Advisories · Weakness

CWE-256.

Every Advisory and CVE whose sources give the weakness CWE-256, newest first.

CVE-2023-4984 CVE record

CVSS 4.3 Medium

didi KnowSearch 1 credentials storage
- didi KnowSearch
- CWE-256
Not analysed yet 15 Sept 2023
CVE-2023-4400 CVE record

CVSS 6.2 Medium

Plaintext password storage in Skyhigh Security Skyhigh Secure Web Gateway (SWG)
- Skyhigh Security Skyhigh Secure Web Gateway (SWG)
- CWE-256
Not analysed yet 13 Sept 2023
org.keycloak:keycloak-core Maven

CVSS 8.8 High

Keycloak vulnerable to Plaintext Storage of User Password
- Weak cryptography or TLS
- CWE-256
>=22.0.2, <22.0.3 · fixed in 22.0.3

GHSA-5q66-v53q-pm35 · CVE-2023-4918 Not analysed yet 12 Sept 2023
CVE-2023-39227 CVE record

CVSS 6.1 Medium

Softneta MedDream PACS Plaintext Storage of a Password
- Softneta MedDream PACS
- CWE-256
Not analysed yet 11 Sept 2023
CVE-2023-35067 CVE record

CVSS 7.5 High

Plaintext Storage of a Password in Infodrom Sofwares E-Invoice Approval System
- Infodrom Software E-Invoice Approval System
- CWE-256
Not analysed yet 25 Jul 2023
CVE-2023-35765 CVE record

CVSS 6.5 Medium

PiiGAB M-Bus Plaintext Storage of a Password
- PiiGAB M-Bus SoftwarePack
- CWE-256
Not analysed yet 6 Jul 2023
CVE-2023-3395 CVE record

CVSS 6.5 Medium

Plaintext password storage in Ovarro TBox MS-CPU32 and others
- Ovarro TBox MS-CPU32
- Ovarro TBox MS-CPU32-S2
- CWE-256
Not analysed yet 3 Jul 2023
CVE-2023-26204 CVE record

CVSS 3.6 Low

Plaintext password storage in Fortinet FortiSIEM
- Fortinet FortiSIEM
- CWE-256
Not analysed yet 13 Jun 2023
org.jenkins-ci.plugins:codedx Maven

CVSS 4.3 Medium

Jenkins Code Dx Plugin stores API keys in plain text
- Hard-coded credentials
- CWE-256
<4.0.0 · fixed in 4.0.0

GHSA-gpc2-f62m-c6h6 · CVE-2023-2632 Not analysed yet 16 May 2023
org.jenkins-ci.plugins:codedx Maven

CVSS 4.3 Medium

Jenkins Code Dx Plugin displays API keys in plain text
- Hard-coded credentials
- CWE-256
<4.0.0 · fixed in 4.0.0

GHSA-352v-hhmh-2w8h · CVE-2023-2633 Not analysed yet 16 May 2023
CVE-2022-4308 CVE record

CVSS 6.1 Medium

Clear-text passwords in configuration files
- Secomea GateManager
- CWE-256
Not analysed yet 19 Apr 2023
CVE-2023-0457 CVE record

CVSS 7.5 High

Information Disclosure Vulnerability in MELSEC Series
- Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-32MT/ES
- Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-64MT/ES
- CWE-256
Not analysed yet 3 Mar 2023
CVE-2023-22389 CVE record

CVSS 5.7 Medium

Plaintext password storage in Snap One Wattbox WB-300-IP-3
- Snap One Wattbox WB-300-IP-3
- CWE-256
Not analysed yet 30 Jan 2023
org.jenkins-ci.plugins:jira-steps Maven

CVSS 5.5 Medium

Plaintext Storage of a Password in Jenkins JIRA Pipeline Steps Plugin
- Information disclosure
- CWE-256
<=2.0.165.v8846cf59f3db · no fixed version yet

GHSA-g29v-5pwh-wxx4 · CVE-2023-24439 Not analysed yet 26 Jan 2023
org.jenkins-ci.plugins:testquality-updater Maven

CVSS 5.5 Medium

Plaintext Storage of a Password in Jenkins TestQuality Updater Plugin
- Information disclosure
- CWE-256
<=1.3 · no fixed version yet

GHSA-98qc-v8vg-mcx4 · CVE-2023-24454 Not analysed yet 26 Jan 2023
org.jenkins-ci.plugins:view-cloner Maven

