CWE-312 · Cleartext Storage of Sensitive Information (page 2)
Page 2 of 9 — CVEs classified under CWE-312, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-4346 | Medium | 6.8 | 2026-03-26 | The vulnerability affecting TL-WR850N v3 allows cleartext storage of administrative and Wi-Fi credentials in a region of the device’s flash memory while the se… |
CVE-2026-33512 | High | 7.5 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the API plugin exposes a `decryptString` action without any authentication… |
CVE-2026-31848 | Critical | 9.8 | 2026-03-23 | Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 uses the ecos_pw cookie for authentication, which contains Base64-encoded credential data comb… |
CVE-2026-33003 | Medium | 4.3 | 2026-03-18 | Jenkins LoadNinja Plugin 2.1 and earlier stores LoadNinja API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by us… |
CVE-2026-32842 | Medium | 6.5 | 2026-03-17 | Edimax GS-5008PL firmware version 1.00.54 and prior contain an insecure credential storage vulnerability that allows attackers to obtain administrator credenti… |
CVE-2025-55717 | Medium | 4.0 | 2026-03-10 | A cleartext storage of sensitive information vulnerability [CWE-312] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, Fo… |
CVE-2026-24311 | Medium | 5.6 | 2026-03-10 | The SAP Customer Checkout application exhibits certain design characteristics that involve locally storing operational data using reversible protection mechani… |
CVE-2025-36105 | Medium | 4.4 | 2026-03-10 | IBM Planning Analytics Advanced Certified Containers 3.1.0 through 3.1.4 could allow a local privileged user to obtain sensitive information from environment v… |
CVE-2025-70050 | Medium | 6.5 | 2026-03-09 | An issue pertaining to CWE-312: Cleartext Storage of Sensitive Information was discovered in lesspass lesspass v9.6.9 which allows attackers to obtain sensitiv… |
CVE-2024-55027 | High | 7.5 | 2026-03-03 | Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to stroe credentials in plaintext in the component uac_temp.db. |
CVE-2025-47147 | Medium | 5.7 | 2026-03-03 | Cleartext Storage of Sensitive Information (CWE-312) in the Command Centre Mobile Client on Android and iOS could allow an attacker with access to a logged-in… |
CVE-2026-3277 | Medium | 6.5 | 2026-02-27 | The OpenID Connect (OIDC) authentication configuration in PowerShell Universal before 2026.1.3 stores the OIDC client secret in cleartext in the .universal/a… |
CVE-2026-3221 | Medium | 4.9 | 2026-02-25 | Sensitive user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker with access to the… |
CVE-2026-27520 | High | 7.5 | 2026-02-24 | Binardat 10G08-0800GSM network switch firmware versions prior to V300SP10260209 store a user password in a client-side cookie as a Base64-encoded value accessi… |
CVE-2026-23655 | Medium | 6.5 | 2026-02-10 | Cleartext storage of sensitive information in Azure Compute Gallery allows an authorized attacker to disclose information over a network. |
CVE-2026-24319 | Medium | 5.8 | 2026-02-10 | In SAP Business One, sensitive information is written to the application�s memory dump files without obfuscation. Gaining access to this information could pote… |
CVE-2025-10464 | Medium | 6.5 | 2026-02-09 | Insecure Storage of Sensitive Information vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Senseway allows Retrieve Embedded Sensi… |
CVE-2026-25751 | High | 7.5 | 2026-02-06 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An information disclosure vulnerability in FUXA allows an unauthenticated, remote att… |
CVE-2025-33081 | Low | 3.3 | 2026-02-03 | IBM Concert 1.0.0 through 2.1.0 stores potentially sensitive information in log files that could be read by a local user. |
