-25024 | Medium | 5.5 | 2024-08-15 | IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores user credentials in plain clear text whi… |
CVE-2024-39922 | Medium | 4.6 | 2024-08-13 | A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) (All versions), LOGO! 230RCE (6… |
CVE-2024-36460 | High | 8.1 | 2024-08-12 | The front-end audit log allows viewing of unprotected plaintext passwords, where the passwords are displayed in plain text. |
CVE-2024-6118 | Critical | 9.1 | 2024-08-05 | A Plaintext Storage of a Password vulnerability in ebooknote function in Hamastar MeetingHub Paperless Meetings 2021 allows remote attackers to obtain the othe… |
CVE-2024-3082 | Medium | 4.2 | 2024-07-31 | A “CWE-256: Plaintext Storage of a Password” affecting the administrative account allows an attacker with physical access to the machine to retrieve the passwo… |
CVE-2024-37135 | Low | 3.3 | 2024-07-31 | DM5500 5.16.0.0, contains an information disclosure vulnerability. A local attacker with high privileges could potentially exploit this vulnerability, leading… |
CVE-2024-40116 | High | 8.1 | 2024-07-26 | An issue in Solar-Log 1000 before v2.8.2 and build 52-23.04.2013 was discovered to store plaintext passwords in the export.html, email.html, and sms.html files… |
CVE-2024-39733 | Medium | 5.5 | 2024-07-14 | IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 29… |
CVE-2024-39220 | Medium | 6.5 | 2024-07-03 | BAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE, AV-02IDR, AV-02IPD, AV-02FDE, AV-02FDR, AV-03D, AV-03BD, AV-04AFD, AV-… |
CVE-2024-33375 | Critical | 9.8 | 2024-06-14 | LB-LINK BL-W1210M v2.0 was discovered to store user credentials in plaintext within the router's firmware. |
CVE-2024-27166 | High | 7.4 | 2024-06-14 | Coredump binaries in Toshiba printers have incorrect permissions. A local attacker can steal confidential information. As for the affected products/models/vers… |
CVE-2024-25052 | Medium | 4.4 | 2024-06-13 | IBM Jazz Reporting Service 7.0.3 stores user credentials in plain clear text which can be read by an admin user. IBM X-Force ID: 283363. |
CVE-2022-0555 | High | 8.4 | 2024-06-03 | Subiquity Shows Guided Storage Passphrase in Plaintext with Read-all Permissions |
CVE-2024-28736 | High | 7.1 | 2024-05-31 | An issue in Debezium Community debezium-ui v.2.5 allows a local attacker to execute arbitrary code via the refresh page function. |
CVE-2024-36081 | Critical | 9.8 | 2024-05-19 | Westermo EDW-100 devices through 2024-05-03 allow an unauthenticated user to download a configuration file containing a cleartext password. NOTE: this is a ser… |
CVE-2024-4425 | Medium | 5.4 | 2024-05-14 | The access control in CemiPark software stores integration (e.g. FTP or SIP) credentials in plain-text. An attacker who gained unauthorized access to the devic… |
CVE-2024-4232 | Medium | 4.1 | 2024-05-14 | This vulnerability exists in Digisol Router (DG-GR1321: Hardware version 3.7L; Firmware version : v3.2.02) due to lack of encryption or hashing in storing of… |
CVE-2024-28971 | Low | 3.5 | 2024-05-08 | Dell Update Manager Plugin, versions 1.4.0 through 1.5.0, contains a Plain-text Password Storage Vulnerability in Log file. A remote high privileged attacker c… |
CVE-2024-28961 | Medium | 6.3 | 2024-04-29 | Dell OpenManage Enterprise, versions 4.0.0 and 4.0.1, contains a sensitive information disclosure vulnerability. A local low privileged malicious user could po… |
CVE-2024-28325 | Medium | 6.1 | 2024-04-26 | Asus RT-N12+ B1 router stores credentials in cleartext, which could allow local attackers to obtain unauthorized access and modify router settings. |
CVE-2024-3625 | High | 7.3 | 2024-04-25 | A flaw was found in Quay, where Quay's database is stored in plain text in mirror-registry on Jinja's config.yaml file. This issue leaves the possibility of a… |
CVE-2024-3624 | High | 7.3 | 2024-04-25 | A flaw was found in how Quay's database is stored in plain-text in mirror-registry on the jinja's config.yaml file. This flaw allows a malicious actor with acc… |
