CWE-312 · Cleartext Storage of Sensitive Information (page 4)
Page 4 of 9 — CVEs classified under CWE-312, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-25024 | Medium | 5.5 | 2024-08-15 | IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores user credentials in plain clear text whi… |
CVE-2024-5916 | Medium | 4.4 | 2024-08-14 | An information exposure vulnerability in Palo Alto Networks PAN-OS software enables a local system administrator to unintentionally disclose secrets, passwords… |
CVE-2024-33892 | High | 7.5 | 2024-08-02 | Insecure Permissions vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are susceptible to leaking informatio… |
CVE-2024-38877 | High | 8.2 | 2024-08-02 | A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 Domain Controller R9.2 (All versions), Omnivise T3… |
CVE-2024-41691 | Medium | 4.6 | 2024-07-26 | This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to storing of FTP credentials in plaintext within the SquashFS-root filesystem associated w… |
CVE-2024-41690 | Medium | 4.6 | 2024-07-26 | This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to storing of default username and password credentials in plaintext within the router's fi… |
CVE-2024-41689 | Medium | 4.6 | 2024-07-26 | This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to unencrypted storing of WPA/ WPS credentials within the router's firmware/ database. An a… |
CVE-2024-41688 | Medium | 4.6 | 2024-07-26 | This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due lack of encryption in storing of usernames and passwords within the router's firmware/ data… |
CVE-2024-39674 | Medium | 6.2 | 2024-07-25 | Plaintext vulnerability in the Gallery search module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2019-16638 | High | 7.5 | 2024-07-16 | An issue was found on the Ruijie EG-2000 series gateway. An attacker can easily dump cleartext stored passwords in /data/config.text with simple XORs. This aff… |
CVE-2024-39732 | Medium | 4.1 | 2024-07-14 | IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 temporarily stores data from different environments that could be obtained by a malicious user. IB… |
CVE-2024-25023 | Medium | 5.5 | 2024-07-10 | IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.22.0 stores potentially sensitive information in log… |
CVE-2024-21993 | Medium | 5.7 | 2024-07-09 | SnapCenter versions prior to 5.0p1 are susceptible to a vulnerability which could allow an authenticated attacker to discover plaintext credentials. |
CVE-2024-40750 | Medium | 5.3 | 2024-07-09 | Linksys Velop Pro 6E 1.0.8 MX6200_1.0.8.215731 and 7 1.0.10.215314 devices send cleartext Wi-Fi passwords over the public Internet during app-based installatio… |
CVE-2024-40594 | Low | 2.3 | 2024-07-06 | The OpenAI ChatGPT app before 2024-07-05 for macOS opts out of the sandbox, and stores conversations in cleartext in a location accessible to other apps. |
CVE-2024-39846 | Low | 3.5 | 2024-06-29 | NewPass before 1.2.0 stores passwords (rather than password hashes) directly, which makes it easier to obtain unauthorized access to sensitive information. NOT… |
CVE-2024-29954 | Medium | 5.9 | 2024-06-26 | A vulnerability in a password management API in Brocade Fabric OS versions before v9.2.1, v9.2.0b, v9.1.1d, and v8.2.3e prints sensitive information in log fil… |
CVE-2024-36497 | Critical | 9.1 | 2024-06-24 | The decrypted configuration file contains the password in cleartext which is used to configure WINSelect. It can be used to remove the existing restrictions… |
CVE-2023-49113 | High | 7.8 | 2024-06-20 | The Kiuwan Local Analyzer (KLA) Java scanning application contains several hard-coded secrets in plain text format. In some cases, this can potentially compr… |