CVE-2025-12774 | High | 7.5 | 2026-02-03 | A vulnerability in the migration script for Brocade SANnav before 3.0 could allow the collection of database sql queries in the SANnav support save file. An at… |
CVE-2025-12772 | Medium | 4.9 | 2026-02-02 | Brocade SANnav before 2.4.0b logs the Brocade Fabric OS Switch admin password on the SANnav support save logs. When OOM occurs on a Brocade SANnav server, the… |
CVE-2025-12680 | Medium | 4.9 | 2026-02-02 | Brocade SANnav before Brocade SANnav 2.4.0b logs database passwords in clear text in the standby SANnav server, after disaster recovery failover. The vulnerab… |
CVE-2025-12679 | Medium | 6.5 | 2026-02-02 | A vulnerability in Brocade SANnav before 2.4.0b prints the Password-Based Encryption (PBE) key in plaintext in the system audit log file. The vulnerability c… |
CVE-2024-9432 | | 2026-01-30 | Cleartext Storage of Sensitive Information vulnerability in OpenText™ Vertica allows Retrieve Embedded Sensitive Data. The vulnerability could read Vertica… | |
CVE-2025-59105 | | 2026-01-26 | With physical access to the device and enough time an attacker can desolder the flash memory, modify it and then reinstall it because of missing encryption. Th… | |
CVE-2025-59102 | | 2026-01-26 | The web server of the Access Manager offers a functionality to download a backup of the local database stored on the device. This database contains the whole c… | |
CVE-2026-22276 | Medium | 5.5 | 2026-01-23 | Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0, contains a Cleartext Storage of Sensitive Information vulnerability… |
CVE-2025-14377 | | 2026-01-20 | A security issue was discovered within the legacy Ansible playbook component of Verve Asset Manager, caused by plaintext secrets incorrectly stored when a play… | |
CVE-2026-22240 | High | 7.5 | 2026-01-14 | The vulnerability exists in BLUVOYIX due to an improper password storage implementation and subsequent exposure via unauthenticated APIs. An unauthenticated re… |
CVE-2019-25279 | High | 7.5 | 2026-01-08 | FaceSentry Access Control System 6.4.8 contains a cleartext password storage vulnerability that allows attackers to access unencrypted credentials in the devic… |
CVE-2025-14836 | Low | 2.7 | 2025-12-17 | A flaw has been found in ZZCMS 2025. Affected by this vulnerability is an unknown functionality of the file /reg/user_save.php of the component User Data Stora… |
CVE-2025-11009 | Medium | 5.1 | 2025-12-17 | Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GT Designer3 Version1 (GOT2000) all versions and Mitsubishi Electric GT Designe… |
CVE-2025-65826 | Critical | 9.8 | 2025-12-10 | The mobile application was found to contain stored credentials for the network it was developed on. If an attacker retrieved this, and found the physical locat… |
CVE-2020-36887 | High | 7.5 | 2025-12-10 | SpinetiX Fusion Digital Signage 3.4.8 contains an unauthenticated information disclosure vulnerability in the database backup directory. Attackers can access t… |
CVE-2025-34428 | High | 7.8 | 2025-12-10 | MailEnable versions prior to 10.54 contain a cleartext storage of credentials vulnerability that can lead to local credential compromise and account takeover… |
CVE-2025-34427 | High | 7.8 | 2025-12-10 | MailEnable versions prior to 10.54 contain a cleartext storage of credentials vulnerability that can lead to local credential compromise and account takeover… |
CVE-2025-67638 | Medium | 4.3 | 2025-12-10 | Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential f… |
CVE-2025-67637 | Medium | 4.3 | 2025-12-10 | Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they c… |
CVE-2024-58277 | | 2025-12-04 | R Radio Network FM Transmitter 1.07 allows unauthenticated attackers to access the admin user's password through the system.cgi endpoint, enabling authenticati… | |
