Common Weakness Enumeration
CWE-256
AllowedPlaintext Storage of a Password
Abstraction: Base · Status: Incomplete
The product stores a password in plaintext within resources such as memory or files.
397 vulnerabilities reference this CWE, most recent first.
GHSA-C9RG-8P7F-JWWP
Vulnerability from github – Published: 2026-03-03 21:31 – Updated: 2026-03-04 15:30
VLAI
Details
An issue in the reset_pj.cgi endpoint of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to execute arbitrary commands via supplying a crafted GET request.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2024-55026"
],
"database_specific": {
"cwe_ids": [
"CWE-256"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-03T20:16:41Z",
"severity": "HIGH"
},
"details": "An issue in the reset_pj.cgi endpoint of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to execute arbitrary commands via supplying a crafted GET request.",
"id": "GHSA-c9rg-8p7f-jwwp",
"modified": "2026-03-04T15:30:33Z",
"published": "2026-03-03T21:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55026"
},
{
"type": "WEB",
"url": "https://gist.github.com/AenganZ/f86ed0da28825a1432ec697f484622de"
},
{
"type": "WEB",
"url": "https://plain-trick-71d.notion.site/weintek-cMT-3072XH2-14687a89c4c181eeb21ad61e0392f34b?pvs=4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CCWP-633J-G29V
Vulnerability from github – Published: 2022-05-24 17:27 – Updated: 2022-12-20 22:10
VLAI
Summary
Passwords stored in plain text by Jenkins ReadyAPI Functional Testing Plugin
Details
ReadyAPI Functional Testing Plugin 1.3 and earlier stores project passwords unencrypted in job config.xml files as part of its configuration. These project passwords can be viewed by attackers with Extended Read permission or access to the Jenkins controller file system.
ReadyAPI Functional Testing Plugin 1.4 stores project passwords encrypted once affected job configurations are saved again.
Severity
4.3 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.3"
},
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:soapui-pro-functional-testing"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-2250"
],
"database_specific": {
"cwe_ids": [
"CWE-256",
"CWE-311"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-20T22:10:51Z",
"nvd_published_at": "2020-09-01T14:15:00Z",
"severity": "MODERATE"
},
"details": "ReadyAPI Functional Testing Plugin 1.3 and earlier stores project passwords unencrypted in job `config.xml` files as part of its configuration. These project passwords can be viewed by attackers with Extended Read permission or access to the Jenkins controller file system.\n\nReadyAPI Functional Testing Plugin 1.4 stores project passwords encrypted once affected job configurations are saved again.",
"id": "GHSA-ccwp-633j-g29v",
"modified": "2022-12-20T22:10:51Z",
"published": "2022-05-24T17:27:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2250"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/soapui-pro-functional-testing-plugin"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1631%20(1)"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2020/09/01/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Passwords stored in plain text by Jenkins ReadyAPI Functional Testing Plugin"
}
GHSA-CG4H-CFJP-H3X2
Vulnerability from github – Published: 2022-05-24 17:33 – Updated: 2022-12-22 13:50
VLAI
Summary
Password stored in plain text by Jenkins VMware Lab Manager Slaves Plugin
Details
Jenkins VMware Lab Manager Slaves Plugin 0.2.8 and earlier stores a password unencrypted in the global config.xml file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system.
Severity
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:labmanager"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.2.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-2319"
],
"database_specific": {
"cwe_ids": [
"CWE-256",
"CWE-522"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-22T13:50:16Z",
"nvd_published_at": "2020-11-04T15:15:00Z",
"severity": "LOW"
},
"details": "Jenkins VMware Lab Manager Slaves Plugin 0.2.8 and earlier stores a password unencrypted in the global `config.xml` file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system.",
"id": "GHSA-cg4h-cfjp-h3x2",
"modified": "2022-12-22T13:50:16Z",
"published": "2022-05-24T17:33:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2319"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/labmanager-plugin"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2084"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Password stored in plain text by Jenkins VMware Lab Manager Slaves Plugin"
}
GHSA-CHM8-WP3H-F4M3
Vulnerability from github – Published: 2022-05-24 16:43 – Updated: 2023-10-26 15:33
VLAI
Summary
Jenkins jira-ext Plugin stores credentials unencrypted
Details
Jenkins jira-ext Plugin 0.8 and earlier stored credentials unencrypted in its global configuration file hudson.plugins.jira.JiraProjectProperty.xml on the Jenkins master. These credentials could be viewed by users with access to the Jenkins master file system.
jira-ext Plugin version 0.9 stores credentials encrypted.
