CWE-312 · Cleartext Storage of Sensitive Information (page 3)
Page 3 of 9 — CVEs classified under CWE-312, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-41647 | Medium | 5.5 | 2025-06-25 | A local, low-privileged attacker can learn the password of the connected controller in PLC Designer V4 due to an incorrect implementation that results in the p… |
CVE-2025-48463 | Low | 3.1 | 2025-06-24 | Successful exploitation of the vulnerability could allow an attacker to intercept data and conduct session hijacking on the exposed data as the vulnerable prod… |
CVE-2025-45001 | High | 7.5 | 2025-06-09 | react-native-keys 0.7.11 is vulnerable to sensitive information disclosure (remote) as encryption cipher and Base64 chunks are stored as plaintext in the compi… |
CVE-2025-1499 | Medium | 6.5 | 2025-06-01 | IBM InfoSphere Information Server 11.7 stores credential information for database authentication in a cleartext parameter file that could be viewed by an authe… |
CVE-2025-44614 | High | 7.5 | 2025-05-30 | Tinxy WiFi Lock Controller v1 RF was discovered to store users' sensitive information, including credentials and mobile phone numbers, in plaintext. |
CVE-2025-32752 | Medium | 5.7 | 2025-05-29 | Dell ThinOS 2502 and prior contain a Cleartext Storage of Sensitive Information vulnerability. A high privileged attacker with physical access could potentiall… |
CVE-2024-47056 | Medium | 5.1 | 2025-05-28 | SummaryThis advisory addresses a security vulnerability in Mautic where sensitive .env configuration files may be directly accessible via a web browser. This e… |
CVE-2025-4053 | | 2025-05-26 | The data stored in Be-Tech Mifare Classic card is stored in cleartext. An attacker having access to a Be-Tech hotel guest Mifare Classic card can create a mast… | |
CVE-2025-5154 | Low | 2.3 | 2025-05-25 | A vulnerability, which was classified as problematic, was found in PhonePe App 25.03.21.0 on Android. Affected is an unknown function of the file /data/data/co… |
CVE-2024-56428 | Medium | 5.5 | 2025-05-21 | The local iLabClient database in itech iLabClient 3.7.1 allows local attackers to read cleartext credentials (from the CONFIGS table) for their servers configu… |
CVE-2025-4737 | Medium | 6.2 | 2025-05-15 | Insufficient encryption vulnerability in the mobile application (com.transsion.aivoiceassistant) may lead to the risk of sensitive information leakage. |
CVE-2025-4537 | Low | 3.1 | 2025-05-11 | A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.8.9 and classified as problematic. Affected by this issue is some unknown functionality of the fil… |
CVE-2025-46820 | High | 7.1 | 2025-05-06 | phpgt/Dom provides access to modern DOM APIs. Versions of phpgt/Dom prior to 4.1.8 expose the GITHUB_TOKEN in the Dom workflow run artifact. The ci.yml workflo… |
CVE-2025-46634 | High | 8.2 | 2025-05-01 | Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an unauthenticated attacker to authenti… |
CVE-2025-46633 | High | 8.2 | 2025-05-01 | Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an attacker to decrypt traffic between the… |
CVE-2025-3395 | High | 7.1 | 2025-04-30 | Incorrect Permission Assignment for Critical Resource, Cleartext Storage of Sensitive Information vulnerability in ABB Automation Builder.This issue affects Au… |
CVE-2025-27532 | Medium | 6.5 | 2025-04-30 | A vulnerability in the “Backup & Restore” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to access sec… |
CVE-2025-2770 | Medium | 6.5 | 2025-04-23 | BEC Technologies Multiple Routers Cleartext Password Storage Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensi… |
CVE-2025-0123 | | 2025-04-11 | A vulnerability in the Palo Alto Networks PAN-OS® software enables unlicensed administrators to view clear-text data captured using the packet capture feature… | |
