CWE-312

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/gophish/gophish"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.12.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-55196"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-312"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-01-02T21:52:39Z",
    "nvd_published_at": "2024-12-19T19:15:07Z",
    "severity": "HIGH"
  },
  "details": "Insufficiently Protected Credentials in the Mail Server Configuration in GoPhish v0.12.1 allows an attacker to access cleartext passwords for the configured IMAP and SMTP servers.",
  "id": "GHSA-rv83-h68q-c4wq",
  "modified": "2025-01-02T21:52:39Z",
  "published": "2024-12-19T21:31:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55196"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/gophish/gophish"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hexkaster/SecurityResearch/blob/main/CVE-2024-55196.md"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "GoPhish sends cleartext passwords"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-28345"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-312"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-05-31T00:15:09Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in Faronics Insight 10.0.19045 on Windows. The Insight Teacher Console application exposes the teacher\u0027s Console password in cleartext via an API endpoint accessible from localhost. Attackers with physical access to the Teacher Console can open a web browser, navigate to the affected endpoint and obtain the teacher\u0027s password. This enables them to log into the Teacher Console and begin trivially attacking student machines.",
  "id": "GHSA-rwrf-7jj9-g4cp",
  "modified": "2024-04-04T04:24:33Z",
  "published": "2023-05-31T00:31:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28345"
    },
    {
      "type": "WEB",
      "url": "https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight"
    },
    {
      "type": "WEB",
      "url": "https://research.nccgroup.com/?research=Technical%20advisories"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-16638"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-312"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-16T17:15:10Z",
    "severity": "HIGH"
  },
  "details": "An issue was found on the Ruijie EG-2000 series gateway. An attacker can easily dump cleartext stored passwords in /data/config.text with simple XORs. This affects EG-2000SE EG_RGOS 11.1(1)B1.",
  "id": "GHSA-rwrj-7c92-9hmp",
  "modified": "2024-09-10T18:30:42Z",
  "published": "2024-07-16T18:31:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16638"
    },
    {
      "type": "WEB",
      "url": "https://0x.mk/?p=239"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.8.29"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "centreon/centreon"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.8.30"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-17106"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-312"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-17T22:12:18Z",
    "nvd_published_at": "2019-10-08T13:15:00Z",
    "severity": "MODERATE"
  },
  "details": "In Centreon Web through 2.8.29, disclosure of external components\u0027 passwords allows authenticated attackers to move laterally to external components.",
  "id": "GHSA-rx4j-x3fh-9qwg",
  "modified": "2023-09-25T19:36:16Z",
  "published": "2022-05-24T16:58:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17106"
    },
    {
      "type": "WEB",
      "url": "https://github.com/centreon/centreon-archived/issues/7098"
    },
    {
      "type": "WEB",
      "url": "https://github.com/centreon/centreon-archived/pull/9311"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/centreon/centreon-archived"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2019/10/08/1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Centreon Sensitive Data Exposure"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.linkis:linkis"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-44644"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-200",
      "CWE-312"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-02-02T00:09:07Z",
    "nvd_published_at": "2023-01-31T10:15:00Z",
    "severity": "MODERATE"
  },
  "details": "In Apache Linkis \u003c=1.3.0 when used with the MySQL Connector/J, an authenticated attacker could read arbitrary local file by connecting a rogue mysql server, By adding allowLoadLocalInfile to true in the jdbc parameter. Therefore, the parameters in the jdbc url should be blacklisted. Versions of Apache Linkis \u003c= 1.3.0 will be affected. We recommend users upgrade the version of Linkis to version 1.3.1",
  "id": "GHSA-rx76-xw35-6rh8",
  "modified": "2023-02-07T21:16:30Z",
  "published": "2023-01-31T12:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-44644"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/linkis"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/hwq9ytq6y1kdh9lz5znptkcrdll9x85h"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Apache Linkis vulnerable to Exposure of Sensitive Information"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-7783"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-312"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-29T13:15:10Z",
    "severity": "MODERATE"
  },
  "details": "mintplex-labs/anything-llm version latest contains a vulnerability where sensitive information, specifically a password, is improperly stored within a JWT (JSON Web Token) used as a bearer token in single user mode. When decoded, the JWT reveals the password in plaintext. This improper storage of sensitive information poses significant security risks, as an attacker who gains access to the JWT can easily decode it and retrieve the password. The issue is fixed in version 1.0.3.",
  "id": "GHSA-rxmp-x6cw-79xv",
  "modified": "2024-10-29T15:32:05Z",
