Monthly
Cleartext vault data in UpSignOn for Windows before 7.19.0 persists in process memory after the application locks, exposing all stored secrets to any local attacker with standard user privileges. Using the Windows PROCESS_VM_READ permission, an attacker can call ReadProcessMemory() against UpSignOn.exe and extract entry names, URLs, usernames, passwords, TOTP secrets, and notes in plaintext - defeating the lock screen's security guarantee. No public exploit code is identified at time of analysis and no CISA KEV listing exists, but the technique is well within the reach of any attacker with local access to the workstation.
Sensitive key retention in UpSignOn for Windows before 7.19.0 allows a local attacker with low privileges to recover the master password and decrypt the entire password vault. The backup key used to protect an encrypted master password backup is retained in the memory of UpSignOn.exe even after the vault is re-locked, enabling an attacker who can read process memory to extract it, decrypt the master password backup stored in v6-vault1.DATA.txt, and subsequently export all stored credentials in cleartext. No public exploit has been identified at time of analysis, but the attack chain is mechanically straightforward once local access is established.
Cleartext credential exposure in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator (all versions before 2.01.05) allows a local low-privilege attacker who meets specific preconditions to retrieve sensitive data stored unencrypted in application memory (CWE-316). The CVSS 4.0 vector's subsequent-system confidentiality impact (SC:H) is especially notable given this platform interfaces with fire alarm controllers and building safety networks, meaning extracted credentials could be leveraged against downstream safety-critical infrastructure. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Sensitive-data disclosure in IBM Datacap and Datacap Navigator (versions 9.1.7, 9.1.8, 9.1.9) lets an attacker recover user passwords and cryptographic keys that the application holds in cleartext in memory; the recovered keys can then decrypt stored credentials, authenticate to the application, and reach sensitive data in the backing database. IBM has released a patch. There is no public exploit identified at time of analysis, EPSS exploitation probability is negligible (0.08%, 0th percentile), and CISA SSVC rates exploitation as 'none' - indicating low immediate field risk despite the high CVSS confidentiality impact.
Cleartext storage of sensitive information in memory (CWE-316) affects both the Meona Client Launcher Component and the Meona Server Component from Mesalvo, exposing confidential data to local privileged attackers. The CVSS vector (AV:L/PR:H/S:C/C:H) indicates that a locally authenticated administrator can read sensitive material - likely credentials or session tokens - directly from process memory, with the changed scope suggesting this exposure can cascade to resources or components beyond the initially compromised process. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
SAP Business One stores sensitive data unencrypted in memory dump files, allowing high-privileged local users with user interaction to extract credentials and other confidential information. An attacker with access to these dumps could leverage the exposed data to perform unauthorized operations and modify company data within the B1 environment. No patch is currently available for this medium-severity vulnerability.
Session tokens and passwords in couch-auth 0.21.2 are stored in JavaScript objects and remain in memory without explicit clearing in src/user.ts lines 700-707. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Cleartext Storage of Sensitive Information in Memory vulnerability [CWE-316] in Fortinet FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM. Rated medium severity (CVSS 4.2), this vulnerability is low attack complexity. No vendor patch available.
A sensitive information disclosure vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated non-admin user to retrieve sensitive data from Prisma Browser. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
SAP GUI for Windows may allow a highly privileged user on the affected client PC to locally access sensitive information stored in process memory during runtime.This vulnerability has a high impact. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Cleartext vault data in UpSignOn for Windows before 7.19.0 persists in process memory after the application locks, exposing all stored secrets to any local attacker with standard user privileges. Using the Windows PROCESS_VM_READ permission, an attacker can call ReadProcessMemory() against UpSignOn.exe and extract entry names, URLs, usernames, passwords, TOTP secrets, and notes in plaintext - defeating the lock screen's security guarantee. No public exploit code is identified at time of analysis and no CISA KEV listing exists, but the technique is well within the reach of any attacker with local access to the workstation.
Sensitive key retention in UpSignOn for Windows before 7.19.0 allows a local attacker with low privileges to recover the master password and decrypt the entire password vault. The backup key used to protect an encrypted master password backup is retained in the memory of UpSignOn.exe even after the vault is re-locked, enabling an attacker who can read process memory to extract it, decrypt the master password backup stored in v6-vault1.DATA.txt, and subsequently export all stored credentials in cleartext. No public exploit has been identified at time of analysis, but the attack chain is mechanically straightforward once local access is established.
Cleartext credential exposure in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator (all versions before 2.01.05) allows a local low-privilege attacker who meets specific preconditions to retrieve sensitive data stored unencrypted in application memory (CWE-316). The CVSS 4.0 vector's subsequent-system confidentiality impact (SC:H) is especially notable given this platform interfaces with fire alarm controllers and building safety networks, meaning extracted credentials could be leveraged against downstream safety-critical infrastructure. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Sensitive-data disclosure in IBM Datacap and Datacap Navigator (versions 9.1.7, 9.1.8, 9.1.9) lets an attacker recover user passwords and cryptographic keys that the application holds in cleartext in memory; the recovered keys can then decrypt stored credentials, authenticate to the application, and reach sensitive data in the backing database. IBM has released a patch. There is no public exploit identified at time of analysis, EPSS exploitation probability is negligible (0.08%, 0th percentile), and CISA SSVC rates exploitation as 'none' - indicating low immediate field risk despite the high CVSS confidentiality impact.
Cleartext storage of sensitive information in memory (CWE-316) affects both the Meona Client Launcher Component and the Meona Server Component from Mesalvo, exposing confidential data to local privileged attackers. The CVSS vector (AV:L/PR:H/S:C/C:H) indicates that a locally authenticated administrator can read sensitive material - likely credentials or session tokens - directly from process memory, with the changed scope suggesting this exposure can cascade to resources or components beyond the initially compromised process. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
SAP Business One stores sensitive data unencrypted in memory dump files, allowing high-privileged local users with user interaction to extract credentials and other confidential information. An attacker with access to these dumps could leverage the exposed data to perform unauthorized operations and modify company data within the B1 environment. No patch is currently available for this medium-severity vulnerability.
Session tokens and passwords in couch-auth 0.21.2 are stored in JavaScript objects and remain in memory without explicit clearing in src/user.ts lines 700-707. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Cleartext Storage of Sensitive Information in Memory vulnerability [CWE-316] in Fortinet FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM. Rated medium severity (CVSS 4.2), this vulnerability is low attack complexity. No vendor patch available.
A sensitive information disclosure vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated non-admin user to retrieve sensitive data from Prisma Browser. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
SAP GUI for Windows may allow a highly privileged user on the affected client PC to locally access sensitive information stored in process memory during runtime.This vulnerability has a high impact. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.