CWE-256: Plaintext Storage of a Password, page 3
Filter
The product stores a password in plaintext within resources such as memory or files.
What the weakness is: CWE-256 at MITRE. OWASP Top 10: A06:2025 Insecure Design
Ask an AI about CWE-256
Show the prompt
Explain CWE-256: Plaintext Storage of a Password and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/256.html and https://cve.bz/cve/cwe/256?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 2.6CVE-2025-25985EPSS 0.3%
An issue in Macro-video Technologies Co.,Ltd V380E6_C1 IP camera (Hw_HsAKPIQp_WF_XHR) 1020302 allows a physically proximate attacker to execute arbitrary code via the /mnt/mtd/mvconf/wifi.ini and /mnt/mtd/mvconf/user_info.ini components.
- 5.0CVE-2025-24375EPSS 0.2%
Charmed MySQL K8s operator is a Charmed Operator for running MySQL on Kubernetes. Before revision 221, the method for calling a SQL DDL or python based mysql-shell scripts can leak database users credentials. The method mysql-operator call…
- 4.3CVE-2025-31724EPSS 0.3%
Jenkins Cadence vManager Plugin 4.0.0-282.v5096a_c2db_275 and earlier stores Verisium Manager vAPI keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or acces…
- 6.5CVE-2024-43186EPSS 0.3%
IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information that is stored locally under certain conditions.
- 6.5CVE-2024-9418EPSS 0.6%
In version 0.0.14 of transformeroptimus/superagi, the API endpoint `/api/users/get/{id}` returns the user's password in plaintext. This vulnerability allows an attacker to retrieve the password of another user, leading to potential account…
- 4.8CVE-2025-2355EPSS 0.2%
A vulnerability was found in BlackVue App 3.65 on Android and classified as problematic. Affected by this issue is some unknown functionality of the component API Endpoint Handler. The manipulation of the argument BCS_TOKEN/SECRET_KEY lead…
- 4.4CVE-2024-45638EPSS 0.1%
IBM Security QRadar 3.12 EDR stores user credentials in plain text which can be read by a local privileged user.
- 9.8CVE-2025-27662EPSS 0.6%
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Password in URL OVE-20230524-0005.
- 9.8CVE-2025-27656EPSS 0.9%
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Password Stored in Process List V-2023-011.
- 6.2CVE-2025-25727EPSS 0.2%
Bosscomm IF740 Firmware versions:11001.7078 & v11001.0000 and System versions: 6.25 & 6.00 were discovered to store passwords in cleartext.
- 7.5CVE-2024-41336EPSS 0.4%
Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 28…
- 7.0CVE-2024-10334EPSS 0.1%
A vulnerability exists in the VideONet product included in the listed System 800xA versions, where VideONet is used. An attacker who successfully exploited the vulnerability could, in the worst case scenario, stop or manipulate the video…
- 5.5CVE-2023-50945EPSS 0.1%
IBM Common Licensing 9.0 stores user credentials in plain clear text which can be read by a local user.
- 8.3CVE-2024-43659EPSS 0.8%
After gaining access to the firmware of a charging station, a file at <redacted> can be accessed to obtain default credentials that are the same across all Iocharger AC model EV chargers. This issue affects Iocharger firmware for AC model…
- 4.4CVE-2025-21111EPSS 0.1%
Dell VxRail, versions 8.0.000 through 8.0.311, contain(s) a Plaintext Storage of a Password vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.
- 4.4CVE-2025-21102EPSS 0.2%
Dell VxRail, versions 7.0.000 through 7.0.532, contain(s) a Plaintext Storage of a Password vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.
- 5.7CVE-2024-52361EPSS 0.5%
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.9 stores user credentials in plain text which can be read by an authenticated user with access to the pod.
- 4.9CVE-2023-50956EPSS 0.4%
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.9 could allow a privileged user to obtain highly sensitive user credentials from secret keys that are stored in clear text.
- 6.7CVE-2024-53292EPSS 0.1%
Dell VxVerify, versions prior to x.40.405, contain a Plain-text Password Storage Vulnerability in the shell wrapper. A local high privileged attacker could potentially exploit this vulnerability, leading to the disclosure of certain user c…
- 7.2CVE-2024-11982EPSS 0.6%
Certain models of routers from Billion Electric has a Plaintext Storage of a Password vulnerability. Remote attackers with administrator privileges can access the user settings page to retrieve plaintext passwords.
- 2.7CVE-2024-36464EPSS 0.6%
When exporting media types, the password is exported in the YAML in plain text. This appears to be a best practices type issue and may have no actual impact. The user would need to have permissions to access the media types and therefore w…
- 5.9CVE-2024-29978EPSS 1.3%
User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the details of affected product names, model numbers, and versions, refer to the informa…
- 5.5CVE-2024-49351EPSS 0.1%
IBM Workload Scheduler 9.5, 10.1, and 10.2 stores user credentials in plain text which can be read by a local user.
- 8.7CVE-2024-49370EPSS 0.5%
Pimcore is an open source data and experience management platform. When a PortalUserObject is connected to a PimcoreUser and "Use Pimcore Backend Password" is set to true, the change password function in Portal Profile sets the new passwor…
- 2.4CVE-2024-42496EPSS 0.2%
Smart-tab Android app installed April 2023 or earlier contains an issue with plaintext storage of a password. If this vulnerability is exploited, an attacker with physical access to the device may retrieve the credential information and sp…
- 4.3CVE-2024-31899EPSS 0.2%
IBM Cognos Command Center 10.2.4.1 and 10.2.5 could disclose highly sensitive user information to an authenticated user with physical access to the device.
