Skip to content
OpenAdvisories

Weakness (CWE)

CWE-315: Cleartext Storage of Sensitive Information in a Cookie

Variant Draft

The product stores sensitive information in cleartext in a cookie.

Source: MITRE CWE-315

All Critical High Medium Low Exploited only Public exploit

9 results · Feed

  • Critical 9.1
    CVE-2026-25818

    HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 2…

  • Low 3.7
    CVE-2025-8528

    Exrick xboot getMenuList sensitive information in a cookie

    A vulnerability classified as problematic has been found in Exrick xboot up to 3.3.4. Affected is an unknown function of the file /xboot/permission/getMenuList. The manipulation leads to cleartext storage of sensitive information in a cookie. It is possible t…

    Exrick xboot
  • Low 3.1
    CVE-2025-4537

    yangzongzhuan RuoYi-Vue Password login.vue sensitive information in a cookie

    A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.8.9 and classified as problematic. Affected by this issue is some unknown functionality of the file ruoyi-ui/jsencrypt.js and ruoyi-ui/login.vue of the component Password Handler. The manipulation l…

    yangzongzhuan RuoYi-Vue
  • High 8.1
    CVE-2024-41290 Public exploit

    FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data via the cookie's component.

  • Critical 9.3
    CVE-2024-8644

    Cleartext Storage of Sensitive Information in Oceanic Software's ValeApp

    Cleartext Storage of Sensitive Information in a Cookie vulnerability in Oceanic Software ValeApp allows Protocol Manipulation, : JSON Hijacking (aka JavaScript Hijacking). This issue affects ValeApp: before v2.0.0.

    Oceanic Software ValeApp
  • Medium 6.5
    CVE-2024-24768

    1Panel set-cookie is missing the Secure keyword

    1Panel is an open source Linux server operation and maintenance management panel. The HTTPS cookie that comes with the panel does not have the Secure keyword, which may cause the cookie to be sent in plain text if accessed using HTTP. This issue has been patc…

    1Panel-dev 1Panel github.com/1Panel-dev/1Panel Go
  • Low 3.2
    GHSA-j4g3-3q8x-jxqp

    dbt-core's secret env vars written to package-lock.json in plaintext

    ### Impact When used to pull source code from a private repository using a Personal Access Token (PAT), some versions of dbt-core write a URL with the PAT in plaintext to the `package-lock.yml` file. ### Patches The bug has been fixed in [dbt-core v1.7.3](htt…

    dbt-core PyPI
  • Medium 5.5
    CVE-2021-34564

    In WirelessHART-Gateway versions 3.0.9 a vulnerability allows to read and write sensitive data in a cookie

    Any cookie-stealing vulnerabilities within the application or browser would enable an attacker to steal the user's credentials to the PEPPERL+FUCHS WirelessHART-Gateway 3.0.9.

    Phoenix Contact WHA-GW-F2D2-0-AS- Z2-ETH.EIP WHA-GW-F2D2-0-AS- Z2-ETH ICS / OT
  • Unscored —
    CVE-2018-19941

    Cleartext Storage of Sensitive Information in Cookies

    A vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows an attacker to access sensitive information stored in cleartext inside cookies via certain widely-available tools. QNAP have already fixed this vulnerability in the …

    QNAP Systems QTS QuTS hero QuTScloud