CWE-312
AllowedCleartext Storage of Sensitive Information
Abstraction: Base · Status: Draft
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
1085 vulnerabilities reference this CWE, most recent first.
GHSA-WQX4-CGQQ-CPGW
Vulnerability from github – Published: 2025-07-03 12:34 – Updated: 2025-07-03 12:34The hard drives of the device are not encrypted using a full volume encryption feature such as BitLocker. This allows an attacker with physical access to the device to use an alternative operating system to interact with the hard drives, completely circumventing the Windows login. The attacker can read from and write to all files on the hard drives.
{
"affected": [],
"aliases": [
"CVE-2025-27460"
],
"database_specific": {
"cwe_ids": [
"CWE-312",
"CWE-326"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-03T12:15:24Z",
"severity": "HIGH"
},
"details": "The hard drives of the device are not encrypted using a full volume encryption feature such as BitLocker. This allows an attacker with physical access to the device to use an alternative operating system to interact with the hard drives, completely circumventing the Windows login. The attacker can read from and write to all files on the hard drives.",
"id": "GHSA-wqx4-cgqq-cpgw",
"modified": "2025-07-03T12:34:58Z",
"published": "2025-07-03T12:34:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27460"
},
{
"type": "WEB",
"url": "https://sick.com/psirt"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
},
{
"type": "WEB",
"url": "https://www.endress.com"
},
{
"type": "WEB",
"url": "https://www.first.org/cvss/calculator/3.1"
},
{
"type": "WEB",
"url": "https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.json"
},
{
"type": "WEB",
"url": "https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WR27-P9Q7-3CVX
Vulnerability from github – Published: 2022-05-24 19:08 – Updated: 2022-05-24 19:08The MagicMotion Flamingo 2 application for Android stores data on an sdcard under com.vt.magicmotion/files/Pictures, whence it can be read by other applications.
{
"affected": [],
"aliases": [
"CVE-2020-12731"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-15T15:15:00Z",
"severity": "HIGH"
},
"details": "The MagicMotion Flamingo 2 application for Android stores data on an sdcard under com.vt.magicmotion/files/Pictures, whence it can be read by other applications.",
"id": "GHSA-wr27-p9q7-3cvx",
"modified": "2022-05-24T19:08:12Z",
"published": "2022-05-24T19:08:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12731"
},
{
"type": "WEB",
"url": "http://www.magicsmotion.com/p-flamingo.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-WRH5-96RF-7QQ2
Vulnerability from github – Published: 2021-12-08 00:00 – Updated: 2024-11-12 00:30An issue was discovered in Solar-Log 500 before 2.8.2 Build 52 23.04.2013. In /export.html, email.html, and sms.html, cleartext passwords are stored. This may allow sensitive information to be read by someone with access to the device.
{
"affected": [],
"aliases": [
"CVE-2021-34544"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-07T21:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in Solar-Log 500 before 2.8.2 Build 52 23.04.2013. In /export.html, email.html, and sms.html, cleartext passwords are stored. This may allow sensitive information to be read by someone with access to the device.",
"id": "GHSA-wrh5-96rf-7qq2",
"modified": "2024-11-12T00:30:35Z",
"published": "2021-12-08T00:00:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34544"
},
{
"type": "WEB",
"url": "https://drive.google.com/file/d/1N8Ch1UGNcoocUaPhOe_1mAECOe5kr4pt/view?usp=sharing"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/49987"
},
{
"type": "WEB",
"url": "https://www.solar-log.com/en/support/firmware"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WW9W-54W3-CRWX
Vulnerability from github – Published: 2022-05-24 17:42 – Updated: 2023-05-12 00:30IBM Security Verify Information Queue 1.0.6 and 1.0.7 discloses sensitive information in source code that could be used in further attacks against the system. IBM X-Force ID: 198185.
{
"affected": [],
"aliases": [
"CVE-2021-20407"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-12T17:15:00Z",
"severity": "HIGH"
},
"details": "IBM Security Verify Information Queue 1.0.6 and 1.0.7 discloses sensitive information in source code that could be used in further attacks against the system. IBM X-Force ID: 198185.",
"id": "GHSA-ww9w-54w3-crwx",
"modified": "2023-05-12T00:30:16Z",
"published": "2022-05-24T17:42:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20407"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/196185"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6414765"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WWPQ-7CFC-WWWM
Vulnerability from github – Published: 2022-05-13 01:36 – Updated: 2022-05-13 01:36In version 1.9.7 and prior of Insteon's Insteon for Hub Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and secure manner.
