CWE-312 · Cleartext Storage of Sensitive Information (page 8)
Page 8 of 9 — CVEs classified under CWE-312, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-6980 | Low | 3.3 | 2020-03-16 | Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Softw… |
CVE-2020-10532 | High | 7.5 | 2020-03-12 | The AD Helper component in WatchGuard Fireware before 5.8.5.10317 allows remote attackers to discover cleartext passwords via the /domains/list URI. |
CVE-2019-9104 | High | 7.5 | 2020-03-11 | An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices… |
CVE-2019-19291 | Medium | 5.3 | 2020-03-10 | A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0), SiNVR/SiVMS Video Server (All versions < V5.0.0). The FTP services… |
CVE-2020-2154 | Medium | 5.5 | 2020-03-09 | Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier stores its credentials in plain text in a global configuration file on the Jenkins master file s… |
CVE-2019-14886 | Medium | 6.5 | 2020-03-05 | A vulnerability was found in business-central, as shipped in rhdm-7.5.1 and rhpam-7.5.1, where encoded passwords are stored in errai_security_context. The enco… |
CVE-2020-6794 | Medium | 6.5 | 2020-03-02 | If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is becau… |
CVE-2019-18238 | High | 7.5 | 2020-02-26 | In Moxa ioLogik 2500 series firmware, Version 3.0 or lower, and IOxpress configuration utility, Version 2.3.0 or lower, sensitive information is stored in conf… |
CVE-2020-9407 | Medium | 5.3 | 2020-02-26 | IBL Online Weather before 4.3.5a allows attackers to obtain sensitive information by reading the IWEBSERVICE_JSONRPC_COOKIE cookie. |
CVE-2020-3935 | High | 7.5 | 2020-02-11 | TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, stores users’ information by cleartext in the cookie, which divulges… |
CVE-2013-2680 | High | 7.5 | 2020-02-05 | Cisco Linksys E4200 1.0.05 Build 7 devices store passwords in cleartext allowing remote attackers to obtain sensitive information. |
CVE-2020-4224 | Medium | 5.5 | 2020-02-03 | IBM StoredIQ 7.6.0.17 through 7.6.0.20 could disclose sensitive information to a local user due to data in certain directories not being encrypted when it cont… |
CVE-2020-7213 | High | 7.5 | 2020-01-21 | Parallels 13 uses cleartext HTTP as part of the update process, allowing man-in-the-middle attacks. Users of out-of-date versions are presented with a pop-up w… |
CVE-2009-5068 | High | 7.2 | 2020-01-15 | There is a file disclosure vulnerability in SMF (Simple Machines Forum) affecting versions through v2.0.3. On some configurations a SMF deployment is shared by… |
CVE-2010-3282 | Low | 3.3 | 2020-01-09 | 389 Directory Server before 1.2.7.1 (aka Red Hat Directory Server 8.2) and HP-UX Directory Server before B.08.10.03, when audit logging is enabled, logs the Di… |
CVE-2011-5247 | High | 7.5 | 2020-01-08 | Snare for Linux before 1.7.0 has password disclosure because the rendered page contains the field RemotePassword. |
CVE-2019-19314 | High | 7.5 | 2020-01-05 | GitLab EE 8.4 through 12.5, 12.4.3, and 12.3.6 stored several tokens in plaintext. |
CVE-2019-18615 | Medium | 4.9 | 2019-12-19 | In CloudVision Portal (CVP) for all releases in the 2018.2 Train, under certain conditions, the application logs user passwords in plain text for certain API c… |
CVE-2019-13947 | Medium | 4.9 | 2019-12-12 | A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The user configuration menu in the web interface of the Control Cen… |
CVE-2019-19228 | Critical | 9.8 | 2019-12-04 | Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allow attackers to bypass authentication because the password for the today account is stored in the /… |
CVE-2019-6670 | Medium | 4.4 | 2019-11-27 | On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11.6.5, vCMP hypervisors are incorrectly exposing the plainte… |
CVE-2016-3192 | Medium | 6.5 | 2019-11-26 | Cloudera Manager 5.x before 5.7.1 places Sensitive Data in cleartext Readable Files. |
CVE-2019-14890 | High | 8.4 | 2019-11-26 | A vulnerability was found in Ansible Tower before 3.6.1 where an attacker with low privilege could retrieve usernames and passwords credentials from the new RH… |
CVE-2019-14825 | Low | 2.7 | 2019-11-25 | A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.0.9. Registry credentials used during container image discov… |
CVE-2019-5848 | Medium | 6.5 | 2019-11-25 | Incorrect font handling in autofill in Google Chrome prior to 75.0.3770.142 allowed a remote attacker to obtain potentially sensitive information from process… |