CVSS 6.5 Medium

Passwords stored in plain text by Jenkins view-cloner Plugin
- Information disclosure
- CWE-256
<=1.1 · no fixed version yet

GHSA-6hw7-x86v-wrgf · CVE-2023-24450 Not analysed yet 26 Jan 2023
org.jenkins-ci.plugins:github-pr-coverage-status Maven

CVSS 5.5 Medium

Plaintext storage of Access Token in Jenkins GitHub Pull Request Coverage Status Plugin
- Information disclosure
- CWE-256
<=2.2.0 · no fixed version yet

GHSA-4x65-4fjx-r7m6 · CVE-2023-24442 Not analysed yet 26 Jan 2023
github.com/rancher/rancher Go

CVSS 9.9 CriticalCritical · CVSS 9+

Plaintext storage of sensitive data in Rancher API and cluster.management.cattle.io objects
- Information disclosure
- CWE-256
>=2.5.0, <2.5.17 || >=2.6.0, <2.6.10 || >=2.7.0, <2.7.1 · fixed in 2.5.17, 2.6.10, 2.7.1

GHSA-cq4p-vp5q-4522 · CVE-2022-43757 Not analysed yet 25 Jan 2023
CVE-2022-22458 CVE record

CVSS 6.3 Medium

IBM Security Verify Governance, Identity Manager information disclosure
- IBM Security Verify Governance, Identity Manager
- CWE-256
Not analysed yet 22 Dec 2022
CVE-2022-41732 CVE record

CVSS 6.2 Medium

IBM Maximo information disclosure
- IBM Maximo Mobile
- CWE-256
Not analysed yet 28 Nov 2022
io.jenkins.plugins:cavisson-ns-nd-integration Maven

CVSS 6.5 Medium

Plaintext Storage of a Password in Jenkins NS-ND Integration Performance Publisher Plugin
- Hard-coded credentials
- CWE-256
<4.8.0.146 · fixed in 4.8.0.146

GHSA-x2w2-5552-fjv6 · CVE-2022-45392 Not analysed yet 16 Nov 2022
org.jenkins-ci.main:reverse-proxy-auth-plugin Maven

CVSS 6.5 Medium

Jenkins Reverse Proxy Auth Plugin vulnerable due to plaintext storage of passwords
- Hard-coded credentials
- CWE-256
>=1.7.3, <1.7.4 · fixed in 1.7.4

GHSA-wcjj-qm5v-j4pc · CVE-2022-45384 Not analysed yet 16 Nov 2022
CVE-2022-43958 CVE record

CVSS 7.6 High

Plaintext password storage in Siemens QMS Automotive
- Siemens QMS Automotive
- CWE-256
Not analysed yet 8 Nov 2022
pulp-ansible PyPI

CVSS 5.5 Medium

Plaintext storage of tokens in pulp_ansible
- Hard-coded credentials
- CWE-256
<0.15.0 · fixed in 0.15.0

GHSA-qv37-mfjf-42h8 · CVE-2022-3644 Not analysed yet 25 Oct 2022
io.jenkins.plugins:s3explorer Maven

CVSS 3.1 Low

AWS secrets displayed without masking by Jenkins S3 Explorer Plugin
- CWE-256
- CWE-549
<=1.0.8 · no fixed version yet

GHSA-mf4p-wjrm-cmjp · CVE-2022-43426 Not analysed yet 19 Oct 2022
org.jenkins-ci.plugins:katalon Maven

CVSS 4.3 Medium

API keys stored in plain text by Jenkins Katalon Plugin
- Hard-coded credentials
- CWE-256
<1.0.33 · fixed in 1.0.33

GHSA-35rx-7pc8-6963 · CVE-2022-43419 Not analysed yet 19 Oct 2022
go.etcd.io/etcd/client/v3 Go

etcd user credentials are stored in WAL logs in plaintext
- CWE-256
<3.3.23 || >=3.4.0, <3.4.10 · fixed in 3.3.23, 3.4.10

GHSA-528j-9r78-wffx Not analysed yet 6 Oct 2022
CVE-2022-3287 CVE record

CVSS 6.5 Medium

Plaintext password storage in fwupd
- fwupd
- CWE-256
Not analysed yet 28 Sept 2022
org.jenkins-ci.plugins:bigpanda-jenkins Maven

CVSS 3.3 Low

Jenkins BigPanda Notifier Plugin stores BigPanda API key unencrypted
- Hard-coded credentials
- CWE-256
<=1.4.0 · no fixed version yet

