Common Weakness Enumeration
CWE-312
AllowedCleartext Storage of Sensitive Information
Abstraction: Base · Status: Draft
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
1096 vulnerabilities reference this CWE, most recent first.
GHSA-3CMF-2R4C-R97P
Vulnerability from github – Published: 2022-05-13 01:49 – Updated: 2022-05-13 01:49
VLAI
Details
An issue was discovered in the MakeMyTrip application 7.2.4 for Android. The databases (locally stored) are not encrypted and have cleartext that might lead to sensitive information disclosure, as demonstrated by data/com.makemytrip/databases and data/com.makemytrip/Cache SQLite database files.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2018-11242"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-05-20T14:29:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in the MakeMyTrip application 7.2.4 for Android. The databases (locally stored) are not encrypted and have cleartext that might lead to sensitive information disclosure, as demonstrated by data/com.makemytrip/databases and data/com.makemytrip/Cache SQLite database files.",
"id": "GHSA-3cmf-2r4c-r97p",
"modified": "2022-05-13T01:49:11Z",
"published": "2022-05-13T01:49:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11242"
},
{
"type": "WEB",
"url": "https://gist.github.com/NinjaXshell/ba0aeee4b77b4bdea76d0c0c095d53b1"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/44690"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3FPX-G9H3-HH8X
Vulnerability from github – Published: 2022-05-24 22:00 – Updated: 2024-01-30 21:17
VLAI
Summary
Jenkins NeuVector Vulnerability Scanner Plugin stored credentials in plain text
Details
Jenkins NeuVector Vulnerability Scanner Plugin 1.5 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
Severity
5.5 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.5"
},
"package": {
"ecosystem": "Maven",
"name": "io.jenkins.plugins:neuvector-vulnerability-scanner"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-10430"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T21:17:55Z",
"nvd_published_at": "2019-09-25T16:15:00Z",
"severity": "MODERATE"
},
"details": "Jenkins NeuVector Vulnerability Scanner Plugin 1.5 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.",
"id": "GHSA-3fpx-g9h3-hh8x",
"modified": "2024-01-30T21:17:55Z",
"published": "2022-05-24T22:00:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10430"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1504"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2019/09/25/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Jenkins NeuVector Vulnerability Scanner Plugin stored credentials in plain text "
}
GHSA-3FRC-879C-J9H5
Vulnerability from github – Published: 2022-05-24 16:50 – Updated: 2023-10-26 22:45
VLAI
Summary
Jenkins Caliper CI Plugin stores credentials in plain text
Details
Jenkins Caliper CI Plugin stores credentials unencrypted in job config.xml files on the Jenkins controller. These credentials can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
As of publication of this advisory, there is no fix.
Severity
4.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.brianfromoregon:caliper-ci"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-10351"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": true,
"github_reviewed_at": "2023-10-26T22:45:32Z",
"nvd_published_at": "2019-07-11T14:15:00Z",
"severity": "MODERATE"
},
"details": "Jenkins Caliper CI Plugin stores credentials unencrypted in job `config.xml` files on the Jenkins controller. These credentials can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.\n\nAs of publication of this advisory, there is no fix.",
"id": "GHSA-3frc-879c-j9h5",
"modified": "2023-10-26T22:45:32Z",
"published": "2022-05-24T16:50:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10351"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1437"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2019/07/11/4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Jenkins Caliper CI Plugin stores credentials in plain text"
}
GHSA-3G7H-7745-2CMG
Vulnerability from github – Published: 2022-05-02 03:13 – Updated: 2025-04-09 04:09
VLAI
Details
iChat in Apple Mac OS X 10.5 before 10.5.7 disables SSL for AOL Instant Messenger (AIM) communication in certain circumstances that are inconsistent with the Require SSL setting, which allows remote attackers to obtain sensitive information by sniffing the network.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2009-0152"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-05-13T15:30:00Z",
"severity": "MODERATE"
},
"details": "iChat in Apple Mac OS X 10.5 before 10.5.7 disables SSL for AOL Instant Messenger (AIM) communication in certain circumstances that are inconsistent with the Require SSL setting, which allows remote attackers to obtain sensitive information by sniffing the network.",
"id": "GHSA-3g7h-7745-2cmg",
"modified": "2025-04-09T04:09:46Z",
