CWE-312

{
  "affected": [],
  "aliases": [
    "CVE-2024-31840"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-312"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-21T16:15:25Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in Italtel Embrace 1.6.4. The web application inserts cleartext passwords in the HTML source code. An authenticated user is able to edit the configuration of the email server. Once the user access the edit function, the web application fills the edit form with the current credentials for the email account, including the cleartext password.",
  "id": "GHSA-p449-q86c-mx7r",
  "modified": "2024-07-26T21:31:15Z",
  "published": "2024-05-21T18:31:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31840"
    },
    {
      "type": "WEB",
      "url": "https://www.gruppotim.it/it/footer/red-team.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-1882"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-312"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-04-08T15:29:00Z",
    "severity": "MODERATE"
  },
  "details": "In a certain atypical IBM Spectrum Protect 7.1 and 8.1 configurations, the node password could be displayed in plain text in the IBM Spectrum Protect client trace file. IBM X-Force ID: 151968.",
  "id": "GHSA-p469-7gqp-fp24",
  "modified": "2022-05-13T01:02:36Z",
  "published": "2022-05-13T01:02:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1882"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/151968"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=ibm10869208"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=ibm10869436"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/107861"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "zhmcclient"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.18.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-53865"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-312"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-12-02T18:35:18Z",
    "nvd_published_at": "2024-11-29T19:15:09Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nThe Python package \"zhmcclient\" writes password-like properties in clear text into its HMC and API logs in the following cases:\n\n* The \u0027boot-ftp-password\u0027 and \u0027ssc-master-pw\u0027 properties when creating or updating a partition in DPM mode, in the zhmcclient API and HMC logs\n* The \u0027ssc-master-pw\u0027 and \u0027zaware-master-pw\u0027 properties when updating an LPAR in classic mode, in the zhmcclient API and HMC logs\n* The \u0027ssc-master-pw\u0027 and \u0027zaware-master-pw\u0027 properties when creating or updating an image activation profile in classic mode, in the zhmcclient API and HMC logs\n* The \u0027password\u0027 property when creating or updating an HMC user, in the zhmcclient API log\n* The \u0027bind-password\u0027 property when creating or updating an LDAP server definition, in the zhmcclient API and HMC logs\n\nThis issue affects only users of the zhmcclient package that have enabled the Python loggers named \"zhmcclient.api\" (for the API log) or \"zhmcclient.hmc\" (for the HMC log) and that use the functions listed above.\n\n### Patches\n\nHas been fixed in zhmcclient version 1.18.1\n\n### Workarounds\n\nNot applicable, since fix is available.\n\n### References\n\nNone\n",
  "id": "GHSA-p57h-3cmc-xpjq",
  "modified": "2024-12-02T18:35:18Z",
  "published": "2024-12-02T18:35:18Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/zhmcclient/python-zhmcclient/security/advisories/GHSA-p57h-3cmc-xpjq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53865"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zhmcclient/python-zhmcclient/commit/ad32781e782d0f604c6da4680fce48e4cc1f4433"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/zhmcclient/python-zhmcclient"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Python package \"zhmcclient\" stores passwords in clear text in its HMC and API logs"
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-22194"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-312"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-03-26T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "In all versions of GitLab starting from 13.7, marshalled session keys were being stored in Redis.",
  "id": "GHSA-p598-8v9q-qjhx",
  "modified": "2022-05-24T17:45:32Z",
  "published": "2022-05-24T17:45:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22194"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22194.json"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/262107"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-30146"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-312"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-08-04T01:15:09Z",
    "severity": "HIGH"
  },
  "details": "Assmann Digitus Plug\u0026View IP Camera family allows unauthenticated attackers to download a copy of the camera\u0027s settings and the administrator credentials.",
  "id": "GHSA-p5cf-vc34-747c",
  "modified": "2024-04-04T06:33:36Z",
  "published": "2023-08-04T03:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30146"
    },
    {
      "type": "WEB",
      "url": "https://de.assmann.shop/de/Gebaeude-Technik/Sicherheitstechnik/Ueberwachungskameras"
    },
    {
      "type": "WEB",
      "url": "https://github.com/L1-0/CVE-2023-30146"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-42066"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-312"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-12-14T16:15:00Z",
    "severity": "MODERATE"
  },
  "details": "SAP Business One - version 10.0, allows an admin user to view DB password in plain text over the network, which should otherwise be encrypted. For an attacker to discover vulnerable function in-depth application knowledge is required, but once exploited the attacker may be able to completely compromise confidentiality, integrity, and availability of the application.",
  "id": "GHSA-p5ch-7hc9-cv48",
  "modified": "2021-12-17T00:00:43Z",
  "published": "2021-12-15T00:00:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42066"
    },