Severity
8.8 (High)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:jira-ext"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-10302"
],
"database_specific": {
"cwe_ids": [
"CWE-256",
"CWE-522"
],
"github_reviewed": true,
"github_reviewed_at": "2023-05-19T23:46:18Z",
"nvd_published_at": "2019-04-18T17:29:00Z",
"severity": "HIGH"
},
"details": "Jenkins jira-ext Plugin 0.8 and earlier stored credentials unencrypted in its global configuration file `hudson.plugins.jira.JiraProjectProperty.xml` on the Jenkins master. These credentials could be viewed by users with access to the Jenkins master file system.\n\njira-ext Plugin version 0.9 stores credentials encrypted.",
"id": "GHSA-chm8-wp3h-f4m3",
"modified": "2023-10-26T15:33:47Z",
"published": "2022-05-24T16:43:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10302"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/jira-ext-plugin/commit/e252f4084089e5cfb4c7bad389d3d20f3ec594fb"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2019-04-17/#SECURITY-836"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/108045"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Jenkins jira-ext Plugin stores credentials unencrypted"
}
GHSA-CMJF-C5FV-C544
Vulnerability from github – Published: 2025-06-26 21:31 – Updated: 2025-06-26 21:31
VLAI
Details
Multiple wireless router models from Sapido have an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to directly access a system configuration file and obtain plaintext administrator credentials.
The affected models are out of support; replacing the device is recommended.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2025-6560"
],
"database_specific": {
"cwe_ids": [
"CWE-256"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-24T03:15:35Z",
"severity": "CRITICAL"
},
"details": "Multiple wireless router models from Sapido have an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to directly access a system configuration file and obtain plaintext administrator credentials.\u00a0\n\nThe affected models are out of support; replacing the device is recommended.",
"id": "GHSA-cmjf-c5fv-c544",
"modified": "2025-06-26T21:31:04Z",
"published": "2025-06-26T21:31:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6560"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/en/cp-139-10198-55217-2.html"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/tw/cp-132-10197-524ea-1.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-CQ4P-VP5Q-4522
Vulnerability from github – Published: 2023-01-25 19:36 – Updated: 2023-02-15 18:40
VLAI
Summary
Plaintext storage of sensitive data in Rancher API and cluster.management.cattle.io objects
Details
Impact
This issue affects Rancher versions from 2.5.0 up to and including 2.5.16, from 2.6.0 up to and including 2.6.9 and 2.7.0. It was discovered that the security advisory CVE-2021-36782 (GHSA-g7j7-h4q8-8w2f), previously released by Rancher, missed addressing some sensitive fields, secret tokens, encryption keys, and SSH keys that were still being stored in plaintext directly on Kubernetes objects like Clusters.
The exposed credentials are visible in Rancher to authenticated Cluster Owners, Cluster Members, Project Owners and Project Members of that cluster on the endpoints:
/v1/management.cattle.io.cluster/v1/management.cattle.io.clustertemplaterevisions
The remaining sensitive fields are now stripped from Clusters and other objects and moved to a Secret before the object is stored. The Secret is retrieved when the credential is needed. For objects that existed before this security fix, a one-time migration happens on startup.
The fields that have been addressed by this security fix are:
Cluster.Spec.RancherKubernetesEngineConfig.Services.KubeAPI.SecretsEncryptionConfig.CustomConfig.Providers[].AESGCM.Keys[].SecretCluster.Spec.RancherKubernetesEngineConfig.Services.KubeAPI.SecretsEncryptionConfig.CustomConfig.Providers[].AESCBC.Keys[].SecretCluster.Spec.RancherKubernetesEngineConfig.Services.KubeAPI.SecretsEncryptionConfig.CustomConfig.Providers[].SecretboxConfiguration.Keys[].SecretCluster.Spec.RancherKubernetesEngineConfig.Services.Kubelet.ExtraEnvwhen containing theAWS_SECRET_ACCESS_KEYenvironment variableCluster.Spec.RancherKubernetesEngineConfig.BastionHost.SSHKeyCluster.Spec.RancherKubernetesEngineConfig.PrivateRegistries[].ECRCredentialPlugin.AwsSecretAccessKeyCluster.Spec.RancherKubernetesEngineConfig.PrivateRegistries[].ECRCredentialPlugin.AwsSessionTokenCluster.Spec.RancherKubernetesEngineConfig.Network.AciNetworkProvider.ApicUserKeyCluster.Spec.RancherKubernetesEngineConfig.Network.AciNetworkProvider.KafkaClientKeyCluster.Spec.RancherKubernetesEngineConfig.Network.AciNetworkProvider.Token
Important:
-
For the exposure of credentials not related to Rancher, the final impact severity for confidentiality, integrity and availability is dependent on the permissions the leaked credentials have on their services.
-
It is recommended to review for potentially leaked credentials in this scenario and to change them if deemed necessary.
Workarounds
There is no direct mitigation besides updating Rancher to a patched version.
Patches
Patched versions include releases 2.5.17, 2.6.10, 2.7.1 and later versions.
