Common Weakness Enumeration
CWE-312
AllowedCleartext Storage of Sensitive Information
Abstraction: Base · Status: Draft
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
1116 vulnerabilities reference this CWE, most recent first.
GHSA-HHHH-69QP-5P2V
Vulnerability from github – Published: 2022-05-24 16:58 – Updated: 2023-10-27 15:45
VLAI
Summary
Jenkins Fortify on Demand Plugin stores credentials in plain text
Details
Jenkins Fortify on Demand Plugin stores credentials unencrypted in job config.xml files on the Jenkins controller. These credentials can be viewed by users with Extended Read permission or access to the Jenkins controller file system.
Severity
4.3 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.0.1"
},
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:fortify-on-demand-uploader"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-10449"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": true,
"github_reviewed_at": "2023-10-27T15:45:23Z",
"nvd_published_at": "2019-10-16T14:15:00Z",
"severity": "MODERATE"
},
"details": "Jenkins Fortify on Demand Plugin stores credentials unencrypted in job `config.xml` files on the Jenkins controller. These credentials can be viewed by users with Extended Read permission or access to the Jenkins controller file system.",
"id": "GHSA-hhhh-69qp-5p2v",
"modified": "2023-10-27T15:45:23Z",
"published": "2022-05-24T16:58:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10449"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/fortify-on-demand-uploader-plugin/commit/277642040362bcc64df163bfc1ab48f7763c2853"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/fortify-on-demand-uploader-plugin/commit/83b23662dc0ce9486b904e282bd8047496730819"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/fortify-on-demand-uploader-plugin"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1433"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Jenkins Fortify on Demand Plugin stores credentials in plain text"
}
GHSA-HM3F-FWMW-7G2J
Vulnerability from github – Published: 2023-01-20 18:30 – Updated: 2023-01-26 21:30
VLAI
Details
In DPA 2022.4 and older releases, generated heap memory dumps contain sensitive information in cleartext.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2022-38112"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-01-20T18:15:00Z",
"severity": "HIGH"
},
"details": "In DPA 2022.4 and older releases, generated heap memory dumps contain sensitive information in cleartext.",
"id": "GHSA-hm3f-fwmw-7g2j",
"modified": "2023-01-26T21:30:31Z",
"published": "2023-01-20T18:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38112"
},
{
"type": "WEB",
"url": "https://documentation.solarwinds.com/en/success_center/dpa/content/release_notes/dpa_2023-1_release_notes.htm"
},
{
"type": "WEB",
"url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-38112"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HMCH-9947-82RJ
Vulnerability from github – Published: 2022-05-24 17:00 – Updated: 2023-09-26 18:55
VLAI
Summary
Magento 2 Community Edition Weak Cryptography
Details
Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 uses weak cryptographic function to store the failed login attempts for customer accounts.
Severity
5.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "magento/community-edition"
},
"ranges": [
{
"events": [
{
"introduced": "2.1.0"
},
{
"fixed": "2.1.19"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "magento/community-edition"
},
"ranges": [
{
"events": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.2.10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "magento/community-edition"
},
"ranges": [
{
"events": [
{
"introduced": "2.3.0"
},
{
"fixed": "2.3.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-8118"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": true,
"github_reviewed_at": "2023-07-18T17:45:01Z",
"nvd_published_at": "2019-11-05T23:15:00Z",
"severity": "MODERATE"
},
"details": "Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 uses weak cryptographic function to store the failed login attempts for customer accounts.",
"id": "GHSA-hmch-9947-82rj",
"modified": "2023-09-26T18:55:15Z",
"published": "2022-05-24T17:00:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8118"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-8118.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/magento/magento2"
},
{
"type": "WEB",
"url": "https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20220121051105/https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Magento 2 Community Edition Weak Cryptography"
}
GHSA-HMG4-2338-PM28
Vulnerability from github – Published: 2022-07-19 00:00 – Updated: 2022-07-24 00:00
VLAI
Details
Browsing the path: http://ip/wifi_ap_pata_get.cmd, will show in the name of the existing access point on the component, and a password in clear text.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2022-30626"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-07-18T13:15:00Z",
"severity": "HIGH"
},
"details": "Browsing the path: http://ip/wifi_ap_pata_get.cmd, will show in the name of the existing access point on the component, and a password in clear text.",
"id": "GHSA-hmg4-2338-pm28",
"modified": "2022-07-24T00:00:36Z",
"published": "2022-07-19T00:00:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30626"
},
{
"type": "WEB",
"url": "https://www.gov.il/en/Departments/faq/cve_advisories"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HP3R-5R53-CGP6
Vulnerability from github – Published: 2022-05-24 17:46 – Updated: 2024-07-30 03:30
VLAI
Details
An issue was discovered in WiZ Colors A60 1.14.0. API credentials are locally logged.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2020-11923"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-02T19:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in WiZ Colors A60 1.14.0. API credentials are locally logged.",
"id": "GHSA-hp3r-5r53-cgp6",
"modified": "2024-07-30T03:30:50Z",
"published": "2022-05-24T17:46:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11923"
},
{
"type": "WEB",
"url": "https://www.eurofins-cybersecurity.com/news/connected-devices-wiz-smart-lightbulbs"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Jul/14"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HPV3-F5P7-PXJ9
Vulnerability from github – Published: 2023-10-25 18:32 – Updated: 2023-11-02 21:21
VLAI
Summary
Jenkins lambdatest-automation Plugin may expose Credentials access token
Details
Jenkins lambdatest-automation Plugin 1.20.10 and earlier logs LAMBDATEST Credentials access token at the INFO level.