CVE-2025-3442 | | 2025-04-09 | This vulnerability exists in TP-Link Tapo H200 V1 IoT Smart Hub due to storage of Wi-Fi credentials in plain text within the device firmware. An attacker with… | |
CVE-2025-0418 | | 2025-04-01 | Valmet DNA user passwords in plain text. This practice poses a security risk as attackers who gain access to local project data can read the passwords. | |
CVE-2025-2922 | Low | 2.0 | 2025-03-28 | A vulnerability classified as problematic was found in Netis WF-2404 1.1.124EN. Affected by this vulnerability is an unknown functionality of the component Bus… |
CVE-2025-2909 | | 2025-03-28 | The lack of encryption in the DuoxMe (formerly Blue) application binary in versions prior to 3.3.1 for iOS devices allows an attacker to gain unauthorised acce… | |
CVE-2025-25758 | High | 7.5 | 2025-03-20 | An issue in KukuFM Android v1.12.7 (11207) allows attackers to access sensitive cleartext data via the android:allowBackup="true" in the ANdroidManifest.xml |
CVE-2024-23942 | High | 7.1 | 2025-03-18 | A local user may find a configuration file on the client workstation with unencrypted sensitive data. This allows an attacker to impersonate the device or prev… |
CVE-2025-2189 | | 2025-03-11 | This vulnerability exists in the Tinxy smart devices due to storage of credentials in plaintext within the device firmware. An attacker with physical access co… | |
CVE-2024-12604 | Medium | 6.5 | 2025-03-10 | Cleartext Storage of Sensitive Information in an Environment Variable, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Tapandsign Tech… |
CVE-2025-2120 | Low | 2.1 | 2025-03-09 | A vulnerability was found in Thinkware Car Dashcam F800 Pro up to 20250226. It has been rated as problematic. This issue affects some unknown processing of the… |
CVE-2025-27623 | Medium | 4.3 | 2025-03-05 | Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of views via REST API or CLI, allowi… |
CVE-2025-27622 | Medium | 4.3 | 2025-03-05 | Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of agents via REST API or CLI, allow… |
CVE-2025-27685 | High | 7.5 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Configuration File Contains CA & Private Key V-2022-001. |
CVE-2024-10404 | Medium | 5.5 | 2025-02-14 | CalInvocationHandler in Brocade SANnav before 2.3.1b logs sensitive information in clear text. The vulnerability could allow an authenticated, local attacker… |
CVE-2025-22896 | High | 8.6 | 2025-02-13 | mySCADA myPRO Manager stores credentials in cleartext, which could allow an attacker to obtain sensitive information. |
CVE-2025-26495 | High | 7.5 | 2025-02-11 | Cleartext Storage of Sensitive Information vulnerability in Salesforce Tableau Server can record the Personal Access Token (PAT) into logging repositories.This… |
CVE-2024-13843 | Medium | 6.0 | 2025-02-11 | Cleartext storage of information in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a local authenticated… |
CVE-2024-53651 | Medium | 4.6 | 2025-02-11 | A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 6MD85 (CP300) (All versions… |
CVE-2024-45718 | Medium | 4.6 | 2025-02-11 | Sensitive data could be exposed to non- privileged users in a configuration file. Local access to the computer with a low- privileged account is required to a… |
CVE-2024-49800 | Medium | 4.3 | 2025-02-06 | IBM ApplinX 11.1 stores sensitive information in cleartext in memory that could be obtained by an authenticated user. |
CVE-2025-23215 | | 2025-01-31 | PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in jar published to Mave… | |
CVE-2025-0142 | Medium | 4.3 | 2025-01-30 | Cleartext storage of sensitive information in the Zoom Jenkins Marketplace plugin before version 1.4 may allow an authenticated user to conduct a disclosure of… |
