cve.bz

CWE-312: Cleartext Storage of Sensitive Information, page 7

Filter

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

What the weakness is: CWE-312 at MITRE. OWASP Top 10: A06:2025 Insecure Design

Related attack patterns (CAPEC): 1
  • CAPEC-37 Retrieve Embedded Sensitive Data Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-312, as MITRE names them. Credits.

Ask an AI about CWE-312

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-312: Cleartext Storage of Sensitive Information and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/312.html and https://cve.bz/cve/cwe/312?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2024-28807EPSS 0.1%

    An issue was discovered in Infinera hiT 7300 5.60.50. Cleartext storage of sensitive information in the memory of the @CT desktop management application allows guest OS administrators to obtain various users' passwords by accessing memory …

  2. 6.6CVE-2024-28810EPSS 0.2%

    An issue was discovered in Infinera hiT 7300 5.60.50. Sensitive information inside diagnostic files (exported by the @CT application) allows an attacker to achieve loss of confidentiality by analyzing these files.

  3. 8.8CVE-2024-28809EPSS 0.2%

    An issue was discovered in Infinera hiT 7300 5.60.50. Cleartext storage of sensitive password in firmware update packages allows attackers to access various appliance services via hardcoded credentials.

  4. 4.9CVE-2024-8459EPSS 0.3%

    Certain switch models from PLANET Technology store SNMPv3 users' passwords in plaintext within the configuration files, allowing remote attackers with administrator privileges to read the file and obtain the credentials.

  5. 4.3CVE-2024-45744EPSS 0.2%

    TopQuadrant TopBraid EDG stores external credentials insecurely. An authenticated attacker with file system access can read edg-setup.properites and obtain the secret to decrypt external passwords stored in edg-vault.properties. An authent…

  6. 9.3CVE-2024-8644EPSS 0.3%

    Cleartext Storage of Sensitive Information in a Cookie vulnerability in Oceanic Software ValeApp allows Protocol Manipulation, : JSON Hijacking (aka JavaScript Hijacking). This issue affects ValeApp: before v2.0.0.

  7. 4.9CVE-2024-7259EPSS 0.3%

    A flaw was found in oVirt. A user with administrator privileges, including users with the ReadOnlyAdmin permission, may be able to use browser developer tools to view Provider passwords in cleartext.

  8. 7.5CVE-2023-5359EPSS 0.8%

    The W3 Total Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.5 via Google OAuth API secrets stored in plaintext in the publicly visible plugin source. This can allow unauthen…

  9. 6.8CVE-2024-6785EPSS 0.1%

    The configuration file stores credentials in cleartext. An attacker with local access rights can read or modify the configuration file, potentially resulting in the service being abused due to sensitive information exposure.

  10. 4.6CVE-2024-9040EPSS 0.2%

    A vulnerability, which was classified as problematic, was found in code-projects Blood Bank Management System 1.0. This affects an unknown part of the component Password Handler. The manipulation leads to cleartext storage in a file or on …

  11. 8.7CVE-2024-45862EPSS 0.2%

    Kastle Systems firmware prior to May 1, 2024, stored machine credentials in cleartext, which may allow an attacker to access sensitive information.

  12. 8.1CVE-2024-31415EPSS 0.1%

    The Eaton Foreseer software provides the feasibility for the user to configure external servers for multiple purposes such as network management, user management, etc. The software uses encryption to store these configurations securely on …

  13. 5.5CVE-2024-41629EPSS 0.2%

    An issue in Texas Instruments Fusion Digital Power Designer v.7.10.1 allows a local attacker to obtain sensitive information via the plaintext storage of credentials

  14. 9.1CVE-2024-40457EPSS 0.6%

    No-IP Dynamic Update Client (DUC) v3.x uses cleartext credentials that may occur on a command line or in a file. NOTE: the vendor's position is that cleartext in /etc/default/noip-duc is recommended and is the intentional behavior.