CVE-2025-65320 | High | 7.5 | 2025-12-03 | Abacre Restaurant Point of Sale (POS) up to 15.0.0.1656 are vulnerable to Cleartext Storage of Sensitive Information in Memory. The application leaves valid de… |
CVE-2025-59701 | Medium | 4.1 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate att… |
CVE-2025-59792 | Medium | 5.3 | 2025-11-28 | Reveals plaintext credentials in the MONITOR command vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 1.0.0 through 2.13.0. Users are… |
CVE-2025-3784 | Medium | 5.5 | 2025-11-27 | Cleartext Storage of Sensitive Information Vulnerability in GX Works2 all versions allows an attacker to disclose credential information stored in plaintext fr… |
CVE-2025-65278 | High | 7.5 | 2025-11-26 | An issue was discovered in file users.json in GroceryMart commit 21934e6 (2020-10-23) allowing unauthenticated attackers to gain sensitive information includin… |
CVE-2025-63729 | Critical | 9.0 | 2025-11-25 | An issue was discovered in Syrotech SY-GPON-1110-WDONT SYRO_3.7L_3.1.02-240517 allowing attackers to exctract the SSL Private Key, CA Certificate, SSL Certific… |
CVE-2025-25613 | High | 7.5 | 2025-11-20 | FS Inc S3150-8T2F 8-Port Gigabit Ethernet L2+ Switch, 8 x Gigabit RJ45, with 2 x 1Gb SFP, Fanless. All versions before 2.2.0D Build 135103 were discovered to t… |
CVE-2025-63208 | High | 7.5 | 2025-11-19 | An issue was discovered in bridgetech VB288 Objective QoE Content Extractor, firmware version 5.6.0-8, allowing attackers to gain sensitive information such as… |
CVE-2025-54342 | Low | 3.3 | 2025-11-14 | A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2. There is Exposure of Sensitive Information because… |
CVE-2025-34270 | Medium | 4.9 | 2025-10-30 | Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the AD/LDAP user import functionality as it fails to obfuscate the password field dur… |
CVE-2025-62261 | Medium | 6.5 | 2025-10-27 | Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through up… |
CVE-2025-48428 | Medium | 6.7 | 2025-10-23 | Cleartext Storage of Sensitive Information (CWE-312) in the Gallagher Morpho integration could allow an authenticated user with access to the Command Centre Se… |
CVE-2025-55334 | Medium | 6.2 | 2025-10-14 | Cleartext storage of sensitive information in Windows Kernel allows an unauthorized attacker to bypass a security feature locally. |
CVE-2025-21061 | High | 7.1 | 2025-10-10 | Cleartext storage of sensitive information in Smart Switch prior to version 3.7.67.2 allows local attackers to access sensitive data. User interaction is requi… |
CVE-2025-21060 | Medium | 5.5 | 2025-10-10 | Cleartext storage of sensitive information in Smart Switch prior to version 3.7.67.2 allows local attackers to access backup data from applications. User inter… |
CVE-2025-59450 | Medium | 4.3 | 2025-10-06 | The YoSmart YoLink Smart Hub firmware 0382 is unencrypted, and data extracted from it can be used to determine network access credentials. |
CVE-2025-59409 | High | 7.5 | 2025-10-02 | Flock Safety Falcon and Sparrow License Plate Readers OPM1.171019.026 ship with development Wi-Fi credentials (test_flck) stored in cleartext in production fir… |
CVE-2025-23291 | Low | 2.4 | 2025-09-30 | NVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an User/Attacker may cause an authorized action. A successful exp… |
CVE-2025-34216 | Critical | 9.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1026 and Application prior to version 20.0.2702 (VA deployments only) expose… |
CVE-2025-54855 | Medium | 4.2 | 2025-09-23 | Cleartext storage of sensitive information was discovered in Click Programming Software version v3.60. The vulnerability can be exploited by a local user with… |
CVE-2025-34206 | Critical | 9.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) mount host configuration and secret material under /var/w… |
