Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
160 results · page 1 of 4
Oct 13, 2026Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext passwords because UserServiceImpl.registerCVE-2026-110104 · Other software · xxyopen · reported by VulnCheckHigh 8.2
Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext passwords because UserServiceImpl.register() stores unsalted MD5 digests in user_info.password. Attackers who obtain the password column through a database leak or backup exposure can crack hashes with precomputed tables or GPU brute force and reuse credentials.
- Product
- novel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026Simple Membership: Does not avoid transmitting a newly registered member's plaintext password in a URL query stringCVE-2026-88785 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an optional auto-login-after-registration feature is enabled, exposing the credential in browser history and in web server, proxy, and CDN access logs to anyone able to read them.
- Product
- Simple Membership
- Fixed in
- 4.8.3
- What to do
- Update Simple Membership to 4.8.3 or newer.
Aug 5, 2026ESPHome through 2026.7.0-dev discloses plaintext passwords via its web_server component.CVE-2026-71260 · Other software · esphome · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cMedium 6.5
ESPHome through 2026.7.0-dev discloses plaintext passwords via its web_server component. In WebServer::text_json_ (esphome/components/web_server/web_server.cpp), a text entity configured with mode: password (TEXT_MODE_PASSWORD) has its JSON "state" field correctly masked as "********", but the same serialization path unconditionally writes the raw password into the JSON "value" field via set_json_icon_state_value/set_json_value.
- Product
- esphome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026Dell VxRail versions before 7.0.200 contain a Plain-text Password Storage Vulnerability in VxRail Manager.CVE-2021-21508 · Other software · Dell · reported by security_alert@emc.comMedium 6.7
Dell VxRail versions before 7.0.200 contain a Plain-text Password Storage Vulnerability in VxRail Manager. A sys-admin user may exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.
- Product
- VxRail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddellservices.lightning.force.com
May 14, 2026SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection.CVE-2026-46446 · Other software · Alinto · reported by MITREHigh 7.1
SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to c_password = '%@' in changePasswordForLogin.
- Product
- SOGo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commail-archive.com
Apr 21, 2026Changing backend users' passwords via the user settings module results in storing the cleartext password in the uc and user_settings fields of the be_users dataCVE-2026-6553 · Other software · TYPO3 · reported by f4fb688c-4412-4426-b4b8-421ecf27b14aHigh 7.3
Changing backend users' passwords via the user settings module results in storing the cleartext password in the uc and user_settings fields of the be_users database table. This issue affects TYPO3 CMS version 14.2.0.
- Product
- TYPO3 CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data set_new_password() hCVE-2026-23370 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data set_new_password() hex dumps the entire buffer, which contains plaintext password data, including current and new passwords. Remove the hex dump to avoid leaking credentials.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Mar 10, 2026An unauthenticated remote attacker can use firmware images to extract password hashes and brute force plaintext passwords of accounts with limited access.CVE-2025-41711 · Other software · Janitza · reported by info@cert.vde.comMedium 5.3
An unauthenticated remote attacker can use firmware images to extract password hashes and brute force plaintext passwords of accounts with limited access.
- Product
- UMG 96RM-E 24V(5222063)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.comcertvde.com
Jan 7, 2026FaceSentry Access Control System 6.4.8 contains a cleartext password storage vulnerability that allows attackers to access unencrypted credentials in the deviceCVE-2019-25279 · Other software · iWT Ltd. · reported by VulnCheckMedium 6.8
FaceSentry Access Control System 6.4.8 contains a cleartext password storage vulnerability that allows attackers to access unencrypted credentials in the device's SQLite database. Attackers can directly read sensitive login information stored in /faceGuard/database/FaceSentryWeb.sqlite without additional authentication.
