Security Vulnerabilities Related To CWE-312

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2021-31539	312		2021-04-23	2021-05-01	2.1	None	Local	Low	Not required	Partial	None	None
Wowza Streaming Engine through 4.8.5 (in a default installation) has cleartext passwords stored in the conf/admin.password file. A regular local user is able to read usernames and passwords.
2	CVE-2021-30183	312		2021-05-14	2021-05-25	5.0	None	Remote	Low	Not required	Partial	None	None
Cleartext storage of sensitive information in multiple versions of Octopus Server where in certain situations when running import or export processes, the password used to encrypt and decrypt sensitive values would be written to the logs in plaintext.
3	CVE-2021-29683	312		2021-05-20	2021-05-24	4.0	None	Remote	Low	???	Partial	None	None
IBM Security Identity Manager 7.0.2 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID: 199998.
4	CVE-2021-28937	312		2021-03-29	2021-04-02	5.0	None	Remote	Low	Not required	Partial	None	None
The /password.html page of the Web management interface of the Acexy Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) contains the administrator account password in plaintext. The page can be intercepted on HTTP.
5	CVE-2021-28374	312		2021-03-15	2021-05-17	5.0	None	Remote	Low	Not required	Partial	None	None
The Debian courier-authlib package before 0.71.1-2 for Courier Authentication Library creates a /run/courier/authdaemon directory with weak permissions, allowing an attacker to read user information. This may include a cleartext password in some configurations. In general, it includes the user's existence, uid and gids, home and/or Maildir directory, quota, and some type of password information (such as a hash).
6	CVE-2021-27549	312		2021-02-22	2021-02-26	5.0	None	Remote	Low	Not required	Partial	None	None
DISPUTED Genymotion Desktop through 3.2.0 leaks the host's clipboard data to the Android application by default. NOTE: the vendor's position is that this is intended behavior that can be changed through the Settings > Device screen.
7	CVE-2021-27487	312		2021-06-16	2021-06-16	0.0	None	???	???	???	???	???	???
ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products contain credentials stored in plaintext. This could allow an attacker to gain access to sensitive information.
8	CVE-2021-27233	312		2021-02-16	2021-02-22	4.0	None	Remote	Low	???	Partial	None	None
An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8. On the admin portal of the web application, password information for external systems is visible in cleartext. The Settings.asp page is affected by this issue.
9	CVE-2021-27210	312		2021-02-13	2021-02-19	4.0	None	Remote	Low	???	Partial	None	None
TP-Link Archer C5v 1.7_181221 devices allows remote attackers to retrieve cleartext credentials via [USER_CFG#0,0,0,0,0,0#0,0,0,0,0,0]0,0 to the /cgi?1&5 URI.
10	CVE-2021-27205	312		2021-02-12	2021-02-14	2.1	None	Local	Low	Not required	Partial	None	None
Telegram before 7.4 (212543) Stable on macOS stores the local copy of self-destructed messages in a sandbox path, leading to sensitive information disclosure.
11	CVE-2021-27204	312		2021-02-12	2021-02-14	2.1	None	Local	Low	Not required	Partial	None	None
Telegram before 7.4 (212543) Stable on macOS stores the local passcode in cleartext, leading to information disclosure.
12	CVE-2021-27178	312		2021-02-10	2021-02-12	5.0	None	Remote	Low	Not required	Partial	None	None
An issue was discovered on FiberHome HG6245D devices through RP2613. Some passwords are stored in cleartext in nvram.
13	CVE-2021-27176	312		2021-02-10	2021-02-12	5.0	None	Remote	Low	Not required	Partial	None	None
An issue was discovered on FiberHome HG6245D devices through RP2613. wifictl_5g.cfg has cleartext passwords and 0644 permissions.
14	CVE-2021-27175	312		2021-02-10	2021-02-12	5.0	None	Remote	Low	Not required	Partial	None	None
An issue was discovered on FiberHome HG6245D devices through RP2613. wifictl_2g.cfg has cleartext passwords and 0644 permissions.
15	CVE-2021-27174	312		2021-02-10	2021-02-12	5.0	None	Remote	Low	Not required	Partial	None	None
An issue was discovered on FiberHome HG6245D devices through RP2613. wifi_custom.cfg has cleartext passwords and 0644 permissions.
