CWE-312
AllowedCleartext Storage of Sensitive Information
Abstraction: Base · Status: Draft
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
1094 vulnerabilities reference this CWE, most recent first.
GHSA-VRMF-9X5H-2HR7
Vulnerability from github – Published: 2023-04-24 15:30 – Updated: 2024-04-04 03:39Ribose RNP before 0.16.3 sometimes lets secret keys remain unlocked after use.
{
"affected": [],
"aliases": [
"CVE-2023-29480"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-24T15:15:08Z",
"severity": "HIGH"
},
"details": "Ribose RNP before 0.16.3 sometimes lets secret keys remain unlocked after use.",
"id": "GHSA-vrmf-9x5h-2hr7",
"modified": "2024-04-04T03:39:22Z",
"published": "2023-04-24T15:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29480"
},
{
"type": "WEB",
"url": "https://www.rnpgp.org/blog/2023-04-13-rnp-release-0-16-3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VRP4-MRFP-3J9C
Vulnerability from github – Published: 2024-05-14 18:30 – Updated: 2025-11-03 21:31A vulnerability has been identified in OPUPI0 AMQP/MQTT (All versions < V5.30). The affected devices stores MQTT client passwords without sufficient protection on the devices. An attacker with remote shell access or physical access could retrieve the credentials leading to confidentiality loss.
{
"affected": [],
"aliases": [
"CVE-2024-31486"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-14T16:16:51Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been identified in OPUPI0 AMQP/MQTT (All versions \u003c V5.30). The affected devices stores MQTT client passwords without sufficient protection on the devices. An attacker with remote shell access or physical access could retrieve the credentials leading to confidentiality loss.",
"id": "GHSA-vrp4-mrfp-3j9c",
"modified": "2025-11-03T21:31:05Z",
"published": "2024-05-14T18:30:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31486"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-871704.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Jul/4"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/Feb/19"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-VRQ7-Q46G-P2FQ
Vulnerability from github – Published: 2022-05-24 17:38 – Updated: 2022-05-24 17:38An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. The One Touch application discloses sensitive information, such as the hashed admin login password and the Internet provider connection username and cleartext password, in the application's response body for a /tmp/var/passwd or /tmp/home/wan_stat URI.
{
"affected": [],
"aliases": [
"CVE-2020-24577"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-01-08T07:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. The One Touch application discloses sensitive information, such as the hashed admin login password and the Internet provider connection username and cleartext password, in the application\u0027s response body for a /tmp/var/passwd or /tmp/home/wan_stat URI.",
"id": "GHSA-vrq7-q46g-p2fq",
"modified": "2022-05-24T17:38:19Z",
"published": "2022-05-24T17:38:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24577"
},
{
"type": "WEB",
"url": "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/d-link-multiple-security-vulnerabilities-leading-to-rce"
},
{
"type": "WEB",
"url": "https://www.trustwave.com/en-us/resources/security-resources/security-advisories"
},
{
"type": "WEB",
"url": "https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=28241"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-VRV3-8MCQ-PPF5
Vulnerability from github – Published: 2026-02-27 18:31 – Updated: 2026-03-30 21:31The OpenID Connect (OIDC) authentication configuration in PowerShell Universal before 2026.1.3 stores the OIDC client secret in cleartext in the .universal/authentication.ps1 script, which allows an attacker with read access to that file to obtain the OIDC client credentials
{
"affected": [],
"aliases": [
"CVE-2026-3277"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-27T16:16:26Z",
"severity": "MODERATE"
},
"details": "The OpenID Connect (OIDC) authentication configuration in PowerShell \nUniversal before 2026.1.3 stores the OIDC client secret in cleartext in \nthe .universal/authentication.ps1 script, which allows an attacker with read access to that file to obtain the OIDC client credentials",
"id": "GHSA-vrv3-8mcq-ppf5",
"modified": "2026-03-30T21:31:02Z",
"published": "2026-02-27T18:31:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3277"
},
{
"type": "WEB",
"url": "https://devolutions.net/security/advisories/DEVO-2026-0006"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-VVP4-4HW7-Q58R
Vulnerability from github – Published: 2022-05-24 17:42 – Updated: 2024-03-21 03:34** UNSUPPORTED WHEN ASSIGNED ** In Directus 8.x through 8.8.1, an attacker can learn sensitive information such as the version of the CMS, the PHP version used by the site, and the name of the DBMS, simply by view the result of the api-aa, called automatically upon a connection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
{
"affected": [],
"aliases": [
"CVE-2021-26595"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-23T19:15:00Z",
"severity": "MODERATE"
},
"details": "** UNSUPPORTED WHEN ASSIGNED ** In Directus 8.x through 8.8.1, an attacker can learn sensitive information such as the version of the CMS, the PHP version used by the site, and the name of the DBMS, simply by view the result of the api-aa, called automatically upon a connection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.",
"id": "GHSA-vvp4-4hw7-q58r",
"modified": "2024-03-21T03:34:03Z",
"published": "2022-05-24T17:42:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26595"
},
{
"type": "WEB",
"url": "https://github.com/sgranel/directusv8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VW62-WVM7-JFWW
Vulnerability from github – Published: 2022-05-01 02:05 – Updated: 2024-02-13 18:38IMail stores usernames and passwords in cleartext in a cookie, which allows remote attackers to obtain sensitive information.
