CWE-312 · Cleartext Storage of Sensitive Information (page 4)
Page 4 of 9 — CVEs classified under CWE-312, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-20292 | Medium | 4.4 | 2024-03-06 | A vulnerability in the logging component of Cisco Duo Authentication for Windows Logon and RDP could allow an authenticated, local attacker to view sensitive i… |
CVE-2023-50957 | High | 8.0 | 2024-02-10 | IBM Storage Defender - Resiliency Service 2.0 could allow a privileged user to perform unauthorized actions after obtaining encrypted data from clear text key… |
CVE-2024-24488 | Medium | 5.5 | 2024-02-07 | An issue in Shenzen Tenda Technology CP3V2.0 V11.10.00.2311090948 allows a local attacker to obtain sensitive information via the password component. |
CVE-2023-31002 | Medium | 5.1 | 2024-02-07 | IBM Security Access Manager Container 10.0.0.0 through 10.0.6.1 temporarily stores sensitive information in files that could be accessed by a local user. IBM… |
CVE-2023-6874 | High | 7.5 | 2024-02-05 | Prior to v7.4.0, Ember ZNet is vulnerable to a denial of service attack through manipulation of the NWK sequence number |
CVE-2023-51702 | Medium | 6.5 | 2024-01-24 | Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configu… |
CVE-2023-27098 | High | 7.5 | 2024-01-09 | TP-Link Tapo APK up to v2.12.703 uses hardcoded credentials for access to the login panel. |
CVE-2023-6250 | High | 7.5 | 2023-12-26 | The BestWebSoft's Like & Share WordPress plugin before 2.74 discloses the content of password protected posts to unauthenticated users via a meta tag |
CVE-2023-50294 | Medium | 6.5 | 2023-12-26 | The App Settings (/admin/app) page in GROWI versions prior to v6.0.6 stores sensitive information in cleartext form. As a result, the Secret access key for ext… |
CVE-2023-5384 | High | 7.2 | 2023-12-18 | A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with connection pooling… |
CVE-2023-50719 | High | 7.5 | 2023-12-15 | XWiki Platform is a generic wiki platform. Starting in 7.2-milestone-2 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki di… |
CVE-2023-50777 | Medium | 4.3 | 2023-12-13 | Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier does not mask PaaSLane authentication tokens displayed on the job configuration form, increasing the potenti… |
CVE-2023-50776 | Medium | 4.3 | 2023-12-13 | Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier stores PaaSLane authentication tokens unencrypted in job config.xml files on the Jenkins controller where th… |
CVE-2023-50773 | Medium | 4.3 | 2023-12-13 | Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job configuration form, increasing the potential for attackers… |
CVE-2023-50772 | Medium | 4.3 | 2023-12-13 | Jenkins Dingding JSON Pusher Plugin 2.0 and earlier stores access tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed… |
CVE-2015-8314 | High | 7.5 | 2023-12-12 | The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persistent application ac… |
CVE-2022-46141 | Medium | 4.2 | 2023-12-12 | A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) (All versions < V19). An information disclosure vulnerability could allow a local attacker t… |
CVE-2023-40238 | Medium | 5.5 | 2023-12-07 | A LogoFAIL issue was discovered in BmpDecoderDxe in Insyde InsydeH2O with kernel 5.2 before 05.28.47, 5.3 before 05.37.47, 5.4 before 05.45.47, 5.5 before 05.5… |
CVE-2023-46388 | High | 7.5 | 2023-11-30 | LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Insecure Permissions via dpal_config.zml file. This vulnerability allows… |
CVE-2023-46386 | High | 7.5 | 2023-11-30 | LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Insecure Permissions via registry.xml file. This vulnerability allows re… |
