Threats Tagged 'cwe-312'

Cleartext storage of sensitive information in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data.

Cleartext storage of sensitive information vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows SQL Injection. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.

Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromised device to Retrieve Sensitive Data. This issue affects XAAP Application: before 1.53.

Spring Tools for Eclipse versions 5.2.0 and earlier store the Spring Boot DevTools remote secret in cleartext within launch configuration files. These files are saved as XML in the workspace metadata or project directories, potentially exposing the secret if accessed via filesystem, backups, or version control. The secret protects the remote restart/reload endpoint, which can execute arbitrary class bytes on the target application. Exposure of this secret could allow an attacker with read access to achieve remote code execution. The vulnerability has a medium severity with a CVSS score of 4.4.

The web management interface in  Tycon Systems TPDIN-Monitor-WEB2 stores and displays system credentials in cleartext on a certain configuration page accessible to authenticated users. Any party with access to the administrative dashboard can immediately read these credentials, which may be used to compromise other systems on the local network.

Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file system access to read secret values via secret variables stored in cleartext on disk when no vault is selected.

Information disclosure in Bosch Configuration Manager in Version 7.72.0106 allows an attacker to access sensitive information.

VSee Clinic version 7.1.26 and VSee Clinic API 1.3.0 expose cleartext SFTP credentials in HTTP responses from three unauthenticated endpoints when SFTP is configured. These credentials can be retrieved without authentication, allowing an attacker to access the associated SFTP server. This vulnerability is classified under CWE-201 and CWE-312 and has a critical severity with a CVSS score of 9. No official patch or remediation guidance is currently available.