Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2022-2513

Summary
Assigner-Hitachi Energy
Assigner Org ID-e383dce4-0c27-4495-91c4-0db157728d17
Published At-22 Nov, 2022 | 10:30
Updated At-27 Aug, 2025 | 20:32
Rejected At-
Credits

Cleartext Credentials Vulnerability on Hitachi Energy’s Multiple IED Connectivity Packages (IED ConnPacks) and PCM600 Products

A vulnerability exists in the Intelligent Electronic Device (IED) Connectivity Package (ConnPack) credential storage function in Hitachi Energy’s PCM600 product included in the versions listed below, where IEDs credentials are stored in a cleartext format in the PCM600 database and logs files. An attacker having get access to the exported backup file can exploit the vulnerability and obtain user credentials of the IEDs. Additionally, an attacker with administrator access to the PCM600 host machine can obtain other user credentials by analyzing database log files. The credentials may be used to perform unauthorized modifications such as loading incorrect configurations, reboot the IEDs or cause a denial-of-service on the IEDs.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:Hitachi Energy
Assigner Org ID:e383dce4-0c27-4495-91c4-0db157728d17
Published At:22 Nov, 2022 | 10:30
Updated At:27 Aug, 2025 | 20:32
Rejected At:
▼CVE Numbering Authority (CNA)
Cleartext Credentials Vulnerability on Hitachi Energy’s Multiple IED Connectivity Packages (IED ConnPacks) and PCM600 Products

A vulnerability exists in the Intelligent Electronic Device (IED) Connectivity Package (ConnPack) credential storage function in Hitachi Energy’s PCM600 product included in the versions listed below, where IEDs credentials are stored in a cleartext format in the PCM600 database and logs files. An attacker having get access to the exported backup file can exploit the vulnerability and obtain user credentials of the IEDs. Additionally, an attacker with administrator access to the PCM600 host machine can obtain other user credentials by analyzing database log files. The credentials may be used to perform unauthorized modifications such as loading incorrect configurations, reboot the IEDs or cause a denial-of-service on the IEDs.

Affected Products
Vendor
Hitachi Energy Ltd.Hitachi Energy
Product
PCM600
Default Status
unaffected
Versions
Affected
  • From v2.6 through 2.11 Hotfix 20220617 (custom)
Vendor
Hitachi Energy Ltd.Hitachi Energy
Product
670 Connectivity Package
Default Status
unaffected
Versions
Affected
  • From 3.0 through 3.4.1 (semver)
Vendor
Hitachi Energy Ltd.Hitachi Energy
Product
650 Connectivity Package
Default Status
unaffected
Versions
Affected
  • From 1.3 through 2.4.1 (semver)
Vendor
Hitachi Energy Ltd.Hitachi Energy
Product
SAM600-IO Connectivity Package
Default Status
unaffected
Versions
Affected
  • From 1.0 through 1.2 (semver)
Vendor
Hitachi Energy Ltd.Hitachi Energy
Product
GMS600 Connectivity Package
Default Status
unaffected
Versions
Affected
  • From 1.3 through 1.3.1 (semver)
Vendor
Hitachi Energy Ltd.Hitachi Energy
Product
PWC600 Connectivity Package
Default Status
unaffected
Versions
Affected
  • From 1.1 through 1.3 (semver)
Problem Types
TypeCWE IDDescription
CWECWE-312CWE-312 Cleartext Storage of Sensitive Information
Type: CWE
CWE ID: CWE-312
Description: CWE-312 Cleartext Storage of Sensitive Information
Metrics
VersionBase scoreBase severityVector
3.17.1HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Version: 3.1
Base score: 7.1
Base severity: HIGH
Vector:
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Metrics Other Info
Impacts
CAPEC IDDescription
CAPEC-37CAPEC-37 Retrieve Embedded Sensitive Data
CAPEC ID: CAPEC-37
Description: CAPEC-37 Retrieve Embedded Sensitive Data
Solutions

