cve.bz

CWE-312: Cleartext Storage of Sensitive Information, page 9

Filter

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

What the weakness is: CWE-312 at MITRE. OWASP Top 10: A06:2025 Insecure Design

Related attack patterns (CAPEC): 1
  • CAPEC-37 Retrieve Embedded Sensitive Data Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-312, as MITRE names them. Credits.

Ask an AI about CWE-312

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-312: Cleartext Storage of Sensitive Information and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/312.html and https://cve.bz/cve/cwe/312?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2023-41964EPSS 0.3%

    The BIG-IP and BIG-IQ systems do not encrypt some sensitive information written to Database (DB) variables.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

  2. 9.8CVE-2023-2809EPSS 0.4%

    Plaintext credential usage vulnerability in Sage 200 Spain 2023.38.001 version, the exploitation of which could allow a remote attacker to extract SQL database credentials from the DLL application. This vulnerability could be linked to kno…

  3. 5.5CVE-2023-4066EPSS 0.2%

    A flaw was found in Red Hat's AMQ Broker, which stores certain passwords in a secret security-properties-prop-module, defined in ActivemqArtemisSecurity CR; however, they are shown in plaintext in the StatefulSet details yaml of AMQ Broker.

  4. 7.5CVE-2023-44159EPSS 0.7%

    Sensitive information disclosure due to cleartext storage of sensitive information. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 35979.

  5. 7.5CVE-2023-44153EPSS 0.4%

    Sensitive information disclosure due to cleartext storage of sensitive information in memory. The following products are affected: Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 35979.

  6. 3.7CVE-2023-41335EPSS 0.4%

    Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. When users update their passwords, the new credentials may be briefly held in the server database. While this doesn't grant the server any add…

  7. 4.9CVE-2023-2358EPSS 0.3%

    Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.5.0.0 and 9.3.0.4, including 8.3.x.x, saves passwords of the Hadoop Copy Files step in plaintext.

  8. 5.5CVE-2023-40715EPSS 0.2%

    A cleartext storage of sensitive information vulnerability [CWE-312] in FortiTester 2.3.0 through 7.2.3 may allow an attacker with access to the DB contents to retrieve the plaintext password of external servers configured in the device.

  9. 6.5CVE-2023-4400EPSS 0.4%

    A password management vulnerability in Skyhigh Secure Web Gateway (SWG) in main releases 11.x prior to 11.2.14, 10.x prior to 10.2.25 and controlled release 12.x prior to 12.2.1, allows some authentication information stored in configurati…

  10. 9.8CVE-2023-31069ExploitEPSS 3.7%

    An issue was discovered in TSplus Remote Access through 16.0.2.14. Credentials are stored as cleartext within the HTML source code of the login page.

  11. 3.8CVE-2023-3950EPSS 0.3%

    An information disclosure issue in GitLab EE affecting all versions from 16.2 prior to 16.2.5, and 16.3 prior to 16.3.1 allowed other Group Owners to see the Public Key for a Google Cloud Logging audit event streaming destination, if confi…

  12. 6.5CVE-2023-31925EPSS 0.2%

    Brocade SANnav before v2.3.0 and v2.2.2a stores SNMPv3 Authentication passwords in plaintext. A privileged user could retrieve these credentials with knowledge and access to these log files. SNMP credentials could be seen in SANnav Sup…

  13. 5.5CVE-2023-31423EPSS 0.2%

    Possible information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking on Brocade SANnav before v2.3.0 and 2.2.2a. Notes: To access the logs, the local attacker must ha…

  14. 7.5CVE-2023-3489EPSS 0.4%

    The firmwaredownload command on Brocade Fabric OS v9.2.0 could log the FTP/SFTP/SCP server password in clear text in the SupportSave file when performing a downgrade from Fabric OS v9.2.0 to any earlier version of Fabric OS.

