CWE-312 · Cleartext Storage of Sensitive Information (page 5)
Page 5 of 9 — CVEs classified under CWE-312, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-1683 | Medium | 4.3 | 2023-03-29 | A vulnerability was found in Xunrui CMS 4.61 and classified as problematic. Affected by this issue is some unknown functionality of the file /dayrui/Fcms/View/… |
CVE-2023-25263 | Medium | 5.5 | 2023-03-27 | In Stimulsoft Designer (Desktop) 2023.1.5, and 2023.1.4, once an attacker decompiles the Stimulsoft.report.dll the attacker is able to decrypt any connectionst… |
CVE-2023-20059 | Medium | 4.3 | 2023-03-23 | A vulnerability in the implementation of the Cisco Network Plug-and-Play (PnP) agent of Cisco DNA Center could allow an authenticated, remote attacker to view… |
CVE-2023-25596 | Medium | 4.5 | 2023-03-22 | A vulnerability exists in ClearPass Policy Manager that allows for an attacker with administrative privileges to access sensitive information in a cleartext f… |
CVE-2023-23776 | Medium | 4.6 | 2023-03-07 | An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in FortiAnalyzer versions 7.2.0 through 7.2.1, 7.0.0 through 7.0.4 and 6… |
CVE-2022-48310 | Medium | 5.5 | 2023-03-01 | An information disclosure vulnerability allows sensitive key material to be included in technical support archives in Sophos Connect versions older than 2.2.90. |
CVE-2023-26760 | High | 7.5 | 2023-02-27 | Sme.UP ERP TOKYO V6R1M220406 was discovered to contain an information disclosure vulnerability via the /debug endpoint. This vulnerability allows attackers to… |
CVE-2022-34910 | Medium | 4.1 | 2023-02-27 | An issue was discovered in the A4N (Aremis 4 Nomad) application 1.5.0 for Android. It uses a local database to store data and accounts. However, the password i… |
CVE-2022-31405 | Medium | 6.5 | 2023-02-27 | MV iDigital Clinic Enterprise (iDCE) 1.0 stores passwords in cleartext. |
CVE-2022-34351 | Medium | 5.9 | 2023-02-17 | IBM QRadar SIEM 7.4 and 7.5 is vulnerable to information exposure allowing a non-tenant user with a specific domain security profile assigned to see some data… |
CVE-2022-41734 | Medium | 5.3 | 2023-02-17 | IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is return… |
CVE-2023-24964 | Medium | 6.2 | 2023-02-17 | IBM InfoSphere Information Server 11.7 could allow a local user to obtain sensitive information from a log files. IBM X-Force ID: 246463. |
CVE-2022-45154 | Medium | 4.4 | 2023-02-15 | A Cleartext Storage of Sensitive Information vulnerability in suppportutils of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Ent… |
CVE-2022-3089 | Medium | 6.3 | 2023-02-13 | Echelon SmartServer 2.2 with i.LON Vision 2.2 stores cleartext credentials in a file, which could allow an attacker to obtain cleartext usernames and pass… |
CVE-2022-34388 | High | 7.1 | 2023-02-11 | Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior) contain information disclosure vulner… |
CVE-2022-24410 | Medium | 6.8 | 2023-02-10 | Dell BIOS contains an information exposure vulnerability. An unauthenticated local attacker with physical access to the system and knowledge of the system con… |
CVE-2023-0690 | Medium | 5.0 | 2023-02-08 | HashiCorp Boundary from 0.10.0 through 0.11.2 contain an issue where when using a PKI-based worker with a Key Management Service (KMS) defined in the configura… |
CVE-2022-43757 | Critical | 9.9 | 2023-02-07 | A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows users on managed clusters to gain access to credentials. The impact depends o… |
CVE-2023-23944 | Low | 2.0 | 2023-02-06 | Nextcloud mail is an email app for the nextcloud home server platform. In versions prior to 2.2.2 user's passwords were stored in cleartext in the database dur… |
