CWE-312: Cleartext Storage of Sensitive Information
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
A kind of CWE-311 Missing Encryption of Sensitive Data.
From the CWE List. © The MITRE Corporation.
Newest
- ebyte ne2-d11 firmwareEbyte NA111-M Cleartext Storage of Sensitive Information7.1 High
- itsourcecode student management systemsambitraj Student Management System Password aca.sql cleartext storage5.1 Medium
- browser-use web-uibrowser-use web-ui 2.0.0 through 3.0.0 Cleartext API Key Storage6.8 Medium
- ash-project ash paper trailSensitive fields nested in embedded values are not redacted in AshPaperTrail versions5.9 Medium
- ash-project ash paper trailSensitive attribute values stored in a non-sensitive public changes map in AshPaperTrail5.9 Medium
- jahlives openssl encryptopenssl_encrypt before 1.4.9 Plaintext Private Key Storage8.6 High
- apache cloudstackApache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJob7.5 High
io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringsslMavennetty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages8.1 High- splunk on-call, on-call (victorops) +1 moreInformation Disclosure through Cleartext Storage in the App Key Value Store in the Splunk On-Call (VictorOps) app4.3 Medium
- splunk zoom app for splunk soarInformation Disclosure through Action Parameters in Zoom app for Splunk SOAR4.3 Medium
- splunk venafi app for splunk soarInformation Disclosure through Action Parameters in Venafi app for Splunk SOAR4.3 Medium
- splunk attack analyzer connector for splunk soarInformation Disclosure through Action Parameters in Splunk Attack Analyzer Connector for Splunk SOAR4.3 Medium
- splunk rsa securid authentication manager app for splunk soarInformation Disclosure through Action Parameters in RSA SecurID Authentication Manager app for Splunk SOAR4.3 Medium
- splunk phantom app for splunk soarInformation Disclosure through Action Parameters in Phantom app for Splunk SOAR4.3 Medium
- splunk ms graph for active directory app for splunk soarInformation Disclosure through Action Parameters in MS Graph for Active Directory app for Splunk SOAR4.3 Medium
- splunk crowdstrike oauth api app for splunk soarInformation Disclosure through Action Parameters in CrowdStrike OAuth API app for Splunk SOAR4.3 Medium
- splunk cisco webex app for splunk soarInformation Disclosure through Action Parameters in Cisco Webex app for Splunk SOAR4.3 Medium
- splunk cisco secure malware analytics app for splunk soarInformation Disclosure through Action Parameters in Cisco Secure Malware Analytics app for Splunk SOAR4.3 Medium
- splunk azure ad graph app for splunk soarInformation Disclosure through Action Parameters in Azure AD Graph app for Splunk SOAR4.3 Medium
- splunk aws iam app for splunk soarInformation Disclosure through Action Parameters in AWS IAM app for Splunk SOAR4.3 Medium
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.1 Critical
- red hat advanced cluster management for kubernetes 2, advanced cluster management for kubernetes 2.16, advanced cluster management for kubernetes 2.17 +2 moreSubmariner-operator: operator clusterrole grants cluster-wide create/update on all configmaps5.8 Medium
- red hat advanced cluster management for kubernetes 2, advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13 +4 more +6 moreSubmariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication5.4 Medium
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreMust-gather: must-gather: embedded secret data in acm wrapper crs collected without redaction5.5 Medium
- kriptok crypto and information technologies industry trade inc. cryptosimSensitive Data Exposure in Kriptek Crypto's Cryptosim5.7 Medium
- apache airflowApache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI6.5 Medium
- apache airflowApache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI6.5 Medium
- jfrog artifactoryRendered Artifactory Helm manifests may contain generated TLS private keys6.7 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +20 more +22 moreWindows Hello Tampering Vulnerability5.5 Medium
- baptistearno typebot.ioTypeBot API tokens stored in plaintext9.1 Critical
- red hat pen drive powered by red hat lightspeed, certification program for red hat enterprise linux 9, enterprise linux 10 +2 more +4 moreInsights-core: insights-core: incomplete credential redaction exposes sssd bind passwords and pacemaker fence credentials in uploaded archives6.5 Medium
- samsung smart switchCleartext storage of sensitive information in Smart Switch prior to version 3.7.72.6 allows...6.9 Medium
- cisco catalyst sd-wan controller, catalyst sd-wan manager +1 moreCisco Catalyst SD-WAN Security Hardening Release - Information Disclosure Vulnerabilities8.8 High
- rancherLong-lived Rancher registration token exposed in plaintext8.8 High
- bilin software and informatics consultancy inc. humanist digital human resourcesQuery Console SQL Injection Leading to Sensitive Data Disclosure in Bilin Software's HUMANIST Digital Human Resources9.8 Critical
- meesho online shopping appMeesho Online Shopping App com.meesho.supply cleartext storage2.4 Low
- johnson controls xaap application, johnsoncontrols xaap +1 moreXAAP Android Data Stored in Unencrypted Database4.8 Medium
- broadcom spring tools, spring tools for eclipse +1 moreCleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations4.4 Medium
- tycon systems tpdin-monitor-web2Tycon Systems TPDIN-Monitor-WEB2 Cleartext Storage of Sensitive Information5.3 Medium
- devolutions powershell universalCleartext storage of sensitive information in the variables feature in Devolutions PowerShell...6.5 Medium
- bosch configuration managerInformation disclosure in Bosch Configuration Manager in Version 7.72.0106 allows an attacker to...8.4 High
- n8nn8n before 1.123.64, 2.29.8, and 2.30.1 Credential Exposure via JWT Header5.1 Medium
- vsee clinic, clinic api +1 moreVSee Clinic and API Exposes Cleartext SFTP Credentials in Unauthenticated HTTP Responses9.0 Critical
- fantomas42 django-blog-zinniaFantomas42 django-blog-zinnia Protected Entry Password entry_protection.py cleartext storage4.8 Medium
- forgekeep nebula-meshnebula-mesh: Operator session tokens stored in plaintext in the database7.1 High
- perforce puppet core, puppet enterprise +1 moreCleartext Storage of Sensitive Information for Puppet Resource API6.7 Medium
- No product listedCleartext storage and exposure of WPA2 credentials, and missing authentication on the rr/wr...4.6 Medium
- jenkins job configuration history, jenkins project job configuration history plugin +1 moreJenkins Job Configuration History Plugin doesn't redact encrypted values of secrets in job and agent configurations4.3 Medium
github.com/juev/nebula-meshGonebula-mesh's stores enrollment tokens unhashed in SQLite5.0 Medium- getgrav gravGrav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets6.8 Medium
- Show moreLoading…