CVE-2024-55928 | Medium | 6.5 | 2025-01-23 | Xerox Workplace Suite exposes sensitive secrets in clear text, both locally and remotely. This vulnerability allows attackers to intercept or access secrets wi… |
CVE-2024-12079 | Low | 3.3 | 2025-01-23 | ECOVACS robot lawnmowers store the anti-theft PIN in cleartext on the device filesystem. An attacker can steal a lawnmower, read the PIN, and reset the anti-th… |
CVE-2025-23027 | | 2025-01-13 | next-forge is a Next.js project boilerplate for modern web application. The BASEHUB_TOKEN commited in apps/web/.env.example. Users should avoid use of this tok… | |
CVE-2024-46505 | Critical | 9.1 | 2025-01-09 | Infoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities. |
CVE-2024-56362 | High | 7.1 | 2024-12-23 | Navidrome is an open source web-based music collection server and streamer. Navidrome stores the JWT secret in plaintext in the navidrome.db database file unde… |
CVE-2024-55196 | High | 7.5 | 2024-12-19 | Insufficiently Protected Credentials in the Mail Server Configuration in GoPhish v0.12.1 allows an attacker to access cleartext passwords for the configured IM… |
CVE-2024-50570 | Medium | 5.0 | 2024-12-18 | A Cleartext Storage of Sensitive Information vulnerability [CWE-312] in FortiClientWindows 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13 and F… |
CVE-2024-51175 | High | 7.5 | 2024-12-17 | An issue in H3C switch h3c-S1526 allows a remote attacker to obtain sensitive information via the S1526.cfg component. |
CVE-2024-35117 | Medium | 4.4 | 2024-12-11 | IBM OpenPages with Watson 9.0 may write sensitive information, under specific configurations, in clear text to the system tracing log files that could be obtai… |
CVE-2024-46340 | Critical | 9.8 | 2024-12-10 | TL-WR845N(UN)_V4_201214, TP-Link TL-WR845N(UN)_V4_200909, and TL-WR845N(UN)_V4_190219 was discovered to transmit user credentials in plaintext after executing… |
CVE-2024-40582 | High | 7.5 | 2024-12-09 | Pentaminds CuroVMS v2.0.1 was discovered to contain exposed sensitive information. |
CVE-2024-55582 | Medium | 5.7 | 2024-12-09 | Oxide before 6 has unencrypted Control Plane datastores. |
CVE-2024-54127 | | 2024-12-05 | This vulnerability exists in the TP-Link Archer C50 due to presence of terminal access on a serial interface without proper access control. An attacker with ph… | |
CVE-2024-12094 | | 2024-12-05 | This vulnerability exists in the Tinxy mobile app due to storage of logged-in user information in plaintext on the device database. An attacker with physical a… | |
CVE-2024-42451 | Medium | 6.5 | 2024-12-04 | A vulnerability in Veeam Backup & Replication allows low-privileged users to leak all saved credentials in plaintext. This is achieved by calling a series of m… |
CVE-2024-53979 | High | 8.2 | 2024-11-29 | ibm.ibm_zhmc is an Ansible collection for the IBM Z HMC. The Ansible collection "ibm.ibm_zhmc" writes password-like properties in clear text into its log file… |
CVE-2024-53865 | High | 8.2 | 2024-11-29 | zhmcclient is a pure Python client library for the IBM Z HMC Web Services API. In affected versions the Python package "zhmcclient" writes password-like proper… |
CVE-2024-29146 | Medium | 5.9 | 2024-11-26 | User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the deta… |
CVE-2024-46383 | Low | 2.4 | 2024-11-15 | Hathway Skyworth Router CM5100-511 v4.1.1.24 was discovered to store sensitive information about USB and Wifi connected devices in plaintext. |
CVE-2024-52525 | Low | 1.8 | 2024-11-15 | Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the session data. The sessio… |
CVE-2024-11159 | Medium | 4.3 | 2024-11-13 | Using remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird < 128.4.3 and Thunderbird <… |
