Weakness (CWE)
CWE-256: Plaintext Storage of a Password
The product stores a password in plaintext within resources such as memory or files.
How to prevent it (3 mitigations)
-
Architecture and Design
Avoid storing passwords in easily accessible locations.
-
Architecture and Design
Consider storing cryptographic hashes of passwords as an alternative to storing in plaintext.
-
A programmer might attempt to remedy the password management problem by obscuring the password with an encoding function, such as base 64 encoding, but this effort does not adequately protect the password because the encoding can be detected and decoded easily.
Source: MITRE CWE-256
300 results · Feed
-
Medium 4.4
IBM Storage Defender - Resiliency Service information disclosure
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.9 could allow a privileged user to obtain highly sensitive user credentials from secret keys that are stored in clear text.
-
High 7.2
Dell VxVerify, versions prior to x.40.405, contain a Plain-text Password Storage Vulnerability in the shell wrapper. A …
-
High 7.2
Billion Electric router - Plaintext Storage of a Password
Certain models of routers from Billion Electric has a Plaintext Storage of a Password vulnerability. Remote attackers with administrator privileges can access the user settings page to retrieve plaintext passwords.
-
Low 2.7
Media Types: Office365, SMTP passwords are unencrypted and visible in plaintext when exported
When exporting media types, the password is exported in the YAML in plain text. This appears to be a best practices type issue and may have no actual impact. The user would need to have permissions to access the media types and therefore would be expected to …
-
Medium 5.9
User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved…
-
Medium 5.5
IBM Workload Scheduler information disclosure
IBM Workload Scheduler 9.5, 10.1, and 10.2 stores user credentials in plain text which can be read by a local user.
-
High 8.7
Change-Password via Portal-Profile sets PimcoreBackendUser password without hashing
Pimcore is an open source data and experience management platform. When a PortalUserObject is connected to a PimcoreUser and "Use Pimcore Backend Password" is set to true, the change password function in Portal Profile sets the new password. Prior to Pimcore …
-
Medium 6.5
Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpec
A vulnerability has been identified in which an RKE1 cluster keeps constantly reconciling when secrets encryption configuration is enabled. When reconciling, the Kube API secret values are written in plaintext on the AppliedSpec. Cluster owners, Cluster membe…
-
Low 2.4
Smart-tab Android app installed April 2023 or earlier contains an issue with plaintext storage of a password. If this v…
-
Medium 4.3
IBM Cognos Command Center information disclosure
IBM Cognos Command Center 10.2.4.1 and 10.2.5 could disclose highly sensitive user information to an authenticated user with physical access to the device.
-
Critical 9.8
Plaintext Storage of a Password in Eliz Software's Panel
Plaintext Storage of a Password vulnerability in Eliz Software Panel allows : Use of Known Domain Credentials. This issue affects Panel: before v2.3.24.
-
High 8.8
Victure PC420 1.1.39 was discovered to contain a hardcoded root password which is stored in plaintext.
-
High 8.4
Cisco Routed Passive Optical Network Cleartext Password Vulnerability
A vulnerability in the storage method of the PON Controller configuration file could allow an authenticated, local attacker with low privileges to obtain the MongoDB credentials. This vulnerability is due to improper storage of the unencrypted database creden…
-
Medium 6.0
Information disclosure vulnerability in SAP NetWeaver AS for Java (Destination Service)
SAP NetWeaver AS for Java allows an authorized attacker to obtain sensitive information. The attacker could obtain the username and password when creating an RFC destination. After successful exploitation, an attacker can read the sensitive information but ca…
-
High 8.0CVE-2024-44815 Public exploit
Vulnerability in Hathway Skyworth Router CM5100 v.4.1.1.24 allows a physically proximate attacker to obtain user creden…
-
High 7.8
calamares-nixos-extensions LUKS keyfile exposure regression on legacy BIOS systems
calamares-nixos-extensions provides Calamares branding and modules for NixOS, a distribution of GNU/Linux. Users who installed NixOS through the graphical installer who used manual disk partitioning to create a setup where the system was booted via legacy BIO…
-
Medium 5.5
IBM QRadar Suite Software information disclosure
IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 281430.