CVE-2025-34200 | High | 7.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) provision the appliance with the network account credent… |
CVE-2025-49728 | Medium | 4.0 | 2025-09-16 | Cleartext storage of sensitive information in Microsoft PC Manager allows an unauthorized attacker to bypass a security feature locally. |
CVE-2025-58401 | Medium | 6.8 | 2025-09-05 | Obsidian GitHub Copilot Plugin versions prior to 1.1.7 store Github API token in cleartext form. As a result, an attacker may perform unauthorized operations o… |
CVE-2025-57806 | | 2025-09-03 | Local Deep Research is an AI-powered research assistant for deep, iterative research. Versions 0.2.0 through 0.6.7 stored confidential information, including A… | |
CVE-2024-52284 | High | 7.7 | 2025-09-02 | Unauthorized disclosure of sensitive data: Any user with `GET` or `LIST` permissions on `BundleDeployment` resources could retrieve Helm values containing cred… |
CVE-2025-55443 | Critical | 9.1 | 2025-08-26 | Telpo MDM 1.4.6 thru 1.4.9 for Android contains sensitive administrator credentials and MQTT server connection details (IP/port) that are stored in plaintext w… |
CVE-2025-7426 | | 2025-08-25 | Information disclosure and exposure of authentication FTP credentials over the debug port 1604 in the MINOVA TTA service. This allows unauthenticated remote ac… | |
CVE-2025-2182 | | 2025-08-13 | A problem with the implementation of the MACsec protocol in Palo Alto Networks PAN-OS® results in the cleartext exposure of the connectivity association key (C… | |
CVE-2025-2181 | | 2025-08-13 | A sensitive information disclosure vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can result in the cleartext exposure of Prisma Cloud access key… | |
CVE-2025-55280 | | 2025-08-13 | This vulnerability exists in ZKTeco WL20 due to storage of Wi-Fi credentials, configuration data and system data in plaintext within the device firmware. An at… | |
CVE-2025-54464 | | 2025-08-13 | This vulnerability exists in ZKTeco WL20 due to storage of admin and user credentials without encryption in the device firmware. An attacker with physical acce… | |
CVE-2025-40753 | Medium | 6.2 | 2025-08-12 | A vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions >= V2.60 < V2.62), POWER METER SICAM Q100 (7KG9501-0AA01-2AA1)… |
CVE-2025-40752 | Medium | 6.2 | 2025-08-12 | A vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions >= V2.60 < V2.62), POWER METER SICAM Q100 (7KG9501-0AA01-2AA1)… |
CVE-2025-51055 | High | 8.6 | 2025-08-06 | Insecure Data Storage of credentials has been found in /api_vedo/configuration/config.yml file in Vedo Suite version 2024.17. This file contains clear-text cre… |
CVE-2025-8528 | Low | 3.7 | 2025-08-04 | A vulnerability classified as problematic has been found in Exrick xboot up to 3.3.4. Affected is an unknown function of the file /xboot/permission/getMenuList… |
CVE-2025-7738 | Medium | 4.4 | 2025-07-31 | A flaw was found in Ansible Automation Platform (AAP) where the Gateway API returns the client secret for certain GitHub Enterprise authenticators in clear tex… |
CVE-2025-50777 | High | 7.8 | 2025-07-30 | The firmware of the AZIOT 2MP Full HD Smart Wi-Fi CCTV Home Security Camera (version V1.00.02) contains an Incorrect Access Control vulnerability that allows l… |
CVE-2025-54422 | Medium | 5.5 | 2025-07-29 | Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. In versions 1.16.1 and below, a critical security vul… |
CVE-2025-54538 | Medium | 5.5 | 2025-07-28 | In JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg pull" command |
CVE-2025-54537 | Medium | 5.5 | 2025-07-28 | In JetBrains TeamCity before 2025.07 user credentials were stored in plain text in memory snapshots |
