CWE-256 · Plaintext Storage of a Password (page 2)
Page 2 of 3 — CVEs classified under CWE-256, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-43186 | Medium | 5.3 | 2025-03-29 | IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information that is stored locally under certain conditions. |
CVE-2024-9418 | Medium | 6.5 | 2025-03-20 | In version 0.0.14 of transformeroptimus/superagi, the API endpoint `/api/users/get/{id}` returns the user's password in plaintext. This vulnerability allows an… |
CVE-2025-2355 | Low | 3.3 | 2025-03-17 | A vulnerability was found in BlackVue App 3.65 on Android and classified as problematic. Affected by this issue is some unknown functionality of the component… |
CVE-2024-45638 | Medium | 4.1 | 2025-03-14 | IBM Security QRadar 3.12 EDR stores user credentials in plain text which can be read by a local privileged user. |
CVE-2025-27662 | Critical | 9.8 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Password in URL OVE-20230524-0005. |
CVE-2025-27656 | Critical | 9.8 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Password Stored in Process List V-2023-011. |
CVE-2025-25727 | Medium | 6.2 | 2025-02-28 | Bosscomm IF740 Firmware versions:11001.7078 & v11001.0000 and System versions: 6.25 & 6.00 were discovered to store passwords in cleartext. |
CVE-2024-41336 | High | 7.5 | 2025-02-27 | Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor… |
CVE-2024-10334 | High | 7.3 | 2025-02-10 | A vulnerability exists in the VideONet product included in the listed System 800xA versions, where VideONet is used. An attacker who successfully exploited t… |
CVE-2023-50945 | Medium | 6.2 | 2025-01-26 | IBM Common Licensing 9.0 stores user credentials in plain clear text which can be read by a local user. |
CVE-2024-43659 | High | 7.2 | 2025-01-09 | After gaining access to the firmware of a charging station, a file at <redacted> can be accessed to obtain default credentials that are the same across all Ioc… |
CVE-2025-21111 | High | 7.5 | 2025-01-08 | Dell VxRail, versions 8.0.000 through 8.0.311, contain(s) a Plaintext Storage of a Password vulnerability. A high privileged attacker with local access could p… |
CVE-2025-21102 | High | 7.5 | 2025-01-08 | Dell VxRail, versions 7.0.000 through 7.0.532, contain(s) a Plaintext Storage of a Password vulnerability. A high privileged attacker with local access could p… |
CVE-2024-52361 | Medium | 5.7 | 2024-12-18 | IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.9 stores user credentials in plain text which can be read by an authenticated user with access… |
CVE-2023-50956 | Medium | 4.4 | 2024-12-18 | IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.9 could allow a privileged user to obtain highly sensitive user credentials from secret keys that… |
CVE-2024-53292 | High | 7.2 | 2024-12-11 | Dell VxVerify, versions prior to x.40.405, contain a Plain-text Password Storage Vulnerability in the shell wrapper. A local high privileged attacker could pot… |
CVE-2024-11982 | High | 7.2 | 2024-11-29 | Certain models of routers from Billion Electric has a Plaintext Storage of a Password vulnerability. Remote attackers with administrator privileges can access… |
CVE-2024-36464 | Low | 2.7 | 2024-11-27 | When exporting media types, the password is exported in the YAML in plain text. This appears to be a best practices type issue and may have no actual impact. T… |
CVE-2024-29978 | Medium | 5.9 | 2024-11-26 | User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the deta… |
CVE-2024-49351 | Medium | 5.5 | 2024-11-26 | IBM Workload Scheduler 9.5, 10.1, and 10.2 stores user credentials in plain text which can be read by a local user. |
