Weakness (CWE)
CWE-256: Plaintext Storage of a Password
The product stores a password in plaintext within resources such as memory or files.
How to prevent it (3 mitigations)
-
Architecture and Design
Avoid storing passwords in easily accessible locations.
-
Architecture and Design
Consider storing cryptographic hashes of passwords as an alternative to storing in plaintext.
-
A programmer might attempt to remedy the password management problem by obscuring the password with an encoding function, such as base 64 encoding, but this effort does not adequately protect the password because the encoding can be detected and decoded easily.
Source: MITRE CWE-256
16 results · Clear filters · Feed
-
Critical 9.1
motionEye: Authentication possible via password hash
motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Prior to 0.44.0, motionEye accepts the client-controlled meye_username and meye_password_hash cookies as authenticati…
-
Critical 9.3
Plaintext Storage of a Password in Sparx Pro Cloud Server.
Plaintext Storage of a Password vulnerability in Sparx Systems Pty Ltd. Sparx Pro Cloud Server. In a setup where OpenID is used as the primary method of authentication to authenticate to Sparx EA, Pro Cloud Server creates local passwords to the users and sto…
-
Critical 9.2
Plaintext storage of a password in OpenPLC_V3
OpenPLC_V3 is vulnerable to a Plaintext Storage of a Password vulnerability that could allow an attacker to retrieve credentials and access sensitive information.
-
Critical 9.4
Vasion Print (formerly PrinterLogic) Readable Cleartext Passwords
Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA/SaaS deployments) store a large number of sensitive credentials (database passwords, MySQL root password, SaaS keys, Portainer admin password, etc.) in cleartext files that are wo…
-
Critical 9.8
Hunt Electronic Hybrid DVR - Exposure of Sensitive System Information
Certain hybrid DVR models ((HBF-09KD and HBF-16NK)) from Hunt Electronic have an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to directly access a system configuration file and obtain plaintext administrator crede…
-
Critical 9.8
Sapido Wireless Router - Exposure of Sensitive Information
Multiple wireless router models from Sapido have an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to directly access a system configuration file and obtain plaintext administrator credentials. The affected models …
-
Critical 9.8
Honding Technology Smart Parking Management System - Exposure of Sensitive Information
Smart Parking Management System from Honding Technology has an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to access a specific page and obtain plaintext administrator credentials.
-
Critical 9.8
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Password in UR…
-
Critical 9.8
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Password Store…
-
Critical 9.8
Plaintext Storage of a Password in Eliz Software's Panel
Plaintext Storage of a Password vulnerability in Eliz Software Panel allows : Use of Known Domain Credentials. This issue affects Panel: before v2.3.24.
-
Critical 9.3
Hamastar MeetingHub Paperless Meetings - Plaintext Storage of a Password
A Plaintext Storage of a Password vulnerability in ebooknote function in Hamastar MeetingHub Paperless Meetings 2021 allows remote attackers to obtain the other users’ credentials and gain access to the product via an XML file.
-
Critical 9.8
LB-LINK BL-W1210M v2.0 was discovered to store user credentials in plaintext within the router's firmware.
-
Critical 9.8
Westermo EDW-100 devices through 2024-05-03 allow an unauthenticated user to download a configuration file containing a…
-
Critical 9.8
Plaintext storage of a password issue exists in BUFFALO wireless LAN routers, which may allow a network-adjacent unauth…
-
Critical 9.9
Rancher: Exposure of sensitive fields
A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows users on managed clusters to gain access to credentials. The impact depends on the credentials exposed This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher…
-
Critical 9.8
Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i…