Weakness (CWE)
CWE-312: Cleartext Storage of Sensitive Information
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
How to prevent it (2 mitigations)
-
Implementation, System Configuration, Operation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest. [REF-1297] [REF-1299] [REF-1301]
-
Implementation, System Configuration, Operation
In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.
Source: MITRE CWE-312
570 results · Feed
-
High 7.5
Phicomm K2 v22.6.534.263 was discovered to store the root and admin passwords in plaintext.
-
High 7.5
Phicomm K2G v22.6.3.20 was discovered to store the root and admin passwords in plaintext.
-
Medium 5.5
Plaintext storage of Access Token in Jenkins GitHub Pull Request Coverage Status Plugin
Jenkins GitHub Pull Request Coverage Status Plugin 2.2.0 and earlier stores the GitHub Personal Access Token, Sonar access token and Sonar password unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with a…
-
Medium 5.5
Plaintext Storage of a Password in Jenkins JIRA Pipeline Steps Plugin
Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier stores the private keys unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
-
Medium 6.5
Passwords stored in plain text by Jenkins view-cloner Plugin
Jenkins view-cloner Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
-
Medium 5.5
Plaintext Storage of a Password in Jenkins TestQuality Updater Plugin
Jenkins TestQuality Updater Plugin 1.3 and earlier stores the TestQuality Updater password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
-
High 7.5
Sensitive Information Disclosure Vulnerability
In DPA 2022.4 and older releases, generated heap memory dumps contain sensitive information in cleartext.
-
Medium 6.5
A pair of spare WiFi credentials is stored in the configuration file of the Zyxel AX7501-B0 firmware prior to V5.17(ABP…
-
Medium 6.2
NVIDIA BMC stores user passwords in an obfuscated form in a database accessible by the host. This may lead to a credent…
-
Medium 5.5
Apache James MIME4J: Temporary File Information Disclosure in MIME4J TempFileStorageProvider
Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users. This issue affects Apache James MIME4J version 0.8.8 and prior versions. We recommend users to upgrade to MIME4j…
-
High 7.5
An issue was discovered in WeCube Platform 3.2.2. Cleartext passwords are displayed in the configuration for terminal p…
-
Medium 4.6
Certain General Electric Renewable Energy products store cleartext credentials in flash memory. This affects iNET and i…
-
Low 3.3
Logins saved by Firefox should be managed by the Password Manager component which uses encryption to save files on-disk…
-
Medium 5.5
Sensitive Data Disclosure Vulnerability
Sensitive information was stored in plain text in a file that is accessible by a user with a local account in Hybrid Cloud Observability (HCO)/ SolarWinds Platform 2022.4. No other versions are affected
-
Medium 5.5
The vCenter Server contains an information disclosure vulnerability due to the logging of credentials in plaintext. A m…
-
Medium 5.5
A cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3. This could all…
-
High 8.8
IXPdata EasyInstall 6.6.14725 contains an access control issue.
-
High 7.5
The /device/signin end-point for the Ourphoto App version 1.4.1 discloses clear-text password information for functiona…
-
Medium 6.8
Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.087…
-
High 8.6
Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095…
-
High 8.4
Password exposure in H2 Database
The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user (or an attacker t…
-
Medium 6.2
Plaintext storage of password in org.xwiki.platform:xwiki-platform-security-authentication-default
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When the `reset a forgotten password` feature of XWiki was used, the password was then stored in plain text in database. This only concerns XWiki 13.1RC1 …
-
High 7.1
Cleartext Credentials Vulnerability on Hitachi Energy’s Multiple IED Connectivity Packages (IED ConnPacks) and PCM600 Products
A vulnerability exists in the Intelligent Electronic Device (IED) Connectivity Package (ConnPack) credential storage function in Hitachi Energy’s PCM600 product included in the versions listed below, where IEDs credentials are stored in a cleartext format in …
-
High 7.5
The PassWork extension 5.0.9 for Chrome and other browsers allows an attacker to obtain the cleartext master password.
-
High 7.5
The PassWork extension 5.0.9 for Chrome and other browsers allows an attacker to obtain cleartext cached credentials.
-
Medium 6.5
"IBM Cognos Analytics 11.2.1, 11.2.0, 11.1.7 stores user credentials in plain clear text which can be read by an authen…
-
Medium 4.3
"IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.…
-
Medium 4.0
Exception logging in Sharepoint app reveals clear-text connection details
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server prior to versions 23.0.9 and 24.0.5 and Nextcloud Enterprise Server prior to versions 22.2.10.5, 23.0.9, and 24.0.5 an attacker reading `nextc…
-
Medium 4.4
Dependency-Track vulnerable to logging of API keys in clear text when handling API requests using keys with insufficient permissions
Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior to version 4.6.0, performing an API request using a valid API key with insufficient permissions causes the API key to b…
-
Medium 6.5
A flaw was found in ovirt-engine, which leads to the logging of plaintext passwords in the log file when using otapi-st…
-
Medium 6.5
An issue has been discovered in hunter2 affecting all versions before 2.1.0. Improper handling of auto-completion input…
-
Medium 5.3
A cleartext storage of sensitive information exists in Rocket.Chat <v4.6.4 due to Oauth token being leaked in plaintext…
-
Medium 5.3
Jenkins BigPanda Notifier Plugin Missing Password Field Masking
Jenkins BigPanda Notifier Plugin 1.4.0 and earlier does not mask the BigPanda API key on the global configuration form, increasing the potential for attackers to observe and capture it.
-
Medium 5.4
Sensitive data in backend customer module
Shopware is an open source e-commerce software. In affected versions the request for the customer detail view in the backend administration contained sensitive data like the hashed password and the session ID. These fields are now explicitly unset in version …
-
Critical 9.9
Rancher: Failure to properly sanitize credentials in cluster template answers
A Insufficiently Protected Credentials vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners and Project Members to read credentials, passwords and API tokens that have been stored in cleartext and exposed via API …
-
Critical 9.9CVE-2021-36782 Public exploit
Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object
A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners, Project Members and User Base to use the Kubernetes API to retrieve plaintext version of sensitive data. This issu…
-
Medium 5.5
ARC Informatique PcVue
The affected device stores sensitive information in cleartext, which may allow an authenticated user to access session data stored in the OAuth database belonging to legitimate users
-
Medium 4.3
SourceCodester Guest Management System cleartext storage
A vulnerability, which was classified as problematic, was found in SourceCodester Guest Management System. Affected is an unknown function. The manipulation leads to cleartext storage of passwords in the database. The identifier of this vulnerability is VDB-2…
-
Medium 5.9
SICUNET Access Controller Password Storage cleartext storage
A vulnerability was found in SICUNET Access Controller 0.32-05z. It has been declared as problematic. This vulnerability affects unknown code of the component Password Storage. The manipulation leads to weak encryption. Attacking locally is a requirement.
-
Unscored —
During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication…