Weakness (CWE)
CWE-256: Plaintext Storage of a Password
The product stores a password in plaintext within resources such as memory or files.
How to prevent it (3 mitigations)
-
Architecture and Design
Avoid storing passwords in easily accessible locations.
-
Architecture and Design
Consider storing cryptographic hashes of passwords as an alternative to storing in plaintext.
-
A programmer might attempt to remedy the password management problem by obscuring the password with an encoding function, such as base 64 encoding, but this effort does not adequately protect the password because the encoding can be detected and decoded easily.
Source: MITRE CWE-256
70 results · Clear filters · Feed
-
High 7.8
calamares-nixos-extensions LUKS keyfile exposure regression on legacy BIOS systems
calamares-nixos-extensions provides Calamares branding and modules for NixOS, a distribution of GNU/Linux. Users who installed NixOS through the graphical installer who used manual disk partitioning to create a setup where the system was booted via legacy BIO…
-
High 8.1
Front-end audit log shows passwords in plaintext
The front-end audit log allows viewing of unprotected plaintext passwords, where the passwords are displayed in plain text.
-
High 8.1
An issue in Solar-Log 1000 before v2.8.2 and build 52-23.04.2013 was discovered to store plaintext passwords in the exp…
-
High 7.4
Insecure permissions
Coredump binaries in Toshiba printers have incorrect permissions. A local attacker can steal confidential information. As for the affected products/models/versions, see the reference URL.
-
High 8.4
Subiquity Shows Guided Storage Passphrase in Plaintext with Read-all Permissions
-
High 7.1
An issue in Debezium Community debezium-ui v.2.5 allows a local attacker to execute arbitrary code via the refresh page…
-
High 7.3
Mirror-registry: database user and password stored in plain-text
A flaw was found in how Quay's database is stored in plain-text in mirror-registry on the jinja's config.yaml file. This flaw allows a malicious actor with access to this file to gain access to Quay's database.
-
High 7.3
Mirror-registry: redis password stored in plain-text
A flaw was found in Quay, where Quay's database is stored in plain text in mirror-registry on Jinja's config.yaml file. This issue leaves the possibility of a malicious actor with access to this file to gain access to Quay's Redis instance.
-
High 8.8
Mirror-registry: plain-text default csrf secret key
A flaw was found when using mirror-registry to install Quay. It uses a default secret, which is stored in plain-text format in one of the configuration template files. This issue may lead to all instances of Quay deployed using mirror-registry to have the sam…
-
High 8.8
Visual Studio Code Elevation of Privilege Vulnerability
Visual Studio Code Elevation of Privilege Vulnerability
-
High 7.5
Password Disclosure in Mia Technology's Mia-Med
Plaintext Storage of a Password vulnerability in Mia Technology Inc. MİA-MED allows Read Sensitive Strings Within an Executable. This issue affects MİA-MED: before 1.0.7.
-
High 7.8
Networker 19.9 and all prior versions contains a Plain-text Password stored in temporary config file during backup dura…
-
High 7.1
EisBaer Scada - CWE-256: Plaintext Storage of a Password
EisBaer Scada - CWE-256: Plaintext Storage of a Password
-
High 7.3
Unprotected Storage of Credentials in Ormazabal products
The web application stores credentials in clear text in the "admin.xml" file, which can be accessed without logging into the website, which could allow an attacker to obtain credentials related to all users, including admin users, in clear text, and use them …
-
High 7.5
Socomec MOD3GP-SY-120K Plaintext Storage of a Password
The web application that owns the device clearly stores the credentials within the user management section. Obtaining this information can be done remotely due to the incorrect management of the sessions in the web application.
-
High 8.8
Plaintext storage of user password
A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile. When a user registers itself through registration flow, the "password" and "password-confirm" field from the form will occur as regular user attributes. All users and client…
-
High 7.5
Plaintext Storage of a Password in Infodrom Sofwares E-Invoice Approval System
Plaintext Storage of a Password vulnerability in Infodrom Software E-Invoice Approval System allows Read Sensitive Strings Within an Executable. This issue affects E-Invoice Approval System: before v.20230701.
-
High 7.5
Information Disclosure Vulnerability in MELSEC Series
Plaintext Storage of a Password vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series, MELSEC iQ-R Series, MELSEC-Q Series and MELSEC-L Series allows a remote unauthenticated attacker to disclose plaintext credentials stored in project files and…
-
High 7.6
A vulnerability has been identified in QMS Automotive (All versions < V12.39), QMS Automotive (All versions < V12.39). …
-
High 7.5
Plaintext Storage of Keys and Passwords in Rundeck and PagerDuty Process Automation
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. The Key Storage converter plugin mechanism was not enabled correctly in Rundeck 4.2.0 and 4.2.1, resulting in use of the encryption layer for Key Storage possibl…
-
High 7.5
PowerStore contains Plain-Text Password Storage Vulnerability in PowerStore X & T environments running versions 2.0.0.x…
-
High 7.5
Automation Direct CLICK PLC CPU Modules Plaintext Storage of a Password
The programming protocol allows for a previously entered password and lock state to be read by an attacker. If the previously entered password was successful, the attacker can then use the password to unlock Automation Direct CLICK PLC CPU Modules: C0-1x CPUs…
-
High 7.8
Rockwell Automation ISaGRAF5 Runtime Unprotected Storage of Credentials
Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x stores the password in plaintext in a file that is in the same directory as the executable file. ISaGRAF Runtime reads the file and saves the data in a variable without any additional modification. A lo…
-
High 8.2
Dell EMC System Update, version 1.9.2 and prior, contain an Unprotected Storage of Credentials vulnerability. A local a…
-
High 7.1
Dell Enterprise SONiC OS, versions 3.3.0 and earlier, contains a sensitive information disclosure vulnerability. An aut…
-
High 8.8
Dell EMC Repository Manager (DRM) version 3.2 contains a plain-text password storage vulnerability. Proxy server user p…
-
High 7.1
Duo Network Gateway (DNG) Information Disclosure Vulnerability
Duo has identified and fixed an issue with the Duo Network Gateway (DNG) product in which some customer-provided SSL certificates and private keys were not excluded from logging. This issue resulted in certificate and private key information being written out…
-
High 8.8
Dell EMC OpenManage Integration for Microsoft System Center (OMIMSSC) for SCCM and SCVMM versions prior to 7.2.1 contai…
-
High 8.8
Plaintext password storage in Jenkins InfluxDB Plugin
Jenkins InfluxDB Plugin 1.21 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
High 8.8
Jenkins jira-ext Plugin stores credentials unencrypted
Jenkins jira-ext Plugin 0.8 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.