CVE-2024-49370 | Medium | 4.9 | 2024-10-23 | Pimcore is an open source data and experience management platform. When a PortalUserObject is connected to a PimcoreUser and "Use Pimcore Backend Password" is… |
CVE-2024-42496 | Low | 2.4 | 2024-09-30 | Smart-tab Android app installed April 2023 or earlier contains an issue with plaintext storage of a password. If this vulnerability is exploited, an attacker w… |
CVE-2024-31899 | Medium | 4.3 | 2024-09-26 | IBM Cognos Command Center 10.2.4.1 and 10.2.5 could disclose highly sensitive user information to an authenticated user with physical access to the device. |
CVE-2023-41610 | High | 8.8 | 2024-09-18 | Victure PC420 1.1.39 was discovered to contain a hardcoded root password which is stored in plaintext. |
CVE-2024-5960 | Critical | 9.8 | 2024-09-18 | Plaintext Storage of a Password vulnerability in Eliz Software Panel allows : Use of Known Domain Credentials. This issue affects Panel: before v2.3.24. |
CVE-2024-20489 | High | 8.4 | 2024-09-11 | A vulnerability in the storage method of the PON Controller configuration file could allow an authenticated, local attacker with low privileges to obtain the M… |
CVE-2024-44815 | Medium | 4.6 | 2024-09-10 | Vulnerability in Hathway Skyworth Router CM5100 v.4.1.1.24 allows a physically proximate attacker to obtain user credentials via SPI flash Firmware W25Q64JV. |
CVE-2024-45283 | Medium | 6.0 | 2024-09-10 | SAP NetWeaver AS for Java allows an authorized attacker to obtain sensitive information. The attacker could obtain the username and password when creating an R… |
CVE-2024-43378 | High | 7.8 | 2024-08-16 | calamares-nixos-extensions provides Calamares branding and modules for NixOS, a distribution of GNU/Linux. Users who installed NixOS through the graphical inst… |
CVE-2024-25024 | Medium | 5.5 | 2024-08-15 | IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores user credentials in plain clear text whi… |
CVE-2024-39922 | Medium | 4.6 | 2024-08-13 | A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) (All versions), LOGO! 230RCE (6… |
CVE-2024-36460 | High | 8.1 | 2024-08-12 | The front-end audit log allows viewing of unprotected plaintext passwords, where the passwords are displayed in plain text. |
CVE-2024-6118 | Critical | 9.1 | 2024-08-05 | A Plaintext Storage of a Password vulnerability in ebooknote function in Hamastar MeetingHub Paperless Meetings 2021 allows remote attackers to obtain the othe… |
CVE-2024-3082 | Medium | 4.2 | 2024-07-31 | A “CWE-256: Plaintext Storage of a Password” affecting the administrative account allows an attacker with physical access to the machine to retrieve the passwo… |
CVE-2024-37135 | Low | 3.3 | 2024-07-31 | DM5500 5.16.0.0, contains an information disclosure vulnerability. A local attacker with high privileges could potentially exploit this vulnerability, leading… |
CVE-2024-40116 | High | 8.1 | 2024-07-26 | An issue in Solar-Log 1000 before v2.8.2 and build 52-23.04.2013 was discovered to store plaintext passwords in the export.html, email.html, and sms.html files… |
CVE-2024-39733 | Medium | 5.5 | 2024-07-14 | IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 29… |
CVE-2024-39220 | Medium | 6.5 | 2024-07-03 | BAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE, AV-02IDR, AV-02IPD, AV-02FDE, AV-02FDR, AV-03D, AV-03BD, AV-04AFD, AV-… |
CVE-2024-33375 | Critical | 9.8 | 2024-06-14 | LB-LINK BL-W1210M v2.0 was discovered to store user credentials in plaintext within the router's firmware. |
CVE-2024-27166 | High | 7.4 | 2024-06-14 | Coredump binaries in Toshiba printers have incorrect permissions. A local attacker can steal confidential information. As for the affected products/models/vers… |
CVE-2024-25052 | Medium | 4.4 | 2024-06-13 | IBM Jazz Reporting Service 7.0.3 stores user credentials in plain clear text which can be read by an admin user. IBM X-Force ID: 283363. |
