CWE-312 · Cleartext Storage of Sensitive Information (page 7)
Page 7 of 9 — CVEs classified under CWE-312, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-11923 | Medium | 5.5 | 2021-04-02 | An issue was discovered in WiZ Colors A60 1.14.0. API credentials are locally logged. |
CVE-2020-4944 | Medium | 5.5 | 2021-03-30 | IBM UrbanCode Deploy (UCD) 7.0.3.0, 7.0.4.0, 7.0.5.3, 7.0.5.4, 7.1.0.0, 7.1.1.0, 7.1.1.1, and 7.1.1.2, stores keystore passwords in plain text after a manual e… |
CVE-2020-4884 | Medium | 5.5 | 2021-03-30 | IBM UrbanCode Deploy (UCD) 6.2.7.9, 7.0.5.4, and 7.1.1.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 1909… |
CVE-2021-28937 | High | 7.5 | 2021-03-29 | The /password.html page of the Web management interface of the Acexy Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) contains the administrator account password… |
CVE-2021-22194 | Medium | 5.7 | 2021-03-26 | In all versions of GitLab, marshalled session keys were being stored in Redis. |
CVE-2021-21339 | Medium | 5.9 | 2021-03-23 | TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 user session identifi… |
CVE-2020-35455 | High | 7.8 | 2021-03-17 | The Taidii Diibear Android application 2.4.0 and all its derivatives allow attackers to obtain user credentials from Shared Preferences and the SQLite database… |
CVE-2020-35454 | Medium | 6.8 | 2021-03-17 | The Taidii Diibear Android application 2.4.0 and all its derivatives allow attackers to obtain user credentials from an Android backup because of insecure appl… |
CVE-2019-18630 | High | 7.5 | 2021-03-04 | On Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.099.28200, porti… |
CVE-2021-26595 | Medium | 5.3 | 2021-02-23 | In Directus 8.x through 8.8.1, an attacker can learn sensitive information such as the version of the CMS, the PHP version used by the site, and the name of th… |
CVE-2021-23827 | Medium | 5.5 | 2021-02-23 | Keybase Desktop Client before 5.6.0 on Windows and macOS, and before 5.6.1 on Linux, allows an attacker to obtain potentially sensitive media (such as private… |
CVE-2021-27549 | Medium | 5.3 | 2021-02-22 | Genymotion Desktop through 3.2.0 leaks the host's clipboard data to the Android application by default. NOTE: the vendor's position is that this is intended be… |
CVE-2020-36248 | Low | 3.9 | 2021-02-19 | The ownCloud application before 2.15 for Android allows attackers to use adb to include a PIN preferences value in a backup archive, and consequently bypass th… |
CVE-2021-27233 | Medium | 4.9 | 2021-02-16 | An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8. On the admin portal of the web application, password information for external systems is visibl… |
CVE-2021-27210 | Medium | 6.5 | 2021-02-13 | TP-Link Archer C5v 1.7_181221 devices allows remote attackers to retrieve cleartext credentials via [USER_CFG#0,0,0,0,0,0#0,0,0,0,0,0]0,0 to the /cgi?1&5 URI. |
CVE-2021-20408 | Medium | 5.5 | 2021-02-12 | IBM Security Verify Information Queue 1.0.6 and 1.0.7 could disclose highly sensitive information to a local user due to inproper storage of a plaintext crypto… |
CVE-2021-20407 | Medium | 5.3 | 2021-02-12 | IBM Security Verify Information Queue 1.0.6 and 1.0.7 discloses sensitive information in source code that could be used in further attacks against the system… |
CVE-2021-27205 | Medium | 5.5 | 2021-02-12 | Telegram before 7.4 (212543) Stable on macOS stores the local copy of self-destructed messages in a sandbox path, leading to sensitive information disclosure. |
CVE-2021-27204 | Medium | 5.5 | 2021-02-12 | Telegram before 7.4 (212543) Stable on macOS stores the local passcode in cleartext, leading to information disclosure. |
CVE-2021-27178 | High | 7.5 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. Some passwords are stored in cleartext in nvram. |
CVE-2021-27176 | High | 7.5 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. wifictl_5g.cfg has cleartext passwords and 0644 permissions. |
CVE-2021-27175 | High | 7.5 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. wifictl_2g.cfg has cleartext passwords and 0644 permissions. |
CVE-2021-27174 | High | 7.5 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. wifi_custom.cfg has cleartext passwords and 0644 permissions. |
CVE-2021-27140 | High | 7.5 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to find passwords and authentication cookies stored in cleartext in the web… |
CVE-2021-0337 | High | 7.8 | 2021-02-10 | In moveInMediaStore of FileSystemProvider.java, there is a possible file exposure due to stale metadata. This could lead to local escalation of privilege with… |
