CWE-312 · Cleartext Storage of Sensitive Information (page 7)
Page 7 of 9 — CVEs classified under CWE-312, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-30997 | High | 7.5 | 2021-08-24 | A S/MIME issue existed in the handling of encrypted email. This issue was addressed by not automatically loading some MIME parts. This issue is fixed in iOS 15… |
CVE-2021-31820 | High | 7.5 | 2021-08-18 | In Octopus Server after version 2018.8.2 if the Octopus Server Web Request Proxy is configured with authentication, the password is shown in plaintext in the U… |
CVE-2020-36473 | Low | 3.7 | 2021-08-14 | UCWeb UC 12.12.3.1219 through 12.12.3.1226 uses cleartext HTTP, and thus man-in-the-middle attackers can discover visited URLs. |
CVE-2020-18759 | High | 7.5 | 2021-08-13 | An information disclosure vulnerability exists in the EPA protocol of Dut Computer Control Engineering Co.'s PLC MAC1100. |
CVE-2021-37548 | High | 7.5 | 2021-08-06 | In JetBrains TeamCity before 2021.1, passwords in cleartext sometimes could be stored in VCS. |
CVE-2021-33325 | Medium | 4.9 | 2021-08-03 | The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19, and 7.2 before fix pack 7, user… |
CVE-2021-33323 | High | 7.5 | 2021-08-03 | The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, autosaves form values… |
CVE-2021-37468 | Low | 3.3 | 2021-07-25 | NCH Reflect CRM 3.01 allows local users to discover cleartext user account information by reading the configuration files. |
CVE-2021-37452 | Medium | 5.5 | 2021-07-25 | NCH Quorum v2.03 and earlier allows local users to discover cleartext login information relating to users by reading the local .dat configuration files. |
CVE-2021-31581 | High | 7.9 | 2021-07-22 | The restricted shell provided by Akkadian Provisioning Manager Engine (PME) can be escaped by abusing the 'Edit MySQL Configuration' command. This command laun… |
CVE-2020-22741 | High | 7.5 | 2021-07-19 | An issue was discovered in Xuperchain 3.6.0 that allows for attackers to recover any arbitrary users' private key after obtaining the partial signature in mult… |
CVE-2020-4980 | Medium | 6.5 | 2021-07-16 | IBM QRadar SIEM 7.3 and 7.4 uses less secure methods for protecting data in transit between hosts when encrypt host connections is not enabled as well as data… |
CVE-2021-20510 | Medium | 4.4 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 198299 |
CVE-2020-12731 | High | 7.5 | 2021-07-15 | The MagicMotion Flamingo 2 application for Android stores data on an sdcard under com.vt.magicmotion/files/Pictures, whence it can be read by other application… |
CVE-2021-31817 | High | 7.5 | 2021-07-08 | When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written to the OctopusServ… |
CVE-2021-31816 | High | 7.5 | 2021-07-08 | When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written to the OctopusServ… |
CVE-2021-36158 | Medium | 5.9 | 2021-07-05 | In the xrdp package (in branches through 3.14) for Alpine Linux, RDP sessions are vulnerable to man-in-the-middle attacks because pre-generated RSA certificate… |
CVE-2021-29481 | Medium | 6.5 | 2021-06-29 | Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the default configuration of client side sessions results in unencrypted, but s… |
CVE-2021-29956 | Medium | 4.3 | 2021-06-24 | OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted on the user's local disk. The master pass… |
CVE-2021-29954 | Critical | 9.8 | 2021-06-24 | Proxy functionality built into Hubs Cloud’s Reticulum software allowed access to internal URLs, including the metadata service. This vulnerability affects Hubs… |
CVE-2021-29950 | High | 7.5 | 2021-06-24 | Thunderbird unprotects a secret OpenPGP key prior to using it for a decryption, signing or key import task. If the task runs into a failure, the secret key may… |
CVE-2021-27487 | Medium | 5.5 | 2021-06-16 | ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products contain credentials stored in plaintext. This could allow an attacker to gain access to sen… |
CVE-2021-28858 | Medium | 5.5 | 2021-06-15 | TP-Link's TL-WPA4220 4.0.2 Build 20180308 Rel.37064 does not use SSL by default. Attacker on the local network can monitor traffic and capture the cookie and o… |
CVE-2021-23211 | Medium | 6.0 | 2021-06-11 | Cleartext Storage of Sensitive Information in Memory vulnerability in Gallagher Command Centre Server allows Cloud end-to-end encryption key to be discoverable… |
CVE-2021-23182 | Medium | 6.0 | 2021-06-11 | Cleartext Storage of Sensitive Information in Memory vulnerability in Gallagher Command Centre Server allows OSDP reader master keys to be discoverable in serv… |
