CWE-312
AllowedCleartext Storage of Sensitive Information
Abstraction: Base · Status: Draft
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
1116 vulnerabilities reference this CWE, most recent first.
GHSA-5RHW-R4V4-3C33
Vulnerability from github – Published: 2023-08-03 03:30 – Updated: 2024-04-04 06:30Element55 KnowMore appliances version 21 and older was discovered to store passwords in plaintext.
{
"affected": [],
"aliases": [
"CVE-2023-39144"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-03T03:15:10Z",
"severity": "HIGH"
},
"details": "Element55 KnowMore appliances version 21 and older was discovered to store passwords in plaintext.",
"id": "GHSA-5rhw-r4v4-3c33",
"modified": "2024-04-04T06:30:28Z",
"published": "2023-08-03T03:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39144"
},
{
"type": "WEB",
"url": "https://getknowmore.com"
},
{
"type": "WEB",
"url": "https://github.com/cduram/CVE-2023-39144"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5RP3-83J5-W2G4
Vulnerability from github – Published: 2023-12-07 06:30 – Updated: 2025-12-31 03:30A LogoFAIL issue was discovered in BmpDecoderDxe in Insyde InsydeH2O with kernel 5.2 before 05.28.47, 5.3 before 05.37.47, 5.4 before 05.45.47, 5.5 before 05.53.47, and 5.6 before 05.60.47 for certain Lenovo devices. Image parsing of crafted BMP logo files can copy data to a specific address during the DXE phase of UEFI execution. This occurs because of an integer signedness error involving PixelHeight and PixelWidth during RLE4/RLE8 compression.
{
"affected": [],
"aliases": [
"CVE-2023-40238"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-07T04:15:06Z",
"severity": "MODERATE"
},
"details": "A LogoFAIL issue was discovered in BmpDecoderDxe in Insyde InsydeH2O with kernel 5.2 before 05.28.47, 5.3 before 05.37.47, 5.4 before 05.45.47, 5.5 before 05.53.47, and 5.6 before 05.60.47 for certain Lenovo devices. Image parsing of crafted BMP logo files can copy data to a specific address during the DXE phase of UEFI execution. This occurs because of an integer signedness error involving PixelHeight and PixelWidth during RLE4/RLE8 compression.",
"id": "GHSA-5rp3-83j5-w2g4",
"modified": "2025-12-31T03:30:27Z",
"published": "2023-12-07T06:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40238"
},
{
"type": "WEB",
"url": "https://binarly.io/posts/finding_logofail_the_dangers_of_image_parsing_during_system_boot/index.html"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20240105-0002"
},
{
"type": "WEB",
"url": "https://www.insyde.com/security-pledge"
},
{
"type": "WEB",
"url": "https://www.insyde.com/security-pledge/SA-2023053"
},
{
"type": "WEB",
"url": "https://www.kb.cert.org/vuls/id/811862"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5RRC-4HC3-8893
Vulnerability from github – Published: 2022-05-13 01:44 – Updated: 2022-05-13 01:44The Files APP 7.1.1.308 and earlier versions in some Huawei mobile phones has a vulnerability of plaintext storage of users' Safe passwords. An attacker with the root privilege of an Android system could forge the Safe to read users' plaintext Safe passwords, leading to information leak.
{
"affected": [],
"aliases": [
"CVE-2017-2723"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-11-22T19:29:00Z",
"severity": "MODERATE"
},
"details": "The Files APP 7.1.1.308 and earlier versions in some Huawei mobile phones has a vulnerability of plaintext storage of users\u0027 Safe passwords. An attacker with the root privilege of an Android system could forge the Safe to read users\u0027 plaintext Safe passwords, leading to information leak.",
"id": "GHSA-5rrc-4hc3-8893",
"modified": "2022-05-13T01:44:55Z",
"published": "2022-05-13T01:44:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2723"
},
{
"type": "WEB",
"url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170419-01-files-en"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5V4F-V8FW-FJ7J
Vulnerability from github – Published: 2026-02-10 18:30 – Updated: 2026-02-10 18:30Cleartext storage of sensitive information in Azure Compute Gallery allows an authorized attacker to disclose information over a network.
{
"affected": [],
"aliases": [
"CVE-2026-23655"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-10T18:16:36Z",
"severity": "MODERATE"
},
"details": "Cleartext storage of sensitive information in Azure Compute Gallery allows an authorized attacker to disclose information over a network.",
"id": "GHSA-5v4f-v8fw-fj7j",
"modified": "2026-02-10T18:30:43Z",
"published": "2026-02-10T18:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23655"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23655"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5V8F-CHV2-MX64
Vulnerability from github – Published: 2024-09-27 12:31 – Updated: 2026-06-02 09:36Cleartext Storage of Sensitive Information in a Cookie vulnerability in Oceanic Software ValeApp allows Protocol Manipulation, : JSON Hijacking (aka JavaScript Hijacking).This issue affects ValeApp: before v2.0.0.