CVE-2021-23878 | High | 7.3 | 2021-02-10 | Clear text storage of sensitive Information in memory vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update allows a… |
CVE-2021-26550 | Medium | 5.5 | 2021-02-09 | An issue was discovered in SmartFoxServer 2.17.0. Cleartext password disclosure can occur via /config/server.xml. |
CVE-2021-20358 | Medium | 6.5 | 2021-02-08 | IBM Cloud Pak for Automation 20.0.3, 20.0.2-IF002 stores potentially sensitive information in clear text in API connection log files. This information could be… |
CVE-2021-22300 | Medium | 4.1 | 2021-02-06 | There is an information leak vulnerability in eCNS280_TD versions V100R005C00 and V100R005C10. A command does not have timeout exit mechanism. Temporary file c… |
CVE-2020-4189 | Medium | 4.3 | 2021-01-27 | IBM Security Guardium 11.2 discloses sensitive information in the response headers that could be used in further attacks against the system. IBM X-Force ID: 17… |
CVE-2020-29001 | High | 7.2 | 2021-01-26 | An issue was discovered on Geeni GNC-CW028 Camera 2.7.2, Geeni GNC-CW025 Doorbell 2.9.5, Merkury MI-CW024 Doorbell 2.9.6, and Merkury MI-CW017 Camera 2.9.6 dev… |
CVE-2021-1265 | Medium | 6.5 | 2021-01-20 | A vulnerability in the configuration archive functionality of Cisco DNA Center could allow any privilege-level authenticated, remote attacker to obtain the ful… |
CVE-2020-4604 | Medium | 4.4 | 2021-01-13 | IBM Security Guardium Insights 2.0.2 stores user credentials in plain in clear text which can be read by a local privileged user. IBM X-Force ID: 184861. |
CVE-2019-4687 | Medium | 5.3 | 2021-01-13 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized par… |
CVE-2020-5018 | High | 7.5 | 2021-01-08 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may include sensitive information in its URLs increasing the risk of such information being caputured by an att… |
CVE-2020-25678 | Medium | 4.4 | 2021-01-08 | A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for graf… |
CVE-2020-5805 | High | 8.8 | 2021-01-08 | In Marvell QConvergeConsole GUI <= 5.5.0.74, credentials are stored in cleartext in tomcat-users.xml. OS-level users on the QCC host who are not authorized to… |
CVE-2020-24577 | High | 7.5 | 2021-01-08 | An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. The One Touch application discloses sensitive information, such… |
CVE-2020-29502 | High | 7.5 | 2021-01-05 | Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore X & T environments. A locally authenticat… |
CVE-2020-29501 | Medium | 6.4 | 2021-01-05 | Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore X & T environments. A locally authenticat… |
CVE-2020-29500 | High | 7.5 | 2021-01-05 | Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore T environments. A locally authenticated a… |
CVE-2020-29489 | Medium | 6.4 | 2021-01-05 | Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contains a plain-text password storage vulnerability. A user credentials (including the… |
CVE-2020-23249 | Medium | 4.7 | 2021-01-05 | GigaVUE-OS (GVOS) 5.4 - 5.9 stores a Redis database password in plaintext. |
CVE-2018-19941 | High | 7.5 | 2020-12-31 | A vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows an attacker to access sensitive information stored in cleartext i… |
CVE-2020-26288 | High | 7.7 | 2020-12-30 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. It is an npm package "parse-server". In Parse Server be… |
CVE-2020-13473 | Medium | 5.5 | 2020-12-28 | NCH Express Accounts 8.24 and earlier allows local users to discover the cleartext password by reading the configuration file. |
CVE-2020-29550 | High | 7.5 | 2020-12-23 | An issue was discovered in URVE Build 24.03.2020. The password of an integration user account (used for the connection of the MS Office 365 Integration Service… |
CVE-2020-35658 | Medium | 5.3 | 2020-12-23 | SpamTitan before 7.09 allows attackers to tamper with backups, because backups are not encrypted. |
CVE-2020-4843 | Medium | 4.3 | 2020-12-21 | IBM Security Secret Server 10.6 stores potentially sensitive information in config files that could be read by an authenticated user. IBM X-Force ID: 190048. |
CVE-2020-17511 | Medium | 6.5 | 2020-12-14 | In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plain text in the Log table in Airflow Metadatase. Sa… |
CVE-2019-4738 | Medium | 6.5 | 2020-12-10 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 and 6.0.0.0 through 6.0.3.1 discloses sensitive information to an authenticated user from… |
