Weakness (CWE)
CWE-256: Plaintext Storage of a Password
The product stores a password in plaintext within resources such as memory or files.
How to prevent it (3 mitigations)
-
Architecture and Design
Avoid storing passwords in easily accessible locations.
-
Architecture and Design
Consider storing cryptographic hashes of passwords as an alternative to storing in plaintext.
-
A programmer might attempt to remedy the password management problem by obscuring the password with an encoding function, such as base 64 encoding, but this effort does not adequately protect the password because the encoding can be detected and decoded easily.
Source: MITRE CWE-256
300 results · Feed
-
Unscored —
In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Cent…
-
Low 3.3
Jenkins Weibo Plugin stores credentials unencrypted in its global configuration file
Jenkins Weibo Plugin 1.0.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Low —
Plaintext Storage in Jenkins Spira Importer Plugin
Jenkins Spira Importer Plugin 3.2.2 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Medium 5.6
SBR Carrier: A vulnerability in the identity and access management certificate generation procedure allows a local attacker to gain access to confidential information.
An Unprotected Storage of Credentials vulnerability in the identity and access management certificate generation procedure allows a local attacker to gain access to confidential information. This issue affects: Juniper Networks SBR Carrier: 8.4.1 versions pri…
-
Low 3.3
DingTalk Plugin stores credentials in plain text
Jenkins Dingding[钉钉] Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Low —
Jenkins LDAP Email Plugin shows plain text password in configuration form
Jenkins LDAP Email Plugin transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
-
Medium 5.5
Jenkins Gem Publisher Plugin stores credentials as plaintext
Jenkins Gem Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Medium 5.5
Plaintext Storage of a Password in Jenkins Configuration as Code Plugin
Jenkins Configuration as Code Plugin 1.20 and earlier did not treat the proxy password as a secret to be masked when logging or encrypted for export.
-
High 8.8
Plaintext password storage in Jenkins InfluxDB Plugin
Jenkins InfluxDB Plugin 1.21 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Unscored —
A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Unencrypted storage of…
-
High 8.8
Jenkins jira-ext Plugin stores credentials unencrypted
Jenkins jira-ext Plugin 0.8 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
-
Medium 6.5
Junos Space Service Now and Service Insight: Organization username and password stored in plaintext in log files.
A password management issue exists where the Organization authentication username and password were stored in plaintext in log files. A locally authenticated attacker who is able to access these stored plaintext credentials can use them to login to the Organi…
-
Unscored —
Detcon Sitewatch Gateway, all versions without cellular, an attacker can edit settings on the device using a specially …
-
Unscored —
Moxa IKS and EDS store plaintext passwords, which may allow sensitive information to be read by someone with access to …
-
Unscored —
In Ice Qube Thermal Management Center versions prior to version 4.13, passwords are stored in plaintext in a file that …
-
Critical 9.8
Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i…
-
Unscored —
In the web application in BeaconMedaes TotalAlert Scroll Medical Air Systems running software versions prior to 4107600…
-
Unscored —
In Omron CX-Supervisor Versions 3.30 and prior, access of uninitialized pointer vulnerabilities can be exploited when C…
-
Low 3.4
An issue was discovered in SMA Solar Technology products. Sniffed passwords from SMAdata2+ communication can be decrypt…
-
Unscored —
A Plaintext Storage of a Password issue was discovered in Moxa OnCell G3110-HSPA Version 1.3 build 15082117 and previou…