CVE-2024-36589 | Medium | 4.3 | 2024-06-13 | An issue in Annonshop.app DecentralizeJustice/anonymousLocker commit 2b2b4 to ba9fd and DecentralizeJustice/anonBackend commit 57837 to cd815 was discovered to… |
CVE-2024-38280 | Medium | 4.6 | 2024-06-13 | An unauthorized user is able to gain access to sensitive data, including credentials, by physically retrieving the hard disk of the product as the data is stor… |
CVE-2024-28024 | Medium | 4.1 | 2024-06-11 | A vulnerability exists in the FOXMAN-UN/UNEM in which sensitive information is stored in cleartext within a resource that might be accessible to another contr… |
CVE-2024-36790 | High | 8.8 | 2024-06-07 | Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 was discovered to store credentials in plaintext. |
CVE-2024-4540 | High | 7.5 | 2024-06-03 | A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR). Client-provided parameters were found to be included in plain text in the KC_RES… |
CVE-2024-36119 | Low | 1.8 | 2024-05-30 | Statamic is a, Laravel + Git powered CMS designed for building websites. In affected versions users registering via the `user:register_form` tag will have thei… |
CVE-2024-33471 | High | 7.2 | 2024-05-24 | An issue in the Sensor Settings of AVTECH Room Alert 4E v4.4.0 allows attackers to gain access to SMTP credentials in plaintext via a crafted AJAX request. NOT… |
CVE-2024-33470 | Medium | 4.9 | 2024-05-24 | An issue in the SMTP Email Settings of AVTECH Room Alert 4E v4.4.0 allows attackers to gain access to credentials in plaintext via a passback attack. NOTE: Thi… |
CVE-2024-31840 | Medium | 6.5 | 2024-05-21 | An issue was discovered in Italtel Embrace 1.6.4. The web application inserts cleartext passwords in the HTML source code. An authenticated user is able to edi… |
CVE-2024-31486 | Medium | 5.3 | 2024-05-14 | A vulnerability has been identified in OPUPI0 AMQP/MQTT (All versions < V5.30). The affected devices stores MQTT client passwords without sufficient protection… |
CVE-2024-4840 | Medium | 5.5 | 2024-05-14 | An flaw was found in the OpenStack Platform (RHOSP) director, a toolset for installing and managing a complete RHOSP environment. Plaintext passwords may be st… |
CVE-2023-27370 | Medium | 5.7 | 2024-05-03 | NETGEAR RAX30 Device Configuration Cleartext Storage Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sen… |
CVE-2023-46294 | Low | 3.4 | 2024-05-01 | An issue was discovered in Teledyne FLIR M300 2.00-19. User account passwords are encrypted locally, and can be decrypted to cleartext passwords using the util… |
CVE-2024-28327 | High | 8.4 | 2024-04-26 | Asus RT-N12+ B1 router stores user passwords in plaintext, which could allow local attackers to obtain unauthorized access and modify router settings. |
CVE-2024-4235 | Low | 2.7 | 2024-04-26 | A vulnerability classified as problematic was found in Netgear DG834Gv5 1.6.01.34. This vulnerability affects unknown code of the component Web Management Inte… |
CVE-2024-31587 | Medium | 6.5 | 2024-04-19 | SecuSTATION Camera V2.5.5.3116-S50-SMA-B20160811A and lower allows an unauthenticated attacker to download device configuration files via a crafted request. |
CVE-2024-3742 | High | 7.5 | 2024-04-18 | Electrolink transmitters store credentials in clear-text. Use of these credentials could allow an attacker to access the system. |
CVE-2024-32474 | High | 7.3 | 2024-04-18 | Sentry is an error tracking and performance monitoring platform. Prior to 24.4.1, when authenticating as a superuser to Sentry with a username and password, th… |
CVE-2024-29956 | Medium | 6.5 | 2024-04-18 | A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a prints the Brocade SANnav password in clear text in supportsave logs when a user schedules a switch… |
CVE-2024-29952 | Medium | 5.5 | 2024-04-17 | A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a could allow an authenticated user to print the Auth, Priv, and SSL key store passwords in unencrypt… |