- Product
- FaceSentry Access Control System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.compacketstormsecurity.com
Dec 19, 2025Turms Server v0.10.0-SNAPSHOT and earlier contains a plaintext password storage vulnerability in the administrator authentication system.CVE-2025-66910 · Other software · Turms-im · reported by MITREMedium 6
Turms Server v0.10.0-SNAPSHOT and earlier contains a plaintext password storage vulnerability in the administrator authentication system. The BaseAdminService class caches administrator passwords in plaintext within AdminInfo objects to optimize authentication performance. Upon successful login, raw passwords are stored unencrypted in memory in the rawPassword field. Attackers with local system access can extract these passwords through memory dumps, heap analysis, or debugger attachment, bypassing bcrypt protection.
- Product
- Turms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2025Medtronic CareLink Network allows a local attacker with access to log files on an internal API server to view plaintext passwords from errors logged under certaCVE-2025-12996 · Other software · Medtronic · reported by security@medtronic.comMedium 4.1
Medtronic CareLink Network allows a local attacker with access to log files on an internal API server to view plaintext passwords from errors logged under certain circumstances. This issue affects CareLink Network: before December 4, 2025.
- Product
- CareLink Network
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2025Plaintext password storage in Kotaemon 0.11.0 in the client's localStorage.CVE-2025-56527 · Other software · Cinnamon · reported by MITREHigh 7.5
Plaintext password storage in Kotaemon 0.11.0 in the client's localStorage.
- Product
- Kotaemon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2025An authenticated user can disclose the cleartext password of a configured SMTP server via an HTTP GET request to the /config.php endpoint.CVE-2025-48046 · Other software · MICI Network Co. Ltd. · reported by cve@rapid7.comMedium 5.3
An authenticated user can disclose the cleartext password of a configured SMTP server via an HTTP GET request to the /config.php endpoint.
- Product
- NetFax Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2025A vulnerability in the users configuration file of ctrlX OS may allow a remote authenticated (low-privileged) attacker to recover the plaintext passwords of othCVE-2025-24340 · Other software · Bosch Rexroth AG · reported by psirt@bosch.comMedium 6.5
A vulnerability in the users configuration file of ctrlX OS may allow a remote authenticated (low-privileged) attacker to recover the plaintext passwords of other users.
- Product
- ctrlX OS - Device Admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2025BEC Technologies Multiple Routers Cleartext Password Storage Information Disclosure Vulnerability.CVE-2025-2770 · Other software · BEC Technologies · reported by zdi-disclosures@trendmicro.comMedium 6.5
BEC Technologies Multiple Routers Cleartext Password Storage Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of BEC Technologies routers. Authentication is required to exploit this vulnerability. The specific flaw exists within the web-based user interface. The issue results from storing credentials in a recoverable format. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-25986.
- Product
- Multiple Routers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2025Arctera eDiscovery Platform before 10.3.2, when Enterprise Vault Collection Module is used, places a cleartext password on a command line in EVSearcher.CVE-2025-32987 · Other software · Arctera · reported by MITREMedium 6
Arctera eDiscovery Platform before 10.3.2, when Enterprise Vault Collection Module is used, places a cleartext password on a command line in EVSearcher.
- Product
- eDiscovery Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2024Insufficiently Protected Credentials in the Mail Server Configuration in GoPhish v0.12.1 allows an attacker to access cleartext passwords for the configured IMACVE-2024-55196 · Other software · reported by MITREHigh 7.5
Insufficiently Protected Credentials in the Mail Server Configuration in GoPhish v0.12.1 allows an attacker to access cleartext passwords for the configured IMAP and SMTP servers.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024Dell VxVerify, versions prior to x.40.405, contain a Plain-text Password Storage Vulnerability in the shell wrapper.CVE-2024-53292 · Other software · Dell · reported by security_alert@emc.comHigh 7.2
Dell VxVerify, versions prior to x.40.405, contain a Plain-text Password Storage Vulnerability in the shell wrapper. A local high privileged attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable component with privileges of the compromised account.
