Cleartext Storage of Sensitive Information
CWE-312
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
We track 157 vulnerabilities of this type. 99% are rated high or critical, and the average CVSS score is 7.9. 2 have been exploited in real attacks.
How this weakness is prevented
- Implementation System Configuration Operation: When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest.
- Implementation System Configuration Operation: In some systems/environments such as cloud, the use of double encryption (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.
Latest Cleartext Storage of Sensitive Information vulnerabilities
- 8.8 High severity
Verve Asset Manager: Cleartext Storage of Sensitive Information
A security issue was discovered within the legacy Ansible playbook component of Verve Asset Manager, caused by plaintext secrets incorrectly stored when a playbook is running. This component has been retired and has been optional since the 1.36 release in 2024
- 7.5 High severity
BLUVOYIX: Insufficiently Protected Credentials
The vulnerability exists in BLUVOYIX due to an improper password storage implementation and subsequent exposure via unauthenticated APIs. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vuln
- 9.8 Critical severity
Meatmeet: Cleartext Storage of Sensitive Information
The mobile application was found to contain stored credentials for the network it was developed on. If an attacker retrieved this, and found the physical location of the Wi-Fi network, they could gain unauthorized access to the Wi-Fi network of the vendor. Add
- 7.8 High severity
MailEnable: Cleartext Storage of Sensitive Information
MailEnable versions prior to 10.54 contain a cleartext storage of credentials vulnerability that can lead to local credential compromise and account takeover. The product stores user and administrative passwords in plaintext within AUTH.SAV with overly permiss
- 7.8 High severity
MailEnable: Cleartext Storage of Sensitive Information
MailEnable versions prior to 10.54 contain a cleartext storage of credentials vulnerability that can lead to local credential compromise and account takeover. The product stores user and administrative passwords in plaintext within AUTH.TAB with overly permiss
- 8.7 High severity
Radio Network FM Transmitter: Cleartext Storage of Sensitive Information
R Radio Network FM Transmitter 1.07 allows unauthenticated attackers to access the admin user's password through the system.cgi endpoint, enabling authentication bypass and FM station setup access.
- 7.5 High severity
Restaurant Point Of Sale: Cleartext Storage of Sensitive Information
Abacre Restaurant Point of Sale (POS) up to 15.0.0.1656 are vulnerable to Cleartext Storage of Sensitive Information in Memory. The application leaves valid device-bound license keys in process memory during an activation attempt.
- 7.5 High severity
Grocerymart: Exposure of Sensitive Information to an Unauthorized Actor
An issue was discovered in file users.json in GroceryMart commit 21934e6 (2020-10-23) allowing unauthenticated attackers to gain sensitive information including plaintext usernames and passwords.
- 9.0 Critical severity
Sy-gpon-1110-wdont Firmware: Exposure of Sensitive Information to an Unauthorized Actor
An issue was discovered in Syrotech SY-GPON-1110-WDONT SYRO_3.7L_3.1.02-240517 allowing attackers to exctract the SSL Private Key, CA Certificate, SSL Certificate, and Client Certificates in .pem format in firmware in etc folder.
- 7.5 High severity
S3150-8t2f Firmware: Cleartext Storage of Sensitive Information
FS Inc S3150-8T2F 8-Port Gigabit Ethernet L2+ Switch, 8 x Gigabit RJ45, with 2 x 1Gb SFP, Fanless. All versions before 2.2.0D Build 135103 were discovered to transmit cookies for their web based administrative application containing usernames and passwords. Th
- 7.5 High severity
Vb288 Firmware: Cleartext Storage of Sensitive Information
An issue was discovered in bridgetech VB288 Objective QoE Content Extractor, firmware version 5.6.0-8, allowing attackers to gain sensitive information such as administrator passwords via the /probe/core/setup/passwd endpoint.