CVE-2022-0555 | High | 8.4 | 2024-06-03 | Subiquity Shows Guided Storage Passphrase in Plaintext with Read-all Permissions |
CVE-2024-28736 | High | 7.1 | 2024-05-31 | An issue in Debezium Community debezium-ui v.2.5 allows a local attacker to execute arbitrary code via the refresh page function. |
CVE-2024-36081 | Critical | 9.8 | 2024-05-19 | Westermo EDW-100 devices through 2024-05-03 allow an unauthenticated user to download a configuration file containing a cleartext password. NOTE: this is a ser… |
CVE-2024-4425 | Medium | 5.4 | 2024-05-14 | The access control in CemiPark software stores integration (e.g. FTP or SIP) credentials in plain-text. An attacker who gained unauthorized access to the devic… |
CVE-2024-4232 | Medium | 4.1 | 2024-05-14 | This vulnerability exists in Digisol Router (DG-GR1321: Hardware version 3.7L; Firmware version : v3.2.02) due to lack of encryption or hashing in storing of… |
CVE-2024-28971 | Low | 3.5 | 2024-05-08 | Dell Update Manager Plugin, versions 1.4.0 through 1.5.0, contains a Plain-text Password Storage Vulnerability in Log file. A remote high privileged attacker c… |
CVE-2024-28961 | Medium | 6.3 | 2024-04-29 | Dell OpenManage Enterprise, versions 4.0.0 and 4.0.1, contains a sensitive information disclosure vulnerability. A local low privileged malicious user could po… |
CVE-2024-28325 | Medium | 6.1 | 2024-04-26 | Asus RT-N12+ B1 router stores credentials in cleartext, which could allow local attackers to obtain unauthorized access and modify router settings. |
CVE-2024-3625 | High | 7.3 | 2024-04-25 | A flaw was found in Quay, where Quay's database is stored in plain text in mirror-registry on Jinja's config.yaml file. This issue leaves the possibility of a… |
CVE-2024-3624 | High | 7.3 | 2024-04-25 | A flaw was found in how Quay's database is stored in plain-text in mirror-registry on the jinja's config.yaml file. This flaw allows a malicious actor with acc… |
CVE-2024-3623 | Medium | 6.5 | 2024-04-25 | A flaw was found when using mirror-registry to install Quay. It uses a default database secret key, which is stored in plain-text format in one of the configur… |
CVE-2024-3622 | High | 8.8 | 2024-04-25 | A flaw was found when using mirror-registry to install Quay. It uses a default secret, which is stored in plain-text format in one of the configuration templat… |
CVE-2024-23486 | Critical | 9.8 | 2024-04-15 | Plaintext storage of a password issue exists in BUFFALO wireless LAN routers, which may allow a network-adjacent unauthenticated attacker with access to the pr… |
CVE-2024-28782 | Medium | 6.3 | 2024-04-03 | IBM QRadar Suite Software 1.10.12.0 through 1.10.18.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores user credentials in plain clear text whi… |
CVE-2024-25138 | Medium | 6.5 | 2024-03-26 | In AutomationDirect C-MORE EA9 HMI, credentials used by the platform are stored as plain text on the device. |
CVE-2024-26165 | High | 8.8 | 2024-03-12 | Visual Studio Code Elevation of Privilege Vulnerability |
CVE-2023-5775 | Low | 2.2 | 2024-02-26 | The BackWPup plugin for WordPress is vulnerable to Plaintext Storage of Backup Destination Password in all versions up to, and including, 4.0.2. This is due to… |
CVE-2024-26133 | Medium | 5.5 | 2024-02-21 | EventStoreDB (ESDB) is an operational database built to store events. A vulnerability has been identified in the projections subsystem in versions 20 prior to… |
CVE-2024-22312 | Medium | 4.4 | 2024-02-10 | IBM Storage Defender - Resiliency Service 2.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 278748. |
CVE-2023-6518 | High | 7.5 | 2024-02-08 | Plaintext Storage of a Password vulnerability in Mia Technology Inc. MİA-MED allows Read Sensitive Strings Within an Executable. This issue affects MİA-MED: b… |