Update to PCM600 v2.11 Hotfix 20240426 or apply mitigation factors/workarounds as described in the Mitigation Factors/Workarounds Section. List of CPEs:  cpe:2.3:a:hitachienergy:pcm600:*:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:670ConnectivityPackage:3.4.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:670ConnectivityPackage:3.3.0:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:670ConnectivityPackage:3.2.6:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:670ConnectivityPackage:3.1.2:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:670ConnectivityPackage:3.0.2:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:650ConnectivityPackage:2.4.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:650ConnectivityPackage:2.3.0:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:650ConnectivityPackage:2.2.2:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:650ConnectivityPackage:2.1.2:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:650ConnectivityPackage:1.3.0:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:sam600ioConnectivityPackage:1.2.0:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:sam600ioConnectivityPackage:1.1.0:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:sam600ioConnectivityPackage:1.0.0:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:pwc600ConnectivityPackage:1.3.0:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:pwc600ConnectivityPackage:1.2.0:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:pwc600ConnectivityPackage:1.1.2:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:pwc600ConnectivityPackage:1.1.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:pwc600ConnectivityPackage:1.1.0:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:gms600ConnectivityPackage:1.3.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:gms600ConnectivityPackage:1.3.0:*:*:*:*:*:*:*

Configurations

Workarounds

It is recommended to implement and continuously revise least privileges principles to minimize permissions and accesses to PCM600 related resources, included the backup file, PCMI/PCMP file. Recommended security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system. An additional recommendation is to follow the hardening guidelines published by “The Center for Internet Security (CIS)” https://www.cisecurity.org/about-us/ to protect the host Operating System. More information to deploy PCM600 securely can be found in the following documents: 1MRS758440, PCM600 Cyber Security Deployment Guideline

Exploits

Credits

reporter
PSE - Polskie Sieci Elektroenergetyczne (Polish Power Grid Company (PPGC))
Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://publisher.hitachienergy.com/preview?DocumentID=8DBD000120&LanguageCode=en&DocumentPartId=&Action=Launch
N/A
Hyperlink: https://publisher.hitachienergy.com/preview?DocumentID=8DBD000120&LanguageCode=en&DocumentPartId=&Action=Launch
Resource: N/A
▼Authorized Data Publishers (ADP)
1. CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://publisher.hitachienergy.com/preview?DocumentID=8DBD000120&LanguageCode=en&DocumentPartId=&Action=Launch
x_transferred
Hyperlink: https://publisher.hitachienergy.com/preview?DocumentID=8DBD000120&LanguageCode=en&DocumentPartId=&Action=Launch
Resource:
x_transferred
2. CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:cybersecurity@hitachienergy.com
Published At:22 Nov, 2022 | 11:15
Updated At:28 May, 2024 | 11:15

A vulnerability exists in the Intelligent Electronic Device (IED) Connectivity Package (ConnPack) credential storage function in Hitachi Energy’s PCM600 product included in the versions listed below, where IEDs credentials are stored in a cleartext format in the PCM600 database and logs files. An attacker having get access to the exported backup file can exploit the vulnerability and obtain user credentials of the IEDs. Additionally, an attacker with administrator access to the PCM600 host machine can obtain other user credentials by analyzing database log files. The credentials may be used to perform unauthorized modifications such as loading incorrect configurations, reboot the IEDs or cause a denial-of-service on the IEDs.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary3.15.5MEDIUM
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Secondary3.17.1HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Type: Primary
Version: 3.1
Base score: 5.5
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Type: Secondary
Version: 3.1
Base score: 7.1
Base severity: HIGH
Vector:
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CPE Matches