  "published": "2024-10-29T15:32:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7783"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mintplex-labs/anything-llm/commit/4430ddb05988470bc8f0479e7d07db1f7d4646ba"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/20e9950f-ad41-4d6b-8bd0-c7f7051695b3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.1.0"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Steeltoe.Configuration.Abstractions"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-50267"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-312",
      "CWE-732"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-02T20:32:09Z",
    "nvd_published_at": "2026-06-17T23:17:04Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nWhen MySQL or PostgreSQL service bindings from `VCAP_SERVICES` include TLS client credentials, the Connectors library writes those credentials to temporary files in `Path.GetTempPath()` using `File.CreateText`. On Linux, `File.CreateText` creates files with mode `0644` (world-readable) under the process umask, and the files are never deleted. The same key material is protected at mode `0400` in `/proc/\u003cpid\u003e/environ`.\n\n### Impact\n\nAny process co-located in the container that runs as a different UID can read the TLS client private key from `/tmp` and use it to impersonate the application when connecting to the backing database over mutual TLS.\n\n### Affected configuration\n\n- Application is deployed on Cloud Foundry or another environment that populates `VCAP_SERVICES` with a MySQL or PostgreSQL service binding that includes `sslKey` credentials.\n- A process running as a different UID shares the container\u0027s filesystem.\n\n### Mitigations\n\nIf an immediate upgrade is not possible, prevent other processes from running in the container under a different UID with access to `/tmp`.",
  "id": "GHSA-rxrh-4j9h-xgg9",
  "modified": "2026-07-02T20:32:09Z",
  "published": "2026-07-02T20:32:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-rxrh-4j9h-xgg9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50267"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SteeltoeOSS/Steeltoe/commit/8dd97cc6c4b184121a4bd1f92f9ac16918433471"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/SteeltoeOSS/security-advisories"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Steeltoe: TLS private keys written to /tmp with default permissions, never deleted"
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-8276"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-312"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-11-09T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The implementation of Brave Desktop\u0027s privacy-preserving analytics system (P3A) between 1.1 and 1.18.35 logged the timestamp of when the user last opened an incognito window, including Tor windows. The intended behavior was to log the timestamp for incognito windows excluding Tor windows. Note that if a user has P3A enabled, the timestamp is not sent to Brave\u0027s server, but rather a value from:Used in last 24hUsed in last week but not 24hUsed in last 28 days but not weekEver used but not in last 28 daysNever usedThe privacy risk is low because a local attacker with disk access cannot tell if the timestamp corresponds to a Tor window or a non-Tor incognito window.",
  "id": "GHSA-v36p-6rf8-wx94",
  "modified": "2022-05-24T17:34:09Z",
  "published": "2022-05-24T17:34:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8276"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/1024668"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "codeigniter4/shield"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.0-beta.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-48707"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-312"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-11-23T00:28:14Z",
    "nvd_published_at": "2023-11-24T18:15:07Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n**secretKey**, an important key for HMAC SHA256 authentication, was stored in the database in raw form.\n\nIf a malicious person somehow had access to the data in the database, they could use the key and secretKey for HMAC SHA256 authentication to send requests impersonating that person.\n\n### Patches\nUpgrade to Shield v1.0.0-beta.8 or later.\n\nAfter upgrading, all existing secret keys must be encrypted.\nSee https://github.com/codeigniter4/shield/blob/develop/UPGRADING.md for details.\n\n### Workarounds\nNone.\n\n### References\n- https://codeigniter4.github.io/shield/references/authentication/hmac/\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue or discussion in [codeigniter4/shield](https://github.com/codeigniter4/shield)\n* Email us at [security@codeigniter.com](mailto:security@codeigniter.com)\n",
  "id": "GHSA-v427-c49j-8w6x",
  "modified": "2023-11-27T21:44:37Z",
  "published": "2023-11-23T00:28:14Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/codeigniter4/shield/security/advisories/GHSA-v427-c49j-8w6x"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48707"
    },
    {
      "type": "WEB",
      "url": "https://github.com/codeigniter4/shield/commit/f77c6ae20275ac1245330a2b9a523bf7e6f6202f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/codeigniter4/shield"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Cleartext Storage of Sensitive Information in HMAC SHA256 Authentication"
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-41639"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-312"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-24T12:15:00Z",
    "severity": "MODERATE"
  },
  "details": "MELAG FTP Server 2.2.0.4 stores unencrpyted passwords of FTP users in a local configuration file.",
  "id": "GHSA-v4h2-x5v2-fcq7",
  "modified": "2022-07-02T00:00:22Z",
  "published": "2022-06-25T00:01:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41639"
    },
    {
      "type": "WEB",
      "url": "https://www.securesystems.de/blog/advisory-and-exploitation-the-melag-ftp-server"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}