Cleartext Storage of Sensitive Information
CWE-312
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
We track 157 vulnerabilities of this type. 99% are rated high or critical, and the average CVSS score is 7.9. 2 have been exploited in real attacks.
How this weakness is prevented
- Implementation System Configuration Operation: When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest.
- Implementation System Configuration Operation: In some systems/environments such as cloud, the use of double encryption (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.
Latest Cleartext Storage of Sensitive Information vulnerabilities
- 7.5 High severity
Netahsilat: Exposure of Sensitive Information Through Data Queries
Cleartext Storage of Sensitive Information, Exposure of Sensitive Information Through Data Queries vulnerability in Finrota Netahsilat allows Retrieve Embedded Sensitive Data, Authentication Bypass, IMAP/SMTP Command Injection, Collect Data from Common Resourc
- 8.6 High severity
Cisco Data Center Network Manager: Cleartext Storage of Sensitive Information
A vulnerability in the Cisco Nexus Dashboard Fabric Controller (NDFC) software, formerly Cisco Data Center Network Manager (DCNM), could allow an attacker with access to a backup file to view sensitive information. This vulnerability is due to the improper sto
- 7.7 High severity
tnms: Cleartext Storage of Sensitive Information
In Infinera TNMS (Transcend Network Management System) 19.10.3, cleartext storage of sensitive information in memory of the desktop application TNMS Client allows guest OS administrators to obtain various users' passwords by reading memory dumps of the desktop
- 8.8 High severity
hit_7300: Cleartext Storage of Sensitive Information
An issue was discovered in Infinera hiT 7300 5.60.50. Cleartext storage of sensitive password in firmware update packages allows attackers to access various appliance services via hardcoded credentials.
- 7.5 High severity
ValeApp: Cleartext Storage of Sensitive Information
Cleartext Storage of Sensitive Information in a Cookie vulnerability in Oceanic Software ValeApp allows Protocol Manipulation, : JSON Hijacking (aka JavaScript Hijacking). This issue affects ValeApp: before v2.0.0.
- 7.5 High severity
W3 Total Cache: Cleartext Storage of Sensitive Information
The W3 Total Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.5 via Google OAuth API secrets stored in plaintext in the publicly visible plugin source. This can allow unauthenticated attackers to
- 7.1 High severity
MXview One Series: Cleartext Storage of Sensitive Information
The configuration file stores credentials in cleartext. An attacker with local access rights can read or modify the configuration file, potentially resulting in the service being abused due to sensitive information exposure.
- 8.1 High severity
Foreseer: Insufficiently Protected Credentials
The Eaton Foreseer software provides the feasibility for the user to configure external servers for multiple purposes such as network management, user management, etc. The software uses encryption to store these configurations securely on the host machine. How
- 9.1 Critical severity
duc: Cleartext Storage of Sensitive Information
No-IP Dynamic Update Client (DUC) v3.x uses cleartext credentials that may occur on a command line or in a file. NOTE: the vendor's position is that cleartext in /etc/default/noip-duc is recommended and is the intentional behavior.
- 8.8 High severity
c-mor_video_surveillance: Improper Limitation of a Pathname to a Restricted Directory
An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Sensitive information is stored in cleartext. It was found out that sensitive information, for example login credentials of cameras, is stored in cleartext. Thus, an attacker with filesyst
- 8.1 High severity
WindLDR: Cleartext Storage of Sensitive Information
Cleartext storage of sensitive information vulnerability exists in WindLDR and WindO/I-NV4. If this vulnerability is exploited, an attacker who obtained the product's project file may obtain user credentials of the PLC or Operator Interfaces. As a result, an a
- 7.5 High severity
tinacms: Cleartext Storage of Sensitive Information
Tina is an open-source content management system (CMS). Sites building with Tina CMS's command line interface (CLI) prior to version 1.6.2 that use a search token may be vulnerable to the search token being leaked via lock file (tina-lock.json). Administrators
- 7.5 High severity
NACPremium: Cleartext Storage of Sensitive Information
Cleartext Storage of Sensitive Information vulnerability in NAC Telecommunication Systems Inc. NACPremium allows Retrieve Embedded Sensitive Data. This issue affects NACPremium: through 01082024.
- 7.5 High severity
ewon_cosy_firmware: Cleartext Storage of Sensitive Information
Insecure Permissions vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are susceptible to leaking information through cookies. This is fixed in version 21.2s10 and 22.1s3
- 8.8 High severity
Omnivise T3000 Application Server R9.2: Cleartext Storage of Sensitive Information
A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 Domain Controller R9.2 (All versions), Omnivise T3000 Network Intrusion Detection System (NIDS) R9.2 (All versions), Omnivise T3000 Product Data Manage
- 7.5 High severity
Datacap Navigator: Cleartext Storage of Sensitive Information
IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 temporarily stores data from different environments that could be obtained by a malicious user. IBM X-Force ID: 295791.
- 9.1 Critical severity
WINSelect (Standard + Enterprise): Cleartext Storage of Sensitive Information
The decrypted configuration file contains the password in cleartext which is used to configure WINSelect. It can be used to remove the existing restrictions and disable WINSelect entirely.
- 7.8 High severity
SAST Local Analyzer: Cleartext Storage of Sensitive Information
The Kiuwan Local Analyzer (KLA) Java scanning application contains several hard-coded secrets in plain text format. In some cases, this can potentially compromise the confidentiality of the scan results. Several credentials were found in the JAR files of the K
- 7.5 High severity
Red Hat Build of Keycloak: Cleartext Storage of Sensitive Information
A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR). Client-provided parameters were found to be included in plain text in the KC_RESTART cookie returned by the authorization server's HTTP response to a `request_uri` authorization req
- 8.4 High severity
rt-n12\+_b1: Cleartext Storage of Sensitive Information
Asus RT-N12+ B1 router stores user passwords in plaintext, which could allow local attackers to obtain unauthorized access and modify router settings.