- Product
- Dell VxRail HCI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2024Yealink Meeting Server before V26.0.0.67 allows attackers to obtain static key information from a front-end JS file and decrypt the plaintext passwords based onCVE-2024-48353 · Other software · yealink · reported by MITREHigh 7.5
Yealink Meeting Server before V26.0.0.67 allows attackers to obtain static key information from a front-end JS file and decrypt the plaintext passwords based on the obtained key information.
- Product
- meeting_server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2024In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes plaintext passwords for local native authentication Splunk users.CVE-2024-45739 · Other software · Splunk · reported by prodsec@splunk.comMedium 4.9
In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes plaintext passwords for local native authentication Splunk users. This exposure could happen when you configure the Splunk Enterprise AdminManager log channel at the DEBUG logging level.
- Product
- Splunk Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisory.splunk.comresearch.splunk.com
Aug 12, 2024The front-end audit log allows viewing of unprotected plaintext passwords, where the passwords are displayed in plain text.CVE-2024-36460 · Other software · Zabbix · reported by security@zabbix.comHigh 8.1
The front-end audit log allows viewing of unprotected plaintext passwords, where the passwords are displayed in plain text.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.zabbix.comlists.debian.org
Jul 30, 2024Weak password hashing using MD5 in funzioni.php in HotelDruid before 1.32 allows an attacker to obtain plaintext passwords from hash values.CVE-2024-23091 · Other software · Digitaldruid · reported by MITREHigh 7.5
Weak password hashing using MD5 in funzioni.php in HotelDruid before 1.32 allows an attacker to obtain plaintext passwords from hash values.
- Product
- Hoteldruid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comhoteldruid.com
Jul 26, 2024An issue in Solar-Log 1000 before v2.8.2 and build 52-23.04.2013 was discovered to store plaintext passwords in the export.html, email.html, and sms.html files CVE-2024-40116 · Other software · solar-log · reported by MITREHigh 8.1
An issue in Solar-Log 1000 before v2.8.2 and build 52-23.04.2013 was discovered to store plaintext passwords in the export.html, email.html, and sms.html files -- fixed with 3.0.0-60 11.10.2013 for SL 200, 500, 1000 / not existing for SL 250, 300, 1200, 2000, SL 50 Gateway, SL Base.
- Product
- solar-log_1000_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsolar-log.com
May 19, 2024Westermo EDW-100 devices through 2024-05-03 allow an unauthenticated user to download a configuration file containing a cleartext password.CVE-2024-36081 · Other software · westermo · reported by MITRECritical 9.8
Westermo EDW-100 devices through 2024-05-03 allow an unauthenticated user to download a configuration file containing a cleartext password. NOTE: this is a serial-to-Ethernet converter that should not be placed at the edge of the network.
- Product
- edw-100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwestermo.comwestermo.com
May 8, 2024Dell Update Manager Plugin, versions 1.4.0 through 1.5.0, contains a Plain-text Password Storage Vulnerability in Log file.CVE-2024-28971 · Other software · Dell · reported by security_alert@emc.comLow 3.5
Dell Update Manager Plugin, versions 1.4.0 through 1.5.0, contains a Plain-text Password Storage Vulnerability in Log file. A remote high privileged attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.
- Product
- Update Manager Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2024In KDE libksieve before 23.03.80, kmanagesieve/session.cpp places a cleartext password in server logs because a username variable is accidentally given a passwoCVE-2023-52723 · Other software · kde · reported by MITREHigh 7.1
In KDE libksieve before 23.03.80, kmanagesieve/session.cpp places a cleartext password in server logs because a username variable is accidentally given a password value.
- Product
- libksieve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.cominvent.kde.org
Jan 25, 2024 Networker 19.9 and all prior versions contains a Plain-text Password stored in temporary config file during backup duration in NMDA MySQL Database backups.CVE-2024-22432 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Networker 19.9 and all prior versions contains a Plain-text Password stored in temporary config file during backup duration in NMDA MySQL Database backups. User has low privilege access to Networker Client system could potentially exploit this vulnerability, leading to the disclosure of configured MySQL Database user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application Database with privileges of the compromised account.
