CWE-312 · Cleartext Storage of Sensitive Information (page 2)
Page 2 of 9 — CVEs classified under CWE-312, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-25613 | High | 7.5 | 2025-11-20 | FS Inc S3150-8T2F 8-Port Gigabit Ethernet L2+ Switch, 8 x Gigabit RJ45, with 2 x 1Gb SFP, Fanless. All versions before 2.2.0D Build 135103 were discovered to t… |
CVE-2025-63208 | High | 7.5 | 2025-11-19 | An issue was discovered in bridgetech VB288 Objective QoE Content Extractor, firmware version 5.6.0-8, allowing attackers to gain sensitive information such as… |
CVE-2025-54342 | Low | 3.3 | 2025-11-14 | A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2. There is Exposure of Sensitive Information because… |
CVE-2025-34270 | Medium | 4.9 | 2025-10-30 | Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the AD/LDAP user import functionality as it fails to obfuscate the password field dur… |
CVE-2025-62261 | Medium | 6.5 | 2025-10-27 | Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through up… |
CVE-2025-48428 | Medium | 6.7 | 2025-10-23 | Cleartext Storage of Sensitive Information (CWE-312) in the Gallagher Morpho integration could allow an authenticated user with access to the Command Centre Se… |
CVE-2025-55334 | Medium | 6.2 | 2025-10-14 | Cleartext storage of sensitive information in Windows Kernel allows an unauthorized attacker to bypass a security feature locally. |
CVE-2025-21061 | High | 7.1 | 2025-10-10 | Cleartext storage of sensitive information in Smart Switch prior to version 3.7.67.2 allows local attackers to access sensitive data. User interaction is requi… |
CVE-2025-21060 | Medium | 5.5 | 2025-10-10 | Cleartext storage of sensitive information in Smart Switch prior to version 3.7.67.2 allows local attackers to access backup data from applications. User inter… |
CVE-2025-59450 | Medium | 4.3 | 2025-10-06 | The YoSmart YoLink Smart Hub firmware 0382 is unencrypted, and data extracted from it can be used to determine network access credentials. |
CVE-2025-59409 | High | 7.5 | 2025-10-02 | Flock Safety Falcon and Sparrow License Plate Readers OPM1.171019.026 ship with development Wi-Fi credentials (test_flck) stored in cleartext in production fir… |
CVE-2025-23291 | Low | 2.4 | 2025-09-30 | NVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an User/Attacker may cause an authorized action. A successful exp… |
CVE-2025-34216 | Critical | 9.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1026 and Application prior to version 20.0.2702 (VA deployments only) expose… |
CVE-2025-54855 | Medium | 4.2 | 2025-09-23 | Cleartext storage of sensitive information was discovered in Click Programming Software version v3.60. The vulnerability can be exploited by a local user with… |
CVE-2025-34206 | Critical | 9.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) mount host configuration and secret material under /var/w… |
CVE-2025-34200 | High | 7.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) provision the appliance with the network account credent… |
CVE-2025-49728 | Medium | 4.0 | 2025-09-16 | Cleartext storage of sensitive information in Microsoft PC Manager allows an unauthorized attacker to bypass a security feature locally. |
CVE-2025-58401 | Medium | 6.8 | 2025-09-05 | Obsidian GitHub Copilot Plugin versions prior to 1.1.7 store Github API token in cleartext form. As a result, an attacker may perform unauthorized operations o… |
CVE-2025-57806 | | 2025-09-03 | Local Deep Research is an AI-powered research assistant for deep, iterative research. Versions 0.2.0 through 0.6.7 stored confidential information, including A… | |
CVE-2024-52284 | High | 7.7 | 2025-09-02 | Unauthorized disclosure of sensitive data: Any user with `GET` or `LIST` permissions on `BundleDeployment` resources could retrieve Helm values containing cred… |
