Weakness (CWE)
CWE-312: Cleartext Storage of Sensitive Information
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
How to prevent it (2 mitigations)
-
Implementation, System Configuration, Operation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest. [REF-1297] [REF-1299] [REF-1301]
-
Implementation, System Configuration, Operation
In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.
Source: MITRE CWE-312
570 results · Feed
-
Medium 6.5CVE-2021-35036 Public exploit
A cleartext storage of information vulnerability in the Zyxel VMG3625-T50B firmware version V5.50(ABTL.0)b2k could allo…
-
Medium 5.5
Due to usernames/passwords being stored in plaintext in Random Access Memory (RAM), a local, authenticated attacker cou…
-
Unscored —
A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in th…
-
Medium 6.5
Jenkins Support Core Plugin stores sensitive data in plain text
Jenkins Support Core Plugin 2.79 and earlier does not redact some sensitive information in the support bundle.
-
Medium 5.4
NVIDIA License System contains a vulnerability in the installation scripts for the DLS virtual appliance, where a user …
-
Medium 4.6
Cisco IP Phones Information Disclosure Vulnerability
A vulnerability in the information storage architecture of several Cisco IP Phone models could allow an unauthenticated, physical attacker to obtain confidential information from an affected device. This vulnerability is due to unencrypted storage of confiden…
-
Medium 4.9
A cleartext storage of sensitive information vulnerability in the Zyxel NBG6604 firmware could allow a remote, authenti…
-
Unscored —
SAP Business One - version 10.0, allows an admin user to view DB password in plain text over the network, which should …
-
Medium 6.5
Instance config inline secret exposure
Grafana Agent is a telemetry collector for sending metrics, logs, and trace data to the opinionated Grafana observability stack. Prior to versions 0.20.1 and 0.21.2, inline secrets defined within a metrics instance config are exposed in plaintext over two end…
-
Unscored —
A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.12). The affected application w…
-
High 7.8
Delta Electronics DIALink
Delta Electronics DIALink versions 1.2.4.0 and prior stores sensitive information in cleartext, which may allow an attacker to have extensive access to the application directory and escalate privileges.
-
Unscored —
A vulnerability has been identified in SIMATIC CP 1543-1 (incl. SIPLUS variants) (All versions < V3.0), SIMATIC CP 1545…
-
Medium 6.3
Storage of Sensitive Information Vulnerability in Hitachi ABB Power Grids System Data Manager – SDM600 Product
Backup file without encryption vulnerability is found in Hitachi ABB Power Grids System Data Manager – SDM600 allows attacker to gain access to sensitive information. This issue affects: Hitachi ABB Power Grids System Data Manager – SDM600 1.2 versions prior …
-
Unscored —
An information disclosure exists in Brave Browser Desktop prior to version 1.28.62, where logged warning messages that …
-
Medium 4.9
Liferay Portal and Liferay DXP Stores User Passwords in Cleartext
The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19, and 7.2 before fix pack 7, user's clear text passwords are stored in the database if workflow is enabled for user creation, which a…
-
High 7.5
Liferay Portal and Liferay DXP autosaves form data for other users to see
The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, autosaves form values for unauthenticated users, which allows remote attackers to view the autosaved values by viewing th…
-
Medium 6.5
Client side sessions should not allow unencrypted storage
Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the default configuration of client side sessions results in unencrypted, but signed, data being set as cookie values. This means that if something sensitive goes into the session…
-
Unscored —
ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products contain credentials stored in plaintext. This could…
-
Unscored —
In Versa Director, the unencrypted backup files stored on the Versa deployment contain credentials stored within config…
-
Medium 5.3
WAGO: Managed Switches: Storage of user credentials in a cookie
In multiple managed switches by WAGO in different versions the webserver cookies of the web based UI contain user credentials.
-
Medium 5.9
Cleartext storage of session identifier
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 user session identifiers were stored in cleartext - without processing of additional cryptographic hashing algorithms. Th…
-
Medium 4.4
SaltStack Salt Cleartext Storage of Sensitive Information via cmdmod
An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.
-
High 7.3
Clear text storage of sensitive Information in ENS
Clear text storage of sensitive Information in memory vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update allows a local user to view ENS settings and credentials via accessing process memory after the ENS administ…
-
High 7.7
Cisco DNA Center Information Disclosure Vulnerability
A vulnerability in the configuration archive functionality of Cisco DNA Center could allow any privilege-level authenticated, remote attacker to obtain the full unmasked running configuration of managed devices. The vulnerability is due to the configuration a…
-
Unscored —
A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be …
-
High 7.5
Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore X…
-
Medium 6.4
Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore X…
-
High 7.5
Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore T…
-
High 7.7
Parse Server stores password in plain text
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. It is an npm package "parse-server". In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext. This is …
-
Low 2.8
Apache Airflow logs passwords in plaintext
In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plain text in the Log table in Airflow Metadatase. Same happened when creating a Connection with a password field.
-
Unscored —
A flaw was found in Ceph-ansible v4.0.41 where it creates an /etc/ceph/iscsi-gateway.conf with insecure default permiss…
-
High 8.1
Cleartext storage of session identifier
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 user session identifiers were stored in cleartext - without processing with additional cryptographic hashing algorithms. This vulnerability cannot be …
-
Unscored —
The implementation of Brave Desktop's privacy-preserving analytics system (P3A) between 1.1 and 1.18.35 logged the time…
-
High 7.5
SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/setti…
-
Unscored —
A cleartext storage of sensitive information in Nextcloud Desktop Client 2.6.4 gave away information about used proxies…
-
Medium 5.5
Passwords stored in plain text by ElasTest Plugin
Jenkins ElasTest Plugin 1.2.1 and earlier stores its server password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
-
Unscored —
A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP8). Insecure storage of sensitive infor…
-
High 7.5
django-celery-results Stores Sensitive Information In Cleartext
django-celery-results through 1.2.1 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may contain sensitive cleartext information that does not belong unencrypted in the database.
-
Unscored —
A CWE-312: Cleartext Storage of Sensitive Information vulnerability exists in Easergy Builder (Version 1.4.7.2 and olde…
-
Unscored —
A CWE-316: Cleartext Storage of Sensitive Information in Memory vulnerability exists in Easergy Builder V1.4.7.2 and pr…