CVE-2023-46384 | High | 7.5 | 2023-11-30 | LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions. Cleartext storage of credentials allows remote attackers to dis… |
CVE-2023-48707 | Medium | 5.0 | 2023-11-24 | CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. The `secretKey` value is an important key for HMAC SHA256 authentication… |
CVE-2023-47312 | Medium | 6.5 | 2023-11-22 | Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to Login Credential Leakage via Audit Entries. |
CVE-2023-48700 | Medium | 5.7 | 2023-11-21 | The Nautobot Device Onboarding plugin uses the netmiko and NAPALM libraries to simplify the onboarding process of a new device into Nautobot down to, in many c… |
CVE-2023-48305 | Medium | 4.2 | 2023-11-21 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1… |
CVE-2023-46376 | High | 7.5 | 2023-10-27 | Zentao Biz version 8.7 and before is vulnerable to Information Disclosure. |
CVE-2023-41096 | Medium | 6.8 | 2023-10-26 | Missing Encryption of Security Keys vulnerability in Silicon Labs Ember ZNet SDK on 32 bit, ARM (SecureVault High modules) allows potential modification or ex… |
CVE-2023-41095 | Medium | 6.8 | 2023-10-26 | Missing Encryption of Security Keys vulnerability in Silicon Labs OpenThread SDK on 32 bit, ARM (SecureVault High modules) allows potential modification or ext… |
CVE-2023-46653 | Medium | 6.5 | 2023-10-25 | Jenkins lambdatest-automation Plugin 1.20.10 and earlier logs LAMBDATEST Credentials access token at the INFO level, potentially resulting in its exposure. |
CVE-2023-46128 | Medium | 6.5 | 2023-10-25 | Nautobot is a Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 2.0.x, c… |
CVE-2023-45151 | Medium | 6.5 | 2023-10-16 | Nextcloud server is an open source home cloud platform. Affected versions of Nextcloud stored OAuth2 tokens in plaintext which allows an attacker who has gaine… |
CVE-2023-44037 | High | 7.5 | 2023-10-14 | An issue in ZPE Systems, Inc Nodegrid OS v.5.8.10 thru v.5.8.13 and v.5.10.3 thru v.5.10.5 allows a remote attacker to obtain sensitive information via the TAC… |
CVE-2023-41964 | Medium | 4.3 | 2023-10-10 | The BIG-IP and BIG-IQ systems do not encrypt some sensitive information written to Database (DB) variables. Note: Software versions which have reached End o… |
CVE-2023-2809 | High | 7.8 | 2023-10-04 | Plaintext credential usage vulnerability in Sage 200 Spain 2023.38.001 version, the exploitation of which could allow a remote attacker to extract SQL database… |
CVE-2023-4066 | Medium | 5.5 | 2023-09-27 | A flaw was found in Red Hat's AMQ Broker, which stores certain passwords in a secret security-properties-prop-module, defined in ActivemqArtemisSecurity CR; ho… |
CVE-2023-44159 | High | 7.5 | 2023-09-27 | Sensitive information disclosure due to cleartext storage of sensitive information. The following products are affected: Acronis Cyber Protect 15 (Linux, Windo… |
CVE-2023-44153 | High | 7.5 | 2023-09-27 | Sensitive information disclosure due to cleartext storage of sensitive information in memory. The following products are affected: Acronis Cyber Protect 15 (Li… |
CVE-2023-41335 | Low | 3.7 | 2023-09-27 | Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. When users update their passwords, the new credentials may be… |
CVE-2023-2358 | Medium | 4.3 | 2023-09-27 | Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.5.0.0 and 9.3.0.4, including 8.3.x.x, saves passwords of the Hadoop Copy Files step in p… |
CVE-2023-40715 | Medium | 5.5 | 2023-09-13 | A cleartext storage of sensitive information vulnerability [CWE-312] in FortiTester 2.3.0 through 7.2.3 may allow an attacker with access to the DB contents to… |
CVE-2023-4400 | Medium | 6.2 | 2023-09-13 | A password management vulnerability in Skyhigh Secure Web Gateway (SWG) in main releases 11.x prior to 11.2.14, 10.x prior to 10.2.25 and controlled release 1… |