CVE-2025-55443 | Critical | 9.1 | 2025-08-26 | Telpo MDM 1.4.6 thru 1.4.9 for Android contains sensitive administrator credentials and MQTT server connection details (IP/port) that are stored in plaintext w… |
CVE-2025-7426 | | 2025-08-25 | Information disclosure and exposure of authentication FTP credentials over the debug port 1604 in the MINOVA TTA service. This allows unauthenticated remote ac… | |
CVE-2025-2182 | | 2025-08-13 | A problem with the implementation of the MACsec protocol in Palo Alto Networks PAN-OS® results in the cleartext exposure of the connectivity association key (C… | |
CVE-2025-2181 | | 2025-08-13 | A sensitive information disclosure vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can result in the cleartext exposure of Prisma Cloud access key… | |
CVE-2025-55280 | | 2025-08-13 | This vulnerability exists in ZKTeco WL20 due to storage of Wi-Fi credentials, configuration data and system data in plaintext within the device firmware. An at… | |
CVE-2025-54464 | | 2025-08-13 | This vulnerability exists in ZKTeco WL20 due to storage of admin and user credentials without encryption in the device firmware. An attacker with physical acce… | |
CVE-2025-40753 | Medium | 6.2 | 2025-08-12 | A vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions >= V2.60 < V2.62), POWER METER SICAM Q100 (7KG9501-0AA01-2AA1)… |
CVE-2025-40752 | Medium | 6.2 | 2025-08-12 | A vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions >= V2.60 < V2.62), POWER METER SICAM Q100 (7KG9501-0AA01-2AA1)… |
CVE-2025-51055 | High | 8.6 | 2025-08-06 | Insecure Data Storage of credentials has been found in /api_vedo/configuration/config.yml file in Vedo Suite version 2024.17. This file contains clear-text cre… |
CVE-2025-8528 | Low | 3.7 | 2025-08-04 | A vulnerability classified as problematic has been found in Exrick xboot up to 3.3.4. Affected is an unknown function of the file /xboot/permission/getMenuList… |
CVE-2025-7738 | Medium | 4.4 | 2025-07-31 | A flaw was found in Ansible Automation Platform (AAP) where the Gateway API returns the client secret for certain GitHub Enterprise authenticators in clear tex… |
CVE-2025-50777 | High | 7.8 | 2025-07-30 | The firmware of the AZIOT 2MP Full HD Smart Wi-Fi CCTV Home Security Camera (version V1.00.02) contains an Incorrect Access Control vulnerability that allows l… |
CVE-2025-54422 | Medium | 5.5 | 2025-07-29 | Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. In versions 1.16.1 and below, a critical security vul… |
CVE-2025-54538 | Medium | 5.5 | 2025-07-28 | In JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg pull" command |
CVE-2025-54537 | Medium | 5.5 | 2025-07-28 | In JetBrains TeamCity before 2025.07 user credentials were stored in plain text in memory snapshots |
CVE-2025-30124 | Critical | 9.8 | 2025-07-28 | An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices. When a new SD card is inserted into the dashcam, the existing password is written onto the S… |
CVE-2025-4394 | Medium | 6.8 | 2025-07-24 | Medtronic MyCareLink Patient Monitor uses an unencrypted filesystem on internal storage, which allows an attacker with physical access to read and modify files… |
CVE-2025-44649 | High | 7.5 | 2025-07-21 | In the configuration file of racoon in the TRENDnet TEW-WLC100P 2.03b03, the first item of exchage_mode is set to aggressive. Aggressive mode in IKE Phase 1 ex… |
CVE-2025-41458 | Medium | 5.5 | 2025-07-21 | Unencrypted storage in the database in Two App Studio Journey v5.5.9 for iOS allows local attackers to extract sensitive data via direct access to the app’s fi… |
