Common Weakness Enumeration
CWE-312
AllowedCleartext Storage of Sensitive Information
Abstraction: Base · Status: Draft
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
1155 vulnerabilities reference this CWE, most recent first.
GHSA-JJV4-QPPH-8548
Vulnerability from github – Published: 2022-05-24 19:20 – Updated: 2022-05-24 19:20
VLAI
Details
An issue was discovered in OpenGamePanel OGP-Agent-Linux through 2021-08-14. $HOME/OGP/Cfg/Config.pm has the root password in cleartext.
{
"affected": [],
"aliases": [
"CVE-2021-37157"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-10T00:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in OpenGamePanel OGP-Agent-Linux through 2021-08-14. $HOME/OGP/Cfg/Config.pm has the root password in cleartext.",
"id": "GHSA-jjv4-qpph-8548",
"modified": "2022-05-24T19:20:26Z",
"published": "2022-05-24T19:20:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37157"
},
{
"type": "WEB",
"url": "https://github.com/OpenGamePanel/OGP-Agent-Linux/commits/master"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/50373"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-JJW7-3VJF-FG5J
Vulnerability from github – Published: 2026-04-02 20:58 – Updated: 2026-05-06 02:39
VLAI
Summary
OpenClaw Nostr privateKey config redaction bypass leaks plaintext signing key via config.get
Details
Summary
OpenClaw Nostr privateKey config redaction bypass leaks plaintext signing key via config.get
Current Maintainer Triage
- Status: open
- Normalized severity: medium
- Assessment: v2026.3.28 still models Nostr privateKey as plain string so config views can expose it, and the secret-schema fix is unreleased.
Affected Packages / Versions
- Package:
openclaw(npm) - Latest published npm version:
2026.3.31 - Vulnerable version range:
<=2026.3.28 - Patched versions:
>= 2026.3.31 - First stable tag containing the fix:
v2026.3.31
Fix Commit(s)
57700d716f660591fb6e09727f3ca8041fa48b9d— 2026-03-31T19:55:03+09:00
Release Process Note
- The fix is already present in released version
2026.3.31. - This draft looks ready for final maintainer disposition or publication, not additional code-fix work.
Thanks @ccreater222 for reporting.
Severity
6.5 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2026.3.28"
},
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.3.31"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-41385"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-312"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-02T20:58:08Z",
"nvd_published_at": "2026-04-28T19:37:41Z",
"severity": "MODERATE"
},
"details": "## Summary\nOpenClaw Nostr privateKey config redaction bypass leaks plaintext signing key via config.get\n\n## Current Maintainer Triage\n- Status: open\n- Normalized severity: medium\n- Assessment: v2026.3.28 still models Nostr privateKey as plain string so config views can expose it, and the secret-schema fix is unreleased.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Latest published npm version: `2026.3.31`\n- Vulnerable version range: `\u003c=2026.3.28`\n- Patched versions: `\u003e= 2026.3.31`\n- First stable tag containing the fix: `v2026.3.31`\n\n## Fix Commit(s)\n- `57700d716f660591fb6e09727f3ca8041fa48b9d` \u2014 2026-03-31T19:55:03+09:00\n\n## Release Process Note\n- The fix is already present in released version `2026.3.31`.\n- This draft looks ready for final maintainer disposition or publication, not additional code-fix work.\n\nThanks @ccreater222 for reporting.",
"id": "GHSA-jjw7-3vjf-fg5j",
"modified": "2026-05-06T02:39:00Z",
"published": "2026-04-02T20:58:08Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-jjw7-3vjf-fg5j"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41385"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/57700d716f660591fb6e09727f3ca8041fa48b9d"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/releases/tag/v2026.3.31"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openclaw-nostr-private-key-exposure-via-config-get-redaction-bypass"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenClaw Nostr privateKey config redaction bypass leaks plaintext signing key via config.get"
}
GHSA-JJWH-245W-F2XG
Vulnerability from github – Published: 2022-05-24 17:41 – Updated: 2022-05-24 17:41
VLAI
Details
An issue was discovered in SmartFoxServer 2.17.0. Cleartext password disclosure can occur via /config/server.xml.