After upgrading to a patched version, it is important to check for the ACISecretsMigrated and RKESecretsMigrated conditions on Clusters and ClusterTemplateRevisions to confirm when secrets have been fully migrated off of those objects, and the objects scoped within them.
For more information
If you have any questions or comments about this advisory:
- Reach out to SUSE Rancher Security team for security related inquiries.
- Open an issue in Rancher repository.
- Verify our support matrix and product support lifecycle.
Severity
8.8 (High)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/rancher/rancher"
},
"ranges": [
{
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.5.17"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/rancher/rancher"
},
"ranges": [
{
"events": [
{
"introduced": "2.6.0"
},
{
"fixed": "2.6.10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/rancher/rancher"
},
"ranges": [
{
"events": [
{
"introduced": "2.7.0"
},
{
"fixed": "2.7.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-43757"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-256",
"CWE-312"
],
"github_reviewed": true,
"github_reviewed_at": "2023-01-25T19:36:57Z",
"nvd_published_at": "2023-02-07T13:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\n\nThis issue affects Rancher versions from 2.5.0 up to and including 2.5.16, from 2.6.0 up to and including 2.6.9 and 2.7.0. It was discovered that the security advisory CVE-2021-36782 (GHSA-g7j7-h4q8-8w2f), previously released by Rancher, missed addressing some sensitive fields, secret tokens, encryption keys, and SSH keys that were still being stored in plaintext directly on Kubernetes objects like `Clusters`.\n\nThe exposed credentials are visible in Rancher to authenticated `Cluster Owners`, `Cluster Members`, `Project Owners` and `Project Members` of that cluster on the endpoints:\n\n- `/v1/management.cattle.io.cluster`\n- `/v1/management.cattle.io.clustertemplaterevisions`\n\nThe remaining sensitive fields are now stripped from `Clusters` and other objects and moved to a `Secret` before the object is stored. The `Secret` is retrieved when the credential is needed. For objects that existed before this security fix, a one-time migration happens on startup.\n\nThe fields that have been addressed by this security fix are:\n\n- `Cluster.Spec.RancherKubernetesEngineConfig.Services.KubeAPI.SecretsEncryptionConfig.CustomConfig.Providers[].AESGCM.Keys[].Secret`\n- `Cluster.Spec.RancherKubernetesEngineConfig.Services.KubeAPI.SecretsEncryptionConfig.CustomConfig.Providers[].AESCBC.Keys[].Secret`\n- `Cluster.Spec.RancherKubernetesEngineConfig.Services.KubeAPI.SecretsEncryptionConfig.CustomConfig.Providers[].SecretboxConfiguration.Keys[].Secret`\n- `Cluster.Spec.RancherKubernetesEngineConfig.Services.Kubelet.ExtraEnv` when containing the `AWS_SECRET_ACCESS_KEY` environment variable\n- `Cluster.Spec.RancherKubernetesEngineConfig.BastionHost.SSHKey`\n- `Cluster.Spec.RancherKubernetesEngineConfig.PrivateRegistries[].ECRCredentialPlugin.AwsSecretAccessKey`\n- `Cluster.Spec.RancherKubernetesEngineConfig.PrivateRegistries[].ECRCredentialPlugin.AwsSessionToken`\n- `Cluster.Spec.RancherKubernetesEngineConfig.Network.AciNetworkProvider.ApicUserKey`\n- `Cluster.Spec.RancherKubernetesEngineConfig.Network.AciNetworkProvider.KafkaClientKey`\n- `Cluster.Spec.RancherKubernetesEngineConfig.Network.AciNetworkProvider.Token`\n\n**Important:**\n\n- For the exposure of credentials not related to Rancher, the final impact severity for confidentiality, integrity and availability is dependent on the permissions the leaked credentials have on their services.\n\n- It is recommended to review for potentially leaked credentials in this scenario and to change them if deemed necessary.\n\n### Workarounds\n\nThere is no direct mitigation besides updating Rancher to a patched version.\n\n### Patches\n\nPatched versions include releases 2.5.17, 2.6.10, 2.7.1 and later versions.\n\nAfter upgrading to a patched version, it is important to check for the `ACISecretsMigrated` and `RKESecretsMigrated` conditions on `Clusters` and `ClusterTemplateRevisions` to confirm when secrets have been fully migrated off of those objects, and the objects scoped within them.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Reach out to [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.\n* Open an issue in [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.\n* Verify our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).",
"id": "GHSA-cq4p-vp5q-4522",
"modified": "2023-02-15T18:40:09Z",
"published": "2023-01-25T19:36:57Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/rancher/rancher/security/advisories/GHSA-cq4p-vp5q-4522"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43757"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1205295"
},
{
"type": "PACKAGE",
"url": "https://github.com/rancher/rancher"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Plaintext storage of sensitive data in Rancher API and cluster.management.cattle.io objects"
}
GHSA-CWM4-Q4JJ-2W4V
Vulnerability from github – Published: 2025-11-05 17:48 – Updated: 2025-11-05 17:48
VLAI
Details
Dell CloudLink, versions prior to 8.1.1, contain a vulnerability where a privileged user may exploit and gain parallel privilege escalation or access to the database to obtain confidential information.
