CWE-312 · Cleartext Storage of Sensitive Information (page 9)
Page 9 of 9 — CVEs classified under CWE-312, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-12171 | High | 7.8 | 2019-07-08 | Dropbox.exe (and QtWebEngineProcess.exe in the Web Helper) in the Dropbox desktop application 71.4.108.0 store cleartext credentials in memory upon successful… |
CVE-2019-9873 | Critical | 9.8 | 2019-07-03 | In several versions of JetBrains IntelliJ IDEA Ultimate, creating Task Servers configurations leads to saving a cleartext unencrypted record of the server cred… |
CVE-2019-9872 | High | 8.1 | 2019-07-03 | In several versions of JetBrains IntelliJ IDEA Ultimate, creating run configurations for cloud application servers leads to saving a cleartext unencrypted reco… |
CVE-2019-9823 | Critical | 9.8 | 2019-07-03 | In several JetBrains IntelliJ IDEA versions, creating remote run configurations of JavaEE application servers leads to saving a cleartext record of the server… |
CVE-2019-5810 | Medium | 6.5 | 2019-06-27 | Information leak in autofill in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information from process memory… |
CVE-2019-1627 | Medium | 6.5 | 2019-06-20 | A vulnerability in the Server Utilities of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to gain unauthorized acce… |
CVE-2018-2028 | Medium | 6.5 | 2019-06-06 | IBM Maximo Asset Management 7.6 could allow a an authenticated user to replace a target page with a phishing site which could allow the attacker to obtain high… |
CVE-2019-11966 | High | 8.8 | 2019-06-05 | A remote privilege escalation vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. |
CVE-2018-20008 | Medium | 6.8 | 2019-05-28 | iBall Baton iB-WRB302N20122017 devices have improper access control over the UART interface, allowing physical attackers to discover Wi-Fi credentials (plain t… |
CVE-2019-3937 | High | 7.8 | 2019-04-30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 stores usernames, passwords, slideshow passcode, and other configuration options in clea… |
CVE-2019-11384 | Critical | 9.8 | 2019-04-22 | The Zalora application 6.15.1 for Android stores confidential information insecurely on the system (i.e. plain text), which allows a non-root user to find out… |
CVE-2019-0285 | Critical | 9.8 | 2019-04-10 | The .NET SDK WebForm Viewer in SAP Crystal Reports for Visual Studio (fixed in version 2010) discloses sensitive database information including credentials whi… |
CVE-2019-3612 | Medium | 4.4 | 2019-04-10 | Information Disclosure vulnerability in McAfee DXL Platform and TIE Server in DXL prior to 5.0.1 HF2 and TIE prior to 2.3.1 HF1 allows Authenticated users to v… |
CVE-2018-1882 | Medium | 4.7 | 2019-04-08 | In a certain atypical IBM Spectrum Protect 7.1 and 8.1 configurations, the node password could be displayed in plain text in the IBM Spectrum Protect client tr… |
CVE-2018-19981 | High | 7.2 | 2019-04-04 | Amazon AWS SDK <=2.8.5 for Android uses Android SharedPreferences to store plain text AWS STS Temporary Credentials retrieved by AWS Cognito Identity Service… |
CVE-2019-3606 | High | 7.7 | 2019-03-26 | Data Leakage Attacks vulnerability in the web portal component when in an MDR pair in McAfee Network Security Management (NSM) 9.1 < 9.1.7.75 (Update 4) and 9… |
CVE-2014-5433 | Critical | 9.8 | 2019-03-26 | An unauthenticated remote attacker may be able to execute commands to view wireless account credentials that are stored in cleartext on Baxter SIGMA Spectrum I… |
CVE-2015-1012 | High | 7.5 | 2019-03-25 | Wireless keys are stored in plain text on version 5 of the Hospira LifeCare PCA Infusion System. According to Hospira, version 3 of the LifeCare PCA Infusion S… |
CVE-2015-3952 | High | 7.5 | 2019-03-25 | Wireless keys are stored in plain text on Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq I… |
CVE-2018-17499 | Low | 2.9 | 2019-03-21 | Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of unencrypted dat… |
CVE-2018-17489 | Low | 2.9 | 2019-03-21 | EasyLobby Solo could allow a local attacker to obtain sensitive information, caused by the storing of the social security number in plaintext. By visiting the… |
CVE-2018-12572 | High | 7.8 | 2019-03-21 | Avast Free Antivirus prior to 19.1.2360 stores user credentials in memory upon login, which allows local users to obtain sensitive information by dumping Avast… |
CVE-2019-5765 | Medium | 5.5 | 2019-02-19 | An exposed debugging endpoint in the browser in Google Chrome on Android prior to 72.0.3626.81 allowed a local attacker to obtain potentially sensitive informa… |
CVE-2019-6549 | High | 7.2 | 2019-02-12 | An attacker could retrieve plain-text credentials stored in a XML file on PR100088 Modbus gateway versions prior to Release R02 (or Software Version 1.1.13166)… |