CVE-2024-3623 | Medium | 6.5 | 2024-04-25 | A flaw was found when using mirror-registry to install Quay. It uses a default database secret key, which is stored in plain-text format in one of the configur… |
CVE-2024-3622 | High | 8.8 | 2024-04-25 | A flaw was found when using mirror-registry to install Quay. It uses a default secret, which is stored in plain-text format in one of the configuration templat… |
CVE-2024-23486 | Critical | 9.8 | 2024-04-15 | Plaintext storage of a password issue exists in BUFFALO wireless LAN routers, which may allow a network-adjacent unauthenticated attacker with access to the pr… |
CVE-2024-28782 | Medium | 6.3 | 2024-04-03 | IBM QRadar Suite Software 1.10.12.0 through 1.10.18.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores user credentials in plain clear text whi… |
CVE-2024-25138 | Medium | 6.5 | 2024-03-26 | In AutomationDirect C-MORE EA9 HMI, credentials used by the platform are stored as plain text on the device. |
CVE-2024-26165 | High | 8.8 | 2024-03-12 | Visual Studio Code Elevation of Privilege Vulnerability |
CVE-2023-5775 | Low | 2.2 | 2024-02-26 | The BackWPup plugin for WordPress is vulnerable to Plaintext Storage of Backup Destination Password in all versions up to, and including, 4.0.2. This is due to… |
CVE-2024-26133 | Medium | 5.5 | 2024-02-21 | EventStoreDB (ESDB) is an operational database built to store events. A vulnerability has been identified in the projections subsystem in versions 20 prior to… |
CVE-2024-22312 | Medium | 4.4 | 2024-02-10 | IBM Storage Defender - Resiliency Service 2.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 278748. |
CVE-2023-6518 | High | 7.5 | 2024-02-08 | Plaintext Storage of a Password vulnerability in Mia Technology Inc. MİA-MED allows Read Sensitive Strings Within an Executable. This issue affects MİA-MED: b… |
CVE-2023-31002 | Medium | 5.1 | 2024-02-07 | IBM Security Access Manager Container 10.0.0.0 through 10.0.6.1 temporarily stores sensitive information in files that could be accessed by a local user. IBM… |
CVE-2024-21869 | Medium | 6.2 | 2024-02-02 | In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the affected product stores plaintext credentials in various places. This may allow an att… |
CVE-2024-22432 | High | 7.8 | 2024-01-25 | Networker 19.9 and all prior versions contains a Plain-text Password stored in temporary config file during backup duration in NMDA MySQL Database backups. Us… |
CVE-2023-44300 | Medium | 5.5 | 2023-12-04 | Dell DM5500 5.14.0.0, contain a Plain-text Password Storage Vulnerability in the appliance. A local attacker with privileges could potentially exploit this… |
CVE-2023-48700 | Medium | 5.7 | 2023-11-21 | The Nautobot Device Onboarding plugin uses the netmiko and NAPALM libraries to simplify the onboarding process of a new device into Nautobot down to, in many c… |
CVE-2023-42493 | High | 7.1 | 2023-10-25 | EisBaer Scada - CWE-256: Plaintext Storage of a Password |
CVE-2023-43777 | Medium | 5.9 | 2023-10-17 | Eaton easySoft software is used to program easy controllers and displays for configuring, programming and defining parameters for all the intelligent relays. T… |
CVE-2023-27315 | Medium | 6.5 | 2023-10-12 | SnapGathers versions prior to 4.9 are susceptible to a vulnerability which could allow a local authenticated attacker to discover plaintext domain user crede… |
CVE-2022-47561 | High | 7.3 | 2023-09-20 | The web application stores credentials in clear text in the "admin.xml" file, which can be accessed without logging into the website, which could allow an atta… |
CVE-2023-39452 | High | 7.5 | 2023-09-18 | The web application that owns the device clearly stores the credentials within the user management section. Obtaining this information can be do… |
CVE-2022-3261 | Medium | 4.4 | 2023-09-15 | A flaw was found in OpenStack. Multiple components show plain-text passwords in /var/log/messages during the OpenStack overcloud update run, leading to a discl… |