CVE-2023-31002 | Medium | 5.1 | 2024-02-07 | IBM Security Access Manager Container 10.0.0.0 through 10.0.6.1 temporarily stores sensitive information in files that could be accessed by a local user. IBM… |
CVE-2024-21869 | Medium | 6.2 | 2024-02-02 | In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the affected product stores plaintext credentials in various places. This may allow an att… |
CVE-2024-22432 | High | 7.8 | 2024-01-25 | Networker 19.9 and all prior versions contains a Plain-text Password stored in temporary config file during backup duration in NMDA MySQL Database backups. Us… |
CVE-2023-44300 | Medium | 5.5 | 2023-12-04 | Dell DM5500 5.14.0.0, contain a Plain-text Password Storage Vulnerability in the appliance. A local attacker with privileges could potentially exploit this… |
CVE-2023-48700 | Medium | 5.7 | 2023-11-21 | The Nautobot Device Onboarding plugin uses the netmiko and NAPALM libraries to simplify the onboarding process of a new device into Nautobot down to, in many c… |
CVE-2023-42493 | High | 7.1 | 2023-10-25 | EisBaer Scada - CWE-256: Plaintext Storage of a Password |
CVE-2023-43777 | Medium | 5.9 | 2023-10-17 | Eaton easySoft software is used to program easy controllers and displays for configuring, programming and defining parameters for all the intelligent relays. T… |
CVE-2023-27315 | Medium | 6.5 | 2023-10-12 | SnapGathers versions prior to 4.9 are susceptible to a vulnerability which could allow a local authenticated attacker to discover plaintext domain user crede… |
CVE-2022-47561 | High | 7.3 | 2023-09-20 | The web application stores credentials in clear text in the "admin.xml" file, which can be accessed without logging into the website, which could allow an atta… |
CVE-2023-39452 | High | 7.5 | 2023-09-18 | The web application that owns the device clearly stores the credentials within the user management section. Obtaining this information can be do… |
CVE-2022-3261 | Medium | 4.4 | 2023-09-15 | A flaw was found in OpenStack. Multiple components show plain-text passwords in /var/log/messages during the OpenStack overcloud update run, leading to a discl… |
CVE-2023-4984 | Medium | 4.3 | 2023-09-15 | A vulnerability was found in didi KnowSearch 0.3.2/0.3.1.2. It has been rated as problematic. This issue affects some unknown processing of the file /api/es/ad… |
CVE-2023-4400 | Medium | 6.2 | 2023-09-13 | A password management vulnerability in Skyhigh Secure Web Gateway (SWG) in main releases 11.x prior to 11.2.14, 10.x prior to 10.2.25 and controlled release 1… |
CVE-2023-4918 | High | 8.8 | 2023-09-12 | A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile. When a user registers itself through registration flow, the "password" an… |
CVE-2023-39227 | Medium | 6.1 | 2023-09-11 | Softneta MedDream PACS stores usernames and passwords in plaintext. The plaintext storage could be abused by attackers to leak legitimate user’s credentials. |
CVE-2023-35067 | High | 7.5 | 2023-07-25 | Plaintext Storage of a Password vulnerability in Infodrom Software E-Invoice Approval System allows Read Sensitive Strings Within an Executable. This issue af… |
CVE-2023-35765 | Medium | 6.5 | 2023-07-07 | PiiGAB M-Bus stores credentials in a plaintext file, which could allow a low-level user to gain admin credentials. |
CVE-2023-3395 | Medium | 6.5 | 2023-07-03 | All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory. An attacker with access to system files could open a file t… |
CVE-2023-26204 | Low | 3.7 | 2023-06-13 | A plaintext storage of a password vulnerability [CWE-256] in FortiSIEM 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions, 6.3 all versions… |