- 7.5 High severity
License Plate Reader Firmware: Cleartext Storage of Sensitive Information
Flock Safety Falcon and Sparrow License Plate Readers OPM1.171019.026 ship with development Wi-Fi credentials (test_flck) stored in cleartext in production firmware.
- 9.8 Critical severity
Print Virtual Appliance Host: Missing Authentication for Critical Functionality
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1026 and Application prior to version 20.0.2702 (VA deployments only) expose a set of unauthenticated REST API endpoints that return configuration files and clear‑text passwords.
- 9.8 Critical severity
Print Virtual Appliance Host: Cleartext Storage of Sensitive Information
Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) mount host configuration and secret material under /var/www/efs_storage into many Docker containers with overly-permissive filesystem permissions. Files such
- 7.8 High severity
Print Virtual Appliance Host: Cleartext Storage of Sensitive Information
Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) provision the appliance with the network account credentials in clear-text inside /etc/issue, and the file is world-readable by default. An attacker with loca
- 7.7 High severity
Rancher: Cleartext Storage of Sensitive Information
Unauthorized disclosure of sensitive data: Any user with `GET` or `LIST` permissions on `BundleDeployment` resources could retrieve Helm values containing credentials or other secrets.
- 9.1 Critical severity
Telpo Mdm: Cleartext Storage of Sensitive Information
Telpo MDM 1.4.6 thru 1.4.9 for Android contains sensitive administrator credentials and MQTT server connection details (IP/port) that are stored in plaintext within log files on the device's external storage. This allows attackers with access to these logs to:
- 9.3 Critical severity
TTA: Exposure of Sensitive Information to an Unauthorized Actor
Information disclosure and exposure of authentication FTP credentials over the debug port 1604 in the MINOVA TTA service. This allows unauthenticated remote access to an active FTP account containing sensitive internal data and import structures. In environmen
- 7.0 High severity
WL20 Biometric Attendance System: Cleartext Storage of Sensitive Information
This vulnerability exists in ZKTeco WL20 due to storage of admin and user credentials without encryption in the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and reverse engineer the binary data t
- 8.6 High severity
Vedo Suite: Cleartext Storage of Sensitive Information
Insecure Data Storage of credentials has been found in /api_vedo/configuration/config.yml file in Vedo Suite version 2024.17. This file contains clear-text credentials, secret keys, and database information.
- 7.8 High severity
2mp Full Hd Smart Wi-fi Cctv Home Security…: Improper Access Control
The firmware of the AZIOT 2MP Full HD Smart Wi-Fi CCTV Home Security Camera (version V1.00.02) contains an Incorrect Access Control vulnerability that allows local attackers to gain root shell access. Once accessed, the device exposes critical data including W
- 7.5 High severity
Tew-wlc100p Firmware: Cleartext Storage of Sensitive Information
In the configuration file of racoon in the TRENDnet TEW-WLC100P 2.03b03, the first item of exchage_mode is set to aggressive. Aggressive mode in IKE Phase 1 exposes identity information in plaintext, is vulnerable to offline dictionary attacks, and lacks flexi
- 7.1 High severity
Brocade ASCG: Cleartext Storage of Sensitive Information
A vulnerability in the ascgshell, of Brocade ASCG before 3.3.0 stores any command executed in the Command Line Interface (CLI) in plain text within the command history. A local authenticated user that can access sensitive information like passwords within the
- 7.2 High severity
Check Point SmartConsole: Cleartext Storage of Sensitive Information
Credentials are not cleared from memory after being used. A user with Administrator permissions can execute memory dump for SmartConsole process and fetch them.
- 7.5 High severity
React-native-keys: Cleartext Storage of Sensitive Information
react-native-keys 0.7.11 is vulnerable to sensitive information disclosure (remote) as encryption cipher and Base64 chunks are stored as plaintext in the compiled native binary. Attackers can extract these secrets using basic static analysis tools.
