Cleartext Storage of Sensitive Information
CWE-312
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
We track 157 vulnerabilities of this type. 99% are rated high or critical, and the average CVSS score is 7.9. 2 have been exploited in real attacks.
How this weakness is prevented
- Implementation System Configuration Operation: When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest.
- Implementation System Configuration Operation: In some systems/environments such as cloud, the use of double encryption (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.
Latest Cleartext Storage of Sensitive Information vulnerabilities
- 7.5 High severity
Albis: Cleartext Storage of Sensitive Information
An issue found in ALBIS Co. ALBIS v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp ALBIS function.
- 7.5 High severity
Dcap: Cleartext Storage of Sensitive Information
An access control issue in Makves DCAP v3.0.0.122 allows unauthenticated attackers to obtain cleartext credentials via a crafted web request to the product API.
- 7.5 High severity
Power Focus: Cleartext Storage of Sensitive Information
Atlas Copco Power Focus 6000 web server does not sanitize the login information stored by the authenticated user’s browser, which could allow an attacker with access to the user’s computer to gain credential information of the controller.
- 7.1 High severity
Bitwarden: Cleartext Storage of Sensitive Information
Bitwarden Windows desktop application versions prior to v2023.4.0 store biometric keys in Windows Credential Manager, accessible to other local unprivileged processes.
- 8.1 High severity
CONPROSYS HMI System (CHS): Cleartext Storage of Sensitive Information
Plaintext storage of a password exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. Because account information of the database is saved in a local file in plaintext, a user who can access the PC where the affected product is installed can obtain the
- 7.5 High severity
SICK FTMG-ESD15AXX AIR FLOW SENSOR: Cleartext Storage of Sensitive Information
Cleartext Storage of Sensitive Information in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a remote attacker to potentially steal user credentials that are stored in the user’s browsers local s
- 7.5 High severity
surelock windows: Insufficiently Protected Credentials
Plaintext Password in Registry vulnerability in 42gears surelock windows surelockwinsetupv2.40.0.Exe on Windows (Registery modules) allows Retrieve Admin user credentials This issue affects surelock windows: from 2.3.12 through 2.40.0.
- 7.5 High severity
Postgres Advanced Server: Cleartext Storage of Sensitive Information
EnterpriseDB EDB Postgres Advanced Server (EPAS) before 14.6.0 logs unredacted passwords in situations where optional parameters are used with CREATE/ALTER USER/GROUP/ROLE, and redacting was configured with edb_filter_log.redact_password_commands. The fixed ve
- 4.9 Medium severity
Strapi Cleartext Storage of Sensitive Information Exploited
Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the a
- 7.8 High severity
CENTUM series: Cleartext Storage of Sensitive Information
CENTUM series provided by Yokogawa Electric Corporation are vulnerable to cleartext storage of sensitive information. If an attacker who can login or access the computer where the affected product is installed tampers the password file stored in the computer,
- 7.5 High severity
CMS: Cleartext Storage of Sensitive Information
A vulnerability was found in Xunrui CMS 4.61 and classified as problematic. Affected by this issue is some unknown functionality of the file /dayrui/Fcms/View/system_log.html. The manipulation leads to information disclosure. The attack may be launched remotel
- 7.5 High severity
ERP: Cleartext Storage of Sensitive Information
Sme.UP ERP TOKYO V6R1M220406 was discovered to contain an information disclosure vulnerability via the /debug endpoint. This vulnerability allows attackers to access cleartext credentials needed to authenticate to the AS400 system.
- 7.5 High severity
QRadar SIEM: Cleartext Storage of Sensitive Information
IBM QRadar SIEM 7.4 and 7.5 is vulnerable to information exposure allowing a non-tenant user with a specific domain security profile assigned to see some data from other domains. IBM X-Force ID: 230402.