CVE-2021-32942 | Medium | 6.6 | 2021-06-09 | The vulnerability could expose cleartext credentials from AVEVA InTouch Runtime 2020 R2 and all prior versions (WindowViewer) if an authorized, privileged user… |
CVE-2020-15384 | Medium | 5.3 | 2021-06-09 | Brocade SANNav before version 2.1.1 contains an information disclosure vulnerability. Successful exploitation of internal server information in the initial log… |
CVE-2020-29324 | High | 7.5 | 2021-06-04 | The DLink Router DIR-895L MFC v1.21b05 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an unauthentica… |
CVE-2021-31855 | Medium | 6.5 | 2021-06-02 | KDE Messagelib through 5.17.0 reveals cleartext of encrypted messages in some situations. Deleting an attachment of a decrypted encrypted message stored on a r… |
CVE-2021-21734 | Medium | 6.5 | 2021-05-28 | Some PON MDU devices of ZTE stored sensitive information in plaintext, and users with login authority can obtain it by inputing command. This affects: ZTE PON… |
CVE-2018-16498 | Medium | 5.5 | 2021-05-26 | In Versa Director, the unencrypted backup files stored on the Versa deployment contain credentials stored within configuration files. These credentials are for… |
CVE-2021-29683 | Medium | 6.5 | 2021-05-20 | IBM Security Identity Manager 7.0.2 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID: 199998. |
CVE-2021-25644 | High | 7.5 | 2021-05-19 | An issue was discovered in Couchbase Server 5.x and 6.x through 6.6.1 and 7.0.0 Beta. Incorrect commands to the REST API can result in leaked authentication in… |
CVE-2021-30183 | High | 7.5 | 2021-05-14 | Cleartext storage of sensitive information in multiple versions of Octopus Server where in certain situations when running import or export processes, the pass… |
CVE-2021-20995 | Medium | 5.3 | 2021-05-13 | In multiple managed switches by WAGO in different versions the webserver cookies of the web based UI contain user credentials. |
CVE-2021-25645 | Medium | 4.4 | 2021-05-10 | An issue was discovered in Couchbase Server before 6.0.5, 6.1.x through 6.5.x before 6.5.2, and 6.6.x before 6.6.1. An internal user with administrator privile… |
CVE-2021-22206 | Medium | 6.8 | 2021-05-06 | An issue has been discovered in GitLab affecting all versions starting from 11.6. Pull mirror credentials are exposed that allows other maintainers to be able… |
CVE-2021-21547 | Medium | 6.4 | 2021-04-30 | Dell EMC Unity, UnityVSA, and Unity XT versions prior to 5.0.7.0.5.008 contain a plain-text password storage vulnerability when the Dell Upgrade Readiness Util… |
CVE-2020-22783 | Medium | 6.5 | 2021-04-28 | Etherpad <1.8.3 stored passwords used by users insecurely in the database and in log files. This affects every database backend supported by Etherpad. |
CVE-2021-31791 | High | 7.5 | 2021-04-23 | In Hardware Sentry KM before 10.0.01 for BMC PATROL, a cleartext password may be discovered after a failure or timeout of a command. |
CVE-2021-25898 | High | 7.5 | 2021-04-23 | An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. Passwords are stored in unencrypted source-code text files. This was noted when acc… |
CVE-2021-31539 | Medium | 5.5 | 2021-04-23 | Wowza Streaming Engine before 4.8.8.01 (in a default installation) has cleartext passwords stored in the conf/admin.password file. A regular local user is able… |
CVE-2021-3473 | Medium | 4.5 | 2021-04-13 | An internal product security audit of Lenovo XClarity Controller (XCC) discovered that the XCC configuration backup/restore password may be written to an inter… |
CVE-2021-25692 | Medium | 4.6 | 2021-04-06 | Sensitive smart card data is logged in default INFO logs by Teradici's PCoIP Connection Manager and Security Gateway prior to version 21.01.3. |
CVE-2020-11924 | Medium | 5.5 | 2021-04-02 | An issue was discovered in WiZ Colors A60 1.14.0. Wi-Fi credentials are stored in cleartext in flash memory, which presents an information-disclosure risk for… |
CVE-2020-11923 | Medium | 5.5 | 2021-04-02 | An issue was discovered in WiZ Colors A60 1.14.0. API credentials are locally logged. |
CVE-2020-4944 | Medium | 5.5 | 2021-03-30 | IBM UrbanCode Deploy (UCD) 7.0.3.0, 7.0.4.0, 7.0.5.3, 7.0.5.4, 7.1.0.0, 7.1.1.0, 7.1.1.1, and 7.1.1.2, stores keystore passwords in plain text after a manual e… |
CVE-2020-4884 | Medium | 5.5 | 2021-03-30 | IBM UrbanCode Deploy (UCD) 6.2.7.9, 7.0.5.4, and 7.1.1.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 1909… |
