Weakness (CWE)
CWE-312: Cleartext Storage of Sensitive Information
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
How to prevent it (2 mitigations)
-
Implementation, System Configuration, Operation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest. [REF-1297] [REF-1299] [REF-1301]
-
Implementation, System Configuration, Operation
In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.
Source: MITRE CWE-312
312 results · Clear filters · Feed
-
Medium 4.4
IBM OpenPages with Watson information disclosure
IBM OpenPages with Watson 9.0 may write sensitive information, under specific configurations, in clear text to the system tracing log files that could be obtained by a privileged user.
-
Medium 5.7
Oxide before 6 has unencrypted Control Plane datastores.
-
Medium 5.4
Information Disclosure Vulnerability in Tinxy
This vulnerability exists in the Tinxy mobile app due to storage of logged-in user information in plaintext on the device database. An attacker with physical access to the rooted device could exploit this vulnerability by accessing its database leading to una…
-
Medium 4.3
Exposure of Wi-Fi Credentials in Plaintext in TP-Link Archer C50
This vulnerability exists in the TP-Link Archer C50 due to presence of terminal access on a serial interface without proper access control. An attacker with physical access could exploit this by accessing the UART shell on the vulnerable device. Successful ex…
-
Medium 5.9
User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved…
-
Medium 5.3
Using remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. This vulnerability affects …
-
Medium 5.3
Moodle: user information visibility control issues in gradebook reports
A flaw was found in moodle. Some hidden user profile fields are visible in gradebook reports, which could result in users without the "view hidden user fields" capability having access to the information.
-
Medium 5.4
An issue was discovered in Siime Eye 14.1.00000001.3.330.0.0.3.14. When a backup file is created through the web interf…
-
Medium 4.4
Information Disclosure Vulnerability in TP-Link IoT Smart Hub
This vulnerability exists in TP-Link IoT Smart Hub due to storage of Wi-Fi credentials in plain text within the device firmware. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obtain the Wi-Fi c…
-
Medium 6.8
Insufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrato…
-
Medium 5.9
Improper Storage of Sensitive Information in Bearer Token in mintplex-labs/anything-llm
mintplex-labs/anything-llm version latest contains a vulnerability where sensitive information, specifically a password, is improperly stored within a JWT (JSON Web Token) used as a bearer token in single user mode. When decoded, the JWT reveals the password …
-
Medium 5.3
Conformance validation endpoint discloses detail about service to unauthenticated users
The conformance validation endpoint is public so everybody can verify the conformance of onboarded services. The response could contain specific information about the service, including available endpoints, and swagger. It could advise about the running versi…
-
Medium 5.3
Health endpoint offers list of onboarded services to unauthenticated users
The health endpoint is public so everybody can see a list of all services. It is potentially valuable information for attackers.
-
Medium 4.8
OpenC3 COSMOS uses clear text storage of password/token (`GHSL-2024-129`)
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. OpenC3 COSMOS stores the password of a user unencrypted in the LocalStorage of a web browser. This makes the user password susceptible to e…
-
Medium 6.5
Cleartext storage of passwords in Infinera TNMS (Transcend Network Management System) Server 19.10.3 allows attackers (…
-
Medium 6.6
An issue was discovered in Infinera hiT 7300 5.60.50. Sensitive information inside diagnostic files (exported by the @C…
-
Medium 6.5
An issue was discovered in Infinera hiT 7300 5.60.50. Cleartext storage of sensitive information in the memory of the @…
-
Medium 4.9
Ovirt-engine: potential exposure of cleartext provider passwords via web ui
A flaw was found in oVirt. A user with administrator privileges, including users with the ReadOnlyAdmin permission, may be able to use browser developer tools to view Provider passwords in cleartext.