CVE-2011-2916 | Medium | 5.5 | 2019-11-15 | qtnx 0.9 stores non-custom SSH keys in a world-readable configuration file. If a user has a world-readable or world-executable home directory, another local sy… |
CVE-2008-7272 | High | 7.5 | 2019-11-08 | FireGPG before 0.6 handle user’s passphrase and decrypted cleartext insecurely by writing pre-encrypted cleartext and the user's passphrase to disk which may r… |
CVE-2019-8118 | Medium | 5.3 | 2019-11-05 | Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 uses weak cryptographic function to store the failed login attempts for cu… |
CVE-2019-4314 | High | 7.5 | 2019-10-29 | IBM Security Guardium Big Data Intelligence (SonarG) 4.0 stores sensitive information in cleartext within a resource that might be accessible to another contro… |
CVE-2019-3636 | High | 7.5 | 2019-10-28 | A File Masquerade vulnerability in McAfee Total Protection (MTP) version 16.0.R21 and earlier in Windows client allowed an attacker to read the plaintext list… |
CVE-2019-10453 | High | 7.8 | 2019-10-16 | Jenkins Delphix Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to t… |
CVE-2019-10452 | Medium | 4.3 | 2019-10-16 | Jenkins View26 Test-Reporting Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extend… |
CVE-2019-10451 | Medium | 4.3 | 2019-10-16 | Jenkins SOASTA CloudTest Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with ac… |
CVE-2019-10450 | Low | 3.3 | 2019-10-16 | Jenkins ElasticBox CI Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users… |
CVE-2019-10449 | High | 8.8 | 2019-10-16 | Jenkins Fortify on Demand Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended R… |
CVE-2019-10447 | Medium | 4.3 | 2019-10-16 | Jenkins Sofy.AI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permis… |
CVE-2019-10443 | High | 8.8 | 2019-10-16 | Jenkins iceScrum Plugin 1.1.4 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with… |
CVE-2019-10440 | High | 8.8 | 2019-10-16 | Jenkins NeoLoad Plugin 2.2.5 and earlier stored credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins master wher… |
CVE-2019-3767 | High | 8.2 | 2019-10-14 | Dell ImageAssist versions prior to 8.7.15 contain an information disclosure vulnerability. Dell ImageAssist stores some sensitive encrypted information in the… |
CVE-2019-15023 | High | 7.5 | 2019-10-09 | A security vulnerability exists in Zingbox Inspector versions 1.294 and earlier, that results in passwords for 3rd party integrations being stored in cleartext… |
CVE-2019-17106 | Medium | 6.5 | 2019-10-08 | In Centreon Web through 2.8.29, disclosure of external components' passwords allows authenticated attackers to move laterally to external components. |
CVE-2019-10433 | Low | 3.3 | 2019-10-01 | Jenkins Dingding[钉钉] Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read p… |
CVE-2019-10430 | Medium | 5.5 | 2019-09-25 | Jenkins NeuVector Vulnerability Scanner Plugin 1.5 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they… |
CVE-2019-4566 | Medium | 5.5 | 2019-09-24 | IBM Security Key Lifecycle Manager 3.0 and 3.0.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 166627. |
CVE-2019-15947 | High | 7.5 | 2019-09-05 | In Bitcoin Core 0.18.0, bitcoin-qt stores wallet.dat data unencrypted in memory. Upon a crash, it may dump a core file. If a user were to mishandle a core file… |
CVE-2019-15508 | Medium | 6.5 | 2019-08-23 | In Octopus Tentacle versions 3.0.8 to 5.0.0, when a web request proxy is configured, an authenticated user (in certain limited OctopusPrintVariables circumstan… |
CVE-2019-15507 | Medium | 6.5 | 2019-08-23 | In Octopus Deploy versions 2018.8.4 to 2019.7.6, when a web request proxy is configured, an authenticated user (in certain limited special-characters circumsta… |
CVE-2019-3753 | Medium | 6.5 | 2019-08-20 | Dell EMC PowerConnect 8024, 7000, M6348, M6220, M8024 and M8024-K running firmware versions prior to 5.1.15.2 contain a plain-text password storage vulnerabili… |
CVE-2019-10099 | High | 7.5 | 2019-08-07 | Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cach… |
CVE-2019-13096 | Critical | 9.8 | 2019-07-22 | TronLink Wallet 2.2.0 stores user wallet keystore in plaintext and places them in insecure storage. An attacker can read and reuse the user keystore of a valid… |
CVE-2019-13100 | Medium | 6.5 | 2019-07-22 | The Send Anywhere application 9.4.18 for Android stores confidential information insecurely on the system (i.e., in cleartext), which allows a non-root user to… |
