CWE-312 Cleartext Storage of Sensitive Information
baseThe product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
untergeordnete Schwächen
Spezifischere Einträge unterhalb dieses.
03
Schwachstellen (1242)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-22894US | medium4.9OT kritisch | KEV | ||
Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns t… | ||||
| CVE-2020-29583US | critical9.8OT kritisch | KEV | ||
Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the fi… | ||||
| CVE-2011-4723US | medium6.8OT kritisch | KEV | ||
The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information via unspecified vectors. | ||||
| CVE-2023-50719US | high7.5OT hoch | — | ||
XWiki Platform is a generic wiki platform. Starting in 7.2-milestone-2 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the password… | ||||
| CVE-2022-26148US | critical9.8OT hoch | — | ||
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When the user logs in and a… | ||||
| CVE-2005-2428US | medium5.0OT hoch | Exploit | ||
Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hidden form fields, which allows remote attackers to read the H… | ||||
| CVE-2000-0834US | high7.5OT hoch | Exploit | ||
The Windows 2000 telnet client attempts to perform NTLM authentication by default, which allows remote attackers to capture and replay the NTLM challenge/response via a telnet:// U… | ||||
| CVE-2021-36782US | critical9.9OT hoch | Exploit | ||
A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners, Project Members and User Base to us… | ||||
| CVE-2020-5723US | critical9.8OT hoch | Exploit | ||
The UCM6200 series 1.0.20.22 and below stores unencrypted user passwords in an SQLite database. This could allow an attacker to retrieve all passwords and possibly gain elevated pr… | ||||
| CVE-2019-0285US | critical9.8OT hoch | Exploit | ||
The .NET SDK WebForm Viewer in SAP Crystal Reports for Visual Studio (fixed in version 2010) discloses sensitive database information including credentials which can be misused by… | ||||
| CVE-2007-2149US | high10.0OT hoch | Exploit | ||
Stephen Craton (aka WiredPHP) Chatness 2.5.3 and earlier stores usernames and unencrypted passwords in (1) classes/vars.php and (2) classes/varstuff.php, and recommends 0666 or 077… | ||||
| CVE-2023-31069US | critical9.8OT hoch | Exploit | ||
An issue was discovered in TSplus Remote Access through 16.0.2.14. Credentials are stored as cleartext within the HTML source code of the login page. | ||||
| CVE-2007-0977US | high7.1OT hoch | Exploit | ||
IBM Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores HTTPPassword hashes from names.nsf in a manner accessible through Readviewentries and OpenDo… | ||||
| CVE-2018-8947US | high7.5OT erhöht | Exploit | ||
rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easier for remote attackers to bypass intended access restrictio… | ||||
| CVE-2013-2680US | high7.5OT erhöht | Exploit | ||
Cisco Linksys E4200 1.0.05 Build 7 devices store passwords in cleartext allowing remote attackers to obtain sensitive information. | ||||
| CVE-2007-6330US | high10.0OT erhöht | — | ||
Meridian Prolog Manager 2007, and 7.5 and earlier, sends all usernames and passwords to the client in a (1) cleartext or (2) weakly encrypted format to support client-side login au… | ||||
| CVE-2006-0261US | high10.0OT erhöht | — | ||
Multiple unspecified vulnerabilities in Oracle Database server 8.1.7.4, 9.0.1.5, 9.2.0.7, and 10.1.0.5 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1)… | ||||
| CVE-2002-2190US | high7.5OT erhöht | Exploit | ||
ArtsCore Studios CuteCast Forum 1.2 stores passwords in plaintext under the web document root, which allows remote attackers to obtain the passwords via an HTTP request to a .user… | ||||
| CVE-2000-1100US | high7.5OT erhöht | Exploit | ||
The default configuration for PostACI webmail system installs the /includes/global.inc configuration file within the web root, which allows remote attackers to read sensitive infor… | ||||
| CVE-1999-0364US | high10.0OT erhöht | — | ||
Microsoft Access 97 stores a database password as plaintext in a foreign mdb, allowing access to data. | ||||
04
Angriffsmuster (1)
CAPEC-Angriffsmuster, die dies ausnutzen.
05
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan