cve.bz

CWE-312: Cleartext Storage of Sensitive Information, page 5

Filter

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

What the weakness is: CWE-312 at MITRE. OWASP Top 10: A06:2025 Insecure Design

Related attack patterns (CAPEC): 1
  • CAPEC-37 Retrieve Embedded Sensitive Data Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-312, as MITRE names them. Credits.

Ask an AI about CWE-312

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-312: Cleartext Storage of Sensitive Information and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/312.html and https://cve.bz/cve/cwe/312?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.9CVE-2025-54422EPSS 0.08%

    Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. In versions 1.16.1 and below, a critical security vulnerability exists in password handling mechanisms. During encrypted sandbox crea…

  2. 5.5CVE-2025-54538EPSS 0.3%

    In JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg pull" command

  3. 5.5CVE-2025-54537EPSS 0.3%

    In JetBrains TeamCity before 2025.07 user credentials were stored in plain text in memory snapshots

  4. 9.8CVE-2025-30124EPSS 0.3%

    An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices. When a new SD card is inserted into the dashcam, the existing password is written onto the SD card in cleartext automatically. An attacker with temporary access to the dash…

  5. 6.8CVE-2025-4394EPSS 0.2%

    Medtronic MyCareLink Patient Monitor uses an unencrypted filesystem on internal storage, which allows an attacker with physical access to read and modify files. This issue affects MyCareLink Patient Monitor models 24950 and 24952: before…

  6. 7.5CVE-2025-44649EPSS 0.3%

    In the configuration file of racoon in the TRENDnet TEW-WLC100P 2.03b03, the first item of exchage_mode is set to aggressive. Aggressive mode in IKE Phase 1 exposes identity information in plaintext, is vulnerable to offline dictionary att…

  7. 5.5CVE-2025-41458EPSS 0.1%

    Unencrypted storage in the database in Two App Studio Journey v5.5.9 for iOS allows local attackers to extract sensitive data via direct access to the app’s filesystem.

  8. 6.8CVE-2025-7397EPSS 0.1%

    A vulnerability in the ascgshell, of Brocade ASCG before 3.3.0 stores any command executed in the Command Line Interface (CLI) in plain text within the command history. A local authenticated user that can access sensitive information li…

  9. 8.2CVE-2025-32353EPSS 0.1%

    Kaseya Rapid Fire Tools Network Detective 2.0.16.0 has Unencrypted Credentials (for privileged access) stored in the collector.txt configuration file.

  10. 5.1CVE-2025-53758EPSS 0.1%

    This vulnerability exists in Digisol DG-GR6821AC Router due to use of default admin credentials at its web management interface. An attacker with physical access could exploit this vulnerability by extracting the firmware and reverse engin…

  11. 5.1CVE-2025-53755EPSS 0.1%

    This vulnerability exists in Digisol DG-GR6821AC Router due to storage of credentials and PINS without encryption in the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and reve…

  12. 6.5CVE-2025-53742EPSS 0.2%

    Jenkins Applitools Eyes Plugin 1.16.5 and earlier stores Applitools API keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins contr…

  13. 6.5CVE-2025-53672EPSS 0.3%

    Jenkins Kryptowire Plugin 0.2 and earlier stores the Kryptowire API key unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system.

  14. 6.5CVE-2025-53670EPSS 0.2%

    Jenkins Nouvola DiveCloud Plugin 1.08 and earlier stores DiveCloud API Keys and Credentials Encryption Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission…

  15. 0.3CVE-2025-7215EPSS 0.1%

    A vulnerability, which was classified as problematic, has been found in FNKvision FNK-GU2 up to 40.1.7. Affected by this issue is some unknown functionality of the file /rom/wpa_supplicant.conf. The manipulation leads to cleartext storage …

  16. 6.8CVE-2025-27460EPSS 0.1%

    The hard drives of the device are not encrypted using a full volume encryption feature such as BitLocker. This allows an attacker with physical access to the device to use an alternative operating system to interact with the hard drives, c…