Hitachi Energy Ltd.
hitachienergy
>>650connectivitypackage>>1.3.0
cpe:2.3:a:hitachienergy:650connectivitypackage:1.3.0:*:*:*:*:*:*:*
Hitachi Energy Ltd.
hitachienergy
>>650connectivitypackage>>2.1.2
cpe:2.3:a:hitachienergy:650connectivitypackage:2.1.2:*:*:*:*:*:*:*
Hitachi Energy Ltd.
hitachienergy
>>650connectivitypackage>>2.2.2
cpe:2.3:a:hitachienergy:650connectivitypackage:2.2.2:*:*:*:*:*:*:*
Hitachi Energy Ltd.
hitachienergy
>>650connectivitypackage>>2.3.0
cpe:2.3:a:hitachienergy:650connectivitypackage:2.3.0:*:*:*:*:*:*:*
Hitachi Energy Ltd.
hitachienergy
>>650connectivitypackage>>2.4.1
cpe:2.3:a:hitachienergy:650connectivitypackage:2.4.1:*:*:*:*:*:*:*
Hitachi Energy Ltd.
hitachienergy
>>670connectivitypackage>>3.0.2
cpe:2.3:a:hitachienergy:670connectivitypackage:3.0.2:*:*:*:*:*:*:*
Hitachi Energy Ltd.
hitachienergy
>>670connectivitypackage>>3.1.2
cpe:2.3:a:hitachienergy:670connectivitypackage:3.1.2:*:*:*:*:*:*:*
Hitachi Energy Ltd.
hitachienergy
>>670connectivitypackage>>3.2.6
cpe:2.3:a:hitachienergy:670connectivitypackage:3.2.6:*:*:*:*:*:*:*
Hitachi Energy Ltd.
hitachienergy
>>670connectivitypackage>>3.3.0
cpe:2.3:a:hitachienergy:670connectivitypackage:3.3.0:*:*:*:*:*:*:*
Hitachi Energy Ltd.
hitachienergy
>>670connectivitypackage>>3.4.1
cpe:2.3:a:hitachienergy:670connectivitypackage:3.4.1:*:*:*:*:*:*:*
Hitachi Energy Ltd.
hitachienergy
>>gms600connectivitypackage>>1.3.0
cpe:2.3:a:hitachienergy:gms600connectivitypackage:1.3.0:*:*:*:*:*:*:*
Hitachi Energy Ltd.
hitachienergy
>>gms600connectivitypackage>>1.3.1
cpe:2.3:a:hitachienergy:gms600connectivitypackage:1.3.1:*:*:*:*:*:*:*
Hitachi Energy Ltd.
hitachienergy
>>pcm600>>Versions up to 2.11(inclusive)
cpe:2.3:a:hitachienergy:pcm600:*:*:*:*:*:*:*:*
Hitachi Energy Ltd.
hitachienergy
>>pwc600connectivitypackage>>1.1.0
cpe:2.3:a:hitachienergy:pwc600connectivitypackage:1.1.0:*:*:*:*:*:*:*
Hitachi Energy Ltd.
hitachienergy
>>pwc600connectivitypackage>>1.1.1
cpe:2.3:a:hitachienergy:pwc600connectivitypackage:1.1.1:*:*:*:*:*:*:*
Hitachi Energy Ltd.
hitachienergy
>>pwc600connectivitypackage>>1.1.2
cpe:2.3:a:hitachienergy:pwc600connectivitypackage:1.1.2:*:*:*:*:*:*:*
Hitachi Energy Ltd.
hitachienergy
>>pwc600connectivitypackage>>1.2.0
cpe:2.3:a:hitachienergy:pwc600connectivitypackage:1.2.0:*:*:*:*:*:*:*
Hitachi Energy Ltd.
hitachienergy
>>pwc600connectivitypackage>>1.3.0
cpe:2.3:a:hitachienergy:pwc600connectivitypackage:1.3.0:*:*:*:*:*:*:*
Hitachi Energy Ltd.
hitachienergy
>>sam600ioconnectivitypackage>>1.0.0
cpe:2.3:a:hitachienergy:sam600ioconnectivitypackage:1.0.0:*:*:*:*:*:*:*
Hitachi Energy Ltd.
hitachienergy
>>sam600ioconnectivitypackage>>1.1.0
cpe:2.3:a:hitachienergy:sam600ioconnectivitypackage:1.1.0:*:*:*:*:*:*:*
Hitachi Energy Ltd.
hitachienergy
>>sam600ioconnectivitypackage>>1.2.0
cpe:2.3:a:hitachienergy:sam600ioconnectivitypackage:1.2.0:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-312Primarynvd@nist.gov
CWE-312Secondarycybersecurity@hitachienergy.com
CWE ID: CWE-312
Type: Primary
Source: nvd@nist.gov
CWE ID: CWE-312
Type: Secondary
Source: cybersecurity@hitachienergy.com
Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References
HyperlinkSourceResource
https://publisher.hitachienergy.com/preview?DocumentID=8DBD000120&LanguageCode=en&DocumentPartId=&Action=Launchcybersecurity@hitachienergy.com
N/A
Hyperlink: https://publisher.hitachienergy.com/preview?DocumentID=8DBD000120&LanguageCode=en&DocumentPartId=&Action=Launch
Source: cybersecurity@hitachienergy.com
Resource: N/A