CVE-2023-31069 | Critical | 9.8 | 2023-09-11 | An issue was discovered in TSplus Remote Access through 16.0.2.14. Credentials are stored as cleartext within the HTML source code of the login page. |
CVE-2023-3950 | Medium | 5.5 | 2023-09-01 | An information disclosure issue in GitLab EE affecting all versions from 16.2 prior to 16.2.5, and 16.3 prior to 16.3.1 allowed other Group Owners to see the P… |
CVE-2023-31925 | Medium | 5.4 | 2023-08-31 | Brocade SANnav before v2.3.0 and v2.2.2a stores SNMPv3 Authentication passwords in plaintext. A privileged user could retrieve these credentials with knowle… |
CVE-2023-31423 | Medium | 5.7 | 2023-08-31 | Possible information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking on Brocade SANnav… |
CVE-2023-3489 | High | 8.6 | 2023-08-31 | The firmwaredownload command on Brocade Fabric OS v9.2.0 could log the FTP/SFTP/SCP server password in clear text in the SupportSave file when performing a… |
CVE-2023-4392 | Low | 3.7 | 2023-08-17 | A vulnerability was found in Control iD Gerencia Web 1.30 and classified as problematic. Affected by this issue is some unknown functionality of the component… |
CVE-2023-40354 | Medium | 6.5 | 2023-08-14 | An issue was discovered in MariaDB MaxScale before 23.02.3. A user enters an encrypted password on a "maxctrl create service" command line, but this password i… |
CVE-2023-31041 | High | 7.5 | 2023-08-14 | An issue was discovered in SysPasswordDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. System password information could optionally be stored in cleartext… |
CVE-2023-39210 | Medium | 5.5 | 2023-08-08 | Cleartext storage of sensitive information in Zoom Client SDK for Windows before 5.15.0 may allow an authenticated user to enable an information disclosure via… |
CVE-2023-36136 | Medium | 6.5 | 2023-08-08 | PHPJabbers Class Scheduling System 1.0 lacks encryption on the password when editing a user account (update user page) allowing an attacker to capture all user… |
CVE-2023-39440 | Medium | 4.4 | 2023-08-08 | In SAP BusinessObjects Business Intelligence - version 420, If a user logs in to a particular program, under certain specific conditions memory might not be c… |
CVE-2023-39903 | Medium | 5.9 | 2023-08-07 | An issue was discovered in Fujitsu Software Infrastructure Manager (ISM) before 2.8.0.061. The ismsnap component (in this specific case at /var/log/fujitsu/Ser… |
CVE-2023-33373 | Critical | 9.8 | 2023-08-04 | Connected IO v2.1.0 and prior keeps passwords and credentials in clear-text format, allowing attackers to exfiltrate the credentials and use them to impersonat… |
CVE-2023-39379 | High | 7.5 | 2023-08-04 | Fujitsu Software Infrastructure Manager (ISM) stores sensitive information at the product's maintenance data (ismsnap) in cleartext form. As a result, the pass… |
CVE-2023-30146 | High | 7.5 | 2023-08-04 | Assmann Digitus Plug&View IP Camera HT-IP211HDP, version 2.000.022 allows unauthenticated attackers to download a copy of the camera's settings and the adminis… |
CVE-2023-39144 | High | 7.5 | 2023-08-03 | Element55 KnowMore appliances version 21 and older was discovered to store passwords in plaintext. |
CVE-2023-33742 | High | 7.5 | 2023-07-27 | TeleAdapt RoomCast TA-2400 1.0 through 3.1 suffers from Cleartext Storage of Sensitive Information: RSA private key in Update.exe. |
CVE-2023-30367 | High | 7.5 | 2023-07-26 | Multi-Remote Next Generation Connection Manager (mRemoteNG) is free software that enables users to store and manage multi-protocol connection configurations to… |
CVE-2023-32455 | Medium | 5.5 | 2023-07-20 | Dell Wyse ThinOS versions prior to 2208 (9.3.2102) contain a sensitive information disclosure vulnerability. An unauthenticated malicious user with local acce… |