-
Medium 4.6
A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions), LOGO! 12/24RCEo (6ED1052-2MD…
-
High 8.1
Front-end audit log shows passwords in plaintext
The front-end audit log allows viewing of unprotected plaintext passwords, where the passwords are displayed in plain text.
-
Critical 9.3
Hamastar MeetingHub Paperless Meetings - Plaintext Storage of a Password
A Plaintext Storage of a Password vulnerability in ebooknote function in Hamastar MeetingHub Paperless Meetings 2021 allows remote attackers to obtain the other users’ credentials and gain access to the product via an XML file.
-
Low 3.3
DM5500 5.16.0.0, contains an information disclosure vulnerability. A local attacker with high privileges could potentia…
-
Medium 4.2
A “CWE-256: Plaintext Storage of a Password” affecting the administrative account allows an attacker with physical acce…
-
High 8.1
An issue in Solar-Log 1000 before v2.8.2 and build 52-23.04.2013 was discovered to store plaintext passwords in the exp…
-
Medium 5.9
Zowe CLI Auto-Init Leaks Credentials Locally
A vulnerability in Zowe CLI allows local, privileged actors to store previously entered secure credentials in a plaintext file as part of an auto-init operation.
-
Medium 5.5
IBM Datacap Navigator information disclosure
IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 295972.
-
Medium 6.5
BAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE, AV-02IDR, AV-02IPD, AV-02FDE, …
-
High 7.4
Insecure permissions
Coredump binaries in Toshiba printers have incorrect permissions. A local attacker can steal confidential information. As for the affected products/models/versions, see the reference URL.
-
Critical 9.8
LB-LINK BL-W1210M v2.0 was discovered to store user credentials in plaintext within the router's firmware.
-
Medium 4.4
IBM Jazz Reporting Service information disclosure
IBM Jazz Reporting Service 7.0.3 stores user credentials in plain clear text which can be read by an admin user. IBM X-Force ID: 283363.
-
High 8.4
Subiquity Shows Guided Storage Passphrase in Plaintext with Read-all Permissions
-
High 7.1
An issue in Debezium Community debezium-ui v.2.5 allows a local attacker to execute arbitrary code via the refresh page…
-
Medium 5.3
TYPO3 Information Disclosure in User Authentication
It has been discovered that login failures have been logged on the default stream with log level "warning" including plain-text user credentials.
-
Critical 9.8
Westermo EDW-100 devices through 2024-05-03 allow an unauthenticated user to download a configuration file containing a…
-
Medium 5.4CVE-2024-4232 Public exploit
Password Storage in Plaintext Vulnerability in Digisol Router
This vulnerability exists in Digisol Router (DG-GR1321: Hardware version 3.7L; Firmware version : v3.2.02) due to lack of encryption or hashing in storing of passwords within the router's firmware/ database. An attacker with physical access could exploit this…
-
Medium 5.4
Storing credentials in plaintext in CemiPark
The access control in CemiPark software stores integration (e.g. FTP or SIP) credentials in plain-text. An attacker who gained unauthorized access to the device can retrieve clear text passwords used by the system.This issue affects CemiPark software: 4.5, 4.…
-
Low 3.5
Dell Update Manager Plugin, versions 1.4.0 through 1.5.0, contains a Plain-text Password Storage Vulnerability in Log f…
-
Medium 6.3
Dell OpenManage Enterprise, versions 4.0.0 and 4.0.1, contains a sensitive information disclosure vulnerability. A loca…
-
Medium 6.1
Asus RT-N12+ B1 router stores credentials in cleartext, which could allow local attackers to obtain unauthorized access…
-
High 7.3
Mirror-registry: database user and password stored in plain-text
A flaw was found in how Quay's database is stored in plain-text in mirror-registry on the jinja's config.yaml file. This flaw allows a malicious actor with access to this file to gain access to Quay's database.
-
High 7.3
Mirror-registry: redis password stored in plain-text
A flaw was found in Quay, where Quay's database is stored in plain text in mirror-registry on Jinja's config.yaml file. This issue leaves the possibility of a malicious actor with access to this file to gain access to Quay's Redis instance.