- 7.5 High severity
Maximo Asset Management: Cleartext Storage of Sensitive Information
IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force
- 9.8 Critical severity
Smartserver: Cleartext Storage of Sensitive Information
Echelon SmartServer 2.2 with i.LON Vision 2.2 stores cleartext credentials in a file, which could allow an attacker to obtain cleartext usernames and passwords of the SmartServer. If the attacker obtains the file, then the credentials could be used to control
- 7.1 High severity
SupportAssist: Cleartext Storage of Sensitive Information
Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior) contain information disclosure vulnerability. A local malicious user with low privileges could exploit this vulnerability to view and modify
- 7.1 High severity
Boundary: Missing Encryption of Sensitive Data
HashiCorp Boundary from 0.10.0 through 0.11.2 contain an issue where when using a PKI-based worker with a Key Management Service (KMS) defined in the configuration file, new credentials created after an automatic rotation may not have been encrypted via the in
- 8.8 High severity
Rancher: Cleartext Storage of Sensitive Information
A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows users on managed clusters to gain access to credentials. The impact depends on the credentials exposed This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher
- 7.5 High severity
Ourphoto: Cleartext Storage of Sensitive Information
The /device/signin end-point for the Ourphoto App version 1.4.1 discloses clear-text password information for functionality within the picture frame devices. The deviceVideoCallPassword and mqttPassword are returned in clear-text. The lack of sessions manageme
- 7.5 High severity
GX Works3: Cleartext Storage of Sensitive Information
Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.087R and Motion Control Setting(GX Works3 related software) versions from 1.000A to 1.042U allows a remote unauthenticated attacker to disclose
- 7.5 High severity
GX Works3: Cleartext Storage of Sensitive Information
Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z and Mitsubishi Electric MX OPC UA Module Configurator-R versions 1.08J and prior allows a remote unauthenticated attacker to disclose sensi
- 7.8 High severity
H2: Cleartext Storage of Sensitive Information
The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user (or an attacker th
- 9.1 Critical severity
QMS Automotive: Cleartext Storage of Sensitive Information
A vulnerability has been identified in QMS Automotive (All versions < V12.39), QMS Automotive (All versions < V12.39). User credentials are stored in plaintext in the database without any hashing mechanism. This could allow an attacker to gain access to creden
- 7.5 High severity
Hauk: Cleartext Storage of Sensitive Information
bilde2910 Hauk v1.6.1 requires a hardcoded password which by default is blank. This hardcoded password is hashed but stored within the config.php file server-side as well as in clear-text on the android client device by default.
- 7.8 High severity
Snapdragon Auto, Snapdragon Compute…: Cleartext Storage of Sensitive Information
Devices with keyprotect off may store unencrypted keybox in RPMB and cause cryptographic issue in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
- 7.5 High severity
Guest Management System: Cleartext Storage of Sensitive Information
A vulnerability, which was classified as problematic, was found in SourceCodester Guest Management System. Affected is an unknown function. The manipulation leads to cleartext storage of passwords in the database. The identifier of this vulnerability is VDB-20
- 8.8 High severity
Wyse Management Suite: Cleartext Storage of Sensitive Information
Dell Wyse Management Suite 3.6.1 and below contains an Plain-text Password Storage Vulnerability in UI. An attacker with low privileges could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be abl
- 7.5 High severity
Landray Office Automation: Cleartext Storage of Sensitive Information
Lanling OA Landray Office Automation (OA) internal patch number #133383/#137780 contains an arbitrary file read vulnerability via the component /sys/ui/extend/varkind/custom.jsp.
- 7.5 High severity
Sysmac Cs1 Firmware: Cleartext Storage of Sensitive Information
In Omron CS series, CJ series, and CP series PLCs through 2022-05-18, the password for access to the Web UI is stored in memory area D1449...D1452 and can be read out using the Omron FINS protocol without any further authentication.
- 7.5 High severity
Mdlc: Cleartext Storage of Sensitive Information
The Motorola MOSCAD Toolbox software through 2022-05-02 relies on a cleartext password. It utilizes an MDLC driver to communicate with MOSCAD/ACE RTUs for engineering purposes. Access to these communications is protected by a password stored in cleartext in th
- 7.5 High severity
Goldshell Miner Firmware: Cleartext Storage of Sensitive Information
The debug interface of Goldshell ASIC Miners v2.2.1 and below was discovered to be exposed publicly on the web interface, allowing attackers to access passwords and other sensitive information in plaintext.
- 7.5 High severity
cve-services: Cleartext Storage of Sensitive Information
CVEProject/cve-services is an open source project used to operate the CVE services API. A conditional in 'data.js' has potential for production secrets to be written to disk. The affected method writes the generated randomKey to disk if the environment is not
- 7.8 High severity
SAP BusinessObjects Enterprise (Central…: Cleartext Storage of Sensitive Information
During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosure could cause a high impact on systems’ Confidentiality, Integ
- 9.1 Critical severity
Mitsubishi Electric MELSEC iQ-F series FX5U(C)…: Cleartext Storage of Sensitive Information
Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi Electric MELSEC iQ-F series FX5UJ CPU all versions, Mitsubishi Electric MELSEC iQ-R series R00/01/02CPU all versions, Mitsub
- 9.8 Critical severity
Grafana: Cleartext Storage of Sensitive Information
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When the user logs in and allows the user to register, one can right click to view the source code and use
- 7.8 High severity
FormStorm Enterprise: Cleartext Storage of Sensitive Information
Charactell - FormStorm Enterprise Account takeover – An attacker can modify (add, remove and update) passwords file for all the users. The xx_users.ini file in the FormStorm folder contains usernames in cleartext and an obfuscated password. Malicious user can
- 6.8 Medium severity
D-Link DIR-300 Router Cleartext Storage of a Password Exploited
The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information via unspecified vectors.