CVE-2023-2633 | Medium | 4.3 | 2023-05-16 | Jenkins Code Dx Plugin 3.1.0 and earlier does not mask Code Dx server API keys displayed on the configuration form, increasing the potential for attackers to o… |
CVE-2023-2632 | Medium | 4.3 | 2023-05-16 | Jenkins Code Dx Plugin 3.1.0 and earlier stores Code Dx server API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed… |
CVE-2022-4308 | Medium | 6.1 | 2023-04-19 | Plaintext Storage of a Password vulnerability in Secomea GateManager (USB wizard) allows Authentication abuse on SiteManager, if the generated file is leaked. |
CVE-2023-0457 | High | 7.5 | 2023-03-03 | Plaintext Storage of a Password vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series, MELSEC iQ-R Series, MELSEC-Q Series and MELSEC-L Series al… |
CVE-2023-22389 | Medium | 5.7 | 2023-01-30 | Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior store passwords in a plaintext file when the device configuration is exported via Save/Restore–>Back… |
CVE-2022-22458 | Medium | 6.3 | 2022-12-22 | IBM Security Verify Governance, Identity Manager 10.0.1 stores user credentials in plain clear text which can be read by a remote authenticated user. IBM X-Fo… |
CVE-2022-41732 | Medium | 6.2 | 2022-11-28 | IBM Maximo Mobile 8.7 and 8.8 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 237407. |
CVE-2022-43958 | High | 7.6 | 2022-11-08 | A vulnerability has been identified in QMS Automotive (All versions < V12.39), QMS Automotive (All versions < V12.39). User credentials are stored in plaintext… |
CVE-2022-3644 | Medium | 5.5 | 2022-10-25 | The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API () in… |
CVE-2022-43426 | Medium | 5.3 | 2022-10-19 | Jenkins S3 Explorer Plugin 1.0.8 and earlier does not mask the AWS_SECRET_ACCESS_KEY form field, increasing the potential for attackers to observe and capture… |
CVE-2022-3287 | Medium | 6.5 | 2022-09-28 | When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction… |
CVE-2022-36308 | Critical | 9.1 | 2022-08-16 | Airspan AirVelocity 1500 web management UI displays SNMP credentials in plaintext on software versions older than 15.18.00.2511, and stores SNMPv3 credentials… |
CVE-2022-33928 | Medium | 6.4 | 2022-08-10 | Dell Wyse Management Suite 3.6.1 and below contains an Plain-text Password Storage Vulnerability in UI. An attacker with low privileges could potentially explo… |
CVE-2022-1794 | Medium | 5.5 | 2022-07-11 | The CODESYS OPC DA Server prior V3.5.18.20 stores PLC passwords as plain text in its configuration file so that it is visible to all authorized Microsoft Windo… |
CVE-2022-27548 | Medium | 4.9 | 2022-07-06 | HCL Launch stores user credentials in plain clear text which can be read by a local user. |
CVE-2022-31044 | High | 7.5 | 2022-06-15 | Rundeck is an open source automation service with a web console, command line tools and a WebAPI. The Key Storage converter plugin mechanism was not enabled co… |
CVE-2022-29085 | Medium | 6.4 | 2022-06-02 | Dell Unity, Dell UnityVSA, and Dell Unity XT versions prior to 5.2.0.0.5.173 contain a plain-text password storage vulnerability when certain off-array tools a… |
CVE-2022-22557 | High | 7.5 | 2022-06-02 | PowerStore contains Plain-Text Password Storage Vulnerability in PowerStore X & T environments running versions 2.0.0.x and 2.0.1.x A locally authenticated att… |
CVE-2021-32978 | High | 7.5 | 2022-04-04 | The programming protocol allows for a previously entered password and lock state to be read by an attacker. If the previously entered password was successful… |
CVE-2020-25184 | High | 7.8 | 2022-03-18 | Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x stores the password in plaintext in a file that is in the same directory as the executable file. ISaGR… |