"published": "2022-05-02T03:13:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-0152"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50487"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2009/May/msg00002.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35074"
},
{
"type": "WEB",
"url": "http://support.apple.com/kb/HT3549"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/34926"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1022212"
},
{
"type": "WEB",
"url": "http://www.us-cert.gov/cas/techalerts/TA09-133A.html"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2009/1297"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3G7R-R3CR-Q6F8
Vulnerability from github – Published: 2024-06-07 15:30 – Updated: 2024-08-14 21:33
VLAI
Details
Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 was discovered to store credentials in plaintext.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2024-36790"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-07T15:15:50Z",
"severity": "HIGH"
},
"details": "Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 was discovered to store credentials in plaintext.",
"id": "GHSA-3g7r-r3cr-q6f8",
"modified": "2024-08-14T21:33:11Z",
"published": "2024-06-07T15:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36790"
},
{
"type": "WEB",
"url": "https://redfoxsec.com/blog/security-advisory-multiple-vulnerabilities-in-netgear-wnr614-router"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3GPM-78PQ-33VJ
Vulnerability from github – Published: 2025-12-10 21:31 – Updated: 2025-12-17 18:31
VLAI
Details
MailEnable versions prior to 10.54 contain a cleartext storage of credentials vulnerability that can lead to local credential compromise and account takeover. The product stores user and administrative passwords in plaintext within AUTH.TAB with overly permissive filesystem access. A local authenticated user with read access to this file can recover all user passwords and super-admin credentials, then use them to authenticate to MailEnable services such as POP3, SMTP, or the webmail interface, enabling unauthorized mailbox access and administrative control.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-34427"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-10T19:16:13Z",
"severity": "MODERATE"
},
"details": "MailEnable versions prior to 10.54 contain a cleartext storage of credentials vulnerability that can lead to local credential compromise and account takeover. The product stores user and administrative passwords in plaintext within AUTH.TAB with overly permissive filesystem access. A local authenticated user with read access to this file can recover all user passwords and super-admin credentials, then use them to authenticate to MailEnable services such as POP3, SMTP, or the webmail interface, enabling unauthorized mailbox access and administrative control.",
"id": "GHSA-3gpm-78pq-33vj",
"modified": "2025-12-17T18:31:32Z",
"published": "2025-12-10T21:31:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-34427"
},
{
"type": "WEB",
"url": "https://mailenable.com/Standard-ReleaseNotes.txt"
},
{
"type": "WEB",
"url": "https://www.mailenable.com"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/mailenable-cleartext-credential-storage-in-auth-tab"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-3H9P-FMW3-6WPV
Vulnerability from github – Published: 2023-12-01 00:31 – Updated: 2024-09-20 18:32
VLAI
Details
LOYTEC electronics GmbH LINX-212 firmware 6.2.4 and LINX-151 firmware 7.2.4 are vulnerable to Insecure Permissions via registry.xml file. This vulnerability allows remote attackers to disclose smtp client account credentials and bypass email authentication.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2023-46386"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-30T23:15:07Z",
"severity": "HIGH"
},
"details": "LOYTEC electronics GmbH LINX-212 firmware 6.2.4 and LINX-151 firmware 7.2.4 are vulnerable to Insecure Permissions via registry.xml file. This vulnerability allows remote attackers to disclose smtp client account credentials and bypass email authentication.",
"id": "GHSA-3h9p-fmw3-6wpv",
"modified": "2024-09-20T18:32:23Z",
"published": "2023-12-01T00:31:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46386"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-247-01"
},
{
"type": "WEB",
"url": "https://www.txone.com/blog/ten-unpatched-vulnerabilities-in-building-automation-products-identified-by-txone-networks"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/175952/Loytec-L-INX-Automation-Servers-Information-Disclosure-Cleartext-Secrets.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2023/Nov/7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3HRW-324R-F9XJ
Vulnerability from github – Published: 2022-05-24 17:42 – Updated: 2022-05-24 17:42
VLAI
Details
Telegram before 7.4 (212543) Stable on macOS stores the local passcode in cleartext, leading to information disclosure.
