Common Weakness Enumeration
CWE-316
AllowedCleartext Storage of Sensitive Information in Memory
Abstraction: Variant · Status: Draft
The product stores sensitive information in cleartext in memory.
69 vulnerabilities reference this CWE, most recent first.
GHSA-G437-XQHV-C7MQ
Vulnerability from github – Published: 2024-05-20 21:31 – Updated: 2024-08-01 15:31
VLAI
Details
Issue in KeePassXC 2.7.7 allows an attacker to recover some passwords stored in the .kdbx database.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-33901"
],
"database_specific": {
"cwe_ids": [
"CWE-316"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-20T21:15:09Z",
"severity": "MODERATE"
},
"details": "Issue in KeePassXC 2.7.7 allows an attacker to recover some passwords stored in the .kdbx database.",
"id": "GHSA-g437-xqhv-c7mq",
"modified": "2024-08-01T15:31:45Z",
"published": "2024-05-20T21:31:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33901"
},
{
"type": "WEB",
"url": "https://github.com/keepassxreboot/keepassxc/issues/10784"
},
{
"type": "WEB",
"url": "https://gist.github.com/Fastor01/30c6d89c842feb1865ec2cd2d3806838"
},
{
"type": "WEB",
"url": "https://keepassxc.org/blog"
},
{
"type": "WEB",
"url": "https://keepassxc.org/blog/2019-02-21-memory-security"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GQM3-PXVJ-G2XQ
Vulnerability from github – Published: 2025-07-11 00:30 – Updated: 2025-07-11 00:30
VLAI
Details
Emerson ValveLink Products store sensitive information in cleartext within a resource that might be accessible to another control sphere.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-50109"
],
"database_specific": {
"cwe_ids": [
"CWE-316"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-11T00:15:26Z",
"severity": "HIGH"
},
"details": "Emerson ValveLink Products store\nsensitive information in cleartext within a resource that might be accessible to another control sphere.",
"id": "GHSA-gqm3-pxvj-g2xq",
"modified": "2025-07-11T00:30:32Z",
"published": "2025-07-11T00:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50109"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-189-01"
},
{
"type": "WEB",
"url": "https://www.emerson.com/en-us/support/security-notifications"
},
{
"type": "WEB",
"url": "https://www.emerson.com/en-us/support/software-downloads-drivers"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-H4JV-267R-4GXQ
Vulnerability from github – Published: 2022-04-12 00:00 – Updated: 2022-04-19 00:01
VLAI
Details
AVEVA System Platform 2020 stores sensitive information in cleartext, which may allow access to an attacker or a low-privileged user.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-0835"
],
"database_specific": {
"cwe_ids": [
"CWE-312",
"CWE-316"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-11T20:15:00Z",
"severity": "MODERATE"
},
"details": "AVEVA System Platform 2020 stores sensitive information in cleartext, which may allow access to an attacker or a low-privileged user.",
"id": "GHSA-h4jv-267r-4gxq",
"modified": "2022-04-19T00:01:25Z",
"published": "2022-04-12T00:00:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0835"
},
{
"type": "WEB",
"url": "https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-007.pdf"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-067-02"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HFPV-GCCV-QHV9
Vulnerability from github – Published: 2025-07-11 00:30 – Updated: 2025-07-11 00:30
VLAI
Details
Emerson ValveLink Products store sensitive information in cleartext in memory. The sensitive memory might be saved to disk, stored in a core dump, or remain uncleared if the product crashes, or if the programmer does not properly clear the memory before freeing it.
Severity
9.4 (Critical)
{
"affected": [],
"aliases": [
"CVE-2025-52579"
],
"database_specific": {
"cwe_ids": [
"CWE-316"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-11T00:15:26Z",
"severity": "CRITICAL"
},
"details": "Emerson ValveLink Products store sensitive information in cleartext in memory. The \nsensitive memory might be saved to disk, stored in a core dump, or \nremain uncleared if the product crashes, or if the programmer does not \nproperly clear the memory before freeing it.",
"id": "GHSA-hfpv-gccv-qhv9",
"modified": "2025-07-11T00:30:33Z",
"published": "2025-07-11T00:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52579"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-189-01"
},
{
"type": "WEB",
"url": "https://www.emerson.com/en-us/support/security-notifications"
},
{
"type": "WEB",
"url": "https://www.emerson.com/en-us/support/software-downloads-drivers"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-JFGV-77W2-93RX
Vulnerability from github – Published: 2022-05-24 19:04 – Updated: 2022-10-26 12:00
VLAI
Details
The vulnerability could expose cleartext credentials from AVEVA InTouch Runtime 2020 R2 and all prior versions (WindowViewer) if an authorized, privileged user creates a diagnostic memory dump of the process and saves it to a non-protected location.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2021-32942"
],
"database_specific": {
"cwe_ids": [
"CWE-312",
"CWE-316"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-09T17:15:00Z",
"severity": "MODERATE"
},
"details": "The vulnerability could expose cleartext credentials from AVEVA InTouch Runtime 2020 R2 and all prior versions (WindowViewer) if an authorized, privileged user creates a diagnostic memory dump of the process and saves it to a non-protected location.",
"id": "GHSA-jfgv-77w2-93rx",
"modified": "2022-10-26T12:00:39Z",
"published": "2022-05-24T19:04:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32942"
},
{
"type": "WEB",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-159-03"
},
{
"type": "WEB",
"url": "https://www.aveva.com/en/support/cyber-security-updates"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JFX7-932X-94FG
Vulnerability from github – Published: 2025-10-27 18:31 – Updated: 2025-10-27 21:30
VLAI
Details
Easywork Enterprise 2.1.3.354 is vulnerable to Cleartext Storage of Sensitive Information in Memory. The application leaves valid device-bound license keys in process memory after a failed activation attempt. The keys can be obtained by attaching a debugger or analyzing the process/memory dump and then they can be used to activate the software on the same machine without purchasing.