16	CVE-2021-27140	312		2021-02-10	2021-02-12	5.0	None	Remote	Low	Not required	Partial	None	None
An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to find passwords and authentication cookies stored in cleartext in the web.log HTTP logs.
17	CVE-2021-26833	312		2021-04-06	2021-04-14	4.3	None	Remote	Medium	Not required	Partial	None	None
Cleartext Storage in a File or on Disk in TimelyBills <= 1.7.0 for iOS and versions <= 1.21.115 for Android allows attacker who can locally read user's files obtain JWT tokens for user's account due to insufficient cache clearing mechanisms. A threat actor can obtain sensitive user data by decoding the tokens as JWT is signed and encoded, not encrypted.
18	CVE-2021-26595	312		2021-02-23	2021-03-01	5.0	None	Remote	Low	Not required	Partial	None	None
UNSUPPORTED WHEN ASSIGNED In Directus 8.x through 8.8.1, an attacker can learn sensitive information such as the version of the CMS, the PHP version used by the site, and the name of the DBMS, simply by view the result of the api-aa, called automatically upon a connection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
19	CVE-2021-26579	312		2021-03-30	2021-04-02	2.1	None	Local	Low	Not required	Partial	None	None
A security vulnerability in HPE Unified Data Management (UDM) could allow the local disclosure of privileged information (CWE-321: Use of Hard-coded Cryptographic Key in a product). HPE has provided updates to versions 1.2009.0 and 1.2101.0 of HPE Unified Data Management (UDM). Version 1.2103.0 of HPE Unified Data Management (UDM) removes all hard-coded cryptographic keys.
20	CVE-2021-26550	312		2021-02-09	2021-02-11	2.1	None	Local	Low	Not required	Partial	None	None
An issue was discovered in SmartFoxServer 2.17.0. Cleartext password disclosure can occur via /config/server.xml.
21	CVE-2021-25692	312		2021-04-06	2021-04-19	2.1	None	Local	Low	Not required	Partial	None	None
Sensitive smart card data is logged in default INFO logs by Teradici's PCoIP Connection Manager and Security Gateway prior to version 21.01.3.
22	CVE-2021-25645	312		2021-05-10	2021-05-24	2.1	None	Local	Low	Not required	Partial	None	None
An issue was discovered in Couchbase Server before 6.0.5, 6.1.x through 6.5.x before 6.5.2, and 6.6.x before 6.6.1. An internal user with administrator privileges, @ns_server, leaks credentials in cleartext in the cbcollect_info.log, debug.log, ns_couchdb.log, indexer.log, and stats.log files. NOTE: updating the product does not automatically address leaks that occurred in the past.
23	CVE-2021-25644	312	+Info	2021-05-19	2021-05-25	5.0	None	Remote	Low	Not required	Partial	None	None
An issue was discovered in Couchbase Server 5.x and 6.x through 6.6.1 and 7.0.0 Beta. Incorrect commands to the REST API can result in leaked authentication information being stored in cleartext in the debug.log and info.log files, and is also shown in the UI visible to administrators.
24	CVE-2021-25284	312		2021-02-27	2021-03-31	1.9	None	Local	Medium	Not required	None	Partial	None
An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.
25	CVE-2021-23878	312		2021-02-10	2021-02-16	4.3	None	Remote	Medium	Not required	Partial	None	None
Clear text storage of sensitive Information in memory vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update allows a local user to view ENS settings and credentials via accessing process memory after the ENS administrator has performed specific actions. To exploit this, the local user has to access the relevant memory location immediately after an ENS administrator has made a configuration change through the console on their machine
26	CVE-2021-23827	312		2021-02-23	2021-02-26	2.1	None	Local	Low	Not required	Partial	None	None
Keybase Desktop Client before 5.6.0 on Windows and macOS, and before 5.6.1 on Linux, allows an attacker to obtain potentially sensitive media (such as private pictures) in the Cache and uploadtemps directories. It fails to effectively clear cached pictures, even after deletion via normal methodology within the client, or by utilizing the "Explode message/Explode now" functionality. Local filesystem access is needed by the attacker.