{
"affected": [],
"aliases": [
"CVE-2024-8644"
],
"database_specific": {
"cwe_ids": [
"CWE-312",
"CWE-315"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-27T12:15:04Z",
"severity": "CRITICAL"
},
"details": "Cleartext Storage of Sensitive Information in a Cookie vulnerability in Oceanic Software ValeApp allows Protocol Manipulation, : JSON Hijacking (aka JavaScript Hijacking).This issue affects ValeApp: before v2.0.0.",
"id": "GHSA-5v8f-chv2-mx64",
"modified": "2026-06-02T09:36:13Z",
"published": "2024-09-27T12:31:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8644"
},
{
"type": "WEB",
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-1562"
},
{
"type": "WEB",
"url": "https://www.usom.gov.tr/bildirim/tr-24-1562"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-5VGJ-HXP2-9GRG
Vulnerability from github – Published: 2026-07-24 15:33 – Updated: 2026-07-24 18:31Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file system access to read secret values via secret variables stored in cleartext on disk when no vault is selected.
{
"affected": [],
"aliases": [
"CVE-2026-16802"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-24T15:17:13Z",
"severity": "MODERATE"
},
"details": "Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file system access to read secret values via secret variables stored in cleartext on disk when no vault is selected.",
"id": "GHSA-5vgj-hxp2-9grg",
"modified": "2026-07-24T18:31:25Z",
"published": "2026-07-24T15:33:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16802"
},
{
"type": "WEB",
"url": "https://devolutions.net/security/advisories/DEVO-2026-0025"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5VH5-CR3G-G663
Vulnerability from github – Published: 2026-09-10 18:31 – Updated: 2026-09-16 18:31There is a storage of sensitive information in cleartext vulnerability in NI SystemLink. This vulnerability may allow an attacker with local access to obtain sensitive information stored by the system in the clear. This vulnerability affects NI SystemLink and NI SystemLink Server 2026 Q3 and prior versions.
{
"affected": [],
"aliases": [
"CVE-2026-4130"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-10T16:17:14Z",
"severity": "HIGH"
},
"details": "There is a storage of sensitive information in cleartext vulnerability in NI SystemLink. This vulnerability may allow an attacker with local access to obtain sensitive information stored by the system in the clear.\u00a0 This vulnerability affects NI SystemLink and NI SystemLink Server 2026 Q3 and prior versions.",
"id": "GHSA-5vh5-cr3g-g663",
"modified": "2026-09-16T18:31:24Z",
"published": "2026-09-10T18:31:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4130"
},
{
"type": "WEB",
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/storage-of-sensitive-information-in-cleartext-in-ni-systemlink.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-5VQP-64MP-PG5R
Vulnerability from github – Published: 2022-05-24 19:19 – Updated: 2022-05-24 19:19A unprotected storage of credentials in Fortinet FortiSIEM Windows Agent version 4.1.4 and below allows an authenticated user to disclosure agent password due to plaintext credential storage in log files
{
"affected": [],
"aliases": [
"CVE-2021-41023"
],
"database_specific": {
"cwe_ids": [
"CWE-312",
"CWE-522"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-02T19:15:00Z",
"severity": "MODERATE"
},
"details": "A unprotected storage of credentials in Fortinet FortiSIEM Windows Agent version 4.1.4 and below allows an authenticated user to disclosure agent password due to plaintext credential storage in log files",
"id": "GHSA-5vqp-64mp-pg5r",
"modified": "2022-05-24T19:19:24Z",
"published": "2022-05-24T19:19:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41023"
},
{
"type": "WEB",
"url": "https://fortiguard.com/advisory/FG-IR-21-175"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5WQ8-R82H-2QQC
Vulnerability from github – Published: 2022-05-24 17:41 – Updated: 2022-05-24 17:41There is an information leak vulnerability in eCNS280_TD versions V100R005C00 and V100R005C10. A command does not have timeout exit mechanism. Temporary file contains sensitive information. This allows attackers to obtain information by inter-process access that requires other methods.
{
"affected": [],
"aliases": [
"CVE-2021-22300"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-06T01:15:00Z",
"severity": "MODERATE"
},
"details": "There is an information leak vulnerability in eCNS280_TD versions V100R005C00 and V100R005C10. A command does not have timeout exit mechanism. Temporary file contains sensitive information. This allows attackers to obtain information by inter-process access that requires other methods.",
"id": "GHSA-5wq8-r82h-2qqc",
"modified": "2022-05-24T17:41:14Z",
"published": "2022-05-24T17:41:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22300"
},
{
"type": "WEB",
"url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210127-01-cgp-en"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-5XHG-WQM3-8WW2
Vulnerability from github – Published: 2023-09-01 12:30 – Updated: 2024-04-04 07:21An information disclosure issue in GitLab EE affecting all versions from 16.2 prior to 16.2.5, and 16.3 prior to 16.3.1 allowed other Group Owners to see the Public Key for a Google Cloud Logging audit event streaming destination, if configured. Owners can now only write the key, not read it.
{
"affected": [],
"aliases": [
"CVE-2023-3950"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-01T11:15:42Z",
"severity": "LOW"
},
"details": "An information disclosure issue in GitLab EE affecting all versions from 16.2 prior to 16.2.5, and 16.3 prior to 16.3.1 allowed other Group Owners to see the Public Key for a Google Cloud Logging audit event streaming destination, if configured. Owners can now only write the key, not read it.",
"id": "GHSA-5xhg-wqm3-8ww2",
"modified": "2024-04-04T07:21:22Z",
"published": "2023-09-01T12:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3950"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/2079154"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/419675"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest. [REF-1297] [REF-1299] [REF-1301]
Mitigation
In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.
CAPEC-37: Retrieve Embedded Sensitive Data
An attacker examines a target system to find sensitive data that has been embedded within it. This information can reveal confidential contents, such as account numbers or individual keys/credentials that can be used as an intermediate step in a larger attack.