CVE-2025-7397 | High | 7.1 | 2025-07-17 | A vulnerability in the ascgshell, of Brocade ASCG before 3.3.0 stores any command executed in the Command Line Interface (CLI) in plain text within the comma… |
CVE-2025-32353 | High | 8.2 | 2025-07-16 | Kaseya Rapid Fire Tools Network Detective 2.0.16.0 has Unencrypted Credentials (for privileged access) stored in the collector.txt configuration file. |
CVE-2025-53758 | | 2025-07-16 | This vulnerability exists in Digisol DG-GR6821AC Router due to use of default admin credentials at its web management interface. An attacker with physical acce… | |
CVE-2025-53755 | | 2025-07-16 | This vulnerability exists in Digisol DG-GR6821AC Router due to storage of credentials and PINS without encryption in the device firmware. An attacker with phys… | |
CVE-2025-53742 | Medium | 6.5 | 2025-07-09 | Jenkins Applitools Eyes Plugin 1.16.5 and earlier stores Applitools API keys unencrypted in job config.xml files on the Jenkins controller, where they can be v… |
CVE-2025-53672 | Medium | 6.5 | 2025-07-09 | Jenkins Kryptowire Plugin 0.2 and earlier stores the Kryptowire API key unencrypted in its global configuration file on the Jenkins controller, where it can be… |
CVE-2025-53670 | Medium | 6.5 | 2025-07-09 | Jenkins Nouvola DiveCloud Plugin 1.08 and earlier stores DiveCloud API Keys and Credentials Encryption Keys unencrypted in job config.xml files on the Jenkins… |
CVE-2025-7215 | Low | 1.6 | 2025-07-09 | A vulnerability, which was classified as problematic, has been found in FNKvision FNK-GU2 up to 40.1.7. Affected by this issue is some unknown functionality of… |
CVE-2025-27460 | High | 7.6 | 2025-07-03 | The hard drives of the device are not encrypted using a full volume encryption feature such as BitLocker. This allows an attacker with physical access to the d… |
CVE-2025-53103 | Medium | 5.8 | 2025-07-01 | JUnit is a testing framework for Java and the JVM. From version 5.12.0 to 5.13.1, JUnit's support for writing Open Test Reporting XML files can leak Git creden… |
CVE-2025-6224 | Medium | 6.5 | 2025-07-01 | Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the netw… |
CVE-2024-24915 | Medium | 6.1 | 2025-06-29 | Credentials are not cleared from memory after being used. A user with Administrator permissions can execute memory dump for SmartConsole process and fetch them. |
CVE-2023-28912 | Medium | 5.7 | 2025-06-28 | The MIB3 unit stores the synchronized phone contact book in clear-text, allowing an attacker with either code execution privilege on the system or physical acc… |
CVE-2025-47824 | Low | 2.0 | 2025-06-27 | Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have cleartext storage of code. |
CVE-2025-6748 | Low | 2.1 | 2025-06-27 | A vulnerability classified as problematic has been found in Bharti Airtel Thanks App 4.105.4 on Android. Affected is an unknown function of the file /Android/d… |
CVE-2025-47820 | Low | 2.0 | 2025-06-27 | Flock Safety Gunshot Detection devices before 1.3 have cleartext storage of code. |
CVE-2025-41647 | Medium | 5.5 | 2025-06-25 | A local, low-privileged attacker can learn the password of the connected controller in PLC Designer V4 due to an incorrect implementation that results in the p… |
CVE-2025-48463 | Low | 3.1 | 2025-06-24 | Successful exploitation of the vulnerability could allow an attacker to intercept data and conduct session hijacking on the exposed data as the vulnerable prod… |
CVE-2025-45001 | High | 7.5 | 2025-06-09 | react-native-keys 0.7.11 is vulnerable to sensitive information disclosure (remote) as encryption cipher and Base64 chunks are stored as plaintext in the compi… |
CVE-2025-1499 | Medium | 6.5 | 2025-06-01 | IBM InfoSphere Information Server 11.7 stores credential information for database authentication in a cleartext parameter file that could be viewed by an authe… |