GHSA-j7xv-fc46-hgpg · CVE-2022-41247 Not analysed yet 22 Sept 2022
org.jenkins-ci.plugins:cons3rt Maven

CVSS 3.3 Low

API token stored in plain text by Jenkins CONS3RT Plugin
- Hard-coded credentials
- CWE-256
<=1.0.0 · no fixed version yet

GHSA-fmq9-r4p2-8272 · CVE-2022-41255 Not analysed yet 22 Sept 2022
org.jenkins-ci.plugins:collabnet Maven

CVSS 3.3 Low

RabbitMQ password stored in plain text by Jenkins CollabNet Plugins Plugin
- Hard-coded credentials
- CWE-256
<2.0.9 · fixed in 2.0.9

GHSA-qh87-2qvh-5jf8 · CVE-2022-38665 Not analysed yet 24 Aug 2022
CVE-2022-36308 CVE record

Plaintext password storage in Airspan AirVelocity
- Airspan AirVelocity
- CWE-256
Not analysed yet 16 Aug 2022
CVE-2022-33928 CVE record

CVSS 6.4 Medium

Plaintext password storage in Dell Wyse Management Suite
- Dell Wyse Management Suite
- CWE-256
Not analysed yet 10 Aug 2022
org.jenkins-ci.plugins:http_request Maven

CVSS 3.3 Low

Jenkins HTTP Request Plugin stores HTTP Request passwords unencrypted
- Information disclosure
- CWE-256
<1.16 · fixed in 1.16

GHSA-2qh6-hhvv-m2ww · CVE-2022-36901 Not analysed yet 28 Jul 2022
CVE-2022-1794 CVE record

CVSS 5.5 Medium

Plaintext Storage of a password in CODESYS V3 OPC DA Server
- CODESYS OPC DA Server
- CWE-256
Not analysed yet 11 Jul 2022
CVE-2022-27548 CVE record

CVSS 4.9 Medium

HCL Launch is vulnerable to information disclosure which can be read by a local user.
- HCL Software HCL Launch
- CWE-256
Not analysed yet 6 Jul 2022
net.praqma:rqm-plugin Maven

CVSS 3.3 Low

Password stored in plain text by Jenkins RQM Plugin
- Hard-coded credentials
- CWE-256
<=2.8 · no fixed version yet

GHSA-m59q-vgq9-75cr · CVE-2022-34809 Not analysed yet 1 Jul 2022
org.jenkins-ci.plugins:elasticsearch-query Maven

CVSS 3.3 Low

Plaintext Storage of a Password in Jenkins Elasticsearch Query Plugin
- Hard-coded credentials
- CWE-256
<=1.2 · no fixed version yet

GHSA-h5h5-m2mc-j2pv · CVE-2022-34807 Not analysed yet 1 Jul 2022
org.jenkins-ci.plugins:jigomerge Maven

CVSS 3.3 Low

Plaintext Storage of a Password in Jenkins Jigomerge Plugin
- Hard-coded credentials
- CWE-256
<=0.9 · no fixed version yet

GHSA-h5g3-v72x-hc6f · CVE-2022-34806 Not analysed yet 1 Jul 2022
org.jenkins-ci.plugins:skype-notifier Maven

CVSS 3.3 Low

Plaintext Storage of a Password in Jenkins Skype notifier Plugin
- Hard-coded credentials
- CWE-256
<=1.1.0 · no fixed version yet

GHSA-gvmr-mp5q-9wvw · CVE-2022-34805 Not analysed yet 1 Jul 2022
org.jenkins-ci.plugins:hpe-network-virtualization Maven

CVSS 3.3 Low

Passwords stored in plain text by Jenkins hpe-network-virtualization plugin
- Hard-coded credentials
- CWE-256
=1.0 · no fixed version yet

GHSA-36j8-f33j-vjwq · CVE-2022-34816 Not analysed yet 1 Jul 2022
org.jenkins-ci.plugins:opsgenie Maven

CVSS 4.3 Medium

Jenkins OpsGenie Plugin Plaintext Storage of a Password vulnerability
- Hard-coded credentials
- CWE-256
<=1.9 · no fixed version yet

GHSA-273c-fjw8-v2w8 · CVE-2022-34803 Not analysed yet 1 Jul 2022
tools.devnull:build-notifications Maven

CVSS 3.3 Low

Plaintext Storage of a Password in Jenkins Build Notifications Plugin
- Hard-coded credentials
- CWE-256
<=1.5.0 · no fixed version yet