{
"affected": [],
"aliases": [
"CVE-2021-27204"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-12T08:15:00Z",
"severity": "MODERATE"
},
"details": "Telegram before 7.4 (212543) Stable on macOS stores the local passcode in cleartext, leading to information disclosure.",
"id": "GHSA-3hrw-324r-f9xj",
"modified": "2022-05-24T17:42:07Z",
"published": "2022-05-24T17:42:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27204"
},
{
"type": "WEB",
"url": "https://www.inputzero.io/2020/12/telegram-privacy-fails-again.html"
},
{
"type": "WEB",
"url": "https://www.youtube.com/watch?v=zEt-_5b4OaA"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-3HXW-4626-CM6F
Vulnerability from github – Published: 2025-08-13 12:31 – Updated: 2025-08-13 12:31
VLAI
Details
This vulnerability exists in ZKTeco WL20 due to storage of admin and user credentials without encryption in the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and reverse engineer the binary data to access the unencrypted credentials stored in the firmware of targeted device.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-54464"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-13T12:15:25Z",
"severity": "HIGH"
},
"details": "This vulnerability exists in ZKTeco WL20 due to storage of admin and user credentials without encryption in the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and reverse engineer the binary data to access the unencrypted credentials stored in the firmware of targeted device.",
"id": "GHSA-3hxw-4626-cm6f",
"modified": "2025-08-13T12:31:30Z",
"published": "2025-08-13T12:31:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54464"
},
{
"type": "WEB",
"url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01\u0026VLCODE=CIVN-2025-0172"
},
{
"type": "WEB",
"url": "https://www.zkteco.com/en/Security_Bulletinsibs/20"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-3JQ7-8PH8-63XM
Vulnerability from github – Published: 2022-05-24 17:16 – Updated: 2024-11-18 16:26
VLAI
Summary
Grafana information disclosure
Details
An information-disclosure flaw was found in Grafana. The database directory /var/lib/grafana and database file /var/lib/grafana/grafana.db are world readable. This can result in exposure of sensitive information (e.g., cleartext or encrypted datasource passwords).
Severity
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/grafana/grafana"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.2.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-12458"
],
"database_specific": {
"cwe_ids": [
"CWE-312",
"CWE-732"
],
"github_reviewed": true,
"github_reviewed_at": "2024-02-01T21:46:49Z",
"nvd_published_at": "2020-04-29T16:15:00Z",
"severity": "HIGH"
},
"details": "An information-disclosure flaw was found in Grafana. The database directory `/var/lib/grafana` and database file `/var/lib/grafana/grafana.db` are world readable. This can result in exposure of sensitive information (e.g., cleartext or encrypted datasource passwords).",
"id": "GHSA-3jq7-8ph8-63xm",
"modified": "2024-11-18T16:26:25Z",
"published": "2022-05-24T17:16:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12458"
},
{
"type": "WEB",
"url": "https://github.com/grafana/grafana/issues/8283"
},
{
"type": "WEB",
"url": "https://github.com/grafana/grafana/commit/102448040d5132460e3b0013e03ebedec0677e00"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2020-12458"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1827765"
},
{
"type": "PACKAGE",
"url": "https://github.com/grafana/grafana"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CTQCKJZZYXMCSHJFZZ3YXEO5NUBANGZS"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WEBCIEVSYIDDCA7FTRS2IFUOYLIQU34A"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20200518-0001"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Grafana information disclosure"
}
Mitigation
Implementation
System Configuration
Operation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest. [REF-1297] [REF-1299] [REF-1301]
Mitigation
Implementation
System Configuration
Operation
In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.
CAPEC-37: Retrieve Embedded Sensitive Data
An attacker examines a target system to find sensitive data that has been embedded within it. This information can reveal confidential contents, such as account numbers or individual keys/credentials that can be used as an intermediate step in a larger attack.