CVE-2023-32447 | Medium | 5.5 | 2023-07-20 | Dell Wyse ThinOS versions prior to 2306 (9.4.2103) contain a sensitive information disclosure vulnerability. A malicious user with local access to the device… |
CVE-2023-32446 | Medium | 5.5 | 2023-07-20 | Dell Wyse ThinOS versions prior to 2303 (9.4.1141) contain a sensitive information disclosure vulnerability. An unauthenticated malicious user with local acce… |
CVE-2023-32483 | Medium | 4.4 | 2023-07-20 | Wyse Management Suite versions prior to 4.0 contain a sensitive information disclosure vulnerability. An authenticated malicious user having local access to t… |
CVE-2023-3762 | Medium | 4.3 | 2023-07-19 | A vulnerability was found in Intergard SGS 8.7.0. It has been classified as problematic. This affects an unknown part. The manipulation leads to cleartext stor… |
CVE-2023-37468 | Medium | 6.0 | 2023-07-13 | Feedbacksystem is a personalized feedback system for students using artificial intelligence. Passwords of users using LDAP login are stored in clear text in th… |
CVE-2023-31821 | High | 7.5 | 2023-07-13 | An issue found in ALBIS Co. ALBIS v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp ALBIS f… |
CVE-2023-20207 | Medium | 4.9 | 2023-07-12 | A vulnerability in the logging component of Cisco Duo Authentication Proxy could allow an authenticated, remote attacker to view sensitive information in clear… |
CVE-2022-22302 | Medium | 5.3 | 2023-07-11 | A clear text storage of sensitive information (CWE-312) vulnerability in both FortiGate version 6.4.0 through 6.4.1, 6.2.0 through 6.2.9 and 6.0.0 through 6.0… |
CVE-2023-35699 | Medium | 5.3 | 2023-07-10 | Cleartext Storage on Disk in the SICK ICR890-4 could allow an unauthenticated attacker with local access to the device to disclose sensitive information by acc… |
CVE-2023-3395 | Medium | 6.5 | 2023-07-03 | All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory. An attacker with access to system files could open a file t… |
CVE-2023-27243 | High | 7.5 | 2023-06-21 | An access control issue in Makves DCAP v3.0.0.122 allows unauthenticated attackers to obtain cleartext credentials via a crafted web request to the product API. |
CVE-2022-33159 | Medium | 5.3 | 2023-06-15 | IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID… |
CVE-2023-1897 | Critical | 9.4 | 2023-06-12 | Atlas Copco Power Focus 6000 web server does not sanitize the login information stored by the authenticated user’s browser, which could allow an attacker with… |
CVE-2023-22584 | High | 7.5 | 2023-06-11 | The Danfoss AK-EM100 stores login credentials in cleartext. |
CVE-2023-27706 | High | 7.1 | 2023-06-09 | Bitwarden Windows desktop application versions prior to v2023.4.0 store biometric keys in Windows Credential Manager, accessible to other local unprivileged pr… |
CVE-2023-28713 | High | 8.1 | 2023-06-01 | Plaintext storage of a password exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. Because account information of the database is saved in a local f… |
CVE-2023-28345 | Medium | 4.6 | 2023-05-31 | An issue was discovered in Faronics Insight 10.0.19045 on Windows. The Insight Teacher Console application exposes the teacher's Console password in cleartext… |
CVE-2023-32448 | Medium | 5.5 | 2023-05-30 | PowerPath for Windows, versions 7.0, 7.1 & 7.2 contains License Key Stored in Cleartext vulnerability. A local user with access to the installation directory… |
CVE-2023-2863 | Low | 2.3 | 2023-05-24 | A vulnerability has been found in Simple Design Daily Journal 1.012.GP.B on Android and classified as problematic. Affected by this vulnerability is an unknown… |