  15. 6.0CVE-2024-8689EPSS 0.2%

    A problem with the ActiveMQ integration for both Cortex XSOAR and Cortex XSIAM can result in the cleartext exposure of the configured ActiveMQ credentials in log bundles.

  16. 4.6CVE-2024-35282EPSS 0.2%

    A cleartext storage of sensitive information in memory vulnerability [CWE-316] affecting FortiClient VPN iOS 7.2 all versions, 7.0 all versions, 6.4 all versions, 6.2 all versions, 6.0 all versions may allow an unauthenticated attacker tha…

  17. 8.8CVE-2024-45175EPSS 0.7%

    An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Sensitive information is stored in cleartext. It was found out that sensitive information, for example login credentials of cameras, is stored in cleartext. Thus, an a…

  18. 5.5CVE-2024-45004EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: dcp: fix leak of blob encryption key Trusted keys unseal the key blob on load, but keep the sealed payload in the blob field so that every subsequent read…

  19. 8.1CVE-2024-41716EPSS 0.4%

    Cleartext storage of sensitive information vulnerability exists in WindLDR and WindO/I-NV4. If this vulnerability is exploited, an attacker who obtained the product's project file may obtain user credentials of the PLC or Operator Interfac…

  20. 7.5CVE-2024-45391EPSS 0.3%

    Tina is an open-source content management system (CMS). Sites building with Tina CMS's command line interface (CLI) prior to version 1.6.2 that use a search token may be vulnerable to the search token being leaked via lock file (tina-lock.…

  21. 8.7CVE-2024-6921EPSS 0.2%

    Cleartext Storage of Sensitive Information vulnerability in NAC Telecommunication Systems Inc. NACPremium allows Retrieve Embedded Sensitive Data. This issue affects NACPremium: through 01082024.

  22. 6.5CVE-2021-22509EPSS 0.2%

    A vulnerability identified in storing and reusing information in Advance Authentication. This issue can lead to leakage of sensitive data to unauthorized user. The issue affects NetIQ Advance Authentication before 6.3.5.1

  23. 3.7CVE-2024-32939EPSS 0.2%

    Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2, when shared channels are enabled, fail to redact remote users' original email addresses stored in user props when email addresses are otherwise configure…

  24. 5.5CVE-2024-25024EPSS 0.1%

    IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 281430.

  25. 6.0CVE-2024-5916EPSS 0.2%

    An information exposure vulnerability in Palo Alto Networks PAN-OS software enables a local system administrator to unintentionally disclose secrets, passwords, and tokens of external systems. A read-only administrator who has access to th…

  26. 7.5CVE-2024-33892EPSS 0.4%

    Insecure Permissions vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are susceptible to leaking information through cookies. This is fixed in version 21.2s10 and 22.1s3

  27. 8.3CVE-2024-38877EPSS 0.2%

    A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 Domain Controller R9.2 (All versions), Omnivise T3000 Network Intrusion Detection System (NIDS) R9.2 (All versions), Omnivise T300…

  28. 7.0CVE-2024-41691EPSS 0.2%

    This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to storing of FTP credentials in plaintext within the SquashFS-root filesystem associated with the router's firmware. An attacker with physical access could exploit this b…

  29. 7.0CVE-2024-41690EPSS 0.2%

    This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to storing of default username and password credentials in plaintext within the router's firmware/ database. An attacker with physical access could exploit this by extract…

  30. 5.2CVE-2024-41689EPSS 0.2%

    This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to unencrypted storing of WPA/ WPS credentials within the router's firmware/ database. An attacker with physical access could exploit this by extracting the firmware and r…

  31. 7.0CVE-2024-41688EPSS 0.1%

    This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due lack of encryption in storing of usernames and passwords within the router's firmware/ database. An attacker with physical access could exploit this by extracting the firm…

  32. 5.5CVE-2024-39674EPSS 0.09%

    Plaintext vulnerability in the Gallery search module. Impact: Successful exploitation of this vulnerability will affect availability.