CVE-2022-45098 | Medium | 6.1 | 2023-02-01 | Dell PowerScale OneFS, 9.0.0.x-9.4.0.x, contain a cleartext storage of sensitive information vulnerability in S3 component. An authenticated local attacker co… |
CVE-2022-45897 | Medium | 6.5 | 2023-01-31 | On Xerox WorkCentre 3550 25.003.03.000 devices, an authenticated attacker can view the SMB server settings and can obtain the stored cleartext credentials asso… |
CVE-2023-22332 | Medium | 6.5 | 2023-01-30 | Information disclosure vulnerability exists in Pgpool-II 4.4.0 to 4.4.1 (4.4 series), 4.3.0 to 4.3.4 (4.3 series), 4.2.0 to 4.2.11 (4.2 series), 4.1.0 to 4.1.1… |
CVE-2022-48073 | High | 7.5 | 2023-01-27 | Phicomm K2G v22.6.3.20 was discovered to store the root and admin passwords in plaintext. |
CVE-2022-48071 | High | 7.5 | 2023-01-27 | Phicomm K2 v22.6.534.263 was discovered to store the root and admin passwords in plaintext. |
CVE-2023-24454 | Medium | 5.5 | 2023-01-26 | Jenkins TestQuality Updater Plugin 1.3 and earlier stores the TestQuality Updater password unencrypted in its global configuration file on the Jenkins controll… |
CVE-2023-24450 | Medium | 6.5 | 2023-01-26 | Jenkins view-cloner Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users wit… |
CVE-2023-24442 | Medium | 5.5 | 2023-01-26 | Jenkins GitHub Pull Request Coverage Status Plugin 2.2.0 and earlier stores the GitHub Personal Access Token, Sonar access token and Sonar password unencrypted… |
CVE-2023-24439 | Medium | 5.5 | 2023-01-26 | Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier stores the private keys unencrypted in its global configuration file on the Jenkins contro… |
CVE-2023-24055 | Medium | 5.5 | 2023-01-22 | KeePass through 2.53 (in a default installation) allows an attacker, who has write access to the XML configuration file, to obtain the cleartext passwords by a… |
CVE-2022-38112 | High | 7.5 | 2023-01-20 | In DPA 2022.4 and older releases, generated heap memory dumps contain sensitive information in cleartext. |
CVE-2022-45439 | Medium | 6.5 | 2023-01-17 | A pair of spare WiFi credentials is stored in the configuration file of the Zyxel AX7501-B0 firmware prior to V5.17(ABPC.3)C0 in cleartext. An unauthenticated… |
CVE-2022-42284 | Medium | 6.2 | 2023-01-13 | NVIDIA BMC stores user passwords in an obfuscated form in a database accessible by the host. This may lead to a credentials exposure. |
CVE-2022-22470 | Medium | 4.1 | 2023-01-09 | IBM Security Verify Governance 10.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 225232. |
CVE-2022-45787 | Medium | 5.5 | 2023-01-06 | Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users. This issue a… |
CVE-2022-41740 | Medium | 4.6 | 2023-01-05 | IBM Robotic Process Automation 20.12 through 21.0.6 could allow an attacker with physical access to the system to obtain highly sensitive information from sys… |
CVE-2022-37785 | High | 7.5 | 2023-01-01 | An issue was discovered in WeCube Platform 3.2.2. Cleartext passwords are displayed in the configuration for terminal plugins. |
CVE-2022-24120 | Medium | 4.6 | 2022-12-26 | Certain General Electric Renewable Energy products store cleartext credentials in flash memory. This affects iNET and iNET II before 8.3.0. |
CVE-2022-22457 | Medium | 5.3 | 2022-12-22 | IBM Security Verify Governance, Identity Manager 10.0.1 stores sensitive information including user credentials in plain clear text which can be read by a loca… |
CVE-2022-42931 | Low | 3.3 | 2022-12-22 | Logins saved by Firefox should be managed by the Password Manager component which uses encryption to save files on-disk. Instead, the username (not password) w… |