CVE-2024-43429 | Medium | 5.3 | 2024-11-11 | A flaw was found in moodle. Some hidden user profile fields are visible in gradebook reports, which could result in users without the "view hidden user fields"… |
CVE-2024-51993 | Low | 3.4 | 2024-11-07 | Combodo iTop is a web based IT Service Management tool. An attacker accessing a backup file or the database can read some passwords for misconfigured Users. Th… |
CVE-2020-11918 | Medium | 5.4 | 2024-11-07 | An issue was discovered in Siime Eye 14.1.00000001.3.330.0.0.3.14. When a backup file is created through the web interface, information on all users, including… |
CVE-2024-34891 | Medium | 6.8 | 2024-11-04 | Insufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to read Exchange account passwords vi… |
CVE-2024-10523 | Medium | 4.6 | 2024-11-04 | This vulnerability exists in TP-Link IoT Smart Hub due to storage of Wi-Fi credentials in plain text within the device firmware. An attacker with physical acce… |
CVE-2024-7783 | High | 7.5 | 2024-10-29 | mintplex-labs/anything-llm version latest contains a vulnerability where sensitive information, specifically a password, is improperly stored within a JWT (JSO… |
CVE-2024-9991 | | 2024-10-25 | This vulnerability exists in Philips lighting devices due to storage of Wi-Fi credentials in plain text within the device firmware. An attacker with physical a… | |
CVE-2024-8070 | High | 8.5 | 2024-10-13 | CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that exposes test credentials in the firmware binary |
CVE-2024-9802 | Medium | 5.3 | 2024-10-10 | The conformance validation endpoint is public so everybody can verify the conformance of onboarded services. The response could contain specific information ab… |
CVE-2024-9798 | Critical | 9.0 | 2024-10-10 | The health endpoint is public so everybody can see a list of all services. It is potentially valuable information for attackers. |
CVE-2024-9466 | Medium | 6.5 | 2024-10-09 | A cleartext storage of sensitive information vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to reveal firewall usernames, pass… |
CVE-2024-6400 | High | 7.5 | 2024-10-04 | Cleartext Storage of Sensitive Information, Exposure of Sensitive Information Through Data Queries vulnerability in Finrota Netahsilat allows Retrieve Embedded… |
CVE-2024-47529 | Medium | 6.5 | 2024-10-02 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. OpenC3 COSMOS stores the password of a… |
CVE-2024-20448 | Medium | 6.3 | 2024-10-02 | A vulnerability in the Cisco Nexus Dashboard Fabric Controller (NDFC) software, formerly Cisco Data Center Network Manager (DCNM), could allow an attacker with… |
CVE-2024-25661 | High | 7.7 | 2024-10-01 | In Infinera TNMS (Transcend Network Management System) 19.10.3, cleartext storage of sensitive information in memory of the desktop application TNMS Client all… |
CVE-2024-25658 | Medium | 6.5 | 2024-10-01 | Cleartext storage of passwords in Infinera TNMS (Transcend Network Management System) Server 19.10.3 allows attackers (with access to the database or exported… |
CVE-2024-28807 | Medium | 6.5 | 2024-09-30 | An issue was discovered in Infinera hiT 7300 5.60.50. Cleartext storage of sensitive information in the memory of the @CT desktop management application allows… |
CVE-2024-28810 | Medium | 6.6 | 2024-09-30 | An issue was discovered in Infinera hiT 7300 5.60.50. Sensitive information inside diagnostic files (exported by the @CT application) allows an attacker to ach… |
CVE-2024-28809 | High | 8.8 | 2024-09-30 | An issue was discovered in Infinera hiT 7300 5.60.50. Cleartext storage of sensitive password in firmware update packages allows attackers to access various ap… |
CVE-2024-8459 | High | 7.2 | 2024-09-30 | Certain switch models from PLANET Technology store SNMPv3 users' passwords in plaintext within the configuration files, allowing remote attackers with administ… |