- 7.1 High severity
Dom: Exposure of Sensitive Information to an Unauthorized Actor
phpgt/Dom provides access to modern DOM APIs. Versions of phpgt/Dom prior to 4.1.8 expose the GITHUB_TOKEN in the Dom workflow run artifact. The ci.yml workflow file uses actions/upload-artifact@v4 to upload the build artifact. This artifact is a zip of the cu
- 8.2 High severity
Rx2 Pro Firmware: Cleartext Storage of Sensitive Information
Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an unauthenticated attacker to authenticate to the web management portal by collecting credentials from observed/collected traffic. It imple
- 8.2 High severity
Rx2 Pro Firmware: Cleartext Storage of Sensitive Information
Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an attacker to decrypt traffic between the client and server by collecting the symmetric AES key from collected and/or observed traffic. The AE
- 7.5 High severity
Kukufm: Cleartext Storage of Sensitive Information
An issue in KukuFM Android v1.12.7 (11207) allows attackers to access sensitive cleartext data via the android:allowBackup="true" in the ANdroidManifest.xml
- 7.1 High severity
mbCONNECT24: Cleartext Storage of Sensitive Information
A local user may find a configuration file on the client workstation with unencrypted sensitive data. This allows an attacker to impersonate the device or prevent the device from accessing the cloud portal which leads to a DoS.
- 7.5 High severity
Vasion Print: Cleartext Storage of Sensitive Information
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Configuration File Contains CA & Private Key V-2022-001.
- 7.5 High severity
Tableau Server: Cleartext Storage of Sensitive Information
Cleartext Storage of Sensitive Information vulnerability in Salesforce Tableau Server can record the Personal Access Token (PAT) into logging repositories.This issue affects Tableau Server: before 2022.1.3, before 2021.4.8, before 2021.3.13, before 2021.2.14,
- 9.3 Critical severity
pmd: Exposure of Sensitive Information to an Unauthorized Actor
PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in jar published to Maven Central. The private key itself is not known to have been compromised itself, but given its passphr
- 7.5 High severity
Xerox Workplace Suite: Cleartext Storage of Sensitive Information
Xerox Workplace Suite exposes sensitive secrets in clear text, both locally and remotely. This vulnerability allows attackers to intercept or access secrets without encryption
- 9.8 Critical severity
Tl-wr845n Firmware: Cleartext Storage of Sensitive Information
TL-WR845N(UN)_V4_201214, TP-Link TL-WR845N(UN)_V4_200909, and TL-WR845N(UN)_V4_190219 was discovered to transmit user credentials in plaintext after executing a factory reset.
- 8.2 High severity
zhmc-ansible-modules: Cleartext Storage of Sensitive Information
ibm.ibm_zhmc is an Ansible collection for the IBM Z HMC. The Ansible collection "ibm.ibm_zhmc" writes password-like properties in clear text into its log file and into the output returned by some of its Ansible module in the following cases: 1. The 'boot_ftp_p
- 8.2 High severity
python-zhmcclient: Cleartext Storage of Sensitive Information
zhmcclient is a pure Python client library for the IBM Z HMC Web Services API. In affected versions the Python package "zhmcclient" writes password-like properties in clear text into its HMC and API logs in the following cases: 1. The 'boot-ftp-password' and '
- 7.5 High severity
security-advisories: Cleartext Storage of Sensitive Information
Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the session data. The session data is encrypted before being saved in the session storage (Redis or disk), but it would allow a m
- 7.5 High severity
mintplex-labs/anything-llm: Cleartext Storage of Sensitive Information
mintplex-labs/anything-llm version latest contains a vulnerability where sensitive information, specifically a password, is improperly stored within a JWT (JSON Web Token) used as a bearer token in single user mode. When decoded, the JWT reveals the password i
- 7.0 High severity
Philips Smart Wi-Fi LED Batten 24-Watt: Cleartext Storage of Sensitive Information
This vulnerability exists in Philips lighting devices due to storage of Wi-Fi credentials in plain text within the device firmware. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obtain the plain