CVE-2025-30124 | Critical | 9.8 | 2025-07-28 | An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices. When a new SD card is inserted into the dashcam, the existing password is written onto the S… |
CVE-2025-4394 | Medium | 6.8 | 2025-07-24 | Medtronic MyCareLink Patient Monitor uses an unencrypted filesystem on internal storage, which allows an attacker with physical access to read and modify files… |
CVE-2025-44649 | High | 7.5 | 2025-07-21 | In the configuration file of racoon in the TRENDnet TEW-WLC100P 2.03b03, the first item of exchage_mode is set to aggressive. Aggressive mode in IKE Phase 1 ex… |
CVE-2025-41458 | Medium | 5.5 | 2025-07-21 | Unencrypted storage in the database in Two App Studio Journey v5.5.9 for iOS allows local attackers to extract sensitive data via direct access to the app’s fi… |
CVE-2025-7397 | High | 7.1 | 2025-07-17 | A vulnerability in the ascgshell, of Brocade ASCG before 3.3.0 stores any command executed in the Command Line Interface (CLI) in plain text within the comma… |
CVE-2025-32353 | High | 8.2 | 2025-07-16 | Kaseya Rapid Fire Tools Network Detective 2.0.16.0 has Unencrypted Credentials (for privileged access) stored in the collector.txt configuration file. |
CVE-2025-53758 | | 2025-07-16 | This vulnerability exists in Digisol DG-GR6821AC Router due to use of default admin credentials at its web management interface. An attacker with physical acce… | |
CVE-2025-53755 | | 2025-07-16 | This vulnerability exists in Digisol DG-GR6821AC Router due to storage of credentials and PINS without encryption in the device firmware. An attacker with phys… | |
CVE-2025-53742 | Medium | 6.5 | 2025-07-09 | Jenkins Applitools Eyes Plugin 1.16.5 and earlier stores Applitools API keys unencrypted in job config.xml files on the Jenkins controller, where they can be v… |
CVE-2025-53672 | Medium | 6.5 | 2025-07-09 | Jenkins Kryptowire Plugin 0.2 and earlier stores the Kryptowire API key unencrypted in its global configuration file on the Jenkins controller, where it can be… |
CVE-2025-53670 | Medium | 6.5 | 2025-07-09 | Jenkins Nouvola DiveCloud Plugin 1.08 and earlier stores DiveCloud API Keys and Credentials Encryption Keys unencrypted in job config.xml files on the Jenkins… |
CVE-2025-7215 | Low | 1.6 | 2025-07-09 | A vulnerability, which was classified as problematic, has been found in FNKvision FNK-GU2 up to 40.1.7. Affected by this issue is some unknown functionality of… |
CVE-2025-27460 | High | 7.6 | 2025-07-03 | The hard drives of the device are not encrypted using a full volume encryption feature such as BitLocker. This allows an attacker with physical access to the d… |
CVE-2025-53103 | Medium | 5.8 | 2025-07-01 | JUnit is a testing framework for Java and the JVM. From version 5.12.0 to 5.13.1, JUnit's support for writing Open Test Reporting XML files can leak Git creden… |
CVE-2025-6224 | Medium | 6.5 | 2025-07-01 | Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the netw… |
CVE-2024-24915 | Medium | 6.1 | 2025-06-29 | Credentials are not cleared from memory after being used. A user with Administrator permissions can execute memory dump for SmartConsole process and fetch them. |
CVE-2023-28912 | Medium | 5.7 | 2025-06-28 | The MIB3 unit stores the synchronized phone contact book in clear-text, allowing an attacker with either code execution privilege on the system or physical acc… |
CVE-2025-47824 | Low | 2.0 | 2025-06-27 | Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have cleartext storage of code. |
CVE-2025-6748 | Low | 2.1 | 2025-06-27 | A vulnerability classified as problematic has been found in Bharti Airtel Thanks App 4.105.4 on Android. Affected is an unknown function of the file /Android/d… |
CVE-2025-47820 | Low | 2.0 | 2025-06-27 | Flock Safety Gunshot Detection devices before 1.3 have cleartext storage of code. |