CVE-2024-23584 | Medium | 6.6 | 2024-04-08 | The NMAP Importer service may expose data store credentials to authorized users of the Windows Registry. |
CVE-2024-28065 | Medium | 5.9 | 2024-04-05 | In Unify CP IP Phone firmware 1.10.4.3, files are not encrypted and contain sensitive information such as the root password hash. |
CVE-2024-28387 | High | 7.5 | 2024-03-25 | An issue in axonaut v.3.1.23 and before allows a remote attacker to obtain sensitive information via the log.txt component. |
CVE-2024-22084 | High | 7.5 | 2024-03-20 | An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Cleartext passwords and hashes are exposed through log files. |
CVE-2023-49341 | High | 7.5 | 2024-03-09 | An issue was discovered in Newland Nquire 1000 Interactive Kiosk version NQ1000-II_G_V1.00.011, allows remote attackers to obtain sensitive information via cle… |
CVE-2024-24375 | High | 7.5 | 2024-03-07 | SQL injection vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to obtain sensitive information via /admin/admin name parameter. |
CVE-2024-20292 | Medium | 4.4 | 2024-03-06 | A vulnerability in the logging component of Cisco Duo Authentication for Windows Logon and RDP could allow an authenticated, local attacker to view sensitive i… |
CVE-2023-50957 | High | 8.0 | 2024-02-10 | IBM Storage Defender - Resiliency Service 2.0 could allow a privileged user to perform unauthorized actions after obtaining encrypted data from clear text key… |
CVE-2024-24488 | Medium | 5.5 | 2024-02-07 | An issue in Shenzen Tenda Technology CP3V2.0 V11.10.00.2311090948 allows a local attacker to obtain sensitive information via the password component. |
CVE-2023-31002 | Medium | 5.1 | 2024-02-07 | IBM Security Access Manager Container 10.0.0.0 through 10.0.6.1 temporarily stores sensitive information in files that could be accessed by a local user. IBM… |
CVE-2023-6874 | High | 7.5 | 2024-02-05 | Prior to v7.4.0, Ember ZNet is vulnerable to a denial of service attack through manipulation of the NWK sequence number |
CVE-2023-51702 | Medium | 6.5 | 2024-01-24 | Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configu… |
CVE-2023-27098 | High | 7.5 | 2024-01-09 | TP-Link Tapo APK up to v2.12.703 uses hardcoded credentials for access to the login panel. |
CVE-2023-6250 | High | 7.5 | 2023-12-26 | The BestWebSoft's Like & Share WordPress plugin before 2.74 discloses the content of password protected posts to unauthenticated users via a meta tag |
CVE-2023-50294 | Medium | 6.5 | 2023-12-26 | The App Settings (/admin/app) page in GROWI versions prior to v6.0.6 stores sensitive information in cleartext form. As a result, the Secret access key for ext… |
CVE-2023-5384 | High | 7.2 | 2023-12-18 | A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with connection pooling… |
CVE-2023-50719 | High | 7.5 | 2023-12-15 | XWiki Platform is a generic wiki platform. Starting in 7.2-milestone-2 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki di… |
CVE-2023-50777 | Medium | 4.3 | 2023-12-13 | Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier does not mask PaaSLane authentication tokens displayed on the job configuration form, increasing the potenti… |
CVE-2023-50776 | Medium | 4.3 | 2023-12-13 | Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier stores PaaSLane authentication tokens unencrypted in job config.xml files on the Jenkins controller where th… |
CVE-2023-50773 | Medium | 4.3 | 2023-12-13 | Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job configuration form, increasing the potential for attackers… |
CVE-2023-50772 | Medium | 4.3 | 2023-12-13 | Jenkins Dingding JSON Pusher Plugin 2.0 and earlier stores access tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed… |
