CWE-312: Cleartext Storage of Sensitive Information
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
A kind of CWE-311 Missing Encryption of Sensitive Data.
From the CWE List. © The MITRE Corporation.
Newest
- steeltoeoss steeltoe.configuration.abstractionsSteeltoe: TLS private keys written to /tmp with default permissions, never deleted4.7 Medium
- solidinvoiceSolidInvoice: API tokens stored as plaintext in the database allowing full credential compromise on database breach8.1 High
- devolutions serverImproper access control in the ticketing integration settings in Devolutions Server allows an...6.5 Medium
- No product listedGNCC GP5 v7.1.76 was discovered to store pre-signed Backblaze B2 upload URLs (PUT requests) in...7.1 High
- strongdm desktop application, desktop client +1 moreUnencrypted storage of authentication state in StrongDM Desktop Application state.kv file2.0 Low
- rustfsRustFS: Sensitive Information Leakage (SessionToken and SecretAccessKey) in RustFS Logs [Debug Mode]5.3 Medium
- cp plus wi-fi camera cp-e38q, cp-e48q, cp-e25q, cp-e35q, cp-e45q, cp-e28q, cp-e21q, cp-e31q, cp-e41q, cp-e24q, cp-z43q, cp-e34q, cp-e44q, cp-t31q, cp-v48q, cp-v41q, cp-z45qInformation Exposure Vulnerability in CP-Plus Wi-Fi Camera5.2 Medium
- aws amazon sagemaker python sdkCleartext storage of HMAC signing key in Amazon SageMaker Python SDK ModelBuilder/Serve path8.5 High
- schneider electric ecostruxure™ machine expert hvac, schneider-electric ecostruxure machine expert hvac +1 moreClear Text Storage of Sensitive Information on EcoStruxure™ Machine Expert HVAC6.8 Medium
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +19 more +21 moreBIG-IP DNS tmsh vulnerability6.7 Medium
- f5 big-ip, big-ip domain name system +1 moreBIG-IP iControl REST vulnerability6.7 Medium
- dragonmonk111 junoclawJunoClaw: MCP write tools exposed raw BIP-39 mnemonic as a tool-call parameter9.8 Critical
- sangoma switchvoxSangoma Switchvox before 8.4 places cleartext SIP authentication credentials in a backup file.3.2 Low
- electermelecterm: Full process.env exposed to renderer via window.pre.env in electerm5.5 Medium
- flowiseai flowiseFlowiseAI Flowise API Response account.service.ts login information disclosure6.3 Medium
- prometheus, red hat custom metric autoscaler operator for red hat openshift, file integrity operator +52 more +54 morePrometheus Azure AD remote write OAuth client secret exposed via config API7.5 High
- argoproj argo cd, red hat openshift data foundation 4, openshift gitops +2 moreIn Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext...7.7 High
- red hat multicluster engine for kubernetes 2.1, multicluster engine for kubernetes 2.11, multicluster engine for kubernetes 2.7 +2 more +4 moreAssisted-service: assisted-service: authenticated users can gain administrative access to openshift clusters via credential disclosure6.1 Medium
- ciliumCillium exposes sensitive information included in the cilium-bugtool debug archive7.9 High
- sanluan publiccmsSanluan PublicCMS Failed Login LoginAdminController.java log_login cleartext storage in file5.3 Medium
- typo3, typo3 cms +1 moreTYPO3 CMS Stores Cleartext Password in User Settings Module7.3 High
- langflow-ai langflowlangflow-ai langflow Project Creation Endpoint projects.py encrypt_auth_settings cleartext storage in file5.3 Medium
- flowiseFlowise - Unauthenticated OAuth Secrets Disclosure via /api/v1/loginmethod Endpoint8.7 High
- mitsubishi electric corporation analytix, genesis, genesis64 +4 more +6 moreInformation Disclosure, Tampering, and Denial-of-Service Vulnerabilities in GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, GENESIS, and MC Works649.3 Critical