CVE-2020-26816 | Medium | 4.5 | 2020-12-09 | SAP AS JAVA (Key Storage Service), versions - 7.10, 7.11, 7.20 ,7.30, 7.31, 7.40, 7.50, has the key material which is stored in the SAP NetWeaver AS Java Key S… |
CVE-2020-25677 | Medium | 5.5 | 2020-12-08 | A flaw was found in Ceph-ansible v4.0.41 where it creates an /etc/ceph/iscsi-gateway.conf with insecure default permissions. This flaw allows any user on the s… |
CVE-2020-26228 | High | 8.1 | 2020-11-23 | TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 user session identifiers were stored in cleartext… |
CVE-2020-28917 | Medium | 6.5 | 2020-11-18 | An issue was discovered in the view_statistics (aka View frontend statistics) extension before 2.0.1 for TYPO3. It saves all GET and POST data of TYPO3 fronten… |
CVE-2020-26551 | High | 7.5 | 2020-11-17 | An issue was discovered in Aviatrix Controller before R5.3.1151. Encrypted key values are stored in a readable file. |
CVE-2020-8276 | Medium | 5.5 | 2020-11-09 | The implementation of Brave Desktop's privacy-preserving analytics system (P3A) between 1.1 and 1.18.35 logged the timestamp of when the user last opened an in… |
CVE-2020-27986 | High | 7.5 | 2020-10-28 | SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. NOTE: reportedly, the ve… |
CVE-2020-27613 | High | 8.4 | 2020-10-21 | The installation procedure in BigBlueButton before 2.2.28 (or earlier) uses ClueCon as the FreeSWITCH password, which allows local users to achieve unintended… |
CVE-2020-6648 | Medium | 5.3 | 2020-10-21 | A cleartext storage of sensitive information vulnerability in FortiOS command line interface in versions 6.2.4 and earlier and FortiProxy 2.0.0, 1.2.9 and earl… |
CVE-2020-4619 | Medium | 6.5 | 2020-09-22 | IBM Data Risk Manager (iDNA) 2.0.6 stores user credentials in plain in clear text which can be read by an authenticated user. IBM X-Force ID: 184976. |
CVE-2020-8225 | High | 7.5 | 2020-09-18 | A cleartext storage of sensitive information in Nextcloud Desktop Client 2.6.4 gave away information about used proxies and their authentication credentials. |
CVE-2020-2274 | Medium | 5.5 | 2020-09-16 | Jenkins ElasTest Plugin 1.2.1 and earlier stores its server password unencrypted in its global configuration file on the Jenkins controller where it can be vie… |
CVE-2020-15784 | Medium | 5.3 | 2020-09-09 | A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP8). Insecure storage of sensitive information in the configuration files could… |
CVE-2020-15485 | Medium | 5.5 | 2020-08-26 | An issue was discovered on Nescomed Multipara Monitor M1000 devices. The onboard Flash memory stores data in cleartext, without integrity protection against ta… |
CVE-2020-15484 | High | 7.5 | 2020-08-26 | An issue was discovered on Nescomed Multipara Monitor M1000 devices. The internal storage of the underlying Linux system stores data in cleartext, without inte… |
CVE-2020-17495 | High | 7.5 | 2020-08-11 | django-celery-results through 1.2.1 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may co… |
CVE-2020-7517 | Medium | 5.5 | 2020-07-23 | A CWE-312: Cleartext Storage of Sensitive Information vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow an attacker to read… |
CVE-2020-7516 | High | 7.8 | 2020-07-23 | A CWE-316: Cleartext Storage of Sensitive Information in Memory vulnerability exists in Easergy Builder V1.4.7.2 and prior which could allow an attacker access… |
CVE-2020-4369 | Medium | 5.5 | 2020-07-22 | IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 stores highly sensitive information in cleartext that could be obtained by a user. IBM X-Force ID: 179004. |
CVE-2020-4095 | Medium | 6.0 | 2020-07-16 | "BigFix Platform is storing clear text credentials within the system's memory. An attacker who is able to gain administrative privileges can use a program to c… |
CVE-2020-15105 | Medium | 5.4 | 2020-07-10 | Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the sess… |
CVE-2020-5899 | High | 7.8 | 2020-07-01 | In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted and stored in the database in plain text, which allows an at… |
CVE-2019-4676 | High | 7.8 | 2020-07-01 | IBM Security Identity Manager Virtual Appliance 7.0.2 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 171512. |
CVE-2020-15085 | Medium | 6.9 | 2020-06-30 | In Saleor Storefront before version 2.10.3, request data used to authenticate customers was inadvertently cached in the browser's local storage mechanism, incl… |
CVE-2020-12032 | Critical | 9.1 | 2020-06-29 | Baxter ExactaMix EM 2400 Versions 1.10, 1.11 and ExactaMix EM1200 Versions 1.1, 1.2 systems store device data with sensitive information in an unencrypted data… |