- 7.5 High severity
g5_digital_fault_recorder: Cleartext Storage of Sensitive Information
An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Cleartext passwords and hashes are exposed through log files.
- 7.5 High severity
nquire_1000_manta: Cleartext Storage of Sensitive Information
An issue was discovered in Newland Nquire 1000 Interactive Kiosk version NQ1000-II_G_V1.00.011, allows remote attackers to obtain sensitive information via cleartext credential storage in backup.htm component.
- 7.2 High severity
Storage Defender - Resiliency Service: Cleartext Storage of Sensitive Information
IBM Storage Defender - Resiliency Service 2.0 could allow a privileged user to perform unauthorized actions after obtaining encrypted data from clear text key storage. IBM X-Force ID: 275783.
- 7.5 High severity
xwiki-platform: Cleartext Storage of Sensitive Information
XWiki Platform is a generic wiki platform. Starting in 7.2-milestone-2 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the password hashes of all users to anyone with view right on the respective user profiles. B
- 7.5 High severity
Linx-212 Firmware: Cleartext Storage of Sensitive Information
LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Insecure Permissions via dpal_config.zml file. This vulnerability allows remote attackers to disclose smtp client account credentials and bypass email authentication.
- 7.5 High severity
Linx-212 Firmware: Cleartext Storage of Sensitive Information
LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Insecure Permissions via registry.xml file. This vulnerability allows remote attackers to disclose smtp client account credentials and bypass email authentication.
- 7.5 High severity
L-inx Configurator: Cleartext Storage of Sensitive Information
LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions. Cleartext storage of credentials allows remote attackers to disclose admin password and bypass an authentication to login Loytec device.
- 9.1 Critical severity
OpenThread SDK: Missing Encryption of Sensitive Data
Missing Encryption of Security Keys vulnerability in Silicon Labs OpenThread SDK on 32 bit, ARM (SecureVault High modules) allows potential modification or extraction of network credentials stored in flash. This issue affects Silicon Labs OpenThread SDK: 2.3.1
- 8.8 High severity
security-advisories: Cleartext Storage of Sensitive Information
Nextcloud server is an open source home cloud platform. Affected versions of Nextcloud stored OAuth2 tokens in plaintext which allows an attacker who has gained access to the server to potentially elevate their privilege. This issue has been addressed and user
- 7.5 High severity
Nodegrid OS: Cleartext Storage of Sensitive Information
An issue in ZPE Systems, Inc Nodegrid OS v.5.8.10 thru v.5.8.13 and v.5.10.3 thru v.5.10.5 allows a remote attacker to obtain sensitive information via the TACACS+ server component.
- 9.8 Critical severity
Sage 200 Spain: Cleartext Storage of Sensitive Information
Plaintext credential usage vulnerability in Sage 200 Spain 2023.38.001 version, the exploitation of which could allow a remote attacker to extract SQL database credentials from the DLL application. This vulnerability could be linked to known techniques to obta
- 7.5 High severity
Acronis Cyber Protect 15: Cleartext Storage of Sensitive Information
Sensitive information disclosure due to cleartext storage of sensitive information. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 35979.
- 7.5 High severity
Acronis Cyber Protect 15: Cleartext Storage of Sensitive Information
Sensitive information disclosure due to cleartext storage of sensitive information in memory. The following products are affected: Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 35979.
- 7.5 High severity
Fabric OS: Cleartext Storage of Sensitive Information
The firmwaredownload command on Brocade Fabric OS v9.2.0 could log the FTP/SFTP/SCP server password in clear text in the SupportSave file when performing a downgrade from Fabric OS v9.2.0 to any earlier version of Fabric OS.
- 7.5 High severity
Insydeh2o: Cleartext Storage of Sensitive Information
An issue was discovered in SysPasswordDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. System password information could optionally be stored in cleartext, which might lead to possible information disclosure.
- 9.8 Critical severity
connected_io: Cleartext Storage of Sensitive Information
Connected IO v2.1.0 and prior keeps passwords and credentials in clear-text format, allowing attackers to exfiltrate the credentials and use them to impersonate the devices.
- 7.5 High severity
Fujitsu Software Infrastructure Manager…: Cleartext Storage of Sensitive Information
Fujitsu Software Infrastructure Manager (ISM) stores sensitive information at the product's maintenance data (ismsnap) in cleartext form. As a result, the password for the proxy server that is configured in ISM may be retrieved. Affected products and versions
- 7.5 High severity
ht-ip211hdp: Cleartext Storage of Sensitive Information
Assmann Digitus Plug&View IP Camera HT-IP211HDP, version 2.000.022 allows unauthenticated attackers to download a copy of the camera's settings and the administrator credentials.
- 7.5 High severity
Mremoteng: Cleartext Storage of Sensitive Information
Multi-Remote Next Generation Connection Manager (mRemoteNG) is free software that enables users to store and manage multi-protocol connection configurations to remotely connect to systems. mRemoteNG configuration files can be stored in an encrypted state on di
- 7.5 High severity
SGS: Cleartext Storage of Sensitive Information
A vulnerability was found in Intergard SGS 8.7.0. It has been classified as problematic. This affects an unknown part. The manipulation leads to cleartext storage of sensitive information in memory. It is possible to initiate the attack remotely. The exploit h