  17. 5.8CVE-2025-53103EPSS 0.1%

    JUnit is a testing framework for Java and the JVM. From version 5.12.0 to 5.13.1, JUnit's support for writing Open Test Reporting XML files can leak Git credentials. The impact depends on the level of the access token exposed through the O…

  18. 6.5CVE-2025-6224EPSS 0.2%

    Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the network in plaintext, an attacker listening on that network could sniff the certific…

  19. 7.2CVE-2024-24915EPSS 0.2%

    Credentials are not cleared from memory after being used. A user with Administrator permissions can execute memory dump for SmartConsole process and fetch them.

  20. 5.7CVE-2023-28912EPSS 0.2%

    The MIB3 unit stores the synchronized phone contact book in clear-text, allowing an attacker with either code execution privilege on the system or physical access to the system to obtain vehicle owner's contact data. The vulnerability was …

  21. 2.4CVE-2025-47824EPSS 0.2%

    Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have cleartext storage of code.

  22. 0.9CVE-2025-6748EPSS 0.1%

    A vulnerability classified as problematic has been found in Bharti Airtel Thanks App 4.105.4 on Android. Affected is an unknown function of the file /Android/data/com.myairtelapp/files/. The manipulation leads to cleartext storage in a fil…

  23. 2.4CVE-2025-47820EPSS 0.2%

    Flock Safety Gunshot Detection devices before 1.3 have cleartext storage of code.

  24. 5.5CVE-2025-41647EPSS 0.1%

    A local, low-privileged attacker can learn the password of the connected controller in PLC Designer V4 due to an incorrect implementation that results in the password being displayed in plain text under special conditions.

  25. 3.1CVE-2025-48463EPSS 0.1%

    Successful exploitation of the vulnerability could allow an attacker to intercept data and conduct session hijacking on the exposed data as the vulnerable product uses unencrypted HTTP communication, potentially leading to unauthorised acc…

  26. 7.5CVE-2025-45001EPSS 0.2%

    react-native-keys 0.7.11 is vulnerable to sensitive information disclosure (remote) as encryption cipher and Base64 chunks are stored as plaintext in the compiled native binary. Attackers can extract these secrets using basic static analys…

  27. 6.5CVE-2025-1499EPSS 0.2%

    IBM InfoSphere Information Server 11.7 stores credential information for database authentication in a cleartext parameter file that could be viewed by an authenticated user.

  28. 7.5CVE-2025-44614EPSS 0.2%

    Tinxy WiFi Lock Controller v1 RF was discovered to store users' sensitive information, including credentials and mobile phone numbers, in plaintext.

  29. 4.6CVE-2025-32752EPSS 0.2%

    Dell ThinOS 2502 and prior contain a Cleartext Storage of Sensitive Information vulnerability. A high privileged attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure.

  30. 5.1CVE-2024-47056EPSS 0.1%

    SummaryThis advisory addresses a security vulnerability in Mautic where sensitive .env configuration files may be directly accessible via a web browser. This exposure could lead to the disclosure of sensitive information, including databas…

  31. 6.8CVE-2025-4053EPSS 0.2%

    The data stored in Be-Tech Mifare Classic card is stored in cleartext. An attacker having access to a Be-Tech hotel guest Mifare Classic card can create a master key card that unlocks all the locks in the building. This issue affects all…

  32. 1.8CVE-2025-5154EPSS 0.2%

    A vulnerability was identified in PhonePe App 25.03.21.0 on Android. This affects an unknown function of the file /data/data/com.phonepe.app/databases/ of the component SQLite Database. The manipulation leads to cleartext storage in a file…

  33. 5.5CVE-2024-56428EPSS 0.2%

    The local iLabClient database in itech iLabClient 3.7.1 allows local attackers to read cleartext credentials (from the CONFIGS table) for their servers configured in the client.