{
"affected": [],
"aliases": [
"CVE-2017-5250"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-02-22T16:29:00Z",
"severity": "CRITICAL"
},
"details": "In version 1.9.7 and prior of Insteon\u0027s Insteon for Hub Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and secure manner.",
"id": "GHSA-wwpq-7cfc-wwwm",
"modified": "2022-05-13T01:36:38Z",
"published": "2022-05-13T01:36:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5250"
},
{
"type": "WEB",
"url": "https://blog.rapid7.com/2017/09/22/multiple-vulnerabilities-in-wink-and-insteon-smart-home-systems"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WXXX-J927-5GRX
Vulnerability from github – Published: 2026-03-09 18:31 – Updated: 2026-03-11 18:30An issue pertaining to CWE-312: Cleartext Storage of Sensitive Information was discovered in lesspass lesspass v9.6.9 which allows attackers to obtain sensitive information.
{
"affected": [],
"aliases": [
"CVE-2025-70050"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-09T16:16:15Z",
"severity": "MODERATE"
},
"details": "An issue pertaining to CWE-312: Cleartext Storage of Sensitive Information was discovered in lesspass lesspass v9.6.9 which allows attackers to obtain sensitive information.",
"id": "GHSA-wxxx-j927-5grx",
"modified": "2026-03-11T18:30:27Z",
"published": "2026-03-09T18:31:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-70050"
},
{
"type": "WEB",
"url": "https://gist.github.com/zcxlighthouse/12809648370f0e08d71434ff419df28e"
},
{
"type": "WEB",
"url": "https://github.com/lesspass"
},
{
"type": "WEB",
"url": "https://github.com/lesspass/lesspass"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-X27P-5F68-M644
Vulnerability from github – Published: 2026-03-29 15:13 – Updated: 2026-03-31 18:51Summary
Iceberg connector REST catalog static credentials (access key) or vended credentials (temporary access key) are accessible to users that have write privilege on SQL level.
Details
Iceberg REST catalog typically needs access to object storage. This access can be configured in multiple different ways. When storage access is achieved by static credentials (e.g. AWS S3 access key) or vended credentials (temporary access key).
Query JSON is a query visualization and performance troubleshooting facility. It includes serialized query plan and handles for table writes or execution of table procedures. A user that submitted a query has access to query JSON for their query. Query JSON is available from Trino UI or via /ui/api/query/«query_id» and /v1/query/«query_id» endpoints.
The storage credentials are stored in those handles when performing write operations, or table maintenance operations. They are serialized in query JSON. A user with write access to data in Iceberg connector configured to use REST Catalog with static or vended credentials can retrieve those credentials.
