Weakness (CWE)
CWE-312: Cleartext Storage of Sensitive Information
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
How to prevent it (2 mitigations)
-
Implementation, System Configuration, Operation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest. [REF-1297] [REF-1299] [REF-1301]
-
Implementation, System Configuration, Operation
In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.
Source: MITRE CWE-312
570 results · Feed
-
Medium 5.6
PAN-OS: Firewall Clusters using the MACsec Protocol Expose the Connectivity Association Key (CAK)
A problem with the implementation of the MACsec protocol in Palo Alto Networks PAN-OS® results in the cleartext exposure of the connectivity association key (CAK). This issue is only applicable to PA-7500 Series devices which are in an NGFW cluster. A user wh…
-
Medium 5.1
Checkov by Prisma Cloud: Cleartext Exposure of Credentials
A sensitive information disclosure vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can result in the cleartext exposure of Prisma Cloud access keys in Checkov's output.
-
Medium 5.2
Information Disclosure Vulnerability in ZKTeco WL20
This vulnerability exists in ZKTeco WL20 due to storage of Wi-Fi credentials, configuration data and system data in plaintext within the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and reverse …
-
High 7.0
Cleartext Storage Vulnerability in ZKTeco WL20
This vulnerability exists in ZKTeco WL20 due to storage of admin and user credentials without encryption in the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and reverse engineer the binary data …
-
Medium 6.2
A vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions >= V2.60 < V2.62), POW…
-
Medium 6.2
A vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions >= V2.60 < V2.62), POW…
-
High 8.6
Insecure Data Storage of credentials has been found in /api_vedo/configuration/config.yml file in Vedo Suite version 20…
-
Low 3.7
Exrick xboot getMenuList sensitive information in a cookie
A vulnerability classified as problematic has been found in Exrick xboot up to 3.3.4. Affected is an unknown function of the file /xboot/permission/getMenuList. The manipulation leads to cleartext storage of sensitive information in a cookie. It is possible t…
-
Medium 4.4
Python3.11-django-ansible-base: sensitive authenticator secrets returned in clear text via api in aap
A flaw was found in Ansible Automation Platform (AAP) where the Gateway API returns the client secret for certain GitHub Enterprise authenticators in clear text. This vulnerability affects administrators or auditors accessing authenticator configurations. Whi…
-
High 7.8CVE-2025-50777 Public exploit
The firmware of the AZIOT 2MP Full HD Smart Wi-Fi CCTV Home Security Camera (version V1.00.02) contains an Incorrect Ac…
-
Medium 6.9
Sandboxie exposes encrypted sandbox key during password change
Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. In versions 1.16.1 and below, a critical security vulnerability exists in password handling mechanisms. During encrypted sandbox creation, user passwords…
-
Medium 5.5
In JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg pull" command
-
Medium 5.5
In JetBrains TeamCity before 2025.07 user credentials were stored in plain text in memory snapshots
-
Critical 9.8
An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices. When a new SD card is inserted into the dashcam, the…
-
Medium 6.8
Medtronic MyCareLink Patient Monitor Unencrypted Filesystem Vulnerability
Medtronic MyCareLink Patient Monitor uses an unencrypted filesystem on internal storage, which allows an attacker with physical access to read and modify files. This issue affects MyCareLink Patient Monitor models 24950 and 24952: before June 25, 2025
-
Medium 5.5
Insecure data storage vulnerability in Two App Studio Journey v5.5.9 for iOS
Unencrypted storage in the database in Two App Studio Journey v5.5.9 for iOS allows local attackers to extract sensitive data via direct access to the app’s filesystem.
-
High 7.5
In the configuration file of racoon in the TRENDnet TEW-WLC100P 2.03b03, the first item of exchage_mode is set to aggre…
-
Medium 6.8
CLI history displays inline passwords
A vulnerability in the ascgshell, of Brocade ASCG before 3.3.0 stores any command executed in the Command Line Interface (CLI) in plain text within the command history. A local authenticated user that can access sensitive information like passwords within the…
-
Medium 5.1
Default Credential Vulnerability in Digisol DG-GR6821AC Router
This vulnerability exists in Digisol DG-GR6821AC Router due to use of default admin credentials at its web management interface. An attacker with physical access could exploit this vulnerability by extracting the firmware and reverse engineer the binary data …
-
Medium 5.1
Cleartext Storage Vulnerability in Digisol DG-GR6821AC Router
This vulnerability exists in Digisol DG-GR6821AC Router due to storage of credentials and PINS without encryption in the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and reverse engineer the bin…
-
High 8.2
Kaseya Rapid Fire Tools Network Detective 2.0.16.0 has Unencrypted Credentials (for privileged access) stored in the co…
-
Medium 6.5
Jenkins Applitools Eyes Plugin vulnerability exposes unencrypted keys to certain authenticated users
Jenkins Applitools Eyes Plugin 1.16.5 and earlier stores Applitools API keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
-
Medium 6.5
Jenkins Kryptowire Plugin vulnerability stores unencrypted Kryptowire API key
Jenkins Kryptowire Plugin 0.2 and earlier stores the Kryptowire API key unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system.