{
"affected": [],
"aliases": [
"CVE-2021-26550"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-09T20:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in SmartFoxServer 2.17.0. Cleartext password disclosure can occur via /config/server.xml.",
"id": "GHSA-jjwh-245w-f2xg",
"modified": "2022-05-24T17:41:38Z",
"published": "2022-05-24T17:41:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26550"
},
{
"type": "WEB",
"url": "https://www.smartfoxserver.com"
},
{
"type": "WEB",
"url": "https://www.zeroscience.mk/en/vulnerabilities"
},
{
"type": "WEB",
"url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5627.php"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/161337/SmartFoxServer-2X-2.17.0-Credential-Disclosure.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-JM3X-QP4Q-P8JR
Vulnerability from github – Published: 2024-06-13 18:31 – Updated: 2024-10-03 21:31
VLAI
Details
An unauthorized user is able to gain access to sensitive data, including credentials, by physically retrieving the hard disk of the product as the data is stored in clear text.
Severity
{
"affected": [],
"aliases": [
"CVE-2024-38280"
],
"database_specific": {
"cwe_ids": [
"CWE-312",
"CWE-313"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-13T17:15:51Z",
"severity": "HIGH"
},
"details": "An unauthorized user is able to gain access to sensitive data, including credentials, by physically retrieving the hard disk of the product as the data is stored in clear text.",
"id": "GHSA-jm3x-qp4q-p8jr",
"modified": "2024-10-03T21:31:03Z",
"published": "2024-06-13T18:31:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38280"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-19"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-JM4H-WWJV-4Q5C
Vulnerability from github – Published: 2024-11-13 15:31 – Updated: 2024-11-27 00:31
VLAI
Details
Using remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird < 128.4.3 and Thunderbird < 132.0.1.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-11159"
],
"database_specific": {
"cwe_ids": [
"CWE-203",
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-13T14:15:15Z",
"severity": "MODERATE"
},
"details": "Using remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird \u003c 128.4.3 and Thunderbird \u003c 132.0.1.",
"id": "GHSA-jm4h-wwjv-4q5c",
"modified": "2024-11-27T00:31:41Z",
"published": "2024-11-13T15:31:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11159"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1925929"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00017.html"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2024-61"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2024-62"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JMH9-7H36-CVQP
Vulnerability from github – Published: 2026-09-15 00:31 – Updated: 2026-09-15 00:31
VLAI
Details
A weakness has been identified in PHPGurukul Blood Donor Management System 1.0. Affected by this issue is some unknown functionality of the file application/models/admin/Login_Model.php. This manipulation of the argument password/email/currentpassword/dbcurrentpwd/newpassword causes cleartext storage in a file or on disk. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The exploit has been made available to the public and could be used for attacks.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-90842"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-15T00:17:31Z",
"severity": "LOW"
},
"details": "A weakness has been identified in PHPGurukul Blood Donor Management System 1.0. Affected by this issue is some unknown functionality of the file application/models/admin/Login_Model.php. This manipulation of the argument password/email/currentpassword/dbcurrentpwd/newpassword causes cleartext storage in a file or on disk. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The exploit has been made available to the public and could be used for attacks.",
"id": "GHSA-jmh9-7h36-cvqp",
"modified": "2026-09-15T00:31:15Z",
"published": "2026-09-15T00:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90842"
},
{
"type": "WEB",
"url": "https://github.com/usernamevnq/CVEs/issues/3"
},
{
"type": "WEB",
"url": "https://phpgurukul.com"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-90842"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/925629"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/403394"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/403394/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-JQV9-XXR8-R2P9
Vulnerability from github – Published: 2022-11-08 12:00 – Updated: 2022-11-09 19:02
VLAI
Details
A vulnerability has been identified in QMS Automotive (All versions). User credentials are stored in plaintext in the database. This could allow an attacker to gain access to credentials and impersonate other users.