CVE-2025-44614 | High | 7.5 | 2025-05-30 | Tinxy WiFi Lock Controller v1 RF was discovered to store users' sensitive information, including credentials and mobile phone numbers, in plaintext. |
CVE-2025-32752 | Medium | 5.7 | 2025-05-29 | Dell ThinOS 2502 and prior contain a Cleartext Storage of Sensitive Information vulnerability. A high privileged attacker with physical access could potentiall… |
CVE-2024-47056 | Medium | 5.1 | 2025-05-28 | SummaryThis advisory addresses a security vulnerability in Mautic where sensitive .env configuration files may be directly accessible via a web browser. This e… |
CVE-2025-4053 | | 2025-05-26 | The data stored in Be-Tech Mifare Classic card is stored in cleartext. An attacker having access to a Be-Tech hotel guest Mifare Classic card can create a mast… | |
CVE-2025-5154 | Low | 2.3 | 2025-05-25 | A vulnerability, which was classified as problematic, was found in PhonePe App 25.03.21.0 on Android. Affected is an unknown function of the file /data/data/co… |
CVE-2024-56428 | Medium | 5.5 | 2025-05-21 | The local iLabClient database in itech iLabClient 3.7.1 allows local attackers to read cleartext credentials (from the CONFIGS table) for their servers configu… |
CVE-2025-4737 | Medium | 6.2 | 2025-05-15 | Insufficient encryption vulnerability in the mobile application (com.transsion.aivoiceassistant) may lead to the risk of sensitive information leakage. |
CVE-2025-4537 | Low | 3.1 | 2025-05-11 | A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.8.9 and classified as problematic. Affected by this issue is some unknown functionality of the fil… |
CVE-2025-46820 | High | 7.1 | 2025-05-06 | phpgt/Dom provides access to modern DOM APIs. Versions of phpgt/Dom prior to 4.1.8 expose the GITHUB_TOKEN in the Dom workflow run artifact. The ci.yml workflo… |
CVE-2025-46634 | High | 8.2 | 2025-05-01 | Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an unauthenticated attacker to authenti… |
CVE-2025-46633 | High | 8.2 | 2025-05-01 | Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an attacker to decrypt traffic between the… |
CVE-2025-3395 | High | 7.1 | 2025-04-30 | Incorrect Permission Assignment for Critical Resource, Cleartext Storage of Sensitive Information vulnerability in ABB Automation Builder.This issue affects Au… |
CVE-2025-27532 | Medium | 6.5 | 2025-04-30 | A vulnerability in the “Backup & Restore” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to access sec… |
CVE-2025-2770 | Medium | 6.5 | 2025-04-23 | BEC Technologies Multiple Routers Cleartext Password Storage Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensi… |
CVE-2025-0123 | | 2025-04-11 | A vulnerability in the Palo Alto Networks PAN-OS® software enables unlicensed administrators to view clear-text data captured using the packet capture feature… | |
CVE-2025-3442 | | 2025-04-09 | This vulnerability exists in TP-Link Tapo H200 V1 IoT Smart Hub due to storage of Wi-Fi credentials in plain text within the device firmware. An attacker with… | |
CVE-2025-0418 | | 2025-04-01 | Valmet DNA user passwords in plain text. This practice poses a security risk as attackers who gain access to local project data can read the passwords. | |
CVE-2025-2922 | Low | 2.0 | 2025-03-28 | A vulnerability classified as problematic was found in Netis WF-2404 1.1.124EN. Affected by this vulnerability is an unknown functionality of the component Bus… |
CVE-2025-2909 | | 2025-03-28 | The lack of encryption in the DuoxMe (formerly Blue) application binary in versions prior to 3.3.1 for iOS devices allows an attacker to gain unauthorised acce… | |
CVE-2025-25758 | High | 7.5 | 2025-03-20 | An issue in KukuFM Android v1.12.7 (11207) allows attackers to access sensitive cleartext data via the android:allowBackup="true" in the ANdroidManifest.xml |
