Plaintext Storage of a Password
CWE-256
The product stores a password in plaintext within resources such as memory or files.
We track 58 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.2.
How this weakness is prevented
- Architecture and Design: Avoid storing passwords in easily accessible locations.
- Architecture and Design: Consider storing cryptographic hashes of passwords as an alternative to storing in plaintext.
- A programmer might attempt to remedy the password management problem by obscuring the password with an encoding function, such as base 64 encoding, but this effort does not adequately protect the password because the encoding can be detected and decoded easily.
Latest Plaintext Storage of a Password vulnerabilities
- 7.3 High severity
mirror registry for Red Hat OpenShift: Plaintext Storage of a Password
A flaw was found in Quay, where Quay's database is stored in plain text in mirror-registry on Jinja's config.yaml file. This issue leaves the possibility of a malicious actor with access to this file to gain access to Quay's Redis instance.
- 7.3 High severity
mirror registry for Red Hat OpenShift: Plaintext Storage of a Password
A flaw was found in how Quay's database is stored in plain-text in mirror-registry on the jinja's config.yaml file. This flaw allows a malicious actor with access to this file to gain access to Quay's database.
- 8.8 High severity
mirror registry for Red Hat OpenShift: Plaintext Storage of a Password
A flaw was found when using mirror-registry to install Quay. It uses a default secret, which is stored in plain-text format in one of the configuration template files. This issue may lead to all instances of Quay deployed using mirror-registry to have the same
- 9.8 Critical severity
WSR-2533DHP: Plaintext Storage of a Password
Plaintext storage of a password issue exists in BUFFALO wireless LAN routers, which may allow a network-adjacent unauthenticated attacker with access to the product's login page may obtain configured credentials.
- 7.5 High severity
MİA-MED: Plaintext Storage of a Password
Plaintext Storage of a Password vulnerability in Mia Technology Inc. MİA-MED allows Read Sensitive Strings Within an Executable. This issue affects MİA-MED: before 1.0.7.
- 7.5 High severity
MODULYS GP (MOD3GP-SY-120K): Plaintext Storage of a Password
The web application that owns the device clearly stores the credentials within the user management section. Obtaining this information can be done remotely due to the incorrect management of the sessions in the web application.
- 7.5 High severity
openstack: Cleartext Transmission of Sensitive Information
A flaw was found in OpenStack. Multiple components show plain-text passwords in /var/log/messages during the OpenStack overcloud update run, leading to a disclosure of sensitive information problem.
- 8.8 High severity
keycloak: Cleartext Transmission of Sensitive Information
A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile. When a user registers itself through registration flow, the "password" and "password-confirm" field from the form will occur as regular user attributes. All users and clients
- 7.5 High severity
MedDream PACS: Plaintext Storage of a Password
Softneta MedDream PACS stores usernames and passwords in plaintext. The plaintext storage could be abused by attackers to leak legitimate user’s credentials.
- 7.5 High severity
E-Invoice Approval System: Insufficiently Protected Credentials
Plaintext Storage of a Password vulnerability in Infodrom Software E-Invoice Approval System allows Read Sensitive Strings Within an Executable. This issue affects E-Invoice Approval System: before v.20230701.
- 9.8 Critical severity
FortiSIEM: Insufficiently Protected Credentials
A plaintext storage of a password vulnerability [CWE-256] in FortiSIEM 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions, 6.3 all versions, 6.2 all versions, 6.1 all versions, 5.4 all versions, 5.3 all versions may allow an attacker able t
- 8.8 High severity
GateManager: Insufficiently Protected Credentials
Plaintext Storage of a Password vulnerability in Secomea GateManager (USB wizard) allows Authentication abuse on SiteManager, if the generated file is leaked.
- 7.5 High severity
MELSEC iQ-F Series FX5U-32MT/ES: Insufficiently Protected Credentials
Plaintext Storage of a Password vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series, MELSEC iQ-R Series, MELSEC-Q Series and MELSEC-L Series allows a remote unauthenticated attacker to disclose plaintext credentials stored in project files and
- 9.1 Critical severity
QMS Automotive: Cleartext Storage of Sensitive Information
A vulnerability has been identified in QMS Automotive (All versions < V12.39), QMS Automotive (All versions < V12.39). User credentials are stored in plaintext in the database without any hashing mechanism. This could allow an attacker to gain access to creden
- 9.1 Critical severity
AirVelocity: Insufficiently Protected Credentials
Airspan AirVelocity 1500 web management UI displays SNMP credentials in plaintext on software versions older than 15.18.00.2511, and stores SNMPv3 credentials unhashed on the filesystem, enabling anyone with web access to use these credentials to manipulate th
- 8.8 High severity
Wyse Management Suite: Cleartext Storage of Sensitive Information
Dell Wyse Management Suite 3.6.1 and below contains an Plain-text Password Storage Vulnerability in UI. An attacker with low privileges could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be abl
- 7.5 High severity
rundeck: Plaintext Storage of a Password
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. The Key Storage converter plugin mechanism was not enabled correctly in Rundeck 4.2.0 and 4.2.1, resulting in use of the encryption layer for Key Storage possibly
- 7.8 High severity
PowerStore: Insufficiently Protected Credentials
PowerStore contains Plain-Text Password Storage Vulnerability in PowerStore X & T environments running versions 2.0.0.x and 2.0.1.x A locally authenticated attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credent