- 8.8CVE-2023-41610EPSS 0.4%
Victure PC420 1.1.39 was discovered to contain a hardcoded root password which is stored in plaintext.
- 9.8CVE-2024-5960EPSS 0.4%
Plaintext Storage of a Password vulnerability in Eliz Software Panel allows : Use of Known Domain Credentials. This issue affects Panel: before v2.3.24.
- 5.5CVE-2024-20489EPSS 0.1%
A vulnerability in the storage method of the PON Controller configuration file could allow an authenticated, local attacker with low privileges to obtain the MongoDB credentials. This vulnerability is due to improper storage of the unen…
- 4.6CVE-2024-44815EPSS 0.6%
Vulnerability in Hathway Skyworth Router CM5100 v.4.1.1.24 allows a physically proximate attacker to obtain user credentials via SPI flash Firmware W25Q64JV.
- 6.0CVE-2024-45283EPSS 0.2%
SAP NetWeaver AS for Java allows an authorized attacker to obtain sensitive information. The attacker could obtain the username and password when creating an RFC destination. After successful exploitation, an attacker can read the sensitiv…
- 7.8CVE-2024-43378EPSS 0.1%
calamares-nixos-extensions provides Calamares branding and modules for NixOS, a distribution of GNU/Linux. Users who installed NixOS through the graphical installer who used manual disk partitioning to create a setup where the system was b…
- 5.5CVE-2024-25024EPSS 0.1%
IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 281430.
- 5.1CVE-2024-39922EPSS 0.2%
A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) (All versions), LOGO! 230RCE (6ED1052-1FB08-0BA1) (All versions), LOGO! 230RCEo (6ED1052-2FB08-0BA1) (All versi…
- 8.1CVE-2024-36460EPSS 0.6%
The front-end audit log allows viewing of unprotected plaintext passwords, where the passwords are displayed in plain text.
- 9.3CVE-2024-6118EPSS 0.5%
A Plaintext Storage of a Password vulnerability in ebooknote function in Hamastar MeetingHub Paperless Meetings 2021 allows remote attackers to obtain the other users’ credentials and gain access to the product via an XML file.
- 4.6CVE-2024-3082EPSS 0.1%
A “CWE-256: Plaintext Storage of a Password” affecting the administrative account allows an attacker with physical access to the machine to retrieve the password in cleartext unless specific security measures at other layers (e.g., full-di…
- 4.4CVE-2024-37135EPSS 0.1%
DM5500 5.16.0.0, contains an information disclosure vulnerability. A local attacker with high privileges could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use t…
- 8.1CVE-2024-40116EPSS 0.4%
An issue in Solar-Log 1000 before v2.8.2 and build 52-23.04.2013 was discovered to store plaintext passwords in the export.html, email.html, and sms.html files -- fixed with 3.0.0-60 11.10.2013 for SL 200, 500, 1000 / not existing for SL 2…
- 5.5CVE-2024-39733EPSS 0.1%
IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 295972.
- 6.5CVE-2024-39220EPSS 0.4%
BAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE, AV-02IDR, AV-02IPD, AV-02FDE, AV-02FDR, AV-03D, AV-03BD, AV-04AFD, AV-04ASD, AV-04FD, AV-04SD, AV-05FD, AV-05SD, AA-07BD, AA-07BDI, BA-04BD, BA-04MD, …
- 9.8CVE-2024-33375EPSS 0.6%
LB-LINK BL-W1210M v2.0 was discovered to store user credentials in plaintext within the router's firmware.
- 7.4CVE-2024-27166EPSS 0.2%
Coredump binaries in Toshiba printers have incorrect permissions. A local attacker can steal confidential information. As for the affected products/models/versions, see the reference URL.
- 4.4CVE-2024-25052EPSS 0.2%
IBM Jazz Reporting Service 7.0.3 stores user credentials in plain clear text which can be read by an admin user. IBM X-Force ID: 283363.
- 8.4CVE-2022-0555EPSS 0.3%
Subiquity Shows Guided Storage Passphrase in Plaintext with Read-all Permissions
- 7.1CVE-2024-28736EPSS 2.5%
An issue in Debezium Community debezium-ui v.2.5 allows a local attacker to execute arbitrary code via the refresh page function.
- 9.8CVE-2024-36081EPSS 0.6%
Westermo EDW-100 devices through 2024-05-03 allow an unauthenticated user to download a configuration file containing a cleartext password. NOTE: this is a serial-to-Ethernet converter that should not be placed at the edge of the network.
- 5.4CVE-2024-4425EPSS 0.4%
The access control in CemiPark software stores integration (e.g. FTP or SIP) credentials in plain-text. An attacker who gained unauthorized access to the device can retrieve clear text passwords used by the system.This issue affects CemiPa…
- 5.4CVE-2024-4232EPSS 0.3%
This vulnerability exists in Digisol Router (DG-GR1321: Hardware version 3.7L; Firmware version : v3.2.02) due to lack of encryption or hashing in storing of passwords within the router's firmware/ database. An attacker with physical acce…
- 4.9CVE-2024-28971EPSS 0.2%
Dell Update Manager Plugin, versions 1.4.0 through 1.5.0, contains a Plain-text Password Storage Vulnerability in Log file. A remote high privileged attacker could potentially exploit this vulnerability, leading to the disclosure of certai…