CVE-2015-8314 | High | 7.5 | 2023-12-12 | The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persistent application ac… |
CVE-2022-46141 | Medium | 4.2 | 2023-12-12 | A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) (All versions < V19). An information disclosure vulnerability could allow a local attacker t… |
CVE-2023-40238 | Medium | 5.5 | 2023-12-07 | A LogoFAIL issue was discovered in BmpDecoderDxe in Insyde InsydeH2O with kernel 5.2 before 05.28.47, 5.3 before 05.37.47, 5.4 before 05.45.47, 5.5 before 05.5… |
CVE-2023-46388 | High | 7.5 | 2023-11-30 | LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Insecure Permissions via dpal_config.zml file. This vulnerability allows… |
CVE-2023-46386 | High | 7.5 | 2023-11-30 | LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Insecure Permissions via registry.xml file. This vulnerability allows re… |
CVE-2023-46384 | High | 7.5 | 2023-11-30 | LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions. Cleartext storage of credentials allows remote attackers to dis… |
CVE-2023-48707 | Medium | 5.0 | 2023-11-24 | CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. The `secretKey` value is an important key for HMAC SHA256 authentication… |
CVE-2023-47312 | Medium | 6.5 | 2023-11-22 | Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to Login Credential Leakage via Audit Entries. |
CVE-2023-48700 | Medium | 5.7 | 2023-11-21 | The Nautobot Device Onboarding plugin uses the netmiko and NAPALM libraries to simplify the onboarding process of a new device into Nautobot down to, in many c… |
CVE-2023-48305 | Medium | 4.2 | 2023-11-21 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1… |
CVE-2023-46376 | High | 7.5 | 2023-10-27 | Zentao Biz version 8.7 and before is vulnerable to Information Disclosure. |
CVE-2023-41096 | Medium | 6.8 | 2023-10-26 | Missing Encryption of Security Keys vulnerability in Silicon Labs Ember ZNet SDK on 32 bit, ARM (SecureVault High modules) allows potential modification or ex… |
CVE-2023-41095 | Medium | 6.8 | 2023-10-26 | Missing Encryption of Security Keys vulnerability in Silicon Labs OpenThread SDK on 32 bit, ARM (SecureVault High modules) allows potential modification or ext… |
CVE-2023-46653 | Medium | 6.5 | 2023-10-25 | Jenkins lambdatest-automation Plugin 1.20.10 and earlier logs LAMBDATEST Credentials access token at the INFO level, potentially resulting in its exposure. |
CVE-2023-46128 | Medium | 6.5 | 2023-10-25 | Nautobot is a Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 2.0.x, c… |
CVE-2023-45151 | Medium | 6.5 | 2023-10-16 | Nextcloud server is an open source home cloud platform. Affected versions of Nextcloud stored OAuth2 tokens in plaintext which allows an attacker who has gaine… |
CVE-2023-44037 | High | 7.5 | 2023-10-14 | An issue in ZPE Systems, Inc Nodegrid OS v.5.8.10 thru v.5.8.13 and v.5.10.3 thru v.5.10.5 allows a remote attacker to obtain sensitive information via the TAC… |
CVE-2023-41964 | Medium | 4.3 | 2023-10-10 | The BIG-IP and BIG-IQ systems do not encrypt some sensitive information written to Database (DB) variables. Note: Software versions which have reached End o… |
CVE-2023-2809 | High | 7.8 | 2023-10-04 | Plaintext credential usage vulnerability in Sage 200 Spain 2023.38.001 version, the exploitation of which could allow a remote attacker to extract SQL database… |
CVE-2023-4066 | Medium | 5.5 | 2023-09-27 | A flaw was found in Red Hat's AMQ Broker, which stores certain passwords in a secret security-properties-prop-module, defined in ActivemqArtemisSecurity CR; ho… |
CVE-2023-44159 | High | 7.5 | 2023-09-27 | Sensitive information disclosure due to cleartext storage of sensitive information. The following products are affected: Acronis Cyber Protect 15 (Linux, Windo… |