  15. 5.3CVE-2023-4392EPSS 0.6%

    A vulnerability was found in Control iD Gerencia Web 1.30 and classified as problematic. Affected by this issue is some unknown functionality of the component Cookie Handler. The manipulation leads to cleartext storage of sensitive informa…

  16. 6.5CVE-2023-40354EPSS 0.3%

    An issue was discovered in MariaDB MaxScale before 23.02.3. A user enters an encrypted password on a "maxctrl create service" command line, but this password is then stored in cleartext in the resulting .cnf file under /var/lib/maxscale/ma…

  17. 7.5CVE-2023-31041EPSS 0.4%

    An issue was discovered in SysPasswordDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. System password information could optionally be stored in cleartext, which might lead to possible information disclosure.

  18. 5.5CVE-2023-39210EPSS 0.1%

    Cleartext storage of sensitive information in Zoom Client SDK for Windows before 5.15.0 may allow an authenticated user to enable an information disclosure via local access.

  19. 6.5CVE-2023-36136EPSS 0.3%

    PHPJabbers Class Scheduling System 1.0 lacks encryption on the password when editing a user account (update user page) allowing an attacker to capture all user names and passwords in clear text.

  20. 4.4CVE-2023-39440EPSS 0.1%

    In SAP BusinessObjects Business Intelligence - version 420, If a user logs in to a particular program, under certain specific conditions memory might not be cleared up properly, due to which attacker might be able to get access to user cr…

  21. 5.0CVE-2023-39903EPSS 0.1%

    An issue was discovered in Fujitsu Software Infrastructure Manager (ISM) before 2.8.0.061. The ismsnap component (in this specific case at /var/log/fujitsu/ServerViewSuite/ism/FirmwareManagement/FirmwareManagement.log) allows insecure coll…

  22. 9.8CVE-2023-33373EPSS 0.4%

    Connected IO v2.1.0 and prior keeps passwords and credentials in clear-text format, allowing attackers to exfiltrate the credentials and use them to impersonate the devices.

  23. 7.5CVE-2023-39379EPSS 0.4%

    Fujitsu Software Infrastructure Manager (ISM) stores sensitive information at the product's maintenance data (ismsnap) in cleartext form. As a result, the password for the proxy server that is configured in ISM may be retrieved. Affected p…

  24. 7.5CVE-2023-30146EPSS 0.7%

    Assmann Digitus Plug&View IP Camera HT-IP211HDP, version 2.000.022 allows unauthenticated attackers to download a copy of the camera's settings and the administrator credentials.

  25. 7.5CVE-2023-39144EPSS 0.5%

    Element55 KnowMore appliances version 21 and older was discovered to store passwords in plaintext.

  26. 7.5CVE-2023-33742EPSS 0.5%

    TeleAdapt RoomCast TA-2400 1.0 through 3.1 suffers from Cleartext Storage of Sensitive Information: RSA private key in Update.exe.

  27. 7.5CVE-2023-30367EPSS 0.5%

    Multi-Remote Next Generation Connection Manager (mRemoteNG) is free software that enables users to store and manage multi-protocol connection configurations to remotely connect to systems. mRemoteNG configuration files can be stored in an …

  28. 5.5CVE-2023-32455EPSS 0.1%

    Dell Wyse ThinOS versions prior to 2208 (9.3.2102) contain a sensitive information disclosure vulnerability. An unauthenticated malicious user with local access to the device could exploit this vulnerability to read sensitive information w…

  29. 5.5CVE-2023-32447EPSS 0.1%

    Dell Wyse ThinOS versions prior to 2306 (9.4.2103) contain a sensitive information disclosure vulnerability. A malicious user with local access to the device could exploit this vulnerability to read sensitive information written to the log…

  30. 5.5CVE-2023-32446EPSS 0.1%

    Dell Wyse ThinOS versions prior to 2303 (9.4.1141) contain a sensitive information disclosure vulnerability. An unauthenticated malicious user with local access to the device could exploit this vulnerability to read sensitive information w…

  31. 4.4CVE-2023-32483EPSS 0.1%

    Wyse Management Suite versions prior to 4.0 contain a sensitive information disclosure vulnerability. An authenticated malicious user having local access to the system running the application could exploit this vulnerability to read sensit…