CVE-2019-13099 | Medium | 6.5 | 2019-07-22 | The Momo application 2.1.9 for Android stores confidential information insecurely on the system (i.e., in cleartext), which allows a non-root user to find out… |
CVE-2019-10351 | High | 8.8 | 2019-07-11 | Jenkins Caliper CI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read per… |
CVE-2019-10350 | High | 8.8 | 2019-07-11 | Jenkins Port Allocator Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read… |
CVE-2019-10348 | High | 8.8 | 2019-07-11 | Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permissio… |
CVE-2019-12171 | High | 7.8 | 2019-07-08 | Dropbox.exe (and QtWebEngineProcess.exe in the Web Helper) in the Dropbox desktop application 71.4.108.0 store cleartext credentials in memory upon successful… |
CVE-2019-9873 | Critical | 9.8 | 2019-07-03 | In several versions of JetBrains IntelliJ IDEA Ultimate, creating Task Servers configurations leads to saving a cleartext unencrypted record of the server cred… |
CVE-2019-9872 | High | 8.1 | 2019-07-03 | In several versions of JetBrains IntelliJ IDEA Ultimate, creating run configurations for cloud application servers leads to saving a cleartext unencrypted reco… |
CVE-2019-9823 | Critical | 9.8 | 2019-07-03 | In several JetBrains IntelliJ IDEA versions, creating remote run configurations of JavaEE application servers leads to saving a cleartext record of the server… |
CVE-2019-5810 | Medium | 6.5 | 2019-06-27 | Information leak in autofill in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information from process memory… |
CVE-2019-1627 | Medium | 6.5 | 2019-06-20 | A vulnerability in the Server Utilities of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to gain unauthorized acce… |
CVE-2018-2028 | Medium | 6.5 | 2019-06-06 | IBM Maximo Asset Management 7.6 could allow a an authenticated user to replace a target page with a phishing site which could allow the attacker to obtain high… |
CVE-2019-11966 | High | 8.8 | 2019-06-05 | A remote privilege escalation vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. |
CVE-2018-20008 | Medium | 6.8 | 2019-05-28 | iBall Baton iB-WRB302N20122017 devices have improper access control over the UART interface, allowing physical attackers to discover Wi-Fi credentials (plain t… |
CVE-2019-3937 | High | 7.8 | 2019-04-30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 stores usernames, passwords, slideshow passcode, and other configuration options in clea… |
CVE-2019-11384 | Critical | 9.8 | 2019-04-22 | The Zalora application 6.15.1 for Android stores confidential information insecurely on the system (i.e. plain text), which allows a non-root user to find out… |
CVE-2019-0285 | Critical | 9.8 | 2019-04-10 | The .NET SDK WebForm Viewer in SAP Crystal Reports for Visual Studio (fixed in version 2010) discloses sensitive database information including credentials whi… |
CVE-2019-3612 | Medium | 4.4 | 2019-04-10 | Information Disclosure vulnerability in McAfee DXL Platform and TIE Server in DXL prior to 5.0.1 HF2 and TIE prior to 2.3.1 HF1 allows Authenticated users to v… |
CVE-2018-1882 | Medium | 4.7 | 2019-04-08 | In a certain atypical IBM Spectrum Protect 7.1 and 8.1 configurations, the node password could be displayed in plain text in the IBM Spectrum Protect client tr… |
CVE-2018-19981 | High | 7.2 | 2019-04-04 | Amazon AWS SDK <=2.8.5 for Android uses Android SharedPreferences to store plain text AWS STS Temporary Credentials retrieved by AWS Cognito Identity Service… |
CVE-2019-3606 | High | 7.7 | 2019-03-26 | Data Leakage Attacks vulnerability in the web portal component when in an MDR pair in McAfee Network Security Management (NSM) 9.1 < 9.1.7.75 (Update 4) and 9… |
CVE-2014-5433 | Critical | 9.8 | 2019-03-26 | An unauthenticated remote attacker may be able to execute commands to view wireless account credentials that are stored in cleartext on Baxter SIGMA Spectrum I… |
CVE-2015-1012 | High | 7.5 | 2019-03-25 | Wireless keys are stored in plain text on version 5 of the Hospira LifeCare PCA Infusion System. According to Hospira, version 3 of the LifeCare PCA Infusion S… |
CVE-2015-3952 | High | 7.5 | 2019-03-25 | Wireless keys are stored in plain text on Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq I… |
CVE-2018-17499 | Low | 2.9 | 2019-03-21 | Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of unencrypted dat… |
CVE-2018-17489 | Low | 2.9 | 2019-03-21 | EasyLobby Solo could allow a local attacker to obtain sensitive information, caused by the storing of the social security number in plaintext. By visiting the… |