CVE-2021-28937 | High | 7.5 | 2021-03-29 | The /password.html page of the Web management interface of the Acexy Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) contains the administrator account password… |
CVE-2021-22194 | Medium | 5.7 | 2021-03-26 | In all versions of GitLab, marshalled session keys were being stored in Redis. |
CVE-2021-21339 | Medium | 5.9 | 2021-03-23 | TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 user session identifi… |
CVE-2020-35455 | High | 7.8 | 2021-03-17 | The Taidii Diibear Android application 2.4.0 and all its derivatives allow attackers to obtain user credentials from Shared Preferences and the SQLite database… |
CVE-2020-35454 | Medium | 6.8 | 2021-03-17 | The Taidii Diibear Android application 2.4.0 and all its derivatives allow attackers to obtain user credentials from an Android backup because of insecure appl… |
CVE-2019-18630 | High | 7.5 | 2021-03-04 | On Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.099.28200, porti… |
CVE-2021-26595 | Medium | 5.3 | 2021-02-23 | In Directus 8.x through 8.8.1, an attacker can learn sensitive information such as the version of the CMS, the PHP version used by the site, and the name of th… |
CVE-2021-23827 | Medium | 5.5 | 2021-02-23 | Keybase Desktop Client before 5.6.0 on Windows and macOS, and before 5.6.1 on Linux, allows an attacker to obtain potentially sensitive media (such as private… |
CVE-2021-27549 | Medium | 5.3 | 2021-02-22 | Genymotion Desktop through 3.2.0 leaks the host's clipboard data to the Android application by default. NOTE: the vendor's position is that this is intended be… |
CVE-2020-36248 | Low | 3.9 | 2021-02-19 | The ownCloud application before 2.15 for Android allows attackers to use adb to include a PIN preferences value in a backup archive, and consequently bypass th… |
CVE-2021-27233 | Medium | 4.9 | 2021-02-16 | An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8. On the admin portal of the web application, password information for external systems is visibl… |
CVE-2021-27210 | Medium | 6.5 | 2021-02-13 | TP-Link Archer C5v 1.7_181221 devices allows remote attackers to retrieve cleartext credentials via [USER_CFG#0,0,0,0,0,0#0,0,0,0,0,0]0,0 to the /cgi?1&5 URI. |
CVE-2021-20408 | Medium | 5.5 | 2021-02-12 | IBM Security Verify Information Queue 1.0.6 and 1.0.7 could disclose highly sensitive information to a local user due to inproper storage of a plaintext crypto… |
CVE-2021-20407 | Medium | 5.3 | 2021-02-12 | IBM Security Verify Information Queue 1.0.6 and 1.0.7 discloses sensitive information in source code that could be used in further attacks against the system… |
CVE-2021-27205 | Medium | 5.5 | 2021-02-12 | Telegram before 7.4 (212543) Stable on macOS stores the local copy of self-destructed messages in a sandbox path, leading to sensitive information disclosure. |
CVE-2021-27204 | Medium | 5.5 | 2021-02-12 | Telegram before 7.4 (212543) Stable on macOS stores the local passcode in cleartext, leading to information disclosure. |
CVE-2021-27178 | High | 7.5 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. Some passwords are stored in cleartext in nvram. |
CVE-2021-27176 | High | 7.5 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. wifictl_5g.cfg has cleartext passwords and 0644 permissions. |
CVE-2021-27175 | High | 7.5 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. wifictl_2g.cfg has cleartext passwords and 0644 permissions. |
CVE-2021-27174 | High | 7.5 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. wifi_custom.cfg has cleartext passwords and 0644 permissions. |
CVE-2021-27140 | High | 7.5 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to find passwords and authentication cookies stored in cleartext in the web… |
CVE-2021-0337 | High | 7.8 | 2021-02-10 | In moveInMediaStore of FileSystemProvider.java, there is a possible file exposure due to stale metadata. This could lead to local escalation of privilege with… |
CVE-2021-23878 | High | 7.3 | 2021-02-10 | Clear text storage of sensitive Information in memory vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update allows a… |
CVE-2021-26550 | Medium | 5.5 | 2021-02-09 | An issue was discovered in SmartFoxServer 2.17.0. Cleartext password disclosure can occur via /config/server.xml. |
CVE-2021-20358 | Medium | 6.5 | 2021-02-08 | IBM Cloud Pak for Automation 20.0.3, 20.0.2-IF002 stores potentially sensitive information in clear text in API connection log files. This information could be… |
CVE-2021-22300 | Medium | 4.1 | 2021-02-06 | There is an information leak vulnerability in eCNS280_TD versions V100R005C00 and V100R005C10. A command does not have timeout exit mechanism. Temporary file c… |