CVE-2022-47512 | Medium | 5.5 | 2022-12-19 | Sensitive information was stored in plain text in a file that is accessible by a user with a local account in Hybrid Cloud Observability (HCO)/ SolarWinds Plat… |
CVE-2022-31697 | Medium | 5.5 | 2022-12-13 | The vCenter Server contains an information disclosure vulnerability due to the logging of credentials in plaintext. A malicious actor with access to a workstat… |
CVE-2022-4312 | Medium | 5.5 | 2022-12-12 | A cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3. This could allow an unauthorized user with access the… |
CVE-2022-35120 | High | 8.8 | 2022-12-01 | IXPdata EasyInstall 6.6.14725 contains an access control issue. |
CVE-2022-46155 | High | 7.6 | 2022-11-29 | Airtable.js is the JavaScript client for Airtable. Prior to version 0.11.6, Airtable.js had a misconfigured build script in its source package. When the build… |
CVE-2022-24188 | High | 7.5 | 2022-11-28 | The /device/signin end-point for the Ourphoto App version 1.4.1 discloses clear-text password information for functionality within the picture frame devices. T… |
CVE-2022-29832 | Low | 3.7 | 2022-11-25 | Cleartext Storage of Sensitive Information in Memory vulnerability in Mitsubishi Electric Corporation GX Works3 versions 1.015R and later, GX Works2 all versio… |
CVE-2022-29826 | Medium | 6.8 | 2022-11-25 | Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.087R and Motion Control Setting(GX Works3 r… |
CVE-2022-25164 | High | 8.6 | 2022-11-25 | Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z and Mitsubishi Electric MX OPC UA Modu… |
CVE-2022-45868 | High | 8.4 | 2022-11-23 | The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to speci… |
CVE-2022-41933 | Medium | 6.2 | 2022-11-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When the `reset a forgotten password` feature of XWiki… |
CVE-2022-2513 | High | 7.1 | 2022-11-22 | A vulnerability exists in the Intelligent Electronic Device (IED) Connectivity Package (ConnPack) credential storage function in Hitachi Energy’s PCM600 produc… |
CVE-2022-43958 | High | 7.6 | 2022-11-08 | A vulnerability has been identified in QMS Automotive (All versions < V12.39), QMS Automotive (All versions < V12.39). User credentials are stored in plaintext… |
CVE-2022-42956 | High | 7.5 | 2022-11-07 | The PassWork extension 5.0.9 for Chrome and other browsers allows an attacker to obtain the cleartext master password. |
CVE-2022-42955 | High | 7.5 | 2022-11-07 | The PassWork extension 5.0.9 for Chrome and other browsers allows an attacker to obtain cleartext cached credentials. |
CVE-2022-38710 | Medium | 5.3 | 2022-11-03 | IBM Robotic Process Automation 21.0.1 and 21.0.2 could disclose sensitive version to an unauthorized control sphere information that could aid in further attac… |
CVE-2022-35279 | Medium | 4.3 | 2022-11-03 | "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, and 22.0.1 could disclose sen… |
CVE-2022-34339 | Medium | 6.5 | 2022-11-03 | "IBM Cognos Analytics 11.2.1, 11.2.0, 11.1.7 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID: 229963." |
CVE-2021-39077 | Medium | 4.4 | 2022-11-03 | IBM Security Guardium 10.5, 10.6, 11.0, 11.1, 11.2, 11.3, and 11.4 stores user credentials in plain clear text which can be read by a local privileged user. IB… |
CVE-2022-39364 | Medium | 4.0 | 2022-10-27 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server prior to versions 23.0.9 and 24.0.5 and Ne… |
CVE-2022-39351 | Medium | 4.4 | 2022-10-25 | Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior to version 4.6.0, p… |
CVE-2022-2805 | Medium | 6.5 | 2022-10-19 | A flaw was found in ovirt-engine, which leads to the logging of plaintext passwords in the log file when using otapi-style. This flaw allows an attacker with s… |