-
Medium 6.3
The Eaton Foreseer software provides the feasibility for the user to configure external servers for multiple purposes s…
-
Medium 6.0
ActiveMQ Content Pack: Cleartext Exposure of Credentials
A problem with the ActiveMQ integration for both Cortex XSOAR and Cortex XSIAM can result in the cleartext exposure of the configured ActiveMQ credentials in log bundles.
-
Medium 4.3
Email addresses of remote users visible in props regardless of server settings
Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2, when shared channels are enabled, fail to redact remote users' original email addresses stored in user props when email addresses are otherwise configured not to be visible …
-
Medium 6.2
Plaintext vulnerability in the Gallery search module. Impact: Successful exploitation of this vulnerability will affect…
-
Medium 5.5
IBM QRadar Suite Software information disclosure
IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.22.0 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 281429.
-
Medium 5.7
Information Disclosure Vulnerability in SnapCenter
SnapCenter versions prior to 5.0p1 are susceptible to a vulnerability which could allow an authenticated attacker to discover plaintext credentials.
-
Medium 5.3
Linksys Velop Pro 6E 1.0.8 MX6200_1.0.8.215731 and 7 1.0.10.215314 devices send cleartext Wi-Fi passwords over the publ…
-
Medium 5.9
password management API prints sensitive information in log files
A vulnerability in a password management API in Brocade Fabric OS versions before v9.2.1, v9.2.0b, v9.1.1d, and v8.2.3e prints sensitive information in log files. This could allow an authenticated user to view the server passwords for protocols such as scp an…
-
Medium 4.3
An issue in Annonshop.app DecentralizeJustice/anonymousLocker commit 2b2b4 to ba9fd and DecentralizeJustice/anonBackend…
-
Medium 4.1
A vulnerability exists in the FOXMAN-UN/UNEM in which sensitive information is stored in cleartext within a resource th…
-
Medium 4.9
An issue in the SMTP Email Settings of AVTECH Room Alert 4E v4.4.0 allows attackers to gain access to credentials in pl…
-
Medium 6.5
An issue was discovered in Italtel Embrace 1.6.4. The web application inserts cleartext passwords in the HTML source co…
-
Medium 5.3
A vulnerability has been identified in OPUPI0 AMQP/MQTT (All versions < V5.30). The affected devices stores MQTT client…
-
Medium 5.5
Rhosp-director: cleartext passwords exposed in logs
An flaw was found in the OpenStack Platform (RHOSP) director, a toolset for installing and managing a complete RHOSP environment. Plaintext passwords may be stored in log files, which can expose sensitive information to anyone with access to the logs.
-
Medium 5.7
NETGEAR RAX30 Device Configuration Cleartext Storage Information Disclosure Vulnerability
NETGEAR RAX30 Device Configuration Cleartext Storage Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR RAX30 routers. Although authentication is re…
-
Medium 6.5
SecuSTATION Camera V2.5.5.3116-S50-SMA-B20160811A and lower allows an unauthenticated attacker to download device confi…
-
Medium 6.5
cleartext password in supportsave logs when a user schedules a switch Supportsave from Brocade SANnav
A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a prints the Brocade SANnav password in clear text in supportsave logs when a user schedules a switch Supportsave from Brocade SANnav.
-
Medium 5.5
Clear text storage of sensistive information by manipulating command variables
A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a could allow an authenticated user to print the Auth, Priv, and SSL key store passwords in unencrypted logs by manipulating command variables.
-
Medium 6.6
HCL BigFix Asset Discovery is affected by a security vulnerability
The NMAP Importer service may expose data store credentials to authorized users of the Windows Registry.
-
Medium 5.9
In Unify CP IP Phone firmware 1.10.4.3, files are not encrypted and contain sensitive information such as the root pass…
-
Medium 5.5CVE-2024-24488 Public exploit
An issue in Shenzen Tenda Technology CP3V2.0 V11.10.00.2311090948 allows a local attacker to obtain sensitive informati…
-
Medium 6.0
Allegro AI ClearML Stores Credentials in Plaintext in MongoDB Instance
Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaking all user emails and passwords.