Impact
Anyone using Iceberg REST catalog with static or vended credentials is impacted. The credentials should be considered compromised. Vended credentials are temporary in nature so they do not need to be rotated. However, underlying data could have been exposed.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.trino:trino-iceberg"
},
"ranges": [
{
"events": [
{
"introduced": "439"
},
{
"fixed": "480"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-34214"
],
"database_specific": {
"cwe_ids": [
"CWE-212",
"CWE-312"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-29T15:13:30Z",
"nvd_published_at": "2026-03-31T15:16:18Z",
"severity": "HIGH"
},
"details": "### Summary\n\nIceberg connector REST catalog static credentials (access key) or vended credentials (temporary access key) are accessible to users that have write privilege on SQL level.\n\n### Details\n\nIceberg REST catalog typically needs access to object storage. This access can be configured in multiple different ways. When storage access is achieved by static credentials (e.g. AWS S3 access key) or vended credentials (temporary access key).\n\nQuery JSON is a query visualization and performance troubleshooting facility. It includes serialized query plan and handles for table writes or execution of table procedures. A user that submitted a query has access to query JSON for their query. Query JSON is available from Trino UI or via `/ui/api/query/\u00abquery_id\u00bb` and `/v1/query/\u00abquery_id\u00bb` endpoints.\n\nThe storage credentials are stored in those handles when performing write operations, or table maintenance operations. They are serialized in query JSON. A user with write access to data in Iceberg connector configured to use REST Catalog with static or vended credentials can retrieve those credentials.\n\n### Impact\n\nAnyone using Iceberg REST catalog with static or vended credentials is impacted.\nThe credentials should be considered compromised. \nVended credentials are temporary in nature so they do not need to be rotated. However, underlying data could have been exposed.",
"id": "GHSA-x27p-5f68-m644",
"modified": "2026-03-31T18:51:27Z",
"published": "2026-03-29T15:13:30Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/trinodb/trino/security/advisories/GHSA-x27p-5f68-m644"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34214"
},
{
"type": "PACKAGE",
"url": "https://github.com/trinodb/trino"
},
{
"type": "WEB",
"url": "https://github.com/trinodb/trino/releases/tag/480"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Trino: Iceberg REST catalog static and vended credentials are accessible via query JSON"
}
GHSA-X29X-MQ6W-9Q67
Vulnerability from github – Published: 2022-05-24 17:17 – Updated: 2023-02-02 21:33A flaw was found in OpenShift Container Platform where OAuth tokens are not encrypted when the encryption of data at rest is enabled. This flaw allows an attacker with access to a backup to obtain OAuth tokens and then use them to log into the cluster as any user who logged into the cluster via the WebUI or via the command line in the last 24 hours. Once the backup is older than 24 hours the OAuth tokens are no longer valid.
{
"affected": [],
"aliases": [
"CVE-2020-10706"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-05-12T14:15:00Z",
"severity": "MODERATE"
},
"details": "A flaw was found in OpenShift Container Platform where OAuth tokens are not encrypted when the encryption of data at rest is enabled. This flaw allows an attacker with access to a backup to obtain OAuth tokens and then use them to log into the cluster as any user who logged into the cluster via the WebUI or via the command line in the last 24 hours. Once the backup is older than 24 hours the OAuth tokens are no longer valid.",
"id": "GHSA-x29x-mq6w-9q67",
"modified": "2023-02-02T21:33:42Z",
"published": "2022-05-24T17:17:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10706"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHBA-2020:4196"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2020-10706"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1819011"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10706"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-X2H8-3VCP-JMGR
Vulnerability from github – Published: 2022-05-24 19:18 – Updated: 2022-05-24 19:18IBM Jazz Team Server products stores user credentials in clear text which can be read by an authenticated user. IBM X-Force ID: 203172.
{
"affected": [],
"aliases": [
"CVE-2021-29786"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-10-27T16:15:00Z",
"severity": "MODERATE"
},
"details": "IBM Jazz Team Server products stores user credentials in clear text which can be read by an authenticated user. IBM X-Force ID: 203172.",
"id": "GHSA-x2h8-3vcp-jmgr",
"modified": "2022-05-24T19:18:56Z",
"published": "2022-05-24T19:18:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29786"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/203172"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6508583"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-X328-GFW7-CR8V
Vulnerability from github – Published: 2023-09-27 15:30 – Updated: 2023-09-27 15:30Sensitive information disclosure due to cleartext storage of sensitive information in memory. The following products are affected: Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 35979.
{
"affected": [],
"aliases": [
"CVE-2023-44153"
],
"database_specific": {
"cwe_ids": [
"CWE-312",
"CWE-316"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-27T15:19:37Z",
"severity": "LOW"
},
"details": "Sensitive information disclosure due to cleartext storage of sensitive information in memory. The following products are affected: Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 35979.",
"id": "GHSA-x328-gfw7-cr8v",
"modified": "2023-09-27T15:30:39Z",
"published": "2023-09-27T15:30:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44153"
},
{
"type": "WEB",
"url": "https://security-advisory.acronis.com/advisories/SEC-1994"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest. [REF-1297] [REF-1299] [REF-1301]
Mitigation
In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.
CAPEC-37: Retrieve Embedded Sensitive Data
An attacker examines a target system to find sensitive data that has been embedded within it. This information can reveal confidential contents, such as account numbers or individual keys/credentials that can be used as an intermediate step in a larger attack.