CVE-2024-45744 | Low | 3.0 | 2024-09-27 | TopQuadrant TopBraid EDG stores external credentials insecurely. An authenticated attacker with file system access can read edg-setup.properites and obtain the… |
CVE-2024-8644 | High | 7.5 | 2024-09-27 | Cleartext Storage of Sensitive Information in a Cookie vulnerability in Oceanic Software ValeApp allows Protocol Manipulation, : JSON Hijacking (aka JavaScript… |
CVE-2024-7259 | Medium | 4.9 | 2024-09-26 | A flaw was found in oVirt. A user with administrator privileges, including users with the ReadOnlyAdmin permission, may be able to use browser developer tools… |
CVE-2023-5359 | Low | 3.7 | 2024-09-25 | The W3 Total Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.5 via Google OAuth API secrets st… |
CVE-2024-6785 | Medium | 5.5 | 2024-09-21 | The configuration file stores credentials in cleartext. An attacker with local access rights can read or modify the configuration file, potentially resulting i… |
CVE-2024-9040 | Low | 2.3 | 2024-09-20 | A vulnerability, which was classified as problematic, was found in code-projects Blood Bank Management System 1.0. This affects an unknown part of the componen… |
CVE-2024-45862 | High | 7.5 | 2024-09-19 | Kastle Systems firmware prior to May 1, 2024, stored machine credentials in cleartext, which may allow an attacker to access sensitive information. |
CVE-2024-31415 | Medium | 6.3 | 2024-09-13 | The Eaton Foreseer software provides the feasibility for the user to configure external servers for multiple purposes such as network management, user manageme… |
CVE-2024-41629 | Medium | 5.5 | 2024-09-12 | An issue in Texas Instruments Fusion Digital Power Designer v.7.10.1 allows a local attacker to obtain sensitive information via the plaintext storage of crede… |
CVE-2024-40457 | Critical | 9.1 | 2024-09-12 | No-IP Dynamic Update Client (DUC) v3.x uses cleartext credentials that may occur on a command line or in a file. NOTE: the vendor's position is that cleartext… |
CVE-2024-8689 | | 2024-09-11 | A problem with the ActiveMQ integration for both Cortex XSOAR and Cortex XSIAM can result in the cleartext exposure of the configured ActiveMQ credentials in l… | |
CVE-2024-35282 | Medium | 4.2 | 2024-09-10 | A cleartext storage of sensitive information in memory vulnerability [CWE-316] affecting FortiClient VPN iOS 7.2 all versions, 7.0 all versions, 6.4 all versio… |
CVE-2024-45175 | High | 8.8 | 2024-09-05 | An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Sensitive information is stored in cleartext. It was found out that sensitive informati… |
CVE-2024-45004 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: dcp: fix leak of blob encryption key Trusted keys unseal the key blob on l… |
CVE-2024-41716 | High | 8.1 | 2024-09-04 | Cleartext storage of sensitive information vulnerability exists in WindLDR and WindO/I-NV4. If this vulnerability is exploited, an attacker who obtained the pr… |
CVE-2024-45391 | High | 7.5 | 2024-09-03 | Tina is an open-source content management system (CMS). Sites building with Tina CMS's command line interface (CLI) prior to version 1.6.2 that use a search to… |
CVE-2024-6921 | High | 7.5 | 2024-09-02 | Cleartext Storage of Sensitive Information vulnerability in NAC Telecommunication Systems Inc. NACPremium allows Retrieve Embedded Sensitive Data. This issue… |
CVE-2021-22509 | High | 8.1 | 2024-08-28 | A vulnerability identified in storing and reusing information in Advance Authentication. This issue can lead to leakage of sensitive data to unauthorized user… |
CVE-2024-32939 | Medium | 4.3 | 2024-08-22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2, when shared channels are enabled, fail to redact remote users' original e… |