Skip to content
Noroxi

CWE-312 · 765 records

Cleartext Storage of Sensitive Information

CVEs in this class

765 records

  • CVE-2020-5723
    60This week

    The UCM6200 series 1.0.20.22 and below stores unencrypted user passwords in an SQLite database.

    CriticalCVSS 9.8WeaponizedEPSS 5%

    grandstream · ucm6202 firmwareMar 30, 2020

  • CVE-2025-22896
    60This week

    mySCADA myPRO Manager Cleartext Storage of Sensitive Information

    CriticalCVSS 9.2WeaponizedEPSS 3%

    myscada · myproFeb 13, 2025

  • CVE-2022-26148
    55Plan

    An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix.

    CriticalCVSS 9.8Proof of conceptEPSS 52%

    grafana · grafanaMar 21, 2022

  • CVE-2011-4723
    53Plan

    The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information via unspecifi

    MediumCVSS 5.7KEVWeaponizedEPSS 3%

    dlink · dir-300 firmwareDec 20, 2011

  • CVE-2023-22894
    50Plan

    Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter.

    MediumCVSS 4.9KEVWeaponizedEPSS 3%

    strapi · strapiApr 19, 2023

  • CVE-2019-0285
    41Plan

    The .NET SDK WebForm Viewer in SAP Crystal Reports for Visual Studio (fixed in version 2010) discloses sensitive database information includ

    CriticalCVSS 9.8Proof of conceptEPSS 6%

    sap · crystal reportsApr 10, 2019

  • CVE-2021-36782
    40Plan

    Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object

    CriticalCVSS 9.9WeaponizedEPSS 4%

    suse · rancherSep 7, 2022

  • CVE-2023-31069
    40Plan

    An issue was discovered in TSplus Remote Access through 16.0.2.14.

    CriticalCVSS 9.8Proof of conceptEPSS 3%

    tsplus · tsplus remote workSep 11, 2023

  • CVE-2001-1481
    40Plan

    Xitami 2.4 through 2.5 b4 stores the Administrator password in plaintext in the default.aut file, whose default permissions are world-readab

    CriticalCVSS 9.8No exploitEPSS 2%

    xitami · xitamiDec 31, 2001

  • CVE-2014-5433
    40Plan

    An unauthenticated remote attacker may be able to execute commands to view wireless account credentials that are stored in cleartext on Baxt

    CriticalCVSS 9.8No exploitEPSS 2%

    baxter · sigma spectrum infusion system firmwareMar 26, 2019

  • CVE-2008-0174
    40Plan

    GE Fanuc Proficy Real-Time Information Portal 2.6 and earlier uses HTTP Basic Authentication, which transmits usernames and passwords in bas

    CriticalCVSS 9.8No exploitEPSS 1%

    ge · proficy real-time information portalJan 28, 2008

  • CVE-2019-19228
    40Plan

    Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allow attackers to bypass authentication because the password for the today account

    CriticalCVSS 9.8No exploitEPSS 1%

    fronius · datamanager box 2.0 firmwareDec 4, 2019

  • CVE-2019-9823
    39Monitor

    In several JetBrains IntelliJ IDEA versions, creating remote run configurations of JavaEE application servers leads to saving a cleartext re

    CriticalCVSS 9.8No exploitEPSS 1%

    jetbrains · intellij ideaJul 3, 2019

  • CVE-2019-9873
    39Monitor

    In several versions of JetBrains IntelliJ IDEA Ultimate, creating Task Servers configurations leads to saving a cleartext unencrypted record

    CriticalCVSS 9.8No exploitEPSS 1%

    jetbrains · intellij ideaJul 3, 2019

  • CVE-2019-13096
    39Monitor

    TronLink Wallet 2.2.0 stores user wallet keystore in plaintext and places them in insecure storage.

    CriticalCVSS 9.8No exploitEPSS 1%

    tronlink · walletJul 22, 2019

  • CVE-2019-11384
    39Monitor

    The Zalora application 6.15.1 for Android stores confidential information insecurely on the system (i.e.

    CriticalCVSS 9.8No exploitEPSS 0%

    zalora · zaloraApr 22, 2019

  • CVE-2018-18641
    39Monitor

    An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3.

    CriticalCVSS 9.8No exploitEPSS 0%

    gitlab · gitlabDec 4, 2018

  • CVE-2020-15332
    39Monitor

    Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak /opt/axess/etc/default/axess permissions.

    CriticalCVSS 9.8No exploitEPSS 0%

    zyxel · cloudcnm secumanagerSep 28, 2022

  • CVE-2019-18868
    39Monitor

    Blaauw Remote Kiln Control through v3.00r4 allows an unauthenticated attacker to access MySQL credentials in cleartext in /engine/db.inc, /l

    CriticalCVSS 9.8No exploitEPSS 0%

    blaauwproducts · remote kiln controlMay 7, 2020

  • CVE-2018-18394
    39Monitor

    Sensitive Information Stored in Clear Text in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.

    CriticalCVSS 9.8No exploitEPSS 0%

    moxa · thingsproOct 19, 2018

  • CVE-2021-29954
    39Monitor

    Proxy functionality built into Hubs Cloud’s Reticulum software allowed access to internal URLs, including the metadata service.

    CriticalCVSS 9.8No exploitEPSS 0%

    mozilla · hubs cloud reticulumJun 24, 2021

  • CVE-2023-2809
    39Monitor

    Use of Cleartext credentials in Sage 200 Spain

    CriticalCVSS 9.8No exploitEPSS 0%

    sage · sage 200 spainOct 4, 2023

  • CVE-2023-33373
    39Monitor

    Connected IO v2.1.0 and prior keeps passwords and credentials in clear-text format, allowing attackers to exfiltrate the credentials and use

    CriticalCVSS 9.8No exploitEPSS 0%

    connectedio · connected ioAug 4, 2023

  • CVE-2024-46340
    39Monitor

    TL-WR845N(UN)_V4_201214, TP-Link TL-WR845N(UN)_V4_200909, and TL-WR845N(UN)_V4_190219 was discovered to transmit user credentials in plainte

    CriticalCVSS 9.8No exploitEPSS 0%

    tp-link · tl-wr845n firmwareDec 10, 2024

  • CVE-2025-30124
    39Monitor

    An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices.

    CriticalCVSS 9.8No exploitEPSS 0%

    Jul 28, 2025

All vulnerability classes