CVE-2018-16889 | Medium | 5.5 | 2019-01-28 | Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaint… |
CVE-2018-19009 | High | 7.8 | 2019-01-25 | Pilz PNOZmulti Configurator prior to version 10.9 allows an authenticated attacker with local access to the system containing the PNOZmulti Configurator softwa… |
CVE-2018-18984 | Medium | 4.6 | 2018-12-14 | Medtronic CareLink and Encore Programmers do not encrypt or do not sufficiently encrypt sensitive PII and PHI information while at rest . |
CVE-2018-18641 | Critical | 9.8 | 2018-12-04 | An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Cleartext Storage of S… |
CVE-2018-5559 | Low | 3.4 | 2018-11-28 | In Rapid7 Komand version 0.41.0 and prior, certain endpoints that are able to list the always encrypted-at-rest connection data could return some configuration… |
CVE-2018-19279 | Medium | 4.3 | 2018-11-14 | PRIMX ZoneCentral before 6.1.2236 on Windows sometimes leaks the plaintext of NTFS files. On non-SSD devices, this is limited to a 5-second window and file siz… |
CVE-2018-1877 | Medium | 6.2 | 2018-11-02 | IBM Robotic Process Automation with Automation Anywhere 11 could store highly sensitive information in the form of unencrypted passwords that would be availabl… |
CVE-2018-18394 | Critical | 9.8 | 2018-10-19 | Sensitive Information Stored in Clear Text in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1. |
CVE-2018-9065 | High | 7.5 | 2018-07-30 | In Lenovo xClarity Administrator versions earlier than 2.1.0, an attacker that gains access to the underlying LXCA file system user may be able to retrieve a c… |
CVE-2018-10871 | Low | 3.8 | 2018-07-18 | 389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information. By default, when the Replica and/or retroChangeLog… |
CVE-2018-1621 | Medium | 4.4 | 2018-07-06 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local attacker to obtain clear text password in a trace file caused by improper handling… |
CVE-2017-2672 | Medium | 6.5 | 2018-06-21 | A flaw was found in foreman before version 1.15 in the logging of adding and registering images. An attacker with access to the foreman log file would be able… |
CVE-2018-11242 | Medium | 6.5 | 2018-05-20 | An issue was discovered in the MakeMyTrip application 7.2.4 for Android. The databases (locally stored) are not encrypted and have cleartext that might lead to… |
CVE-2018-10812 | Medium | 4.1 | 2018-05-08 | The Bitpie application through 3.2.4 for Android and iOS uses cleartext storage for digital currency initial keys, which allows local users to steal currency b… |
CVE-2017-9654 | High | 8.8 | 2018-04-24 | The Philips DoseWise Portal web-based application versions 1.1.7.333 and 2.1.1.3069 stores login credentials in clear text within backend system files. CVSS v3… |
CVE-2016-8366 | High | 7.3 | 2018-04-05 | Webvisit in Phoenix Contact ILC PLCs offers a password macro to protect HMI pages on the PLC against casual or coincidental opening of HMI pages by the user. T… |
CVE-2018-8947 | High | 7.5 | 2018-03-25 | rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easier for remote attackers to bypass inten… |
CVE-2017-5250 | Critical | 9.8 | 2018-02-22 | In version 1.9.7 and prior of Insteon's Insteon for Hub Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and… |
CVE-2017-5249 | Critical | 9.8 | 2018-02-22 | In version 6.1.0.19 and prior of Wink Labs's Wink - Smart Home Android app, the OAuth token used by the app to authorize user access is not stored in an encryp… |
CVE-2017-16835 | High | 7.5 | 2018-02-20 | The "Photo,Video Locker-Calculator" application 12.0 for Android has android:allowBackup="true" in AndroidManifest.xml, which allows attackers to obtain sensit… |
CVE-2018-0089 | High | 7.5 | 2018-01-18 | A vulnerability in the Policy and Charging Rules Function (PCRF) of the Cisco Policy Suite (CPS) could allow an unauthenticated, remote attacker to access sens… |
CVE-2017-9663 | High | 7.5 | 2018-01-09 | An Cleartext Storage of Sensitive Information issue was discovered in General Motors (GM) and Shanghai OnStar (SOS) SOS iOS Client 7.1. Successful exploitation… |
CVE-2017-13663 | High | 7.5 | 2017-12-01 | Encryption key exposure in firmware in iSmartAlarm CubeOne version 2.2.4.8 and earlier allows attackers to decrypt log files via an exposed key. |
CVE-2017-2723 | Medium | 6.7 | 2017-11-22 | The Files APP 7.1.1.308 and earlier versions in some Huawei mobile phones has a vulnerability of plaintext storage of users' Safe passwords. An attacker with t… |
CVE-2017-14990 | Medium | 6.5 | 2017-10-03 | WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_key values as hashes), which might make it… |
CVE-2017-1309 | High | 7.8 | 2017-07-19 | IBM InfoSphere Master Data Management Server 11.0 - 11.6 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 1254… |