CVE-2023-44153 | High | 7.5 | 2023-09-27 | Sensitive information disclosure due to cleartext storage of sensitive information in memory. The following products are affected: Acronis Cyber Protect 15 (Li… |
CVE-2023-41335 | Low | 3.7 | 2023-09-27 | Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. When users update their passwords, the new credentials may be… |
CVE-2023-2358 | Medium | 4.3 | 2023-09-27 | Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.5.0.0 and 9.3.0.4, including 8.3.x.x, saves passwords of the Hadoop Copy Files step in p… |
CVE-2023-40715 | Medium | 5.5 | 2023-09-13 | A cleartext storage of sensitive information vulnerability [CWE-312] in FortiTester 2.3.0 through 7.2.3 may allow an attacker with access to the DB contents to… |
CVE-2023-4400 | Medium | 6.2 | 2023-09-13 | A password management vulnerability in Skyhigh Secure Web Gateway (SWG) in main releases 11.x prior to 11.2.14, 10.x prior to 10.2.25 and controlled release 1… |
CVE-2023-31069 | Critical | 9.8 | 2023-09-11 | An issue was discovered in TSplus Remote Access through 16.0.2.14. Credentials are stored as cleartext within the HTML source code of the login page. |
CVE-2023-3950 | Medium | 5.5 | 2023-09-01 | An information disclosure issue in GitLab EE affecting all versions from 16.2 prior to 16.2.5, and 16.3 prior to 16.3.1 allowed other Group Owners to see the P… |
CVE-2023-31925 | Medium | 5.4 | 2023-08-31 | Brocade SANnav before v2.3.0 and v2.2.2a stores SNMPv3 Authentication passwords in plaintext. A privileged user could retrieve these credentials with knowle… |
CVE-2023-31423 | Medium | 5.7 | 2023-08-31 | Possible information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking on Brocade SANnav… |
CVE-2023-3489 | High | 8.6 | 2023-08-31 | The firmwaredownload command on Brocade Fabric OS v9.2.0 could log the FTP/SFTP/SCP server password in clear text in the SupportSave file when performing a… |
CVE-2023-4392 | Low | 3.7 | 2023-08-17 | A vulnerability was found in Control iD Gerencia Web 1.30 and classified as problematic. Affected by this issue is some unknown functionality of the component… |
CVE-2023-40354 | Medium | 6.5 | 2023-08-14 | An issue was discovered in MariaDB MaxScale before 23.02.3. A user enters an encrypted password on a "maxctrl create service" command line, but this password i… |
CVE-2023-31041 | High | 7.5 | 2023-08-14 | An issue was discovered in SysPasswordDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. System password information could optionally be stored in cleartext… |
CVE-2023-39210 | Medium | 5.5 | 2023-08-08 | Cleartext storage of sensitive information in Zoom Client SDK for Windows before 5.15.0 may allow an authenticated user to enable an information disclosure via… |
CVE-2023-36136 | Medium | 6.5 | 2023-08-08 | PHPJabbers Class Scheduling System 1.0 lacks encryption on the password when editing a user account (update user page) allowing an attacker to capture all user… |
CVE-2023-39440 | Medium | 4.4 | 2023-08-08 | In SAP BusinessObjects Business Intelligence - version 420, If a user logs in to a particular program, under certain specific conditions memory might not be c… |
CVE-2023-39903 | Medium | 5.9 | 2023-08-07 | An issue was discovered in Fujitsu Software Infrastructure Manager (ISM) before 2.8.0.061. The ismsnap component (in this specific case at /var/log/fujitsu/Ser… |
CVE-2023-33373 | Critical | 9.8 | 2023-08-04 | Connected IO v2.1.0 and prior keeps passwords and credentials in clear-text format, allowing attackers to exfiltrate the credentials and use them to impersonat… |
CVE-2023-39379 | High | 7.5 | 2023-08-04 | Fujitsu Software Infrastructure Manager (ISM) stores sensitive information at the product's maintenance data (ismsnap) in cleartext form. As a result, the pass… |