CWE-256: Plaintext Storage of a Password, page 4
Filter
The product stores a password in plaintext within resources such as memory or files.
What the weakness is: CWE-256 at MITRE. OWASP Top 10: A06:2025 Insecure Design
Ask an AI about CWE-256
Show the prompt
Explain CWE-256: Plaintext Storage of a Password and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/256.html and https://cve.bz/cve/cwe/256?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 7.8CVE-2024-28961EPSS 0.1%
Dell OpenManage Enterprise, versions 4.0.0 and 4.0.1, contains a sensitive information disclosure vulnerability. A local low privileged malicious user could potentially exploit this vulnerability to obtain credentials leading to unauthoriz…
- 6.1CVE-2024-28325EPSS 0.1%
Asus RT-N12+ B1 router stores credentials in cleartext, which could allow local attackers to obtain unauthorized access and modify router settings.
- 7.3CVE-2024-3625EPSS 0.3%
A flaw was found in Quay, where Quay's database is stored in plain text in mirror-registry on Jinja's config.yaml file. This issue leaves the possibility of a malicious actor with access to this file to gain access to Quay's Redis instance.
- 7.3CVE-2024-3624EPSS 0.3%
A flaw was found in how Quay's database is stored in plain-text in mirror-registry on the jinja's config.yaml file. This flaw allows a malicious actor with access to this file to gain access to Quay's database.
- 6.5CVE-2024-3623EPSS 0.4%
A flaw was found when using mirror-registry to install Quay. It uses a default database secret key, which is stored in plain-text format in one of the configuration template files. This issue may lead to all instances of Quay deployed usin…
- 8.8CVE-2024-3622EPSS 0.5%
A flaw was found when using mirror-registry to install Quay. It uses a default secret, which is stored in plain-text format in one of the configuration template files. This issue may lead to all instances of Quay deployed using mirror-regi…
- 9.8CVE-2024-23486EPSS 0.6%
Plaintext storage of a password issue exists in BUFFALO wireless LAN routers, which may allow a network-adjacent unauthenticated attacker with access to the product's login page may obtain configured credentials.
- 6.5CVE-2024-28782EPSS 0.4%
IBM QRadar Suite Software 1.10.12.0 through 1.10.18.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID: 285698.
- 6.5CVE-2024-25138EPSS 0.4%
In AutomationDirect C-MORE EA9 HMI, credentials used by the platform are stored as plain text on the device.
- 8.8CVE-2024-26165EPSS 1.9%
Visual Studio Code Elevation of Privilege Vulnerability
- 2.7CVE-2023-5775EPSS 0.4%
The BackWPup plugin for WordPress is vulnerable to Plaintext Storage of Backup Destination Password in all versions up to, and including, 4.0.2. This is due to to the plugin improperly storing backup destination passwords in plaintext. Thi…
- 4.9CVE-2024-26133EPSS 0.6%
EventStoreDB (ESDB) is an operational database built to store events. A vulnerability has been identified in the projections subsystem in versions 20 prior to 20.10.6, 21 prior to 21.10.11, 22 prior to 22.10.5, and 23 prior to 23.10.1. Onl…
- 5.5CVE-2024-22312EPSS 0.2%
IBM Storage Defender - Resiliency Service 2.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 278748.
- 7.5CVE-2023-6518EPSS 0.4%
Plaintext Storage of a Password vulnerability in Mia Technology Inc. MİA-MED allows Read Sensitive Strings Within an Executable. This issue affects MİA-MED: before 1.0.7.
- 5.5CVE-2023-31002EPSS 0.1%
IBM Security Access Manager Container 10.0.0.0 through 10.0.6.1 temporarily stores sensitive information in files that could be accessed by a local user. IBM X-Force ID: 254657.
- 5.5CVE-2024-21869EPSS 0.2%
In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the affected product stores plaintext credentials in various places. This may allow an attacker with local access to see them.
- 6.5CVE-2024-22432EPSS 0.1%
Networker 19.9 and all prior versions contains a Plain-text Password stored in temporary config file during backup duration in NMDA MySQL Database backups. User has low privilege access to Networker Client system could potentially exploit …
- 5.5CVE-2023-44300EPSS 0.2%
Dell DM5500 5.14.0.0, contain a Plain-text Password Storage Vulnerability in the appliance. A local attacker with privileges could potentially exploit this vulnerability, leading to the disclosure of certain service credentials. The attack…
- 6.5CVE-2023-48700EPSS 0.4%
The Nautobot Device Onboarding plugin uses the netmiko and NAPALM libraries to simplify the onboarding process of a new device into Nautobot down to, in many cases, an IP Address and a Location. Starting in version 2.0.0 and prior to versi…
- 9.8CVE-2023-42493EPSS 0.5%
EisBaer Scada - CWE-256: Plaintext Storage of a Password
- 6.5CVE-2023-43777EPSS 0.3%
Eaton easySoft software is used to program easy controllers and displays for configuring, programming and defining parameters for all the intelligent relays. This software has a password protection functionality to secure the project file …
- 5.5CVE-2023-27315EPSS 0.2%
SnapGathers versions prior to 4.9 are susceptible to a vulnerability which could allow a local authenticated attacker to discover plaintext domain user credentials
- 5.5CVE-2022-47561EPSS 0.2%
The web application stores credentials in clear text in the "admin.xml" file, which can be accessed without logging into the website, which could allow an attacker to obtain credentials related to all users, including admin users, in clear…
- 7.5CVE-2023-39452EPSS 0.6%
The web application that owns the device clearly stores the credentials within the user management section. Obtaining this information can be done remotely due to the incorrect management of the sessions in the web application.