Severity
6.7 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-46366"
],
"database_specific": {
"cwe_ids": [
"CWE-256"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-05T17:15:42Z",
"severity": "MODERATE"
},
"details": "Dell CloudLink, versions prior to 8.1.1, contain a vulnerability where a privileged user may exploit and gain parallel privilege escalation or access to the database to obtain confidential information.",
"id": "GHSA-cwm4-q4jj-2w4v",
"modified": "2025-11-05T17:48:29Z",
"published": "2025-11-05T17:48:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46366"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000384363/dsa-2025-374-security-update-for-dell-cloudlink-multiple-security-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CXVP-2GQQ-8958
Vulnerability from github – Published: 2024-12-11 09:32 – Updated: 2024-12-11 09:32
VLAI
Details
Dell VxVerify, versions prior to x.40.405, contain a Plain-text Password Storage Vulnerability in the shell wrapper. A local high privileged attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable component with privileges of the compromised account.
Severity
7.2 (High)
{
"affected": [],
"aliases": [
"CVE-2024-53292"
],
"database_specific": {
"cwe_ids": [
"CWE-256",
"CWE-522"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-11T08:15:06Z",
"severity": "HIGH"
},
"details": "Dell VxVerify, versions prior to x.40.405, contain a Plain-text Password Storage Vulnerability in the shell wrapper. A local high privileged attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable component with privileges of the compromised account.",
"id": "GHSA-cxvp-2gqq-8958",
"modified": "2024-12-11T09:32:04Z",
"published": "2024-12-11T09:32:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53292"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000258964/dsa-2024-492-security-update-dell-vxverify-on-vxrail-plaintext-password-storage-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FC3J-CFQV-PFRM
Vulnerability from github – Published: 2022-05-24 17:22 – Updated: 2022-12-29 01:28
VLAI
Summary
Password stored in plain text by Jenkins HP ALM Quality Center Plugin
Details
HP ALM Quality Center Plugin 1.6 and earlier stores a password in plain text in its global configuration file org.jenkinsci.plugins.qc.QualityCenterIntegrationRecorder.xml. This password can be viewed by users with access to the Jenkins controller file system.
Severity
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:hp-quality-center"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-2218"
],
"database_specific": {
"cwe_ids": [
"CWE-256",
"CWE-522"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-29T01:28:16Z",
"nvd_published_at": "2020-07-02T15:15:00Z",
"severity": "LOW"
},
"details": "HP ALM Quality Center Plugin 1.6 and earlier stores a password in plain text in its global configuration file `org.jenkinsci.plugins.qc.QualityCenterIntegrationRecorder.xml`. This password can be viewed by users with access to the Jenkins controller file system.",
"id": "GHSA-fc3j-cfqv-pfrm",
"modified": "2022-12-29T01:28:16Z",
"published": "2022-05-24T17:22:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2218"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/hp-quality-center-plugin"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1576"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2020/07/02/7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Password stored in plain text by Jenkins HP ALM Quality Center Plugin"
}
GHSA-FG8P-F9G5-HPR2
Vulnerability from github – Published: 2026-05-04 15:31 – Updated: 2026-05-04 15:31
VLAI
Details
Plaintext storage of a password vulnerability in ILM Informatique OpenConcerto allows Retrieve Embedded Sensitive Data.
This issue affects OpenConcerto: 1.7.5.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-6500"
],
"database_specific": {
"cwe_ids": [
"CWE-256"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-04T15:16:05Z",
"severity": "MODERATE"
},
"details": "Plaintext storage of a password vulnerability in ILM Informatique OpenConcerto allows Retrieve Embedded Sensitive Data.\n\nThis issue affects OpenConcerto: 1.7.5.",
"id": "GHSA-fg8p-f9g5-hpr2",
"modified": "2026-05-04T15:31:15Z",
"published": "2026-05-04T15:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6500"
},
{
"type": "WEB",
"url": "https://www.openconcerto.org/fr/version-1.7.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Architecture and Design
Avoid storing passwords in easily accessible locations.
Mitigation
Architecture and Design
Consider storing cryptographic hashes of passwords as an alternative to storing in plaintext.
Mitigation
A programmer might attempt to remedy the password management problem by obscuring the password with an encoding function, such as base 64 encoding, but this effort does not adequately protect the password because the encoding can be detected and decoded easily.
No CAPEC attack patterns related to this CWE.