CWE-312: Cleartext Storage of Sensitive Information
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
A kind of CWE-311 Missing Encryption of Sensitive Data.
From the CWE List. © The MITRE Corporation.
Newest
- octopus serverIn Octopus Server after version 2018.8.2 if the Octopus Server Web Request Proxy is configured...7.5 High
- ucweb ucUCWeb UC 12.12.3.1219 through 12.12.3.1226 uses cleartext HTTP, and thus man-in-the-middle...3.7 Low
- dcce mac1100 plc firmwareAn information disclosure vulnerability exists in the EPA protocol of Dut Computer Control...7.5 High
- jetbrains teamcityIn JetBrains TeamCity before 2021.1, passwords in cleartext sometimes could be stored in VCS.7.5 High
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP Stores User Passwords in Cleartext4.9 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP autosaves form data for other users to see7.5 High
- nch quorumNCH Quorum v2.03 and earlier allows local users to discover cleartext login information relating...5.5 Medium
- nch reflect customer relationship managementNCH Reflect CRM 3.01 allows local users to discover cleartext user account information by reading...3.3 Low
- akkadian provisioning manager engine (pme), akkadianlabs ova appliance, provisioning manager +2 moreAkkadian Provisioning Manager Engine (PME) Shell Escape via 'vi' editor interface7.9 High
- baidu xuperchainAn issue was discovered in Xuperchain 3.6.0 that allows for attackers to recover any arbitrary...7.5 High
- ibm qradar, qradar security information and event manager +1 moreIBM QRadar SIEM 7.3 and 7.4 uses less secure methods for protecting data in transit between hosts...5.3 Medium
- ibm security verify access docker, security verify access +1 moreIBM Security Verify Access Docker 10.0.0 stores user credentials in plain clear text which can be...6.8 Medium
- magicsmotion flamingo 2 firmwareThe MagicMotion Flamingo 2 application for Android stores data on an sdcard under com.vt...7.5 High
- octopus serverWhen configuring Octopus Server if it is configured with an external SQL database, on initial...7.5 High
- octopus serverWhen configuring Octopus Server if it is configured with an external SQL database, on initial...7.5 High
- alpinelinux aportsIn the xrdp package (in branches through 3.14) for Alpine Linux, RDP sessions are vulnerable to...5.9 Medium
- ratpackClient side sessions should not allow unencrypted storage6.5 Medium
- mozilla hubs cloud, hubs cloud reticulum +1 moreProxy functionality built into Hubs Cloud’s Reticulum software allowed access to internal URLs,...9.8 Critical
- zoll defibrillator dashboardZOLL Defibrillator Dashboard, v prior to 2.2, The affected products contain credentials stored in...5.5 Medium
- thalesgroup safenet keysecureSafeNet KeySecure Management Console 8.12.0 is vulnerable to HTTP response splitting attacks. A...6.5 Medium
- tp-link tl-wpa4220 firmwareTP-Link's TL-WPA4220 4.0.2 Build 20180308 Rel.37064 does not use SSL by default. Attacker on the...5.5 Medium
- gallagher command centreCleartext Storage of Sensitive Information in Memory vulnerability in Gallagher Command Centre...6.0 Medium
- gallagher command centreCleartext Storage of Sensitive Information in Memory vulnerability in Gallagher Command Centre...6.0 Medium
- aveva intouch, intouch 2017, intouch 2020 +2 moreThe vulnerability could expose cleartext credentials from AVEVA InTouch Runtime 2020 R2 and all...6.6 Medium
- broadcom sannavBrocade SANNav before version 2.1.1 contains an information disclosure vulnerability. Successful...5.3 Medium
- dlink dir-895l mfc firmwareThe DLink Router DIR-895L MFC v1.21b05 is vulnerable to credentials disclosure in telnet service...7.5 High
- dogtagpki, fedoraproject fedora, oracle linux +9 more +11 moreA flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores...7.8 High
- zte zxa10 f809 firmware, zxa10 f819 firmware, zxa10 f821 firmware +5 more +7 moreSome PON MDU devices of ZTE stored sensitive information in plaintext, and users with login...6.5 Medium
- versa networks director, versa-networks versa director +1 moreIn Versa Director, the unencrypted backup files stored on the Versa deployment contain...5.5 Medium
- mozilla thunderbirdOpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1...4.3 Medium
- ibm security identity managerIBM Security Identity Manager 7.0.2 stores user credentials in plain clear text which can be read...5.3 Medium
- couchbase serverAn issue was discovered in Couchbase Server 5.x and 6.x through 6.6.1 and 7.0.0 Beta. Incorrect...7.5 High
- octopus serverCleartext storage of sensitive information in multiple versions of Octopus Server where in...7.5 High
- wago 0852-0303, 0852-0303 firmware, 0852-1305 +7 more +9 moreWAGO: Managed Switches: Storage of user credentials in a cookie5.3 Medium
- couchbase serverAn issue was discovered in Couchbase Server before 6.0.5, 6.1.x through 6.5.x before 6.5.2, and 6...4.4 Medium
- kde messagelibKDE Messagelib through 5.17.0 reveals cleartext of encrypted messages in some situations....6.5 Medium
- gitlabAn issue has been discovered in GitLab affecting all versions starting from 11.6. Pull mirror...6.8 Medium
- dell unity, unity operating environment, unity xt operating environment +1 more +3 moreDell EMC Unity, UnityVSA, and Unity XT versions prior to 5.0.7.0.5.008 contain a plain-text...6.4 Medium
- etherpadEtherpad <1.8.3 stored passwords used by users insecurely in the database and in log files. This...6.5 Medium
- sentrysoftware hardware sentry km for bmc patrolIn Hardware Sentry KM before 10.0.01 for BMC PATROL, a cleartext password may be discovered after...7.5 High
- void aural rec monitorAn issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. Passwords are stored...7.5 High
- wowza streaming engineWowza Streaming Engine through 4.8.5 (in a default installation) has cleartext passwords stored...5.5 Medium
- lenovo xclarity controller (xcc), xclarity controller +1 moreAn internal product security audit of Lenovo XClarity Controller (XCC) discovered that the XCC...4.5 Medium
- teradici pcoip connection manager and security gatewaySensitive smart card data is logged in default INFO logs by Teradici's PCoIP Connection Manager...4.6 Medium
- timelybillsCleartext Storage in a File or on Disk in TimelyBills <= 1.7.0 for iOS and versions <= 1.21.115...5.9 Medium
- wizconnected colors a60 firmwareAn issue was discovered in WiZ Colors A60 1.14.0. Wi-Fi credentials are stored in cleartext in...5.5 Medium
- wizconnected wizAn issue was discovered in WiZ Colors A60 1.14.0. API credentials are locally logged.5.5 Medium
- hpe unified data managementA security vulnerability in HPE Unified Data Management (UDM) could allow the local disclosure of...5.5 Medium
- ibm urbancode deployIBM UrbanCode Deploy (UCD) 7.0.3.0, 7.0.4.0, 7.0.5.3, 7.0.5.4, 7.1.0.0, 7.1.1.0, 7.1.1.1, and 7.1...5.1 Medium
- ibm urbancode deployIBM UrbanCode Deploy (UCD) 6.2.7.9, 7.0.5.4, and 7.1.1.1 stores user credentials in plain in...6.2 Medium
- Show moreLoading…