{
"affected": [],
"aliases": [
"CVE-2005-2160"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2005-07-06T04:00:00Z",
"severity": "MODERATE"
},
"details": "IMail stores usernames and passwords in cleartext in a cookie, which allows remote attackers to obtain sensitive information.",
"id": "GHSA-vw62-wvm7-jfww",
"modified": "2024-02-13T18:38:20Z",
"published": "2022-05-01T02:05:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-2160"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=112060187204457\u0026w=2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VWPW-RFX3-GQFW
Vulnerability from github – Published: 2022-05-24 22:01 – Updated: 2022-12-13 03:30IBM Security Guardium Big Data Intelligence (SonarG) 4.0 stores sensitive information in cleartext within a resource that might be accessible to another control sphere. IBM X-Force ID: 1610141.
{
"affected": [],
"aliases": [
"CVE-2019-4314"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-10-29T00:15:00Z",
"severity": "MODERATE"
},
"details": "IBM Security Guardium Big Data Intelligence (SonarG) 4.0 stores sensitive information in cleartext within a resource that might be accessible to another control sphere. IBM X-Force ID: 1610141.",
"id": "GHSA-vwpw-rfx3-gqfw",
"modified": "2022-12-13T03:30:44Z",
"published": "2022-05-24T22:01:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-4314"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/161041"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/1096912"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VX3W-MR85-R8VR
Vulnerability from github – Published: 2023-08-14 18:32 – Updated: 2024-04-04 06:55An issue was discovered in MariaDB MaxScale before 23.02.3. A user enters an encrypted password on a "maxctrl create service" command line, but this password is then stored in cleartext in the resulting .cnf file under /var/lib/maxscale/maxscale.cnf.d. The fixed versions are 2.5.28, 6.4.9, 22.08.8, and 23.02.3.
{
"affected": [],
"aliases": [
"CVE-2023-40354"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-14T17:15:10Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in MariaDB MaxScale before 23.02.3. A user enters an encrypted password on a \"maxctrl create service\" command line, but this password is then stored in cleartext in the resulting .cnf file under /var/lib/maxscale/maxscale.cnf.d. The fixed versions are 2.5.28, 6.4.9, 22.08.8, and 23.02.3.",
"id": "GHSA-vx3w-mr85-r8vr",
"modified": "2024-04-04T06:55:08Z",
"published": "2023-08-14T18:32:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40354"
},
{
"type": "WEB",
"url": "https://jira.mariadb.org/browse/MXS-4681"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VX6M-H78H-XXCF
Vulnerability from github – Published: 2025-07-21 12:30 – Updated: 2025-07-21 12:30Unencrypted storage in the database in Two App Studio Journey v5.5.9 for iOS allows local attackers to extract sensitive data via direct access to the app’s filesystem.
{
"affected": [],
"aliases": [
"CVE-2025-41458"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-21T11:15:23Z",
"severity": "MODERATE"
},
"details": "Unencrypted storage in the database in Two App Studio Journey v5.5.9 for iOS allows local attackers to extract sensitive data via direct access to the app\u2019s filesystem.",
"id": "GHSA-vx6m-h78h-xxcf",
"modified": "2025-07-21T12:30:34Z",
"published": "2025-07-21T12:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41458"
},
{
"type": "WEB",
"url": "https://www.cirosec.de/sa/sa-2025-005"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VXJM-JCH6-9QR5
Vulnerability from github – Published: 2022-05-24 19:06 – Updated: 2022-05-24 19:06OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted on the user's local disk. The master password protection was inactive for those keys. Version 78.10.2 will restore the protection mechanism for newly imported keys, and will automatically protect keys that had been imported using affected Thunderbird versions. This vulnerability affects Thunderbird < 78.10.2.
{
"affected": [],
"aliases": [
"CVE-2021-29956"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-24T14:15:00Z",
"severity": "MODERATE"
},
"details": "OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted on the user\u0027s local disk. The master password protection was inactive for those keys. Version 78.10.2 will restore the protection mechanism for newly imported keys, and will automatically protect keys that had been imported using affected Thunderbird versions. This vulnerability affects Thunderbird \u003c 78.10.2.",
"id": "GHSA-vxjm-jch6-9qr5",
"modified": "2022-05-24T19:06:08Z",
"published": "2022-05-24T19:06:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29956"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1710290"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2021-22"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest. [REF-1297] [REF-1299] [REF-1301]
Mitigation
In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.
CAPEC-37: Retrieve Embedded Sensitive Data
An attacker examines a target system to find sensitive data that has been embedded within it. This information can reveal confidential contents, such as account numbers or individual keys/credentials that can be used as an intermediate step in a larger attack.