CWE-312: Cleartext Storage of Sensitive Information
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
A kind of CWE-311 Missing Encryption of Sensitive Data.
From the CWE List. © The MITRE Corporation.
Newest
- centreon webCentreon Sensitive Data Exposure6.5 Medium
- jenkins dingding, jenkins project dingding[钉钉] plugin +1 moreDingTalk Plugin stores credentials in plain text3.3 Low
- jenkins neuvector vulnerability scanner, jenkins project neuvector vulnerability scanner plugin +1 moreJenkins NeuVector Vulnerability Scanner Plugin stored credentials in plain text5.5 Medium
- ibm security key lifecycle managerIBM Security Key Lifecycle Manager 3.0 and 3.0.1 stores user credentials in plain in clear text...6.2 Medium
- bitcoin coreIn Bitcoin Core 0.18.0, bitcoin-qt stores wallet.dat data unencrypted in memory. Upon a crash, it...7.5 High
- octopus serverIn Octopus Deploy versions 2018.8.4 to 2019.7.6, when a web request proxy is configured, an...6.5 Medium
- octopus tentacle, server +1 moreIn Octopus Tentacle versions 3.0.8 to 5.0.0, when a web request proxy is configured, an...6.5 Medium
- dell emc powerconnect 8024, dell emc powerconnect 7000 firmware, emc powerconnect 8024 firmware +9 more +11 moreDell EMC PowerConnect 8024, 7000, M6348, M6220, M8024 and M8024-K running firmware versions prior...7.2 High
- apache sparkSensitive data written to disk unencrypted in Spark7.5 High
- google chromeIncorrect font handling in autofill in Google Chrome prior to 75.0.3770.142 allowed a remote...6.5 Medium
- tronlink walletTronLink Wallet 2.2.0 stores user wallet keystore in plaintext and places them in insecure...9.8 Critical
- momo project momoThe Momo application 2.1.9 for Android stores confidential information insecurely on the system ...6.5 Medium
- send-anywhere send anywhereThe Send Anywhere application 9.4.18 for Android stores confidential information insecurely on...6.5 Medium
- jenkins caliper ci, jenkins project caliper ci plugin +1 moreJenkins Caliper CI Plugin stores credentials in plain text8.8 High
- jenkins port allocator, jenkins project port allocator plugin +1 moreJenkins Port Allocator Plugin stores credentials in plain text8.8 High
- jenkins gogs, jenkins project gogs plugin +1 moreJenkins Gogs Plugin stored credentials in plain text8.8 High
- dropboxDropbox.exe (and QtWebEngineProcess.exe in the Web Helper) in the Dropbox desktop application 71...7.8 High
- jetbrains intellij ideaIn several versions of JetBrains IntelliJ IDEA Ultimate, creating Task Servers configurations...9.8 Critical
- jetbrains intellij ideaIn several versions of JetBrains IntelliJ IDEA Ultimate, creating run configurations for cloud...8.1 High
- jetbrains intellij ideaIn several JetBrains IntelliJ IDEA versions, creating remote run configurations of JavaEE...9.8 Critical
- cisco integrated management controller, unified computing system (management software), unified computing system +2 moreCisco Integrated Management Controller Information Disclosure Vulnerability6.5 Medium
- ibm maximo asset management, control desk, maximo for aviation +7 more +9 moreIBM Maximo Asset Management 7.6 could allow a an authenticated user to replace a target page with...6.5 Medium
- hewlett packard enterprise hpe intelligent management center (imc) plat, hp intelligent management center +1 moreA remote privilege escalation vulnerability was identified in HPE Intelligent Management Center ...8.8 High
- iball ib-wrb302n firmwareiBall Baton iB-WRB302N20122017 devices have improper access control over the UART interface,...6.8 Medium
- google chrome, debian linux, fedoraproject fedora +2 more +4 moreInformation leak in autofill in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to...6.5 Medium
- crestron am-100 firmware, am-101 firmware, airmedia +2 moreCrestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 stores usernames,...7.8 High