- Product
- NetWorker Module for Databases and Applications - Oracle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2023 IBM i 7.3, 7.4, 7.5, IBM i Db2 Mirror for i 7.4 and 7.5 web browser clients may leave clear-text passwords in browser memory that can be viewed using common brCVE-2023-47741 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM i 7.3, 7.4, 7.5, IBM i Db2 Mirror for i 7.4 and 7.5 web browser clients may leave clear-text passwords in browser memory that can be viewed using common browser tools before the memory is garbage collected. A malicious actor with access to the victim's PC could exploit this vulnerability to gain access to the IBM i operating system. IBM X-Force ID: 272532.
- Product
- i
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2023 Dell DM5500 5.14.0.0, contain a Plain-text Password Storage Vulnerability in the appliance.CVE-2023-44300 · Other software · Dell · reported by security_alert@emc.comMedium 5.5
Dell DM5500 5.14.0.0, contain a Plain-text Password Storage Vulnerability in the appliance. A local attacker with privileges could potentially exploit this vulnerability, leading to the disclosure of certain service credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.
- Product
- Dell PowerProtect Data Manager DM5500 Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2023A Vulnerability in OTRS AgentInterface and ExternalInterface allows the reading of plain text passwords which are send back to the client in the server responseCVE-2023-6254 · Other software · OTRS AG · reported by security@otrs.comHigh 8.1
A Vulnerability in OTRS AgentInterface and ExternalInterface allows the reading of plain text passwords which are send back to the client in the server response- This issue affects OTRS: from 8.0.X through 8.0.37.
- Product
- OTRS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2023The 'check_univention_joinstatus' prometheus monitoring script (and other scripts) in UCS 5.0-5 revealed the LDAP plaintext password of the machine account in tCVE-2023-38994 · Other software · Univention · reported by MITREHigh 7.9
The 'check_univention_joinstatus' prometheus monitoring script (and other scripts) in UCS 5.0-5 revealed the LDAP plaintext password of the machine account in the process list allowing attackers with local ssh access to gain higher privileges and perform followup attacks. By default, the configuration of UCS does not allow local ssh access for regular users.
- Product
- Univention Corporate Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforge.univention.orgforge.univention.org
Oct 17, 2023TSplus Remote Work 16.0.0.0 places a cleartext password on the "var pass" line of the HTML source code for the secure single sign-on web portal.CVE-2023-27132 · Other software · Tsplus · reported by MITRECritical 9.8
TSplus Remote Work 16.0.0.0 places a cleartext password on the "var pass" line of the HTML source code for the secure single sign-on web portal. NOTE: CVE-2023-31069 is only about the TSplus Remote Access product, not the TSplus Remote Work product.
- Product
- Tsplus Remote Work
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 10, 2023An insertion of sensitive information into log file vulnerability in Fortinet FortiGuest 1.0.0 allows a local attacker to access plaintext passwords in the RADICVE-2023-25604 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 5.5
An insertion of sensitive information into log file vulnerability in Fortinet FortiGuest 1.0.0 allows a local attacker to access plaintext passwords in the RADIUS logs.
- Product
- FortiGuest
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Aug 11, 2023Plaintext Password vulnerability in AddAdmin.py in cms-dev/cms v1.4.rc1, allows attackers to gain sensitive information via audit logs.CVE-2020-24804 · Other software · Cms-dev · reported by MITREMedium 6.5
Plaintext Password vulnerability in AddAdmin.py in cms-dev/cms v1.4.rc1, allows attackers to gain sensitive information via audit logs.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2023 Plaintext Password in Registry vulnerability in 42gears surelock windows surelockwinsetupv2.40.0.Exe on Windows (Registery modules) allows Retrieve Admin uCVE-2023-2335 · Other software · 42gears · reported by security@42gears.comMedium 6.5
Plaintext Password in Registry vulnerability in 42gears surelock windows surelockwinsetupv2.40.0.Exe on Windows (Registery modules) allows Retrieve Admin user credentials This issue affects surelock windows: from 2.3.12 through 2.40.0.
