CWE-312: Cleartext Storage of Sensitive Information
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
A kind of CWE-311 Missing Encryption of Sensitive Data.
From the CWE List. © The MITRE Corporation.
Newest
- ibm datacap, datacap navigator +1 moreIBM Datacap Navigator information disclosure4.1 Medium
- ibm cloud pak for security, qradar suite software, qradar suite +2 moreIBM QRadar Suite Software information disclosure5.5 Medium
- netapp snapcenterInformation Disclosure Vulnerability in SnapCenter5.7 Medium
- linksys mbe7000 firmware, mx6200 firmware +1 moreLinksys Velop Pro 6E 1.0.8 MX6200_1.0.8.215731 and 7 1.0.10.215314 devices send cleartext Wi-Fi...5.3 Medium
- No product listedThe OpenAI ChatGPT app before 2024-07-05 for macOS opts out of the sandbox, and stores...2.3 Low
- No product listedNewPass before 1.2.0 stores passwords (rather than password hashes) directly, which makes it...3.5 Low
- brocade fabric os, broadcom fabric operating system +1 morepassword management API prints sensitive information in log files5.9 Medium
- faronics winselect, winselect (standard + enterprise) +1 moreUnhashed Storage of Password9.1 Critical
- kiuwan local analyzer, sast local analyzer +1 moreSensitive Data Stored Insecurely in Kiuwan SAST Local Analyzer7.8 High
- motorola solutions vigilant fixed lpr coms box (bcav1f2-c600), motorolasolutions vigilant fixed lpr coms box, motorola vigilant fixed lpr coms box firmware +2 moreCleartext Storage in a File or on Disk in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)7.0 High
- No product listedAn issue in Annonshop.app DecentralizeJustice/anonymousLocker commit 2b2b4 to ba9fd and...4.3 Medium
- hitachi energy foxman-un, unem +1 moreA vulnerability exists in the FOXMAN-UN/UNEM in which sensitive information is stored in...4.1 Medium
- netgear wnr614 firmwareNetgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 was discovered to store credentials in plaintext.8.8 High
- red hat build of keycloak, build of keycloak 22, build of keycloak 24 +5 more +7 moreKeycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookie7.5 High
- statamic cmsPassword confirmation stored in plain text via registration form in statamic/cms1.8 Low
- No product listedAn issue in the Sensor Settings of AVTECH Room Alert 4E v4.4.0 allows attackers to gain access to SMTP credentials in plaintext via a crafted AJAX request. NOTE: This vulnerability only affects produc…7.2 High
- No product listedAn issue in the SMTP Email Settings of AVTECH Room Alert 4E v4.4.0 allows attackers to gain access to credentials in plaintext via a passback attack. NOTE: This vulnerability only affects products tha…4.9 Medium
- italtel embraceAn issue was discovered in Italtel Embrace 1.6.4. The web application inserts cleartext passwords...6.5 Medium
- siemens opupi0 amqp/mqttA vulnerability has been identified in OPUPI0 AMQP/MQTT (All versions < V5.30). The affected...6.0 Medium
- red hat openstack platform 16.2, openstack platform 17.1 for rhel 9 +1 moreRhosp-director: cleartext passwords exposed in logs5.5 Medium
- netgear rax30, rax30 firmware +1 moreNETGEAR RAX30 Device Configuration Cleartext Storage Information Disclosure Vulnerability5.7 Medium
- teledyne flir m300An issue was discovered in Teledyne FLIR M300 2.00-19. User account passwords are encrypted...3.4 Low
- netgear dg834gv5, dg834gv5 firmware +1 moreNetgear DG834Gv5 Web Management Interface cleartext storage2.7 Low
- asus rt-n12\+ b1Asus RT-N12+ B1 router stores user passwords in plaintext, which could allow local attackers to...8.4 High
- ibm aspera faspexIBM Aspera Faspex information disclosure2.5 Low
- secu secustation firmwareSecuSTATION Camera V2.5.5.3116-S50-SMA-B20160811A and lower allows an unauthenticated attacker to...6.5 Medium
- electrolink compact dab transmitter, compact fm transmitter, digital fm transmitter +5 more +7 moreElectrolink FM/DAB/TV Transmitter Cleartext Storage of Sensitive Information8.7 High
- getsentry sentrySentry's superuser cleartext password leaked in logs7.3 High
- broadcom brocade sannav, brocade sannav +1 morecleartext password in supportsave logs when a user schedules a switch Supportsave from Brocade SANnav6.5 Medium
- broadcom brocade sannav, brocade sannav +1 moreClear text storage of sensistive information by manipulating command variables5.5 Medium
- hcl software bigfix enterprise suite asset discoveryHCL BigFix Asset Discovery is affected by a security vulnerability6.6 Medium
- No product listedIn Unify CP IP Phone firmware 1.10.4.3, files are not encrypted and contain sensitive information...5.9 Medium
- axonautAn issue in axonaut v.3.1.23 and before allows a remote attacker to obtain sensitive information...7.5 High
- elspec g5 digital fault recorder, elspec-ltd g5dfr firmware +1 moreAn issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before....7.5 High
- newlandemea nquire 1000 mantaAn issue was discovered in Newland Nquire 1000 Interactive Kiosk version NQ1000-II_G_V1.00.011,...7.5 High
- jfinalcms project jfinalcmsSQL injection vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to obtain sensitive...7.5 High
- cisco duo, duo authentication for windows logon and rdp +1 moreA vulnerability in the logging component of Cisco Duo Authentication for Windows Logon and RDP...4.4 Medium
- ibm storage defender - resiliency service, storage defender resiliency service +1 moreIBM Storage Defender - Resiliency Service privilege escalation8.0 High
- ibm security access manager container, security verify access appliance, security verify access docker +2 moreIBM Security Access Manager Container information disclosure5.1 Medium
- tendacn cp3 firmwareAn issue in Shenzen Tenda Technology CP3V2.0 V11.10.00.2311090948 allows a local attacker to...5.5 Medium
- allegro.ai clearmlAllegro AI ClearML Stores Credentials in Plaintext in MongoDB Instance6.0 Medium
- silabs gecko software development kit, silabs.com gsdk +1 moreZigbee Unauthenticated DoS via NWK Sequence number manipulation7.5 High
- apache airflow, apache software foundation airflow cncf kubernetes provider, apache apache-airflow-providers-cncf-kubernetes +2 moreApache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service6.5 Medium
- tp-link tapoTP-Link Tapo APK up to v2.12.703 uses hardcoded credentials for access to the login panel.7.5 High
- unknown bestwebsoft's like & share, bestwebsoft like \& share +1 moreBestWebSoft's Like & Share < 2.74 - Unauthenticated Password Protected Post Read7.5 High
- growi, inc. growiThe App Settings (/admin/app) page in GROWI versions prior to v6.0.6 stores sensitive information...6.5 Medium
- infinispan, red hat data grid 8.4.6, redhat data grid +1 more +3 moreInfinispan: credentials returned from configuration as clear text7.2 High
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform Solr search discloses password hashes of all users7.5 High
- jenkins paaslane estimate, jenkins project paaslane estimate plugin +1 moreTokens stored in plain text by PaaSLane Estimate Plugin4.3 Medium
- jenkins paaslane estimate, jenkins project paaslane estimate plugin +1 moreTokens stored in plain text by PaaSLane Estimate Plugin4.3 Medium
- Show moreLoading…