Change History

0
Information is not available yet

Similar CVEs

110Records found

CVE-2011-2916
Matching Score-4
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-4
Assigner-Red Hat, Inc.
CVSS Score-5.5||MEDIUM
EPSS-0.06% / 19.15%
||
7 Day CHG~0.00%
Published-15 Nov, 2019 | 17:19
Updated-06 Aug, 2024 | 23:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

qtnx 0.9 stores non-custom SSH keys in a world-readable configuration file. If a user has a world-readable or world-executable home directory, another local system user could obtain the private key used to connect to remote NX sessions.

Action-Not Available
Vendor-qtnx_projectqtnx
Product-qtnxqtnx
CWE ID-CWE-312
Cleartext Storage of Sensitive Information
CVE-2021-28858
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-5.5||MEDIUM
EPSS-0.03% / 4.98%
||
7 Day CHG~0.00%
Published-15 Jun, 2021 | 21:51
Updated-03 Aug, 2024 | 21:55
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

TP-Link's TL-WPA4220 4.0.2 Build 20180308 Rel.37064 does not use SSL by default. Attacker on the local network can monitor traffic and capture the cookie and other sensitive information.

Action-Not Available
Vendor-n/aTP-Link Systems Inc.
Product-tl-wpa4220_firmwaretl-wpa4220n/a
CWE ID-CWE-312
Cleartext Storage of Sensitive Information
CVE-2021-27487
Matching Score-4
Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)
ShareView Details
Matching Score-4
Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)
CVSS Score-5.5||MEDIUM
EPSS-0.03% / 6.25%
||
7 Day CHG~0.00%
Published-16 Jun, 2021 | 11:59
Updated-03 Aug, 2024 | 21:26
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products contain credentials stored in plaintext. This could allow an attacker to gain access to sensitive information.

Action-Not Available
Vendor-zolln/a
Product-defibrillator_dashboardZOLL Defibrillator Dashboard
CWE ID-CWE-312
Cleartext Storage of Sensitive Information
CVE-2024-56428
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-5.5||MEDIUM
EPSS-0.01% / 0.44%
||
7 Day CHG~0.00%
Published-21 May, 2025 | 00:00
Updated-21 May, 2025 | 20:24
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The local iLabClient database in itech iLabClient 3.7.1 allows local attackers to read cleartext credentials (from the CONFIGS table) for their servers configured in the client.

Action-Not Available
Vendor-n/a
Product-n/a
CWE ID-CWE-312
Cleartext Storage of Sensitive Information
CVE-2021-23827
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-5.5||MEDIUM
EPSS-0.08% / 24.18%
||
7 Day CHG~0.00%
Published-22 Feb, 2021 | 23:07
Updated-03 Aug, 2024 | 19:14
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Keybase Desktop Client before 5.6.0 on Windows and macOS, and before 5.6.1 on Linux, allows an attacker to obtain potentially sensitive media (such as private pictures) in the Cache and uploadtemps directories. It fails to effectively clear cached pictures, even after deletion via normal methodology within the client, or by utilizing the "Explode message/Explode now" functionality. Local filesystem access is needed by the attacker.