-
Medium 6.5
Jenkins Nouvola DiveCloud Plugin vulnerability stores unencrypted credentials
Jenkins Nouvola DiveCloud Plugin 1.08 and earlier stores DiveCloud API Keys and Credentials Encryption Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Je…
-
Low 1.6
FNKvision FNK-GU2 wpa_supplicant.conf cleartext storage
A vulnerability, which was classified as problematic, has been found in FNKvision FNK-GU2 up to 40.1.7. Affected by this issue is some unknown functionality of the file /rom/wpa_supplicant.conf. The manipulation leads to cleartext storage of sensitive informa…
-
High 7.6
CVE-2025-27460
The hard drives of the device are not encrypted using a full volume encryption feature such as BitLocker. This allows an attacker with physical access to the device to use an alternative operating system to interact with the hard drives, completely circumvent…
-
Medium 5.8
JUnit OpenTestReportGeneratingListener can leak Git credentials
JUnit is a testing framework for Java and the JVM. From version 5.12.0 to 5.13.1, JUnit's support for writing Open Test Reporting XML files can leak Git credentials. The impact depends on the level of the access token exposed through the OpenTestReportGenerat…
-
Medium 6.5
Key leakage in juju/utils certificates
Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the network in plaintext, an attacker listening on that network could sniff the certificate and trivially ex…
-
Medium 5.7
Cleartext Phonebook Information
The MIB3 unit stores the synchronized phone contact book in clear-text, allowing an attacker with either code execution privilege on the system or physical access to the system to obtain vehicle owner's contact data. The vulnerability was originally discovere…
-
Low 2.1
Bharti Airtel Thanks App files cleartext storage in a file or on disk
A vulnerability classified as problematic has been found in Bharti Airtel Thanks App 4.105.4 on Android. Affected is an unknown function of the file /Android/data/com.myairtelapp/files/. The manipulation leads to cleartext storage in a file or on disk. It is …
-
Low 2.0
Flock Safety Gunshot Detection devices before 1.3 have cleartext storage of code.
-
Low 2.0
Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have cleartext storage of code.
-
Medium 5.5
Lenze: Plaintext Password Disclosure in PLC Designer V4 Interface
A local, low-privileged attacker can learn the password of the connected controller in PLC Designer V4 due to an incorrect implementation that results in the password being displayed in plain text under special conditions.
-
Low 3.1
Unencrypted HTTP Communication
Successful exploitation of the vulnerability could allow an attacker to intercept data and conduct session hijacking on the exposed data as the vulnerable product uses unencrypted HTTP communication, potentially leading to unauthorised access or data tamperin…
-
High 7.5
react-native-keys insecurely stores encryption cipher and Base64 chunks
react-native-keys 0.7.11 is vulnerable to sensitive information disclosure (remote) as encryption cipher and Base64 chunks are stored as plaintext in the compiled native binary. Attackers can extract these secrets using basic static analysis tools.
-
Medium 6.5
IBM InfoSphere Information Server information disclosure
IBM InfoSphere Information Server 11.7 stores credential information for database authentication in a cleartext parameter file that could be viewed by an authenticated user.
-
High 7.5
Tinxy WiFi Lock Controller v1 RF was discovered to store users' sensitive information, including credentials and mobile…
-
Medium 5.7
Dell ThinOS 2502 and prior contain a Cleartext Storage of Sensitive Information vulnerability. A high privileged attack…
-
Medium 5.1
Mautic does not shield .env files from web traffic
SummaryThis advisory addresses a security vulnerability in Mautic where sensitive .env configuration files may be directly accessible via a web browser. This exposure could lead to the disclosure of sensitive information, including database credentials, API k…
-
Medium 6.8
Unauthorized creation of master key in Mifare Classic Be-Tech cards
The data stored in Be-Tech Mifare Classic card is stored in cleartext. An attacker having access to a Be-Tech hotel guest Mifare Classic card can create a master key card that unlocks all the locks in the building. This issue affects all Be-Tech Mifare Classi…