  33. 7.5CVE-2019-16638EPSS 0.4%

    An issue was found on the Ruijie EG-2000 series gateway. An attacker can easily dump cleartext stored passwords in /data/config.text with simple XORs. This affects EG-2000SE EG_RGOS 11.1(1)B1.

  34. 7.5CVE-2024-39732EPSS 0.2%

    IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 temporarily stores data from different environments that could be obtained by a malicious user. IBM X-Force ID: 295791.

  35. 5.5CVE-2024-25023EPSS 0.1%

    IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.22.0 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 281429.

  36. 6.5CVE-2024-21993EPSS 0.2%

    SnapCenter versions prior to 5.0p1 are susceptible to a vulnerability which could allow an authenticated attacker to discover plaintext credentials.

  37. 5.3CVE-2024-40750EPSS 0.1%

    Linksys Velop Pro 6E 1.0.8 MX6200_1.0.8.215731 and 7 1.0.10.215314 devices send cleartext Wi-Fi passwords over the public Internet during app-based installation.

  38. 2.3CVE-2024-40594EPSS 0.1%

    The OpenAI ChatGPT app before 2024-07-05 for macOS opts out of the sandbox, and stores conversations in cleartext in a location accessible to other apps.

  39. 3.5CVE-2024-39846EPSS 0.2%

    NewPass before 1.2.0 stores passwords (rather than password hashes) directly, which makes it easier to obtain unauthorized access to sensitive information. NOTE: in each case, data at rest is encrypted, but is decrypted within process memo…

  40. 5.5CVE-2024-29954EPSS 0.1%

    A vulnerability in a password management API in Brocade Fabric OS versions before v9.2.1, v9.2.0b, v9.1.1d, and v8.2.3e prints sensitive information in log files. This could allow an authenticated user to view the server passwords for prot…

  41. 9.1CVE-2024-36497EPSS 0.5%

    The decrypted configuration file contains the password in cleartext which is used to configure WINSelect. It can be used to remove the existing restrictions and disable WINSelect entirely.

  42. 7.8CVE-2023-49113EPSS 0.2%

    The Kiuwan Local Analyzer (KLA) Java scanning application contains several hard-coded secrets in plain text format. In some cases, this can potentially compromise the confidentiality of the scan results. Several credentials were found in…

  43. 4.3CVE-2024-36589EPSS 0.2%

    An issue in Annonshop.app DecentralizeJustice/anonymousLocker commit 2b2b4 to ba9fd and DecentralizeJustice/anonBackend commit 57837 to cd815 was discovered to store credentials in plaintext.

  44. 7.0CVE-2024-38280EPSS 0.2%

    An unauthorized user is able to gain access to sensitive data, including credentials, by physically retrieving the hard disk of the product as the data is stored in clear text.

  45. 4.1CVE-2024-28024EPSS 0.1%

    A vulnerability exists in the FOXMAN-UN/UNEM in which sensitive information is stored in cleartext within a resource that might be accessible to another control sphere.

  46. 8.8CVE-2024-36790EPSS 0.3%

    Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 was discovered to store credentials in plaintext.

  47. 7.5CVE-2024-4540EPSS 0.6%

    A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR). Client-provided parameters were found to be included in plain text in the KC_RESTART cookie returned by the authorization server's HTTP response to a `request_u…

  48. 1.8CVE-2024-36119EPSS 0.1%

    Statamic is a, Laravel + Git powered CMS designed for building websites. In affected versions users registering via the `user:register_form` tag will have their password confirmation stored in plain text in their user file. This only affec…

  49. 7.2CVE-2024-33471EPSS 0.3%

    An issue in the Sensor Settings of AVTECH Room Alert 4E v4.4.0 allows attackers to gain access to SMTP credentials in plaintext via a crafted AJAX request. NOTE: This vulnerability only affects products that are no longer supported by the …

  50. 4.9CVE-2024-33470EPSS 0.2%

    An issue in the SMTP Email Settings of AVTECH Room Alert 4E v4.4.0 allows attackers to gain access to credentials in plaintext via a passback attack. NOTE: This vulnerability only affects products that are no longer supported by the mainta…