CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 7CVE-2023-32784
https://notcve.org/view.php?id=CVE-2023-32784
In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace is locked or no longer running. The memory dump can be a KeePass process dump, swap file (pagefile.sys), hibernation file (hiberfil.sys), or RAM dump of the entire system. The first character cannot be recovered. In 2.54, there is different API usage and/or random string insertion for mitigation. En KeePass v2.x anterior a v2.54, es posible recuperar la contraseña maestra en texto claro a partir de un volcado de memoria, incluso cuando un espacio de trabajo está bloqueado o ya no se ejecuta. • https://github.com/Cmadhushanka/CVE-2023-32784-Exploitation https://github.com/CTM1/CVE-2023-32784-keepass-linux https://github.com/dawnl3ss/CVE-2023-32784 https://github.com/ValentinPundikov/poc-CVE-2023-32784 https://github.com/Hirusha-N/CVE-2021-34527-CVE-2023-38831-and-CVE-2023-32784 https://github.com/le01s/poc-CVE-2023-32784 https://github.com/keepassxreboot/keepassxc/discussions/9433 https://github.com/vdohney/keepass-password-dumper https://sourceforge.net/p/keepass/discussion • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 3CVE-2023-24055
https://notcve.org/view.php?id=CVE-2023-24055
KeePass through 2.53 (in a default installation) allows an attacker, who has write access to the XML configuration file, to obtain the cleartext passwords by adding an export trigger. NOTE: the vendor's position is that the password database is not intended to be secure against an attacker who has that level of access to the local PC. KeePass en la versión 2.53 (en una instalación por defecto) permite a un atacante, que tiene acceso de escritura al archivo de configuración XML, obtener las contraseñas en texto claro mediante la adición de un disparador de exportación. NOTA: la posición del vendedor es que la base de datos de contraseñas no está pensada para ser segura contra un atacante que tenga ese nivel de acceso al PC local. • https://github.com/deetl/CVE-2023-24055 https://github.com/duckbillsecurity/CVE-2023-24055 https://github.com/zwlsix/KeePass-CVE-2023-24055 https://securityboulevard.com/2023/01/keepass-password-manager-leak-cve-richixbw https://sourceforge.net/p/keepass/discussion/329220/thread/a146e5cf6b https://sourceforge.net/p/keepass/feature-requests/2773 • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-0725
https://notcve.org/view.php?id=CVE-2022-0725
A flaw was found in keepass. The vulnerability occurs due to logging the plain text passwords in system log and leads to an Information Exposure vulnerability. This flaw allows an attacker to interact and read sensitive passwords and logs. Se ha encontrado un fallo en keepass. La vulnerabilidad se produce debido al registro de las contraseñas en texto plano en el registro del sistema y conduce a una vulnerabilidad de exposición de información. • https://bugzilla.redhat.com/show_bug.cgi?id=2052696 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-20184
https://notcve.org/view.php?id=CVE-2019-20184
KeePass 2.4.1 allows CSV injection in the title field of a CSV export. KeePass versión 2.4.1, permite una inyección CSV en el campo title de una exportación de CSV. • https://medium.com/%40Pablo0xSantiago/cve-2019-20184-keepass-2-4-1-csv-injection-33f08de3c11a • CWE-1236: Improper Neutralization of Formula Elements in a CSV File •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-1000066
https://notcve.org/view.php?id=CVE-2017-1000066
The entry details view function in KeePass version 1.32 inadvertently decrypts certain database entries into memory, which may result in the disclosure of sensitive information. La función entry details view en KeePass versión 1.32, desencripta inadvertidamente ciertas entradas de base de datos en la memoria, resultando en la divulgación de información confidencial. • http://keepass.info/news/news_all.html •