27	CVE-2021-22300	312	+Info	2021-02-06	2021-02-10	1.9	None	Local	Medium	Not required	Partial	None	None
There is an information leak vulnerability in eCNS280_TD versions V100R005C00 and V100R005C10. A command does not have timeout exit mechanism. Temporary file contains sensitive information. This allows attackers to obtain information by inter-process access that requires other methods.
28	CVE-2021-22206	312		2021-05-06	2021-05-13	4.0	None	Remote	Low	???	Partial	None	None
An issue has been discovered in GitLab affecting all versions starting from 11.6. Pull mirror credentials are exposed that allows other maintainers to be able to view the credentials in plain-text,
29	CVE-2021-22194	312		2021-03-26	2021-03-30	2.1	None	Local	Low	Not required	Partial	None	None
In all versions of GitLab starting from 13.7, marshalled session keys were being stored in Redis.
30	CVE-2021-21734	312	+Info	2021-05-28	2021-06-10	4.0	None	Remote	Low	???	Partial	None	None
Some PON MDU devices of ZTE stored sensitive information in plaintext, and users with login authority can obtain it by inputing command. This affects: ZTE PON MDU device ZXA10 F821 V1.7.0P3T22, ZXA10 F822 V1.4.3T6, ZXA10 F819 V1.2.1T5, ZXA10 F832 V1.1.1T7, ZXA10 F839 V1.1.0T8, ZXA10 F809 V3.2.1T1, ZXA10 F822P V1.1.1T7, ZXA10 F832 V2.00.00.01
31	CVE-2021-21547	312	+Priv	2021-04-30	2021-05-11	2.1	None	Local	Low	Not required	Partial	None	None
Dell EMC Unity, UnityVSA, and Unity XT versions prior to 5.0.7.0.5.008 contain a plain-text password storage vulnerability when the Dell Upgrade Readiness Utility is run on the system. The credentials of the Unisphere Administrator are stored in plain text. A local malicious user with high privileges may use the exposed password to gain access with the privileges of the compromised user.
32	CVE-2021-21339	312	Sql	2021-03-23	2021-03-26	5.0	None	Remote	Low	Not required	Partial	None	None
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 user session identifiers were stored in cleartext - without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance SQL injection in any other component of the system. This is fixed in versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1.
33	CVE-2021-20995	312		2021-05-13	2021-05-20	5.0	None	Remote	Low	Not required	Partial	None	None
In multiple managed switches by WAGO in different versions the webserver cookies of the web based UI contain user credentials.
34	CVE-2021-20410	312		2021-02-12	2021-02-12	3.5	None	Remote	Medium	???	Partial	None	None
IBM Security Verify Information Queue 1.0.6 and 1.0.7 sends user credentials in plain clear text which can be read by an authenticated user using man in the middle techniques. IBM X-Force ID: 198190.
35	CVE-2021-20408	312		2021-02-12	2021-02-12	2.1	None	Local	Low	Not required	Partial	None	None
IBM Security Verify Information Queue 1.0.6 and 1.0.7 could disclose highly sensitive information to a local user due to inproper storage of a plaintext cryptographic key. IBM X-Force ID: 198187.
36	CVE-2021-20407	312		2021-02-12	2021-02-12	5.0	None	Remote	Low	Not required	Partial	None	None
IBM Security Verify Information Queue 1.0.6 and 1.0.7 discloses sensitive information in source code that could be used in further attacks against the system. IBM X-Force ID: 198185.
37	CVE-2021-20358	312	+Info	2021-02-08	2021-02-10	4.0	None	Remote	Low	???	Partial	None	None
IBM Cloud Pak for Automation 20.0.3, 20.0.2-IF002 stores potentially sensitive information in clear text in API connection log files. This information could be obtained by a user with permissions to read log files. IBM X-Force ID: 194965.
38	CVE-2021-3473	312		2021-04-13	2021-04-23	4.0	None	Remote	Low	???	Partial	None	None
An internal product security audit of Lenovo XClarity Controller (XCC) discovered that the XCC configuration backup/restore password may be written to an internal XCC log buffer if Lenovo XClarity Administrator (LXCA) is used to perform the backup/restore. The backup/restore password typically exists in this internal log buffer for less than 10 minutes before being overwritten. Generating an FFDC service log will include the log buffer contents, including the backup/restore password if present. The FFDC service log is only generated when requested by a privileged XCC user and it is only accessible to the privileged XCC user that requested the file. The backup/restore password is not captured if the backup/restore is initiated directly from XCC.