Severity
9.1 (Critical)
{
"affected": [],
"aliases": [
"CVE-2022-43958"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-08T11:15:00Z",
"severity": "CRITICAL"
},
"details": "A vulnerability has been identified in QMS Automotive (All versions). User credentials are stored in plaintext in the database. This could allow an attacker to gain access to credentials and impersonate other users.",
"id": "GHSA-jqv9-xxr8-r2p9",
"modified": "2022-11-09T19:02:22Z",
"published": "2022-11-08T12:00:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43958"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-587547.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JR25-FRC3-R97P
Vulnerability from github – Published: 2024-07-10 03:30 – Updated: 2024-07-10 03:30
VLAI
Details
IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.22.0 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 281429.
Severity
6.2 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-25023"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-10T01:15:09Z",
"severity": "MODERATE"
},
"details": "IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.22.0 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 281429.",
"id": "GHSA-jr25-frc3-r97p",
"modified": "2024-07-10T03:30:35Z",
"published": "2024-07-10T03:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25023"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/281429"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7159768"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JRJF-WW9V-C67G
Vulnerability from github – Published: 2026-08-30 15:30 – Updated: 2026-08-30 15:30
VLAI
Details
browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption or access restrictions. Attackers with read access to the temporary settings directory can recover provider API keys from predictably-named JSON files.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-82640"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-30T14:17:03Z",
"severity": "MODERATE"
},
"details": "browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption or access restrictions. Attackers with read access to the temporary settings directory can recover provider API keys from predictably-named JSON files.",
"id": "GHSA-jrjf-ww9v-c67g",
"modified": "2026-08-30T15:30:26Z",
"published": "2026-08-30T15:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82640"
},
{
"type": "WEB",
"url": "https://github.com/browser-use/web-ui/issues/736"
},
{
"type": "WEB",
"url": "https://github.com/browser-use/web-ui"
},
{
"type": "WEB",
"url": "https://github.com/browser-use/web-ui/blob/v3.0.0/src/webui/webui_manager.py"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/browser-use-web-ui-2.0.0-through-3.0.0-cleartext-api-key-storage"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-JV9R-MGX5-PQQ6
Vulnerability from github – Published: 2022-05-24 17:21 – Updated: 2022-05-24 17:21
VLAI
Details
Baxter ExactaMix EM 2400 Versions 1.10, 1.11 and ExactaMix EM1200 Versions 1.1, 1.2 systems store device data with sensitive information in an unencrypted database. This could allow an attacker with network access to view or modify sensitive data including PHI.
{
"affected": [],
"aliases": [
"CVE-2020-12032"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-06-29T14:15:00Z",
"severity": "MODERATE"
},
"details": "Baxter ExactaMix EM 2400 Versions 1.10, 1.11 and ExactaMix EM1200 Versions 1.1, 1.2 systems store device data with sensitive information in an unencrypted database. This could allow an attacker with network access to view or modify sensitive data including PHI.",
"id": "GHSA-jv9r-mgx5-pqq6",
"modified": "2022-05-24T17:21:59Z",
"published": "2022-05-24T17:21:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12032"
},
{
"type": "WEB",
"url": "https://www.us-cert.gov/ics/advisories/icsma-20-170-01"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
Implementation
System Configuration
Operation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest. [REF-1297] [REF-1299] [REF-1301]
Mitigation
Implementation
System Configuration
Operation
In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.
CAPEC-37: Retrieve Embedded Sensitive Data
An attacker examines a target system to find sensitive data that has been embedded within it. This information can reveal confidential contents, such as account numbers or individual keys/credentials that can be used as an intermediate step in a larger attack.