CVE-2019-18254 | Medium | 4.6 | 2020-06-29 | BIOTRONIK CardioMessenger II, The affected products do not encrypt sensitive information while at rest. An attacker with physical access to the CardioMessenger… |
CVE-2020-10727 | Medium | 5.5 | 2020-06-26 | A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis… |
CVE-2020-14017 | High | 7.5 | 2020-06-24 | An issue was discovered in Navigate CMS 2.9 r1433. Sessions, as well as associated information such as CSRF tokens, are stored in cleartext files in the direct… |
CVE-2020-10273 | High | 7.5 | 2020-06-24 | MiR controllers across firmware versions 2.8.1.1 and before do not encrypt or protect in any way the intellectual property artifacts installed in the robots. T… |
CVE-2020-13637 | High | 7.5 | 2020-06-17 | An issue was discovered in the stashcat app through 3.9.2 for macOS, Windows, Android, iOS, and possibly other platforms. It stores the client_key, the device_… |
CVE-2019-17655 | Medium | 5.3 | 2020-06-16 | A cleartext storage in a file or on disk (CWE-313) vulnerability in FortiOS SSL VPN 6.2.0 through 6.2.2, 6.0.9 and earlier and FortiProxy 2.0.0, 1.2.9 and earl… |
CVE-2020-7513 | High | 7.5 | 2020-06-16 | A CWE-312: Cleartext Storage of Sensitive Information vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to… |
CVE-2020-9462 | Medium | 4.3 | 2020-06-04 | An issue was discovered in all Athom Homey and Homey Pro devices up to the current version 4.2.0. An attacker within RF range can obtain a cleartext copy of th… |
CVE-2020-13783 | High | 7.5 | 2020-06-03 | D-Link DIR-865L Ax 1.20B01 Beta devices have Cleartext Storage of Sensitive Information. |
CVE-2020-9045 | Critical | 9.9 | 2020-05-21 | During installation or upgrade to Software House C•CURE 9000 v2.70 and American Dynamics victor Video Management System v5.2, the credentials of the user used… |
CVE-2020-12801 | Medium | 5.3 | 2020-05-18 | If LibreOffice has an encrypted document open and crashes, that document is auto-saved encrypted. On restart, LibreOffice offers to restore the document and pr… |
CVE-2020-12859 | Medium | 5.3 | 2020-05-18 | Unnecessary fields in the OpenTrace/BlueTrace protocol in COVIDSafe through v1.0.17 allow a remote attacker to identify a device model by observing cleartext p… |
CVE-2019-13021 | Medium | 6.5 | 2020-05-14 | The administrative passwords for all versions of Bond JetSelect are stored within an unprotected file on the filesystem, rather than encrypted within the MySQL… |
CVE-2020-10706 | Medium | 6.3 | 2020-05-12 | A flaw was found in OpenShift Container Platform where OAuth tokens are not encrypted when the encryption of data at rest is enabled. This flaw allows an attac… |
CVE-2019-18868 | Critical | 9.8 | 2020-05-07 | Blaauw Remote Kiln Control through v3.00r4 allows an unauthenticated attacker to access MySQL credentials in cleartext in /engine/db.inc, /lang/nl.bak, or /lan… |
CVE-2020-11415 | Medium | 4.9 | 2020-04-27 | An issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.17 and 3.x before 3.22.1. Admin users can retrieve the LDAP server system username… |
CVE-2020-2177 | Medium | 4.3 | 2020-04-16 | Jenkins Copr Plugin 0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extende… |
CVE-2020-11826 | High | 7.5 | 2020-04-16 | Users can lock their notes with a password in Memono version 3.8. Thus, users needs to know a password to read notes. However, these notes are stored in a data… |
CVE-2020-11694 | High | 7.5 | 2020-04-10 | In JetBrains PyCharm 2019.2.5 and 2019.3 on Windows, Apple Notarization Service credentials were included. This is fixed in 2019.2.6 and 2019.3.3. |
CVE-2020-10267 | High | 7.5 | 2020-04-06 | Universal Robots control box CB 3.1 across firmware versions (tested on 1.12.1, 1.12, 1.11 and 1.10) does not encrypt or protect in any way the intellectual pr… |
CVE-2020-5723 | Critical | 9.8 | 2020-03-30 | The UCM6200 series 1.0.20.22 and below stores unencrypted user passwords in an SQLite database. This could allow an attacker to retrieve all passwords and poss… |
CVE-2020-3921 | High | 8.6 | 2020-03-27 | UltraLog Express device management software stores user’s information in cleartext. Any user can obtain accounts information through a specific page. |
CVE-2019-16062 | Medium | 6.5 | 2020-03-19 | NETSAS Enigma NMS 65.0.0 and prior does not encrypt sensitive data stored within the SQL database. It is possible for an attacker to expose unencrypted sensiti… |
CVE-2019-10682 | High | 7.5 | 2020-03-18 | django-nopassword before 5.0.0 stores cleartext secrets in the database. |