Action-Not Available
Vendor-keybasen/aRed Hat, Inc.Microsoft CorporationApple Inc.
Product-windowsmacoslinuxkeybasen/a
CWE ID-CWE-312
Cleartext Storage of Sensitive Information
CVE-2022-34910
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-4.1||MEDIUM
EPSS-0.01% / 0.53%
||
7 Day CHG~0.00%
Published-27 Feb, 2023 | 00:00
Updated-30 May, 2025 | 16:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An issue was discovered in the A4N (Aremis 4 Nomad) application 1.5.0 for Android. It uses a local database to store data and accounts. However, the password is stored in cleartext. Therefore, an attacker can retrieve the passwords of other users that used the same device.

Action-Not Available
Vendor-aremisn/a
Product-aremis_4_nomadsn/a
CWE ID-CWE-312
Cleartext Storage of Sensitive Information
CVE-2024-4840
Matching Score-4
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-4
Assigner-Red Hat, Inc.
CVSS Score-5.5||MEDIUM
EPSS-0.05% / 15.58%
||
7 Day CHG~0.00%
Published-13 May, 2024 | 22:16
Updated-25 Nov, 2024 | 06:11
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Rhosp-director: cleartext passwords exposed in logs

An flaw was found in the OpenStack Platform (RHOSP) director, a toolset for installing and managing a complete RHOSP environment. Plaintext passwords may be stored in log files, which can expose sensitive information to anyone with access to the logs.

Action-Not Available
Vendor-Red Hat, Inc.
Product-Red Hat OpenStack Platform 16.2Red Hat OpenStack Platform 17.1 for RHEL 9
CWE ID-CWE-312
Cleartext Storage of Sensitive Information
CVE-2024-45004
Matching Score-4
Assigner-kernel.org
ShareView Details
Matching Score-4
Assigner-kernel.org
CVSS Score-5.5||MEDIUM
EPSS-0.01% / 1.58%
||
7 Day CHG~0.00%
Published-04 Sep, 2024 | 19:54
Updated-04 May, 2025 | 09:30
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
KEYS: trusted: dcp: fix leak of blob encryption key

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: dcp: fix leak of blob encryption key Trusted keys unseal the key blob on load, but keep the sealed payload in the blob field so that every subsequent read (export) will simply convert this field to hex and send it to userspace. With DCP-based trusted keys, we decrypt the blob encryption key (BEK) in the Kernel due hardware limitations and then decrypt the blob payload. BEK decryption is done in-place which means that the trusted key blob field is modified and it consequently holds the BEK in plain text. Every subsequent read of that key thus send the plain text BEK instead of the encrypted BEK to userspace. This issue only occurs when importing a trusted DCP-based key and then exporting it again. This should rarely happen as the common use cases are to either create a new trusted key and export it, or import a key blob and then just use it without exporting it again. Fix this by performing BEK decryption and encryption in a dedicated buffer. Further always wipe the plain text BEK buffer to prevent leaking the key via uninitialized memory.

Action-Not Available
Vendor-Linux Kernel Organization, Inc
Product-linux_kernelLinux
CWE ID-CWE-312
Cleartext Storage of Sensitive Information
CVE-2021-27204
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-5.5||MEDIUM
EPSS-0.03% / 5.88%
||
7 Day CHG~0.00%
Published-12 Feb, 2021 | 07:48
Updated-03 Aug, 2024 | 20:40
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Telegram before 7.4 (212543) Stable on macOS stores the local passcode in cleartext, leading to information disclosure.

Action-Not Available
Vendor-telegramn/aApple Inc.
Product-macostelegramn/a
CWE ID-CWE-312
Cleartext Storage of Sensitive Information
CVE-2020-7517
Matching Score-4
Assigner-Schneider Electric
ShareView Details
Matching Score-4
Assigner-Schneider Electric
CVSS Score-5.5||MEDIUM
EPSS-0.03% / 6.22%
||
7 Day CHG~0.00%
Published-23 Jul, 2020 | 20:47
Updated-04 Aug, 2024 | 09:33
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A CWE-312: Cleartext Storage of Sensitive Information vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow an attacker to read user credentials.

Action-Not Available
Vendor-n/a
Product-easergy_builderEasergy Builder (Version 1.4.7.2 and older)
CWE ID-CWE-312
Cleartext Storage of Sensitive Information
  • Previous
  • 1
  • 2
  • 3
  • Next
Details not found