CVE-2023-4984 | Medium | 4.3 | 2023-09-15 | A vulnerability was found in didi KnowSearch 0.3.2/0.3.1.2. It has been rated as problematic. This issue affects some unknown processing of the file /api/es/ad… |
CVE-2023-4400 | Medium | 6.2 | 2023-09-13 | A password management vulnerability in Skyhigh Secure Web Gateway (SWG) in main releases 11.x prior to 11.2.14, 10.x prior to 10.2.25 and controlled release 1… |
CVE-2023-4918 | High | 8.8 | 2023-09-12 | A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile. When a user registers itself through registration flow, the "password" an… |
CVE-2023-39227 | Medium | 6.1 | 2023-09-11 | Softneta MedDream PACS stores usernames and passwords in plaintext. The plaintext storage could be abused by attackers to leak legitimate user’s credentials. |
CVE-2023-35067 | High | 7.5 | 2023-07-25 | Plaintext Storage of a Password vulnerability in Infodrom Software E-Invoice Approval System allows Read Sensitive Strings Within an Executable. This issue af… |
CVE-2023-35765 | Medium | 6.5 | 2023-07-07 | PiiGAB M-Bus stores credentials in a plaintext file, which could allow a low-level user to gain admin credentials. |
CVE-2023-3395 | Medium | 6.5 | 2023-07-03 | All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory. An attacker with access to system files could open a file t… |
CVE-2023-26204 | Low | 3.7 | 2023-06-13 | A plaintext storage of a password vulnerability [CWE-256] in FortiSIEM 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions, 6.3 all versions… |
CVE-2023-2633 | Medium | 4.3 | 2023-05-16 | Jenkins Code Dx Plugin 3.1.0 and earlier does not mask Code Dx server API keys displayed on the configuration form, increasing the potential for attackers to o… |
CVE-2023-2632 | Medium | 4.3 | 2023-05-16 | Jenkins Code Dx Plugin 3.1.0 and earlier stores Code Dx server API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed… |
CVE-2022-4308 | Medium | 6.1 | 2023-04-19 | Plaintext Storage of a Password vulnerability in Secomea GateManager (USB wizard) allows Authentication abuse on SiteManager, if the generated file is leaked. |
CVE-2023-0457 | High | 7.5 | 2023-03-03 | Plaintext Storage of a Password vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series, MELSEC iQ-R Series, MELSEC-Q Series and MELSEC-L Series al… |
CVE-2023-22389 | Medium | 5.7 | 2023-01-30 | Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior store passwords in a plaintext file when the device configuration is exported via Save/Restore–>Back… |
CVE-2022-22458 | Medium | 6.3 | 2022-12-22 | IBM Security Verify Governance, Identity Manager 10.0.1 stores user credentials in plain clear text which can be read by a remote authenticated user. IBM X-Fo… |
CVE-2022-41732 | Medium | 6.2 | 2022-11-28 | IBM Maximo Mobile 8.7 and 8.8 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 237407. |
CVE-2022-43958 | High | 7.6 | 2022-11-08 | A vulnerability has been identified in QMS Automotive (All versions < V12.39), QMS Automotive (All versions < V12.39). User credentials are stored in plaintext… |
CVE-2022-3644 | Medium | 5.5 | 2022-10-25 | The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API () in… |
CVE-2022-43426 | Medium | 5.3 | 2022-10-19 | Jenkins S3 Explorer Plugin 1.0.8 and earlier does not mask the AWS_SECRET_ACCESS_KEY form field, increasing the potential for attackers to observe and capture… |
CVE-2022-3287 | Medium | 6.5 | 2022-09-28 | When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction… |
CVE-2022-36308 | Critical | 9.1 | 2022-08-16 | Airspan AirVelocity 1500 web management UI displays SNMP credentials in plaintext on software versions older than 15.18.00.2511, and stores SNMPv3 credentials… |
CVE-2022-33928 | Medium | 6.4 | 2022-08-10 | Dell Wyse Management Suite 3.6.1 and below contains an Plain-text Password Storage Vulnerability in UI. An attacker with low privileges could potentially explo… |