- Product
- surelock windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record42gears.com42gears.com
Jan 21, 2023KeePass through 2.53 (in a default installation) allows an attacker, who has write access to the XML configuration file, to obtain the cleartext passwords by adCVE-2023-24055 · Other software · Keepass · reported by MITREMedium 5.5
KeePass through 2.53 (in a default installation) allows an attacker, who has write access to the XML configuration file, to obtain the cleartext passwords by adding an export trigger. NOTE: the vendor's position is that the password database is not intended to be secure against an attacker who has that level of access to the local PC.
- Product
- Keepass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityboulevard.comsourceforge.net
Nov 28, 2022The /device/signin end-point for the Ourphoto App version 1.4.1 discloses clear-text password information for functionality within the picture frame devices.CVE-2022-24188 · Other software · Sz-fujia · reported by MITREHigh 7.5
The /device/signin end-point for the Ourphoto App version 1.4.1 discloses clear-text password information for functionality within the picture frame devices. The deviceVideoCallPassword and mqttPassword are returned in clear-text. The lack of sessions management and presence of insecure direct object references allows to return password information for other end-users devices. Many of the picture frame devices offer video calling, and it is likely this information can be used to abuse that functionality.
- Product
- Ourphoto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordscrawledsecurityblog.comscrawledsecurityblog.com
Oct 19, 2022A flaw was found in ovirt-engine, which leads to the logging of plaintext passwords in the log file when using otapi-style.CVE-2022-2805 · Other software · Redhat · reported by Red HatMedium 6.5
A flaw was found in ovirt-engine, which leads to the logging of plaintext passwords in the log file when using otapi-style. This flaw allows an attacker with sufficient privileges to read the log file, leading to confidentiality loss.
- Product
- Virtualization
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Sep 13, 2022The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to fetch cleartext passwords upon a successful login requeCVE-2022-38769 · Other software · Transtek · reported by MITREHigh 7.5
The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to fetch cleartext passwords upon a successful login request.
- Product
- Mojodat Fixed Asset Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmojodat-vulnerabilities.netlify.apptranstek.com
Aug 10, 2022Dell Wyse Management Suite 3.6.1 and below contains an Plain-text Password Storage Vulnerability in UI.CVE-2022-33928 · Other software · Dell · reported by security_alert@emc.comMedium 6.4
Dell Wyse Management Suite 3.6.1 and below contains an Plain-text Password Storage Vulnerability in UI. An attacker with low privileges could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.
- Product
- Wyse Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2022Omron CS series, CJ series, and CP series PLCs through 2022-05-18 use cleartext passwords.CVE-2022-31204 · Other software · Omron · reported by MITREHigh 7.5
Omron CS series, CJ series, and CP series PLCs through 2022-05-18 use cleartext passwords. They feature a UM Protection setting that allows users or system integrators to configure a password in order to restrict sensitive engineering operations (such as project/logic uploads and downloads). This password is set using the OMRON FINS command Program Area Protect and unset using the command Program Area Protect Clear, both of which are transmitted in cleartext.
- Product
- Sysmac Cs1 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2022The Motorola MOSCAD Toolbox software through 2022-05-02 relies on a cleartext password.CVE-2022-30275 · Other software · Motorolasolutions · reported by MITREHigh 7.5
The Motorola MOSCAD Toolbox software through 2022-05-02 relies on a cleartext password. It utilizes an MDLC driver to communicate with MOSCAD/ACE RTUs for engineering purposes. Access to these communications is protected by a password stored in cleartext in the wmdlcdrv.ini driver configuration file. In addition, this password is used for access control to MOSCAD/STS projects protected with the Legacy Password feature. In this case, an insecure CRC of the password is present in the project file: this CRC is validated against the password in the driver configuration file.