CVE-2017-3214 | High | 7.5 | 2017-06-20 | The Milwaukee ONE-KEY Android mobile application stores the master token in plaintext in the apk binary. |
CVE-2016-0876 | High | 7.5 | 2016-05-31 | Moxa Secure Router EDR-G903 devices before 3.4.12 allow remote attackers to discover cleartext passwords by reading a configuration file. |
CVE-2015-5537 | | 2015-08-03 | The SSL layer of the HTTPS service in Siemens RuggedCom ROS before 4.2.0 and ROX II does not properly implement CBC padding, which makes it easier for man-in-t… | |
CVE-2011-4723 | Medium | 5.7 | 2011-12-20 | The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information via unspecified vectors. |
CVE-2010-0225 | | 2010-01-07 | SanDisk Cruzer Enterprise USB flash drives use a fixed 256-bit key for obtaining access to the cleartext drive contents, which makes it easier for physically p… | |
CVE-2009-2272 | High | 7.5 | 2009-07-01 | The Huawei D100 stores the administrator's account name and password in cleartext in a cookie, which allows context-dependent attackers to obtain sensitive inf… |
CVE-2008-6828 | High | 7.8 | 2009-06-08 | Symantec Altiris Deployment Solution 6.x before 6.9.355 SP1 stores the Application Identity Account password in memory in cleartext, which allows local users t… |
CVE-2009-1466 | Medium | 5.5 | 2009-05-14 | Application Access Server (A-A-S) 2.0.48 stores (1) passwords and (2) the port keyword in cleartext in aas.ini, which allows local users to obtain sensitive in… |
CVE-2009-0152 | High | 7.5 | 2009-05-13 | iChat in Apple Mac OS X 10.5 before 10.5.7 disables SSL for AOL Instant Messenger (AIM) communication in certain circumstances that are inconsistent with the R… |
CVE-2009-1603 | High | 7.5 | 2009-05-11 | src/tools/pkcs11-tool.c in pkcs11-tool in OpenSC 0.11.7, when used with unspecified third-party PKCS#11 modules, generates RSA keys with incorrect public expon… |
CVE-2009-0964 | High | 7.5 | 2009-03-19 | UserView_list.php in PHPRunner 4.2, and possibly earlier, stores passwords in cleartext in the database, which allows attackers to gain privileges. NOTE: this… |
CVE-2008-6157 | High | 7.5 | 2009-02-17 | SepCity Classified Ads stores the admin password in cleartext in data/classifieds.mdb, which allows context-dependent attackers to obtain sensitive information. |
CVE-2008-1567 | Medium | 5.5 | 2008-03-31 | phpMyAdmin before 2.11.5.1 stores the MySQL (1) username and (2) password, and the (3) Blowfish secret key, in cleartext in a Session file under /tmp, which al… |
CVE-2008-0174 | Critical | 9.8 | 2008-01-29 | GE Fanuc Proficy Real-Time Information Portal 2.6 and earlier uses HTTP Basic Authentication, which transmits usernames and passwords in base64-encoded clearte… |
CVE-2007-5778 | High | 7.5 | 2007-11-01 | Mobile Spy (1) stores login credentials in cleartext under the RetinaxStudios registry key, and (2) sends login credentials and log data over a cleartext HTTP… |
CVE-2005-2209 | Medium | 5.5 | 2005-07-11 | Capturix ScanShare 1.06 build 50 stores sensitive information such as the password in cleartext in capturixss_cfg.ini, which is readable by local users. |
CVE-2005-2160 | High | 7.5 | 2005-07-06 | IMail stores usernames and passwords in cleartext in a cookie, which allows remote attackers to obtain sensitive information. |
CVE-2005-1828 | High | 7.5 | 2005-05-26 | D-Link DSL-504T stores usernames and passwords in cleartext in the router configuration file, which allows remote attackers to obtain sensitive information. |
CVE-2004-2397 | High | 7.5 | 2004-12-31 | The web-based Management Console in Blue Coat Security Gateway OS 3.0 through 3.1.3.13 and 3.2.1, when importing a private key, stores the key and its passphra… |
CVE-2002-1800 | High | 7.5 | 2002-12-31 | phpRank 1.8 stores the administrative password in plaintext on the server and in the "ap" cookie, which allows remote attackers to retrieve the administrative… |
CVE-2002-1696 | Medium | 5.5 | 2002-12-31 | Microsoft Outlook plug-in PGP version 7.0, 7.0.3, and 7.0.4 silently saves a decrypted copy of a message to hard disk when "Automatically decrypt/verify when o… |
CVE-2001-1537 | High | 7.5 | 2001-12-31 | The default "basic" security setting' in config.php for TWIG webmail 2.7.4 and earlier stores cleartext usernames and passwords in cookies, which could allow a… |
CVE-2001-1536 | High | 7.5 | 2001-12-31 | Autogalaxy stores usernames and passwords in cleartext in cookies, which makes it easier for remote attackers to obtain authentication information and gain una… |
CVE-2001-1481 | Critical | 9.8 | 2001-12-31 | Xitami 2.4 through 2.5 b4 stores the Administrator password in plaintext in the default.aut file, whose default permissions are world-readable, which allows re… |