Filtered by CWE-312
Filtered by vendor Subscriptions
Total 797 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-44649 1 Trendnet 2 Tew-wlc100p, Tew-wlc100p Firmware 2025-08-07 7.5 High
In the configuration file of racoon in the TRENDnet TEW-WLC100P 2.03b03, the first item of exchage_mode is set to aggressive. Aggressive mode in IKE Phase 1 exposes identity information in plaintext, is vulnerable to offline dictionary attacks, and lacks flexibility in negotiating security parameters.
CVE-2025-50777 1 Aziot 2 2mp Full Hd Smart Wi-fi Cctv Home Security Camera, 2mp Full Hd Smart Wi-fi Cctv Home Security Camera Firmware 2025-08-06 7.8 High
The firmware of the AZIOT 2MP Full HD Smart Wi-Fi CCTV Home Security Camera (version V1.00.02) contains an Incorrect Access Control vulnerability that allows local attackers to gain root shell access. Once accessed, the device exposes critical data including Wi-Fi credentials and ONVIF service credentials stored in plaintext, enabling further compromise of the network and connected systems.
CVE-2025-54422 2 Sandboxie, Sandboxie-plus 2 Sandboxie, Sandboxie 2025-08-04 5.5 Medium
Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. In versions 1.16.1 and below, a critical security vulnerability exists in password handling mechanisms. During encrypted sandbox creation, user passwords are transmitted via shared memory, exposing them to potential interception. The vulnerability is particularly severe during password modification operations, where both old and new passwords are passed as plaintext command-line arguments to the Imbox process without any encryption or obfuscation. This implementation flaw allows any process within the user session, including unprivileged processes, to retrieve these sensitive credentials by reading the command-line arguments, thereby bypassing standard privilege requirements and creating a significant security risk. This is fixed in version 1.16.2.
CVE-2025-54538 1 Jetbrains 1 Teamcity 2025-07-29 5.5 Medium
In JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg pull" command
CVE-2025-54537 1 Jetbrains 1 Teamcity 2025-07-29 5.5 Medium
In JetBrains TeamCity before 2025.07 user credentials were stored in plain text in memory snapshots
CVE-2021-39077 2 Ibm, Linux 2 Security Guardium, Linux Kernel 2025-07-24 4.4 Medium
IBM Security Guardium 10.5, 10.6, 11.0, 11.1, 11.2, 11.3, and 11.4 stores user credentials in plain clear text which can be read by a local privileged user. IBM X-Force ID: 215587.
CVE-2023-20059 1 Cisco 1 Catalyst Center 2025-07-23 4.3 Medium
A vulnerability in the implementation of the Cisco Network Plug-and-Play (PnP) agent of Cisco DNA Center could allow an authenticated, remote attacker to view sensitive information in clear text. The attacker must have valid low-privileged user credentials. This vulnerability is due to improper role-based access control (RBAC) with the integration of PnP. An attacker could exploit this vulnerability by authenticating to the device and sending a query to an internal API. A successful exploit could allow the attacker to view sensitive information in clear text, which could include configuration files.
CVE-2021-1265 1 Cisco 1 Catalyst Center 2025-07-23 6.5 Medium
A vulnerability in the configuration archive functionality of Cisco DNA Center could allow any privilege-level authenticated, remote attacker to obtain the full unmasked running configuration of managed devices. The vulnerability is due to the configuration archives files being stored in clear text, which can be retrieved by various API calls. An attacker could exploit this vulnerability by authenticating to the device and executing a series of API calls. A successful exploit could allow the attacker to retrieve the full unmasked running configurations of managed devices.
CVE-2025-2120 1 Thinkware 2 F800 Pro, F800 Pro Firmware 2025-07-22 2.1 Low
A vulnerability was found in Thinkware Car Dashcam F800 Pro up to 20250226. It has been rated as problematic. This issue affects some unknown processing of the file /tmp/hostapd.conf of the component Configuration File Handler. The manipulation leads to cleartext storage in a file or on disk. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-44614 1 Tinxy 2 Wifi Lock Controller V1 Rf, Wifi Lock Controller V1 Rf Firmware 2025-07-22 7.5 High
Tinxy WiFi Lock Controller v1 RF was discovered to store users' sensitive information, including credentials and mobile phone numbers, in plaintext.
CVE-2025-48463 1 Advantech 6 Wise-4010lan, Wise-4010lan Firmware, Wise-4050lan and 3 more 2025-07-09 3.1 Low
Successful exploitation of the vulnerability could allow an attacker to intercept data and conduct session hijacking on the exposed data as the vulnerable product uses unencrypted HTTP communication, potentially leading to unauthorised access or data tampering.
CVE-2025-4537 1 Ruoyi 1 Ruoyi-vue 2025-07-08 3.1 Low
A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.8.9 and classified as problematic. Affected by this issue is some unknown functionality of the file ruoyi-ui/jsencrypt.js and ruoyi-ui/login.vue of the component Password Handler. The manipulation leads to cleartext storage of sensitive information in a cookie. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
CVE-2022-22031 1 Microsoft 13 Windows 10, Windows 10 1507, Windows 10 1607 and 10 more 2025-07-08 7.8 High
Windows Credential Guard Domain-joined Public Key Elevation of Privilege Vulnerability
CVE-2024-40750 1 Linksys 4 Mbe7000, Mbe7000 Firmware, Mx6200 and 1 more 2025-06-30 5.3 Medium
Linksys Velop Pro 6E 1.0.8 MX6200_1.0.8.215731 and 7 1.0.10.215314 devices send cleartext Wi-Fi passwords over the public Internet during app-based installation.
CVE-2024-56428 1 Itech-gmbh 1 Ilabclient 2025-06-25 5.5 Medium
The local iLabClient database in itech iLabClient 3.7.1 allows local attackers to read cleartext credentials (from the CONFIGS table) for their servers configured in the client.
CVE-2025-32752 1 Dell 1 Thinos 2025-06-24 5.7 Medium
Dell ThinOS 2502 and prior contain a Cleartext Storage of Sensitive Information vulnerability. A high privileged attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure.
CVE-2025-27622 1 Jenkins 1 Jenkins 2025-06-24 4.3 Medium
Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of agents via REST API or CLI, allowing attackers with Agent/Extended Read permission to view encrypted values of secrets.
CVE-2025-27623 1 Jenkins 1 Jenkins 2025-06-24 4.3 Medium
Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of views via REST API or CLI, allowing attackers with View/Read permission to view encrypted values of secrets.
CVE-2025-45001 1 Numan 1 React-native-keys 2025-06-23 7.5 High
react-native-keys 0.7.11 is vulnerable to sensitive information disclosure (remote) as encryption cipher and Base64 chunks are stored as plaintext in the compiled native binary. Attackers can extract these secrets using basic static analysis tools.
CVE-2024-46340 1 Tp-link 2 Tl-wr845n, Tl-wr845n Firmware 2025-06-20 9.8 Critical
TL-WR845N(UN)_V4_201214, TP-Link TL-WR845N(UN)_V4_200909, and TL-WR845N(UN)_V4_190219 was discovered to transmit user credentials in plaintext after executing a factory reset.