CVE-2018-12572 | High | 7.8 | 2019-03-21 | Avast Free Antivirus prior to 19.1.2360 stores user credentials in memory upon login, which allows local users to obtain sensitive information by dumping Avast… |
CVE-2019-5765 | Medium | 5.5 | 2019-02-19 | An exposed debugging endpoint in the browser in Google Chrome on Android prior to 72.0.3626.81 allowed a local attacker to obtain potentially sensitive informa… |
CVE-2019-6549 | High | 7.2 | 2019-02-12 | An attacker could retrieve plain-text credentials stored in a XML file on PR100088 Modbus gateway versions prior to Release R02 (or Software Version 1.1.13166)… |
CVE-2018-16889 | Medium | 5.5 | 2019-01-28 | Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaint… |
CVE-2018-19009 | High | 7.8 | 2019-01-25 | Pilz PNOZmulti Configurator prior to version 10.9 allows an authenticated attacker with local access to the system containing the PNOZmulti Configurator softwa… |
CVE-2018-18984 | Medium | 4.6 | 2018-12-14 | Medtronic CareLink and Encore Programmers do not encrypt or do not sufficiently encrypt sensitive PII and PHI information while at rest . |
CVE-2018-18641 | Critical | 9.8 | 2018-12-04 | An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Cleartext Storage of S… |
CVE-2018-5559 | Low | 3.4 | 2018-11-28 | In Rapid7 Komand version 0.41.0 and prior, certain endpoints that are able to list the always encrypted-at-rest connection data could return some configuration… |
CVE-2018-19279 | Medium | 4.3 | 2018-11-14 | PRIMX ZoneCentral before 6.1.2236 on Windows sometimes leaks the plaintext of NTFS files. On non-SSD devices, this is limited to a 5-second window and file siz… |
CVE-2018-1877 | Medium | 6.2 | 2018-11-02 | IBM Robotic Process Automation with Automation Anywhere 11 could store highly sensitive information in the form of unencrypted passwords that would be availabl… |
CVE-2018-18394 | Critical | 9.8 | 2018-10-19 | Sensitive Information Stored in Clear Text in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1. |
CVE-2018-9065 | High | 7.5 | 2018-07-30 | In Lenovo xClarity Administrator versions earlier than 2.1.0, an attacker that gains access to the underlying LXCA file system user may be able to retrieve a c… |
CVE-2018-10871 | Low | 3.8 | 2018-07-18 | 389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information. By default, when the Replica and/or retroChangeLog… |
CVE-2018-1621 | Medium | 4.4 | 2018-07-06 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local attacker to obtain clear text password in a trace file caused by improper handling… |
CVE-2017-2672 | Medium | 6.5 | 2018-06-21 | A flaw was found in foreman before version 1.15 in the logging of adding and registering images. An attacker with access to the foreman log file would be able… |
CVE-2018-11242 | Medium | 6.5 | 2018-05-20 | An issue was discovered in the MakeMyTrip application 7.2.4 for Android. The databases (locally stored) are not encrypted and have cleartext that might lead to… |
CVE-2018-10812 | Medium | 4.1 | 2018-05-08 | The Bitpie application through 3.2.4 for Android and iOS uses cleartext storage for digital currency initial keys, which allows local users to steal currency b… |
CVE-2017-9654 | High | 8.8 | 2018-04-24 | The Philips DoseWise Portal web-based application versions 1.1.7.333 and 2.1.1.3069 stores login credentials in clear text within backend system files. CVSS v3… |
CVE-2016-8366 | High | 7.3 | 2018-04-05 | Webvisit in Phoenix Contact ILC PLCs offers a password macro to protect HMI pages on the PLC against casual or coincidental opening of HMI pages by the user. T… |
CVE-2018-8947 | High | 7.5 | 2018-03-25 | rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easier for remote attackers to bypass inten… |
CVE-2017-5250 | Critical | 9.8 | 2018-02-22 | In version 1.9.7 and prior of Insteon's Insteon for Hub Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and… |
CVE-2017-5249 | Critical | 9.8 | 2018-02-22 | In version 6.1.0.19 and prior of Wink Labs's Wink - Smart Home Android app, the OAuth token used by the app to authorize user access is not stored in an encryp… |
CVE-2017-16835 | High | 7.5 | 2018-02-20 | The "Photo,Video Locker-Calculator" application 12.0 for Android has android:allowBackup="true" in AndroidManifest.xml, which allows attackers to obtain sensit… |
CVE-2018-0089 | High | 7.5 | 2018-01-18 | A vulnerability in the Policy and Charging Rules Function (PCRF) of the Cisco Policy Suite (CPS) could allow an unauthenticated, remote attacker to access sens… |