This can result in accidental exposure of the token through the default system log.
lambdatest-automation Plugin 1.21.0 no longer logs LAMBDATEST Credentials access token.
Severity
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:lambdatest-automation"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.21.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-46653"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": true,
"github_reviewed_at": "2023-11-02T21:21:35Z",
"nvd_published_at": "2023-10-25T18:17:40Z",
"severity": "LOW"
},
"details": "Jenkins lambdatest-automation Plugin 1.20.10 and earlier logs LAMBDATEST Credentials access token at the INFO level.\n\nThis can result in accidental exposure of the token through the default system log.\n\nlambdatest-automation Plugin 1.21.0 no longer logs LAMBDATEST Credentials access token.",
"id": "GHSA-hpv3-f5p7-pxj9",
"modified": "2023-11-02T21:21:35Z",
"published": "2023-10-25T18:32:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46653"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2023-10-25/#SECURITY-3202"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/10/25/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Jenkins lambdatest-automation Plugin may expose Credentials access token"
}
GHSA-HQHX-GH2G-HC88
Vulnerability from github – Published: 2022-05-24 19:11 – Updated: 2022-05-24 19:11
VLAI
Details
UCWeb UC 12.12.3.1219 through 12.12.3.1226 uses cleartext HTTP, and thus man-in-the-middle attackers can discover visited URLs.
{
"affected": [],
"aliases": [
"CVE-2020-36473"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-14T21:15:00Z",
"severity": "MODERATE"
},
"details": "UCWeb UC 12.12.3.1219 through 12.12.3.1226 uses cleartext HTTP, and thus man-in-the-middle attackers can discover visited URLs.",
"id": "GHSA-hqhx-gh2g-hc88",
"modified": "2022-05-24T19:11:10Z",
"published": "2022-05-24T19:11:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36473"
},
{
"type": "WEB",
"url": "https://medium.com/@ciph3r/why-you-should-not-use-uc-browser-54558916d020"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-HQM4-P64V-22XM
Vulnerability from github – Published: 2023-07-20 18:33 – Updated: 2024-04-04 06:17
VLAI
Details
Dell Wyse ThinOS versions prior to 2303 (9.4.1141) contain a sensitive information disclosure vulnerability. An unauthenticated malicious user with local access to the device could exploit this vulnerability to read sensitive information written to the log files.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-32446"
],
"database_specific": {
"cwe_ids": [
"CWE-312",
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-20T13:15:10Z",
"severity": "MODERATE"
},
"details": "\nDell Wyse ThinOS versions prior to 2303 (9.4.1141) contain a sensitive information disclosure vulnerability. An unauthenticated malicious user with local access to the device could exploit this vulnerability to read sensitive information written to the log files.\n\n",
"id": "GHSA-hqm4-p64v-22xm",
"modified": "2024-04-04T06:17:43Z",
"published": "2023-07-20T18:33:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32446"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000215864/dsa-2023-247"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HQQQ-FQ68-35HF
Vulnerability from github – Published: 2025-12-18 00:34 – Updated: 2025-12-18 00:34
VLAI
Details
A flaw has been found in ZZCMS 2025. Affected by this vulnerability is an unknown functionality of the file /reg/user_save.php of the component User Data Storage Module. This manipulation causes cleartext storage in a file or on disk. Remote exploitation of the attack is possible. The exploit has been published and may be used.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-14836"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-17T23:15:56Z",
"severity": "MODERATE"
},
"details": "A flaw has been found in ZZCMS 2025. Affected by this vulnerability is an unknown functionality of the file /reg/user_save.php of the component User Data Storage Module. This manipulation causes cleartext storage in a file or on disk. Remote exploitation of the attack is possible. The exploit has been published and may be used.",
"id": "GHSA-hqqq-fq68-35hf",
"modified": "2025-12-18T00:34:08Z",
"published": "2025-12-18T00:34:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14836"
},
{
"type": "WEB",
"url": "https://note-hxlab.wetolink.com/share/bu2KYevoyBm6"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.336986"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.336986"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.711654"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-HVX4-75HG-H9CR
Vulnerability from github – Published: 2022-05-24 19:19 – Updated: 2022-05-24 19:19
VLAI
Details
A vulnerability of storing sensitive information insecurely in Property Settings prior to SMR Nov-2021 Release 1 allows attackers to read ESN value without priviledge.
{
"affected": [],
"aliases": [
"CVE-2021-25502"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-05T03:15:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability of storing sensitive information insecurely in Property Settings prior to SMR Nov-2021 Release 1 allows attackers to read ESN value without priviledge.",
"id": "GHSA-hvx4-75hg-h9cr",
"modified": "2022-05-24T19:19:52Z",
"published": "2022-05-24T19:19:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25502"
},
{
"type": "WEB",
"url": "https://security.samsungmobile.com/securityUpdate.smsb?year=2021\u0026month=11"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
Implementation
System Configuration
Operation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest. [REF-1297] [REF-1299] [REF-1301]
Mitigation
Implementation
System Configuration
Operation
In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.
CAPEC-37: Retrieve Embedded Sensitive Data
An attacker examines a target system to find sensitive data that has been embedded within it. This information can reveal confidential contents, such as account numbers or individual keys/credentials that can be used as an intermediate step in a larger attack.