CVE-2020-4189 | Medium | 4.3 | 2021-01-27 | IBM Security Guardium 11.2 discloses sensitive information in the response headers that could be used in further attacks against the system. IBM X-Force ID: 17… |
CVE-2020-29001 | High | 7.2 | 2021-01-26 | An issue was discovered on Geeni GNC-CW028 Camera 2.7.2, Geeni GNC-CW025 Doorbell 2.9.5, Merkury MI-CW024 Doorbell 2.9.6, and Merkury MI-CW017 Camera 2.9.6 dev… |
CVE-2021-1265 | Medium | 6.5 | 2021-01-20 | A vulnerability in the configuration archive functionality of Cisco DNA Center could allow any privilege-level authenticated, remote attacker to obtain the ful… |
CVE-2020-4604 | Medium | 4.4 | 2021-01-13 | IBM Security Guardium Insights 2.0.2 stores user credentials in plain in clear text which can be read by a local privileged user. IBM X-Force ID: 184861. |
CVE-2019-4687 | Medium | 5.3 | 2021-01-13 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized par… |
CVE-2020-5018 | High | 7.5 | 2021-01-08 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may include sensitive information in its URLs increasing the risk of such information being caputured by an att… |
CVE-2020-25678 | Medium | 4.4 | 2021-01-08 | A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for graf… |
CVE-2020-5805 | High | 8.8 | 2021-01-08 | In Marvell QConvergeConsole GUI <= 5.5.0.74, credentials are stored in cleartext in tomcat-users.xml. OS-level users on the QCC host who are not authorized to… |
CVE-2020-24577 | High | 7.5 | 2021-01-08 | An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. The One Touch application discloses sensitive information, such… |
CVE-2020-29502 | High | 7.5 | 2021-01-05 | Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore X & T environments. A locally authenticat… |
CVE-2020-29501 | Medium | 6.4 | 2021-01-05 | Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore X & T environments. A locally authenticat… |
CVE-2020-29500 | High | 7.5 | 2021-01-05 | Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore T environments. A locally authenticated a… |
CVE-2020-29489 | Medium | 6.4 | 2021-01-05 | Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contains a plain-text password storage vulnerability. A user credentials (including the… |
CVE-2020-23249 | Medium | 4.7 | 2021-01-05 | GigaVUE-OS (GVOS) 5.4 - 5.9 stores a Redis database password in plaintext. |
CVE-2018-19941 | High | 7.5 | 2020-12-31 | A vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows an attacker to access sensitive information stored in cleartext i… |
CVE-2020-26288 | High | 7.7 | 2020-12-30 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. It is an npm package "parse-server". In Parse Server be… |
CVE-2020-13473 | Medium | 5.5 | 2020-12-28 | NCH Express Accounts 8.24 and earlier allows local users to discover the cleartext password by reading the configuration file. |
CVE-2020-29550 | High | 7.5 | 2020-12-23 | An issue was discovered in URVE Build 24.03.2020. The password of an integration user account (used for the connection of the MS Office 365 Integration Service… |
CVE-2020-35658 | Medium | 5.3 | 2020-12-23 | SpamTitan before 7.09 allows attackers to tamper with backups, because backups are not encrypted. |
CVE-2020-4843 | Medium | 4.3 | 2020-12-21 | IBM Security Secret Server 10.6 stores potentially sensitive information in config files that could be read by an authenticated user. IBM X-Force ID: 190048. |
CVE-2020-17511 | Medium | 6.5 | 2020-12-14 | In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plain text in the Log table in Airflow Metadatase. Sa… |
CVE-2019-4738 | Medium | 6.5 | 2020-12-10 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 and 6.0.0.0 through 6.0.3.1 discloses sensitive information to an authenticated user from… |
CVE-2020-26816 | Medium | 4.5 | 2020-12-09 | SAP AS JAVA (Key Storage Service), versions - 7.10, 7.11, 7.20 ,7.30, 7.31, 7.40, 7.50, has the key material which is stored in the SAP NetWeaver AS Java Key S… |
CVE-2020-25677 | Medium | 5.5 | 2020-12-08 | A flaw was found in Ceph-ansible v4.0.41 where it creates an /etc/ceph/iscsi-gateway.conf with insecure default permissions. This flaw allows any user on the s… |
CVE-2020-26228 | High | 8.1 | 2020-11-23 | TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 user session identifiers were stored in cleartext… |
CVE-2020-28917 | Medium | 6.5 | 2020-11-18 | An issue was discovered in the view_statistics (aka View frontend statistics) extension before 2.0.1 for TYPO3. It saves all GET and POST data of TYPO3 fronten… |