39	CVE-2021-1265	312		2021-01-20	2021-01-27	4.0	None	Remote	Low	???	Partial	None	None
A vulnerability in the configuration archive functionality of Cisco DNA Center could allow any privilege-level authenticated, remote attacker to obtain the full unmasked running configuration of managed devices. The vulnerability is due to the configuration archives files being stored in clear text, which can be retrieved by various API calls. An attacker could exploit this vulnerability by authenticating to the device and executing a series of API calls. A successful exploit could allow the attacker to retrieve the full unmasked running configurations of managed devices.
40	CVE-2021-0337	312		2021-02-10	2021-02-12	7.2	None	Local	Low	Not required	Complete	Complete	Complete
In moveInMediaStore of FileSystemProvider.java, there is a possible file exposure due to stale metadata. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-157474195
41	CVE-2020-36248	312	Bypass	2021-02-19	2021-02-25	2.1	None	Local	Low	Not required	Partial	None	None
The ownCloud application before 2.15 for Android allows attackers to use adb to include a PIN preferences value in a backup archive, and consequently bypass the PIN lock feature by restoring from this archive.
42	CVE-2020-29583	312		2020-12-22	2021-01-14	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.
43	CVE-2020-29550	312		2020-12-23	2020-12-29	5.0	None	Remote	Low	Not required	Partial	None	None
An issue was discovered in URVE Build 24.03.2020. The password of an integration user account (used for the connection of the MS Office 365 Integration Service) is stored in cleartext in configuration files as well as in the database. The following files contain the password in cleartext: Profiles/urve/files/sql_db.backup, Server/data/pg_wal/000000010000000A000000DD, Server/data/base/16384/18617, and Server/data/base/17202/8708746. This causes the password to be displayed as cleartext in the HTML code as roomsreservationimport_password in /urve/roomsreservationimport/roomsreservationimport/update-HTML5.
44	CVE-2020-29502	312		2021-01-05	2021-01-08	4.6	None	Local	Low	Not required	Partial	Partial	Partial
Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore X & T environments. A locally authenticated attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.
45	CVE-2020-29501	312		2021-01-05	2021-01-08	4.6	None	Local	Low	Not required	Partial	Partial	Partial
Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore X & T environments. A locally authenticated attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.
46	CVE-2020-29500	312		2021-01-05	2021-01-08	4.6	None	Local	Low	Not required	Partial	Partial	Partial
Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore T environments. A locally authenticated attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.
47	CVE-2020-29489	312	+Priv	2021-01-05	2021-01-12	4.6	None	Local	Low	Not required	Partial	Partial	Partial
Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contains a plain-text password storage vulnerability. A user credentials (including the Unisphere admin privilege user) password is stored in a plain text in a system file. A local authenticated attacker with access to the system files may use the exposed password to gain access with the privileges of the compromised user.
48	CVE-2020-29324	312		2021-06-04	2021-06-10	5.0	None	Remote	Low	Not required	Partial	None	None
The DLink Router DIR-895L MFC v1.21b05 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an unauthenticated attacker to gain access to the firmware and to extract sensitive data.
49	CVE-2020-29001	312		2021-01-26	2021-02-03	6.5	None	Remote	Low	???	Partial	Partial	Partial
An issue was discovered on Geeni GNC-CW028 Camera 2.7.2, Geeni GNC-CW025 Doorbell 2.9.5, Merkury MI-CW024 Doorbell 2.9.6, and Merkury MI-CW017 Camera 2.9.6 devices. A vulnerability exists in the RESTful Services API that allows a remote attacker to take full control of the camera with a high-privileged account. The vulnerability exists because a static username and password are compiled into the ppsapp RESTful application.
50	CVE-2020-28917	312		2020-11-18	2020-12-02	4.0	None	Remote	Low	???	Partial	None	None
An issue was discovered in the view_statistics (aka View frontend statistics) extension before 2.0.1 for TYPO3. It saves all GET and POST data of TYPO3 frontend requests to the database. Depending on the extensions used on a TYPO3 website, sensitive data (e.g., cleartext passwords if ext:felogin is installed) may be saved.

Total number of vulnerabilities : 197 Page : 1 (This Page)2 3 4