Severity
6.2 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-60791"
],
"database_specific": {
"cwe_ids": [
"CWE-316"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-27T16:15:42Z",
"severity": "MODERATE"
},
"details": "Easywork Enterprise 2.1.3.354 is vulnerable to Cleartext Storage of Sensitive Information in Memory. The application leaves valid device-bound license keys in process memory after a failed activation attempt. The keys can be obtained by attaching a debugger or analyzing the process/memory dump and then they can be used to activate the software on the same machine without purchasing.",
"id": "GHSA-jfx7-932x-94fg",
"modified": "2025-10-27T21:30:26Z",
"published": "2025-10-27T18:31:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60791"
},
{
"type": "WEB",
"url": "https://packetstorm.news/files/id/210832"
},
{
"type": "WEB",
"url": "https://sourceforge.net/projects/easyworkaccounting"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JJMC-HPG2-7V48
Vulnerability from github – Published: 2025-06-29 12:31 – Updated: 2025-06-29 12:31
VLAI
Details
Credentials are not cleared from memory after being used. A user with Administrator permissions can execute memory dump for SmartConsole process and fetch them.
Severity
6.1 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-24915"
],
"database_specific": {
"cwe_ids": [
"CWE-312",
"CWE-316"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-29T12:15:22Z",
"severity": "MODERATE"
},
"details": "Credentials are not cleared from memory after being used. A user with Administrator permissions can execute memory dump for SmartConsole process and fetch them.",
"id": "GHSA-jjmc-hpg2-7v48",
"modified": "2025-06-29T12:31:06Z",
"published": "2025-06-29T12:31:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24915"
},
{
"type": "WEB",
"url": "https://support.checkpoint.com/results/sk/sk183545"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JRWF-CCH6-5737
Vulnerability from github – Published: 2025-10-08 18:30 – Updated: 2025-10-08 18:30
VLAI
Details
Cleartext Storage of Sensitive Information in Memory vulnerability in ABB MConfig.This issue affects MConfig: through 1.4.9.21.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-9970"
],
"database_specific": {
"cwe_ids": [
"CWE-316"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-08T17:15:35Z",
"severity": "MODERATE"
},
"details": "Cleartext Storage of Sensitive Information in Memory vulnerability in ABB MConfig.This issue affects MConfig: through 1.4.9.21.",
"id": "GHSA-jrwf-cch6-5737",
"modified": "2025-10-08T18:30:16Z",
"published": "2025-10-08T18:30:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9970"
},
{
"type": "WEB",
"url": "https://search.abb.com/library/Download.aspx?DocumentID=4TZ00000006008\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-M882-67H5-2G42
Vulnerability from github – Published: 2024-03-22 18:30 – Updated: 2024-03-22 18:30
VLAI
Details
Kaspersky has fixed a security issue in Kaspersky Password Manager (KPM) for Windows that allowed a local user to recover the auto-filled credentials from a memory dump when the KPM extension for Google Chrome is used. To exploit the issue, an attacker must trick a user into visiting a login form of a website with the saved credentials, and the KPM extension must autofill these credentials. The attacker must then launch a malware module to steal those specific credentials.
Severity
{
"affected": [],
"aliases": [
"CVE-2023-23349"
],
"database_specific": {
"cwe_ids": [
"CWE-316"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-22T17:15:07Z",
"severity": "LOW"
},
"details": "Kaspersky has fixed a security issue in Kaspersky Password Manager (KPM) for Windows that allowed a local user to recover the auto-filled credentials from a memory dump when the KPM extension for Google Chrome is used. To exploit the issue, an attacker must trick a user into visiting a login form of a website with the saved credentials, and the KPM extension must autofill these credentials. The attacker must then launch a malware module to steal those specific credentials.",
"id": "GHSA-m882-67h5-2g42",
"modified": "2024-03-22T18:30:31Z",
"published": "2024-03-22T18:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23349"
},
{
"type": "WEB",
"url": "https://support.kaspersky.com/vulnerability/list-of-advisories/12430#180324"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-P763-V5VH-F5MG
Vulnerability from github – Published: 2024-06-07 15:30 – Updated: 2024-07-03 18:44
VLAI
Details
An issue in the implementation of the WPS in Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 allows attackers to gain access to the router's pin.
Severity
8.2 (High)
{
"affected": [],
"aliases": [
"CVE-2024-36792"
],
"database_specific": {
"cwe_ids": [
"CWE-316"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-07T15:15:50Z",
"severity": "HIGH"
},
"details": "An issue in the implementation of the WPS in Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 allows attackers to gain access to the router\u0027s pin.",
"id": "GHSA-p763-v5vh-f5mg",
"modified": "2024-07-03T18:44:18Z",
"published": "2024-06-07T15:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36792"
},
{
"type": "WEB",
"url": "https://redfoxsec.com/blog/security-advisory-multiple-vulnerabilities-in-netgear-wnr614-router"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.