CVE-2022-3540 | Medium | 6.5 | 2022-10-17 | An issue has been discovered in hunter2 affecting all versions before 2.1.0. Improper handling of auto-completion input allows an authenticated attacker to ext… |
CVE-2022-33918 | Medium | 5.5 | 2022-10-12 | Dell GeoDrive, Versions 2.1 - 2.2, contains an information disclosure vulnerability. An authenticated non-admin user could potentially exploit this vulnerabili… |
CVE-2020-15332 | Critical | 9.8 | 2022-09-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak /opt/axess/etc/default/axess permissions. |
CVE-2020-15325 | Medium | 5.3 | 2022-09-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded Erlang cookie for ejabberd replication. |
CVE-2015-1931 | Medium | 5.5 | 2022-09-29 | IBM Java Security Components in IBM SDK, Java Technology Edition 8 before SR1 FP10, 7 R1 before SR3 FP10, 7 before SR9 FP10, 6 R1 before SR8 FP7, 6 before SR16… |
CVE-2022-32217 | Medium | 5.3 | 2022-09-23 | A cleartext storage of sensitive information exists in Rocket.Chat <v4.6.4 due to Oauth token being leaked in plaintext in Rocket.chat logs. |
CVE-2022-41248 | Medium | 5.3 | 2022-09-21 | Jenkins BigPanda Notifier Plugin 1.4.0 and earlier does not mask the BigPanda API key on the global configuration form, increasing the potential for attackers… |
CVE-2022-26390 | Medium | 4.2 | 2022-09-09 | The Baxter Spectrum Wireless Battery Module (WBM) stores network credentials and PHI (only applicable to Spectrum IQ pumps using auto programming) in unencrypt… |
CVE-2022-37857 | High | 7.5 | 2022-09-08 | bilde2910 Hauk v1.6.1 requires a hardcoded password which by default is blank. This hardcoded password is hashed but stored within the config.php file server-s… |
CVE-2021-36782 | Critical | 9.9 | 2022-09-07 | A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners, Project Member… |
CVE-2022-22069 | High | 7.7 | 2022-09-02 | Devices with keyprotect off may store unencrypted keybox in RPMB and cause cryptographic issue in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity… |
CVE-2022-2739 | Medium | 5.3 | 2022-09-01 | The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included an incorrect version of podman missing the fix for… |
CVE-2021-39009 | Medium | 5.5 | 2022-09-01 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 stores user credentials in plain clear text which can be read by a local privileged user. IBM X-Force ID: 21355… |
CVE-2021-3585 | Medium | 5.5 | 2022-08-26 | A flaw was found in openstack-tripleo-heat-templates. Plain passwords from RHSM exist in the logs during OSP13 deployment with subscription-manager. |
CVE-2022-2569 | Medium | 5.5 | 2022-08-24 | The affected device stores sensitive information in cleartext, which may allow an authenticated user to access session data stored in the OAuth database belong… |
CVE-2022-2813 | Medium | 4.3 | 2022-08-15 | A vulnerability, which was classified as problematic, was found in SourceCodester Guest Management System. Affected is an unknown function. The manipulation le… |
CVE-2022-33928 | Medium | 6.4 | 2022-08-10 | Dell Wyse Management Suite 3.6.1 and below contains an Plain-text Password Storage Vulnerability in UI. An attacker with low privileges could potentially explo… |
CVE-2022-29090 | High | 8.5 | 2022-08-10 | Dell Wyse Management Suite 3.6.1 and below contains a Sensitive Data Exposure vulnerability. A low privileged malicious user could potentially exploit this vul… |
CVE-2022-34924 | High | 7.5 | 2022-08-02 | Lanling OA Landray Office Automation (OA) internal patch number #133383/#137780 contains an arbitrary file read vulnerability via the component /sys/ui/extend/… |