  34. 6.2CVE-2025-4737EPSS 0.08%

    Insufficient encryption vulnerability in the mobile application (com.transsion.aivoiceassistant) may lead to the risk of sensitive information leakage.

  35. 2.3CVE-2025-4537EPSS 0.3%

    A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.8.9 and classified as problematic. Affected by this issue is some unknown functionality of the file ruoyi-ui/jsencrypt.js and ruoyi-ui/login.vue of the component Password Handler…

  36. 7.1CVE-2025-46820EPSS 0.2%

    phpgt/Dom provides access to modern DOM APIs. Versions of phpgt/Dom prior to 4.1.8 expose the GITHUB_TOKEN in the Dom workflow run artifact. The ci.yml workflow file uses actions/upload-artifact@v4 to upload the build artifact. This artifa…

  37. 8.2CVE-2025-46634EPSS 0.2%

    Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an unauthenticated attacker to authenticate to the web management portal by collecting credentials from observed/collec…

  38. 8.2CVE-2025-46633EPSS 0.3%

    Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an attacker to decrypt traffic between the client and server by collecting the symmetric AES key from collected and/or obs…

  39. 8.4CVE-2025-3395EPSS 0.10%

    Incorrect Permission Assignment for Critical Resource, Cleartext Storage of Sensitive Information vulnerability in ABB Automation Builder.This issue affects Automation Builder: through 2.8.0.

  40. 6.5CVE-2025-27532EPSS 3.6%

    A vulnerability in the “Backup & Restore” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to access secret information via multiple crafted HTTP requests.

  41. 6.5CVE-2025-2770EPSS 0.5%

    BEC Technologies Multiple Routers Cleartext Password Storage Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of BEC Technologies routers. Authenti…

  42. 5.9CVE-2025-0123EPSS 0.1%

    A vulnerability in the Palo Alto Networks PAN-OS® software enables unlicensed administrators to view clear-text data captured using the packet capture feature https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/monitoring/take-pack…

  43. 4.4CVE-2025-3442EPSS 0.1%

    This vulnerability exists in TP-Link Tapo H200 V1 IoT Smart Hub due to storage of Wi-Fi credentials in plain text within the device firmware. An attacker with physical access could exploit this by extracting the firmware and analyzing the…

  44. 5.2CVE-2025-0418EPSS 0.2%

    Valmet DNA user passwords in plain text. This practice poses a security risk as attackers who gain access to local project data can read the passwords.

  45. 1.0CVE-2025-2922EPSS 0.1%

    A vulnerability classified as problematic was found in Netis WF-2404 1.1.124EN. Affected by this vulnerability is an unknown functionality of the component BusyBox Shell. The manipulation leads to cleartext storage of sensitive information…

  46. 6.9CVE-2025-2909EPSS 0.08%

    The lack of encryption in the DuoxMe (formerly Blue) application binary in versions prior to 3.3.1 for iOS devices allows an attacker to gain unauthorised access to the application code and discover sensitive information.

  47. 7.5CVE-2025-25758EPSS 0.3%

    An issue in KukuFM Android v1.12.7 (11207) allows attackers to access sensitive cleartext data via the android:allowBackup="true" in the ANdroidManifest.xml

  48. 7.1CVE-2024-23942EPSS 0.1%

    A local user may find a configuration file on the client workstation with unencrypted sensitive data. This allows an attacker to impersonate the device or prevent the device from accessing the cloud portal which leads to a DoS.

  49. 5.1CVE-2025-2189EPSS 0.1%

    This vulnerability exists in the Tinxy smart devices due to storage of credentials in plaintext within the device firmware. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obt…

  50. 6.5CVE-2024-12604EPSS 0.2%

    Cleartext Storage of Sensitive Information in an Environment Variable, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Tapandsign Technologies Tap&Sign App allows Password Recovery Exploitation, Functionality Misus…