CVE-2023-22878 | Medium | 6.2 | 2023-05-19 | IBM InfoSphere Information Server 11.7 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 244373. |
CVE-2023-32983 | Medium | 5.3 | 2023-05-16 | Jenkins Ansible Plugin 204.v8191fd551eb_f and earlier does not mask extra variables displayed on the configuration form, increasing the potential for attackers… |
CVE-2023-32982 | Medium | 4.3 | 2023-05-16 | Jenkins Ansible Plugin 204.v8191fd551eb_f and earlier stores extra variables unencrypted in job config.xml files on the Jenkins controller where they can be vi… |
CVE-2023-20914 | Medium | 5.5 | 2023-05-15 | In onSetRuntimePermissionGrantStateByDeviceAdmin of AdminRestrictedPermissionsUtils.java, there is a possible way for the work profile to read SMS messages due… |
CVE-2023-31408 | Medium | 5.3 | 2023-05-15 | Cleartext Storage of Sensitive Information in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a… |
CVE-2023-24586 | Medium | 6.5 | 2023-05-10 | Cleartext storage of sensitive information exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier, which may allow a remote authenticated attacker to… |
CVE-2023-30853 | High | 7.6 | 2023-04-28 | Gradle Build Action allows users to execute a Gradle Build in their GitHub Actions workflow. A vulnerability impacts GitHub workflows using the Gradle Build Ac… |
CVE-2023-29471 | Medium | 5.5 | 2023-04-27 | Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is confi… |
CVE-2023-2335 | Medium | 6.5 | 2023-04-27 | Plaintext Password in Registry vulnerability in 42gears surelock windows surelockwinsetupv2.40.0.Exe on Windows (Registery modules) allows Retrieve Admin… |
CVE-2023-29480 | High | 7.5 | 2023-04-24 | Ribose RNP before 0.16.3 sometimes lets secret keys remain unlocked after use. |
CVE-2023-31043 | High | 7.5 | 2023-04-23 | EnterpriseDB EDB Postgres Advanced Server (EPAS) before 14.6.0 logs unredacted passwords in situations where optional parameters are used with CREATE/ALTER USE… |
CVE-2023-22894 | Medium | 4.9 | 2023-04-19 | Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filt… |
CVE-2023-22949 | Medium | 4.9 | 2023-04-14 | An issue was discovered in TigerGraph Enterprise Free Edition 3.x. There is logging of user credentials. All authenticated GSQL access requests are logged by T… |
CVE-2023-30531 | Medium | 6.5 | 2023-04-12 | Jenkins Consul KV Builder Plugin 2.0.13 and earlier does not mask the HashiCorp Consul ACL Token on the global configuration form, increasing the potential for… |
CVE-2023-30530 | Medium | 4.3 | 2023-04-12 | Jenkins Consul KV Builder Plugin 2.0.13 and earlier stores the HashiCorp Consul ACL Token unencrypted in its global configuration file on the Jenkins controlle… |
CVE-2023-30528 | Medium | 6.5 | 2023-04-12 | Jenkins WSO2 Oauth Plugin 1.0 and earlier does not mask the WSO2 Oauth client secret on the global configuration form, increasing the potential for attackers t… |
CVE-2023-30527 | Medium | 4.3 | 2023-04-12 | Jenkins WSO2 Oauth Plugin 1.0 and earlier stores the WSO2 Oauth client secret unencrypted in the global config.xml file on the Jenkins controller where it can… |
CVE-2023-30523 | Medium | 4.3 | 2023-04-12 | Jenkins Report Portal Plugin 0.5 and earlier stores ReportPortal access tokens unencrypted in job config.xml files on the Jenkins controller as part of its con… |
CVE-2023-0005 | Medium | 4.1 | 2023-04-12 | A vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to expose the plaintext values of secrets stored in the device con… |
CVE-2023-26593 | High | 7.8 | 2023-04-11 | CENTUM series provided by Yokogawa Electric Corporation are vulnerable to cleartext storage of sensitive information. If an attacker who can login or access th… |
CVE-2023-0614 | Medium | 6.5 | 2023-04-03 | The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attacker may be able to… |