- zaloraThe Zalora application 6.15.1 for Android stores confidential information insecurely on the...9.8 Critical
- sap crystal reports, sap se crystal reports for visual studio +1 moreThe .NET SDK WebForm Viewer in SAP Crystal Reports for Visual Studio (fixed in version 2010)...9.8 Critical
- mcafee data exchange layer, threat intelligence exchange, mcafee, llc data exchange layer (dxl) platform +1 more +3 moreInformation disclosure vulnerability in McAfee TIE Server and DXL Platform8.2 High
- ibm spectrum protect, spectrum protect for space management, spectrum protect backup-archive client +1 more +3 moreIn a certain atypical IBM Spectrum Protect 7.1 and 8.1 configurations, the node password could be...4.7 Medium
- amazon aws software development kitAmazon AWS SDK <=2.8.5 for Android uses Android SharedPreferences to store plain text AWS STS...7.2 High
- mcafee network security manager, mcafee llc network security manager (nsm), mcafee,llc mcafee network security manager (nsm) +2 moreData leakage when in an MDR pair by McAfee Network Security Manager 9.x7.7 High
- baxter sigma spectrum infusion system, sigma spectrum infusion system firmware +1 moreAn unauthenticated remote attacker may be able to execute commands to view wireless account...9.8 Critical
- hospira lifecare pca infusion system, pfizer lifecare pca infusion system firmware +1 moreWireless keys are stored in plain text on version 5 of the Hospira LifeCare PCA Infusion System....7.5 High
- hospira plum a+ infusion system, plum a+3 infusion system, symbiq infusion system +3 more +5 moreWireless keys are stored in plain text on Hospira Plum A+ Infusion System version 13.4 and prior,...7.5 High
- envoy passport for android, passport for iphone, passport +2 moreEnvoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain...2.9 Low
- hid global easylobby soloEasyLobby Solo could allow a local attacker to obtain sensitive information, caused by the...2.9 Low
- avast free antivirusAvast Free Antivirus prior to 19.1.2360 stores user credentials in memory upon login, which...7.8 High
- google chrome, debian linux, fedoraproject fedora +3 more +5 moreAn exposed debugging endpoint in the browser in Google Chrome on Android prior to 72.0.3626.81...5.5 Medium
- ics-cert pr100088 modbus gateway, kunbus pr100088 modbus gateway firmware +1 moreAn attacker could retrieve plain-text credentials stored in a XML file on PR100088 Modbus gateway...7.2 High
- cephCeph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the...5.5 Medium
- pilz pnozmulti configuratorPilz PNOZmulti Configurator prior to version 10.9 allows an authenticated attacker with local...7.8 High
- medtronic 29901 encore programmer, 29901 encore programmer firmware, carelink 2090 programmer +3 more +5 moreMedtronic 9790, 2090 CareLink, and 29901 Encore Programmers Missing Encryption of Sensitive Data4.6 Medium
- gitlabAn issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before...9.8 Critical
- rapid7 komandIn Rapid7 Komand version 0.41.0 and prior, certain endpoints that are able to list the always...3.4 Low
- primx zonecentralPRIMX ZoneCentral before 6.1.2236 on Windows sometimes leaks the plaintext of NTFS files. On non...4.3 Medium
- ibm robotic process automation with automation anywhereIBM Robotic Process Automation with Automation Anywhere 11 could store highly sensitive...6.2 Medium
- moxa thingspro, thingspro iiot gateway and device management software solutions +1 moreSensitive Information Stored in Clear Text in Moxa ThingsPro IIoT Gateway and Device Management...9.8 Critical
- lenovo xclarity administratorIn Lenovo xClarity Administrator versions earlier than 2.1.0, an attacker that gains access to...7.5 High
- [unknown] 389-ds-base, debian linux, fedoraproject 389 directory server +2 more389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive...3.8 Low
- Show moreLoading…