CVE-2022-1794 | Medium | 5.5 | 2022-07-11 | The CODESYS OPC DA Server prior V3.5.18.20 stores PLC passwords as plain text in its configuration file so that it is visible to all authorized Microsoft Windo… |
CVE-2022-27548 | Medium | 4.9 | 2022-07-06 | HCL Launch stores user credentials in plain clear text which can be read by a local user. |
CVE-2022-31044 | High | 7.5 | 2022-06-15 | Rundeck is an open source automation service with a web console, command line tools and a WebAPI. The Key Storage converter plugin mechanism was not enabled co… |
CVE-2022-29085 | Medium | 6.4 | 2022-06-02 | Dell Unity, Dell UnityVSA, and Dell Unity XT versions prior to 5.2.0.0.5.173 contain a plain-text password storage vulnerability when certain off-array tools a… |
CVE-2022-22557 | High | 7.5 | 2022-06-02 | PowerStore contains Plain-Text Password Storage Vulnerability in PowerStore X & T environments running versions 2.0.0.x and 2.0.1.x A locally authenticated att… |
CVE-2021-32978 | High | 7.5 | 2022-04-04 | The programming protocol allows for a previously entered password and lock state to be read by an attacker. If the previously entered password was successful… |
CVE-2020-25184 | High | 7.8 | 2022-03-18 | Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x stores the password in plaintext in a file that is in the same directory as the executable file. ISaGR… |
CVE-2021-43590 | Medium | 6.0 | 2022-03-04 | Dell EMC Enterprise Storage Analytics for vRealize Operations, versions 4.0.1 to 6.2.1, contain a Plain-text password storage vulnerability. A local high privi… |
CVE-2022-22554 | High | 8.2 | 2022-01-24 | Dell EMC System Update, version 1.9.2 and prior, contain an Unprotected Storage of Credentials vulnerability. A local attacker with user privleges could potent… |
CVE-2021-23207 | Medium | 6.5 | 2022-01-21 | An attacker with physical access to the host can extract the secrets from the registry and create valid JWT tokens for the Fresenius Kabi Vigilant MasterMed ve… |
CVE-2021-36317 | Medium | 6.7 | 2021-12-21 | Dell EMC Avamar Server version 19.4 contains a plain-text password storage vulnerability in AvInstaller. A local attacker could potentially exploit this vulner… |
CVE-2021-3787 | Medium | 6.4 | 2021-11-12 | A vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with local access to obtain the MQTT credentials tha… |
CVE-2021-36309 | High | 7.1 | 2021-10-01 | Dell Enterprise SONiC OS, versions 3.3.0 and earlier, contains a sensitive information disclosure vulnerability. An authenticated malicious user with access to… |
CVE-2021-1589 | Medium | 6.5 | 2021-09-23 | A vulnerability in the disaster recovery feature of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain unauthorized access to… |
CVE-2020-5315 | High | 8.8 | 2021-07-19 | Dell EMC Repository Manager (DRM) version 3.2 contains a plain-text password storage vulnerability. Proxy server user password is stored in a plain text in a l… |
CVE-2021-25358 | Medium | 4.0 | 2021-04-09 | A vulnerability that stores IMSI values in an improper path prior to SMR APR-2021 Release 1 allows local attackers to access IMSI values without any permission… |
CVE-2021-1126 | Medium | 5.5 | 2021-01-13 | A vulnerability in the storage of proxy server credentials of Cisco Firepower Management Center (FMC) could allow an authenticated, local attacker to view cred… |
CVE-2020-26079 | Medium | 4.9 | 2020-11-18 | A vulnerability in the web UI of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to obtain hashes of user passwords on an… |
CVE-2020-8183 | High | 7.5 | 2020-11-02 | A logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it was given on the initial create API call. |
CVE-2020-1669 | Medium | 6.3 | 2020-10-16 | The Juniper Device Manager (JDM) container, used by the disaggregated Junos OS architecture on Juniper Networks NFX350 Series devices, stores password hashes i… |
CVE-2020-3483 | High | 7.1 | 2020-10-14 | Duo has identified and fixed an issue with the Duo Network Gateway (DNG) product in which some customer-provided SSL certificates and private keys were not exc… |