  32. 7.5CVE-2023-3762EPSS 0.4%

    A vulnerability was found in Intergard SGS 8.7.0. It has been classified as problematic. This affects an unknown part. The manipulation leads to cleartext storage of sensitive information in memory. It is possible to initiate the attack re…

  33. 5.5CVE-2023-37468EPSS 0.2%

    Feedbacksystem is a personalized feedback system for students using artificial intelligence. Passwords of users using LDAP login are stored in clear text in the database. The LDAP users password is passed unencrypted in the LoginController…

  34. 7.5CVE-2023-31821EPSS 0.6%

    An issue found in ALBIS Co. ALBIS v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp ALBIS function.

  35. 6.5CVE-2023-20207EPSS 0.5%

    A vulnerability in the logging component of Cisco Duo Authentication Proxy could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. This vulnerability exists because certain unencr…

  36. 3.3CVE-2022-22302EPSS 0.3%

    A clear text storage of sensitive information (CWE-312) vulnerability in both FortiGate version 6.4.0 through 6.4.1, 6.2.0 through 6.2.9 and 6.0.0 through 6.0.13 and FortiAuthenticator version 5.5.0 and all versions of 6.1 and 6.0 may allo…

  37. 4.6CVE-2023-35699EPSS 0.2%

    Cleartext Storage on Disk in the SICK ICR890-4 could allow an unauthenticated attacker with local access to the device to disclose sensitive information by accessing a SD card.

  38. 6.5CVE-2023-3395EPSS 0.3%

    ​All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory. An attacker with access to system files could open a file to load the document into memory, including sensitive information associated with …

  39. 7.5CVE-2023-27243EPSS 0.3%

    An access control issue in Makves DCAP v3.0.0.122 allows unauthenticated attackers to obtain cleartext credentials via a crafted web request to the product API.

  40. 6.5CVE-2022-33159EPSS 0.3%

    IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID: 228567.

  41. 7.5CVE-2023-1897EPSS 0.3%

    Atlas Copco Power Focus 6000 web server does not sanitize the login information stored by the authenticated user’s browser, which could allow an attacker with access to the user’s computer to gain credential information of the controller.

  42. 7.5CVE-2023-22584EPSS 0.5%

    The Danfoss AK-EM100 stores login credentials in cleartext.

  43. 7.1CVE-2023-27706EPSS 0.6%

    Bitwarden Windows desktop application versions prior to v2023.4.0 store biometric keys in Windows Credential Manager, accessible to other local unprivileged processes.

  44. 8.1CVE-2023-28713EPSS 0.4%

    Plaintext storage of a password exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. Because account information of the database is saved in a local file in plaintext, a user who can access the PC where the affected product is ins…

  45. 4.6CVE-2023-28345EPSS 0.3%

    An issue was discovered in Faronics Insight 10.0.19045 on Windows. The Insight Teacher Console application exposes the teacher's Console password in cleartext via an API endpoint accessible from localhost. Attackers with physical access to…

  46. 5.5CVE-2023-32448EPSS 0.1%

    PowerPath for Windows, versions 7.0, 7.1 & 7.2 contains License Key Stored in Cleartext vulnerability. A local user with access to the installation directory can retrieve the license key of the product and use it to install and license Pow…

  47. 5.5CVE-2023-2863EPSS 0.2%

    A vulnerability has been found in Simple Design Daily Journal 1.012.GP.B on Android and classified as problematic. Affected by this vulnerability is an unknown functionality of the component SQLite Database. The manipulation leads to clear…

  48. 5.5CVE-2023-22878EPSS 0.1%

    IBM InfoSphere Information Server 11.7 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 244373.

  49. 5.3CVE-2023-32983EPSS 0.4%

    Jenkins Ansible Plugin 204.v8191fd551eb_f and earlier does not mask extra variables displayed on the configuration form, increasing the potential for attackers to observe and capture them.

  50. 4.3CVE-2023-32982EPSS 0.4%

    Jenkins Ansible Plugin 204.v8191fd551eb_f and earlier stores extra variables unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins contro…