- 7.5CVE-2022-3261EPSS 0.3%
A flaw was found in OpenStack. Multiple components show plain-text passwords in /var/log/messages during the OpenStack overcloud update run, leading to a disclosure of sensitive information problem.
- 6.5CVE-2023-4984EPSS 0.7%
A vulnerability was found in didi KnowSearch 0.3.2/0.3.1.2. It has been rated as problematic. This issue affects some unknown processing of the file /api/es/admin/v3/security/user/1. The manipulation leads to unprotected storage of credent…
- 6.5CVE-2023-4400EPSS 0.4%
A password management vulnerability in Skyhigh Secure Web Gateway (SWG) in main releases 11.x prior to 11.2.14, 10.x prior to 10.2.25 and controlled release 12.x prior to 12.2.1, allows some authentication information stored in configurati…
- 8.8CVE-2023-4918EPSS 0.6%
A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile. When a user registers itself through registration flow, the "password" and "password-confirm" field from the form will occur as regular user attributes. …
- 7.5CVE-2023-39227EPSS 0.3%
Softneta MedDream PACS stores usernames and passwords in plaintext. The plaintext storage could be abused by attackers to leak legitimate user’s credentials.
- 7.5CVE-2023-35067EPSS 0.5%
Plaintext Storage of a Password vulnerability in Infodrom Software E-Invoice Approval System allows Read Sensitive Strings Within an Executable. This issue affects E-Invoice Approval System: before v.20230701.
- 6.5CVE-2023-35765EPSS 0.5%
PiiGAB M-Bus stores credentials in a plaintext file, which could allow a low-level user to gain admin credentials.
- 6.5CVE-2023-3395EPSS 0.3%
All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory. An attacker with access to system files could open a file to load the document into memory, including sensitive information associated with …
- 9.8CVE-2023-26204EPSS 0.4%
A plaintext storage of a password vulnerability [CWE-256] in FortiSIEM 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions, 6.3 all versions, 6.2 all versions, 6.1 all versions, 5.4 all versions, 5.3 all versions may all…
- 4.3CVE-2023-2633EPSS 0.4%
Jenkins Code Dx Plugin 3.1.0 and earlier does not mask Code Dx server API keys displayed on the configuration form, increasing the potential for attackers to observe and capture them.
- 4.3CVE-2023-2632EPSS 0.6%
Jenkins Code Dx Plugin 3.1.0 and earlier stores Code Dx server API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller …
- 8.8CVE-2022-4308EPSS 0.2%
Plaintext Storage of a Password vulnerability in Secomea GateManager (USB wizard) allows Authentication abuse on SiteManager, if the generated file is leaked.
- 7.5CVE-2023-0457EPSS 1.2%
Plaintext Storage of a Password vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series, MELSEC iQ-R Series, MELSEC-Q Series and MELSEC-L Series allows a remote unauthenticated attacker to disclose plaintext credentials stored …
- 6.5CVE-2023-22389EPSS 0.5%
Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior store passwords in a plaintext file when the device configuration is exported via Save/Restore–>Backup Settings, which could be read by any user accessing the file.
- 6.5CVE-2022-22458EPSS 0.8%
IBM Security Verify Governance, Identity Manager 10.0.1 stores user credentials in plain clear text which can be read by a remote authenticated user. IBM X-Force ID: 225009.
- 5.5CVE-2022-41732EPSS 0.2%
IBM Maximo Mobile 8.7 and 8.8 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 237407.
- 7.6CVE-2022-43958EPSS 0.4%
A vulnerability has been identified in QMS Automotive (All versions < V12.39), QMS Automotive (All versions < V12.39). User credentials are stored in plaintext in the database without any hashing mechanism. This could allow an attacker to …
- 5.5CVE-2022-3644EPSS 0.3%
The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API () instead of marking it as write only.
- 5.3CVE-2022-43426EPSS 0.6%
Jenkins S3 Explorer Plugin 1.0.8 and earlier does not mask the AWS_SECRET_ACCESS_KEY form field, increasing the potential for attackers to observe and capture it.
- 6.5CVE-2022-3287EPSS 0.8%
When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file.
- 9.1CVE-2022-36308EPSS 0.8%
Airspan AirVelocity 1500 web management UI displays SNMP credentials in plaintext on software versions older than 15.18.00.2511, and stores SNMPv3 credentials unhashed on the filesystem, enabling anyone with web access to use these credent…
- 8.8CVE-2022-33928EPSS 0.3%
Dell Wyse Management Suite 3.6.1 and below contains an Plain-text Password Storage Vulnerability in UI. An attacker with low privileges could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. Th…
- 5.5CVE-2022-1794EPSS 0.2%
The CODESYS OPC DA Server prior V3.5.18.20 stores PLC passwords as plain text in its configuration file so that it is visible to all authorized Microsoft Windows users of the system.
- 5.5CVE-2022-27548EPSS 0.5%
HCL Launch stores user credentials in plain clear text which can be read by a local user.
- 7.5CVE-2022-31044EPSS 0.7%
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. The Key Storage converter plugin mechanism was not enabled correctly in Rundeck 4.2.0 and 4.2.1, resulting in use of the encryption layer for…
- 6.7CVE-2022-29085EPSS 0.2%
Dell Unity, Dell UnityVSA, and Dell Unity XT versions prior to 5.2.0.0.5.173 contain a plain-text password storage vulnerability when certain off-array tools are run on the system. The credentials of a user with high privileges are stored …