CVE-2022-31205 | High | 7.5 | 2022-07-26 | In Omron CS series, CJ series, and CP series PLCs through 2022-05-18, the password for access to the Web UI is stored in memory area D1449...D1452 and can be r… |
CVE-2022-30275 | High | 7.5 | 2022-07-26 | The Motorola MOSCAD Toolbox software through 2022-05-02 relies on a cleartext password. It utilizes an MDLC driver to communicate with MOSCAD/ACE RTUs for engi… |
CVE-2022-24660 | High | 7.5 | 2022-07-20 | The debug interface of Goldshell ASIC Miners v2.2.1 and below was discovered to be exposed publicly on the web interface, allowing attackers to access password… |
CVE-2022-30626 | Medium | 6.3 | 2022-07-18 | Browsing the path: http://ip/wifi_ap_pata_get.cmd, will show in the name of the existing access point on the component, and a password in clear text. |
CVE-2022-20219 | Medium | 5.5 | 2022-07-13 | In multiple functions of StorageManagerService.java and UserManagerService.java, there is a possible way to leave user's directories unencrypted due to a logic… |
CVE-2022-22031 | High | 7.8 | 2022-07-12 | Windows Credential Guard Domain-joined Public Key Elevation of Privilege Vulnerability |
CVE-2022-27549 | Medium | 4.0 | 2022-07-06 | HCL Launch may store certain data for recurring activities in a plain text format. |
CVE-2022-22367 | Medium | 5.5 | 2022-07-01 | IBM UrbanCode Deploy (UCD) 6.2.7.15, 7.0.5.10, 7.1.2.6, and 7.2.2.1 could disclose sensitive database information to a local user in plain text. IBM X-Force ID… |
CVE-2022-22366 | Medium | 4.4 | 2022-07-01 | IBM UrbanCode Deploy (UCD) 6.2.7.15, 7.0.5.10, 7.1.2.6, and 7.2.2.1 stores user credentials in plain clear text which can be read by a local user. IBM X-Force… |
CVE-2022-22478 | Medium | 5.5 | 2022-06-30 | IBM Spectrum Protect Client 8.1.0.0 through 8.1.14.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 225886. |
CVE-2021-41639 | Medium | 5.5 | 2022-06-24 | MELAG FTP Server 2.2.0.4 stores unencrpyted passwords of FTP users in a local configuration file. |
CVE-2021-45025 | High | 7.5 | 2022-06-17 | ASG technologies ( A Rocket Software Company) ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to Cleartext Storage of Sensitive Informati… |
CVE-2017-20040 | Medium | 5.9 | 2022-06-11 | A vulnerability was found in SICUNET Access Controller 0.32-05z. It has been declared as problematic. This vulnerability affects unknown code of the component… |
CVE-2022-29620 | Medium | 6.5 | 2022-06-07 | FileZilla v3.59.0 allows attackers to obtain cleartext passwords of connected SSH or FTP servers via a memory dump.- NOTE: the vendor does not consider this a… |
CVE-2022-31004 | High | 7.5 | 2022-06-02 | CVEProject/cve-services is an open source project used to operate the CVE services API. A conditional in 'data.js' has potential for production secrets to be w… |
CVE-2022-23236 | Medium | 4.4 | 2022-06-02 | E-Series SANtricity OS Controller Software versions 11.40 through 11.70.2 store the LDAP BIND password in plaintext within a file accessible only to privileged… |
CVE-2022-22484 | Medium | 5.5 | 2022-05-17 | IBM Spectrum Protect Operations Center 8.1.12 and 8.1.13 could allow a local attacker to obtain sensitive information, caused by plain text user account passwo… |
CVE-2022-28214 | High | 7.8 | 2022-05-11 | During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are being exposed in Sysmon… |
CVE-2022-29868 | Medium | 5.5 | 2022-05-09 | 1Password for Mac 7.2.4 through 7.9.x before 7.9.3 is vulnerable to a process validation bypass. Malicious software running on the same computer can exfiltrate… |
CVE-2022-28162 | Low | 3.3 | 2022-05-09 | Brocade SANnav before version SANnav 2.2.0 logs the REST API Authentication token in plain text. |