- Product
- Mdlc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2022FileZilla v3.59.0 allows attackers to obtain cleartext passwords of connected SSH or FTP servers via a memory dump.- NOTE: the vendor does not consider this a vCVE-2022-29620 · Other software · Filezilla-project · reported by MITREMedium 6.5
FileZilla v3.59.0 allows attackers to obtain cleartext passwords of connected SSH or FTP servers via a memory dump.- NOTE: the vendor does not consider this a vulnerability
- Product
- Filezilla Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwhichbuffer.medium.comyoutu.be
Jun 2, 2022Dell Unity, Dell UnityVSA, and Dell Unity XT versions prior to 5.2.0.0.5.173 contain a plain-text password storage vulnerability when certain off-array tools arCVE-2022-29085 · Other software · Dell · reported by security_alert@emc.comMedium 6.4
Dell Unity, Dell UnityVSA, and Dell Unity XT versions prior to 5.2.0.0.5.173 contain a plain-text password storage vulnerability when certain off-array tools are run on the system. The credentials of a user with high privileges are stored in plain text. A local malicious user with high privileges may use the exposed password to gain access with the privileges of the compromised user.
- Product
- Unity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022PowerStore contains Plain-Text Password Storage Vulnerability in PowerStore X & T environments running versions 2.0.0.x and 2.0.1.x A locally authenticated attaCVE-2022-22557 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
PowerStore contains Plain-Text Password Storage Vulnerability in PowerStore X & T environments running versions 2.0.0.x and 2.0.1.x A locally authenticated attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.
- Product
- PowerStore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2022Konica Minolta bizhub MFP devices before 2022-04-14 use cleartext password storage for the /var/log/nginx/html/ADMINPASS and /etc/shadow files.CVE-2022-29588 · Other software · Konicaminolta · reported by MITREHigh 7.5
Konica Minolta bizhub MFP devices before 2022-04-14 use cleartext password storage for the /var/log/nginx/html/ADMINPASS and /etc/shadow files.
- Product
- Bizhub 226i Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsec-consult.com
Apr 21, 2022Dell EMC Repository Manager version 3.4.0 contains a plain-text password storage vulnerability.CVE-2022-26856 · Other software · Dell · reported by security_alert@emc.comHigh 8.2
Dell EMC Repository Manager version 3.4.0 contains a plain-text password storage vulnerability. A local attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application's database with privileges of the compromised account.
- Product
- Dell Repository Manager (DRM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 20223CX System through 2022-03-17 stores cleartext passwords in a database.CVE-2021-45491 · Other software · 3cx · reported by MITREMedium 6.5
3CX System through 2022-03-17 stores cleartext passwords in a database.
- Product
- 3cx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.com3cx.com
Mar 4, 2022Dell EMC Enterprise Storage Analytics for vRealize Operations, versions 4.0.1 to 6.2.1, contain a Plain-text password storage vulnerability.CVE-2021-43590 · Other software · Dell · reported by security_alert@emc.comMedium 6
Dell EMC Enterprise Storage Analytics for vRealize Operations, versions 4.0.1 to 6.2.1, contain a Plain-text password storage vulnerability. A local high privileged malicious user may potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.
- Product
- Dell EMC Enterprise Storage Analytics for vRealize Operations
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2021Dell EMC Avamar versions 18.2,19.1,19.2,19.3,19.4 contain a plain-text password storage vulnerability.CVE-2021-36318 · Other software · Dell · reported by security_alert@emc.comMedium 6.7
Dell EMC Avamar versions 18.2,19.1,19.2,19.3,19.4 contain a plain-text password storage vulnerability. A high privileged user could potentially exploit this vulnerability, leading to a complete outage.
- Product
- Avamar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gentoo.orgdell.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.