- sourcecodester student result management systemSourceCodester Student Result Management System HTTP GET Request login_credentials.txt cleartext storage in file6.9 Medium
- directusDirectus exposes sensitive fields in revision history6.5 Medium
- openclawOpenClaw < 2026.3.31 - Nostr Private Key Exposure via config.get Redaction Bypass7.1 High
- bulwarkmail webmailBulwark Webmail: Information Exposure: password returned in /api/auth/session8.7 High
- 0xjacky nginx-ui, nginxui nginx ui +1 morenginx-ui Backup Restore Allows Tampering with Encrypted Backups9.4 Critical
- trinoTrino: Iceberg REST catalog static and vended credentials are accessible via query JSON7.7 High
- grafana, red hat enterprise linux 10, enterprise linux 10.0 extended update support +3 more +5 morePublic dashboards discloses all direct mode datasources6.5 Medium
github.com/goharbor/harborGoHarbor: LDAP password and OIDC secret are not redacted in the audit log6.9 Medium- tp-link systems inc. tl-wr850n v3, tp-link tl-wr850n firmware +1 moreCleartext Storage of Administrative and Wi-Fi Credentials via Accessible Serial Interface in TP Link's TL-WR850N5.1 Medium
- openclawOpenClaw < 2026.3.22 - Credential Exposure via baseUrl Fields in Gateway Snapshots7.1 High
- wwbn avideoAVideo has Plaintext Video Password Storage9.1 Critical
- nexxt solutions nebula 300+, nexxtsolutions nebula300plus firmware +1 moreReversible ecos_pw Cookie Allows Authentication Bypass in Nexxt Nebula 300+8.7 High
- wwbn avideoAVideo has an unauthenticated decrypt oracle leaking any ciphertext7.5 High
- jenkins loadninja, jenkins project loadninja plugin +1 moreJenkins LoadNinja Plugin does not mask LoadNinja API keys displayed on the job configuration form4.3 Medium
- jenkins loadninja, jenkins project loadninja plugin +1 moreJenkins LoadNinja Plugin stores LoadNinja API keys unencrypted in job config.xml files4.3 Medium
- edimax gs-5008pl firmware, edimax technology co., ltd. gs-5008pl +1 moreEdimax GS-5008PL <= 1.00.54 Admin Credentials Stored in Cleartext7.1 High
- fortinet fortimail, fortirecorder, fortivoice +2 moreA cleartext storage of sensitive information vulnerability [CWE-312] vulnerability in Fortinet...3.8 Low
- ibm planning analytics advanced certified containersIBM Planning Analytics Advanced Certified Containers is vulnerable to a sensitive information disclosure vulnerability4.4 Medium
- sap se customer checkout 2.0Insecure Storage Protection vulnerability in SAP Customer Checkout 2.05.6 Medium
- lesspassAn issue pertaining to CWE-312: Cleartext Storage of Sensitive Information was discovered in...6.5 Medium
- gallagher command centre mobile client, command centre mobile +1 moreCleartext Storage of Sensitive Information (CWE-312) in the Command Centre Mobile Client on...5.7 Medium
- weintek easyweb, cmt-3072xh2 firmware +1 moreWeintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to stroe credentials in...7.5 High
- devolutions powershell universalThe OpenID Connect (OIDC) authentication configuration in PowerShell Universal before 2026.1.3...6.5 Medium
- devolutions serverSensitive user account information is not encrypted in the database in Devolutions Server 2025.3...4.9 Medium
- binardat ltd. 10g08-0800gsm network switch, binardat 10g08-0800gsm firmware +1 moreBinardat 10G08-0800GSM Network Switch Base64-encoded Password Stored in Cookie8.7 High
- microsoft aci confidential containers, confidential sidecar containers +1 moreMicrosoft ACI Confidential Containers Information Disclosure Vulnerability6.5 Medium
- Show moreLoading…