    {
      "type": "WEB",
      "url": "https://launchpad.support.sap.com/#/notes/3101299"
    },
    {
      "type": "WEB",
      "url": "https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021"
    },
    {
      "type": "WEB",
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=596902035"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.platform:xwiki-platform-search-solr-api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.2-milestone-2"
            },
            {
              "fixed": "14.10.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.platform:xwiki-platform-search-solr-api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "15.0-rc-1"
            },
            {
              "fixed": "15.5.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.platform:xwiki-platform-search-solr-api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "15.6-rc-1"
            },
            {
              "fixed": "15.7-rc-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-50719"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-312"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-12-16T00:03:54Z",
    "nvd_published_at": "2023-12-15T19:15:09Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nThe Solr-based search in XWiki discloses the password hashes of all users to anyone with view right on the respective user profiles. By default, all user profiles are public. To reproduce, it is sufficient to search for `propertyvalue:?* AND reference:*.password` and then deselect the \"Document\" property under \"Result type\" in the \"Refine your search\" widget at the right of the search results. If this displays any passwords or password hashes, the installation is vulnerable.\n\nBy default, passwords in XWiki are salted and hashed with SHA-512. On XWiki versions affected by [CVE-2022-41933](https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-q2hm-2h45-v5g3), passwords are stored in plain text if they have been set using the password reset feature. This might affect XWiki installations that are using an external authentication mechanism such that passwords aren\u0027t stored in the wiki.\n\nThis vulnerability also affects any configurations used by extensions that contain passwords like API keys that are viewable for the attacker. Normally, such passwords aren\u0027t accessible but this vulnerability would disclose them as plain text.\n\n### Patches\nThis has been patched in XWiki 14.10.15, 15.5.2 and 15.7RC1. This vulnerability has been patched as part of patching [GHSA-2grh-gr37-2283](https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-2grh-gr37-2283), the part of the fix that changes the indexing of single properties to use the same code as the main document for getting the property\u0027s value fixes this vulnerability.\n\n### Workarounds\nWe\u0027re not aware of any workarounds apart from upgrading to a fixed version.\n\n### References\n* https://github.com/xwiki/xwiki-platform/commit/3e5272f2ef0dff06a8f4db10afd1949b2f9e6eea\n* https://jira.xwiki.org/browse/XWIKI-21208",
  "id": "GHSA-p6cp-6r35-32mh",
  "modified": "2023-12-16T00:03:54Z",
  "published": "2023-12-16T00:03:54Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p6cp-6r35-32mh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50719"
    },
    {
      "type": "WEB",
      "url": "https://github.com/xwiki/xwiki-platform/commit/3e5272f2ef0dff06a8f4db10afd1949b2f9e6eea"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/xwiki/xwiki-platform"
    },
    {
      "type": "WEB",
      "url": "https://jira.xwiki.org/browse/XWIKI-21208"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Solr search discloses password hashes of all users"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-103096"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-312"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-02T01:16:42Z",
    "severity": "HIGH"
  },
  "details": "API\nkey is hardcoded and retrievable from the application package. Since Android\napplications can be reverse engineered, embedding sensitive API credentials\ndirectly in the client application may allow unauthorized users to extract and\nmisuse the key.",
  "id": "GHSA-p7gq-p6v3-22xp",
  "modified": "2026-10-02T03:31:09Z",
  "published": "2026-10-02T03:31:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103096"
    },
    {
      "type": "WEB",
      "url": "https://www.geovision.com.tw/cyber_security.php"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-28979"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-312",
      "CWE-74"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-06-16T12:15:00Z",
    "severity": "MODERATE"
  },
  "details": "SafeNet KeySecure Management Console 8.12.0 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked.",
  "id": "GHSA-p7m7-5qjr-xf2q",
  "modified": "2022-05-24T19:05:34Z",
  "published": "2022-05-24T19:05:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28979"
    },
    {
      "type": "WEB",
      "url": "https://www.gruppotim.it/redteam"
    },
    {
      "type": "WEB",
      "url": "https://www.thalesgroup.com/en"
    },
    {
      "type": "WEB",
      "url": "http://safenet.com"
    },
    {
      "type": "WEB",
      "url": "http://thales.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-29868"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-312"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-05-09T19:15:00Z",
    "severity": "MODERATE"
  },
  "details": "1Password for Mac 7.2.4 through 7.9.x before 7.9.3 is vulnerable to a process validation bypass. Malicious software running on the same computer can exfiltrate secrets from 1Password provided that 1Password is running and is unlocked. Affected secrets include vault items and derived values used for signing in to 1Password.",
  "id": "GHSA-p8g3-hwcg-gr94",
  "modified": "2022-05-19T00:00:21Z",
  "published": "2022-05-10T00:00:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29868"
    },
    {
      "type": "WEB",
      "url": "https://support.1password.com/kb/202204"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}