CVE-2024-23942 | High | 7.1 | 2025-03-18 | A local user may find a configuration file on the client workstation with unencrypted sensitive data. This allows an attacker to impersonate the device or prev… |
CVE-2025-2189 | | 2025-03-11 | This vulnerability exists in the Tinxy smart devices due to storage of credentials in plaintext within the device firmware. An attacker with physical access co… | |
CVE-2024-12604 | Medium | 6.5 | 2025-03-10 | Cleartext Storage of Sensitive Information in an Environment Variable, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Tapandsign Tech… |
CVE-2025-2120 | Low | 2.1 | 2025-03-09 | A vulnerability was found in Thinkware Car Dashcam F800 Pro up to 20250226. It has been rated as problematic. This issue affects some unknown processing of the… |
CVE-2025-27623 | Medium | 4.3 | 2025-03-05 | Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of views via REST API or CLI, allowi… |
CVE-2025-27622 | Medium | 4.3 | 2025-03-05 | Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of agents via REST API or CLI, allow… |
CVE-2025-27685 | High | 7.5 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Configuration File Contains CA & Private Key V-2022-001. |
CVE-2024-10404 | Medium | 5.5 | 2025-02-14 | CalInvocationHandler in Brocade SANnav before 2.3.1b logs sensitive information in clear text. The vulnerability could allow an authenticated, local attacker… |
CVE-2025-22896 | High | 8.6 | 2025-02-13 | mySCADA myPRO Manager stores credentials in cleartext, which could allow an attacker to obtain sensitive information. |
CVE-2025-26495 | High | 7.5 | 2025-02-11 | Cleartext Storage of Sensitive Information vulnerability in Salesforce Tableau Server can record the Personal Access Token (PAT) into logging repositories.This… |
CVE-2024-13843 | Medium | 6.0 | 2025-02-11 | Cleartext storage of information in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a local authenticated… |
CVE-2024-53651 | Medium | 4.6 | 2025-02-11 | A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 6MD85 (CP300) (All versions… |
CVE-2024-45718 | Medium | 4.6 | 2025-02-11 | Sensitive data could be exposed to non- privileged users in a configuration file. Local access to the computer with a low- privileged account is required to a… |
CVE-2024-49800 | Medium | 4.3 | 2025-02-06 | IBM ApplinX 11.1 stores sensitive information in cleartext in memory that could be obtained by an authenticated user. |
CVE-2025-23215 | | 2025-01-31 | PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in jar published to Mave… | |
CVE-2025-0142 | Medium | 4.3 | 2025-01-30 | Cleartext storage of sensitive information in the Zoom Jenkins Marketplace plugin before version 1.4 may allow an authenticated user to conduct a disclosure of… |
CVE-2024-55928 | Medium | 6.5 | 2025-01-23 | Xerox Workplace Suite exposes sensitive secrets in clear text, both locally and remotely. This vulnerability allows attackers to intercept or access secrets wi… |
CVE-2024-12079 | Low | 3.3 | 2025-01-23 | ECOVACS robot lawnmowers store the anti-theft PIN in cleartext on the device filesystem. An attacker can steal a lawnmower, read the PIN, and reset the anti-th… |
CVE-2025-23027 | | 2025-01-13 | next-forge is a Next.js project boilerplate for modern web application. The BASEHUB_TOKEN commited in apps/web/.env.example. Users should avoid use of this tok… | |
CVE-2024-46505 | Critical | 9.1 | 2025-01-09 | Infoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities. |
CVE-2024-56362 | High | 7.1 | 2024-12-23 | Navidrome is an open source web-based music collection server and streamer. Navidrome stores the JWT secret in plaintext in the navidrome.db database file unde… |