GHSA-v3r8-6vfj-pppf · CVE-2022-34800 Not analysed yet 1 Jul 2022
org.jenkins-ci.plugins:rocketchatnotifier Maven

CVSS 3.3 Low

Plaintext Storage of a Password in Jenkins RocketChat Notifier Plugin
- Hard-coded credentials
- CWE-256
<=1.5.2 · no fixed version yet

GHSA-pgp9-x83g-v8x8 · CVE-2022-34802 Not analysed yet 1 Jul 2022
org.jenkins-ci.plugins:ec2-deployment-dashboard Maven

CVSS 3.3 Low

Plaintext Storage of a Password in Jenkins Deployment Dashboard Plugin
- Hard-coded credentials
- CWE-256
<=1.0.10 · no fixed version yet

GHSA-56hc-wf49-2h96 · CVE-2022-34799 Not analysed yet 1 Jul 2022
com.geteasyqa:easyqa Maven

CVSS 3.3 Low

User passwords stored in plain text by Jenkins EasyQA Plugin
- CWE-256
<=1.0 · no fixed version yet

GHSA-xcp5-j5fj-3xp6 · CVE-2022-34202 Not analysed yet 24 Jun 2022
com.convertigo.jenkins.plugins:convertigo-mobile-platform Maven

CVSS 4.3 Medium

Plaintext Storage of a Password in Jenkins Convertigo Mobile Platform Plugin
- Hard-coded credentials
- CWE-256
<=1.1 · no fixed version yet

GHSA-c8mf-mc3f-2wvc · CVE-2022-34199 Not analysed yet 24 Jun 2022
org.rundeck:rundeck Maven

CVSS 7.5 High

Rundeck's Key Storage converter plugin mechanism's encryption layer not working in 4.2.0, 4.2.1, 4.3.0
- Hard-coded credentials
- CWE-256
>=4.2.0, <4.2.2 || >=4.3.0, <4.3.1 · fixed in 4.2.2, 4.3.1

GHSA-hprf-rrwq-jm5c · CVE-2022-31044 Not analysed yet 17 Jun 2022
CVE-2022-29085 CVE record

CVSS 6.4 Medium

Plaintext password storage in Dell Unity
- Dell Unity
- CWE-256
Not analysed yet 2 Jun 2022
CVE-2022-22557 CVE record

CVSS 7.5 High

Plaintext password storage in Dell PowerStore
- Dell PowerStore
- CWE-256
Not analysed yet 2 Jun 2022
net.arangamani.jenkins:gem-publisher Maven

CVSS 5.5 Medium

Jenkins Gem Publisher Plugin stores credentials as plaintext
- Hard-coded credentials
- CWE-256
<=1.0 · no fixed version yet

GHSA-6pqm-pp65-mc26 · CVE-2019-10426 Not analysed yet 24 May 2022
org.jenkins-ci.plugins:influxdb Maven

CVSS 8.8 High

Plaintext password storage in Jenkins InfluxDB Plugin
- Hard-coded credentials
- CWE-256
<1.22 · fixed in 1.22

GHSA-rv97-r8f7-8wmg · CVE-2019-10329 Not analysed yet 24 May 2022
org.jenkins-ci.plugins:nomad Maven

CVSS 5.5 Medium

Password stored in plain text by Jenkins Nomad Plugin
- Hard-coded credentials
- CWE-256
<0.7.5 · fixed in 0.7.5

GHSA-5c2c-cvg6-ghjm · CVE-2021-21681 Not analysed yet 24 May 2022
org.jenkins-ci.plugins:labmanager Maven

CVSS 3.3 Low

Password stored in plain text by Jenkins VMware Lab Manager Slaves Plugin
- Hard-coded credentials
- CWE-256
<=0.2.8 · no fixed version yet

GHSA-cg4h-cfjp-h3x2 · CVE-2020-2319 Not analysed yet 24 May 2022
org.jenkins-ci.plugins:mailcommander Maven

CVSS 6.5 Medium

Passwords stored in plain text by Mail Commander Plugin for Jenkins-ci Plugin
- Hard-coded credentials
- CWE-256
<=1.0.0 · no fixed version yet

GHSA-485q-v457-3p58 · CVE-2020-2318 Not analysed yet 24 May 2022
com.rapid7:jenkinsci-appspider-plugin Maven

CVSS 3.3 Low

Password stored in plain text by Jenkins AppSpider Plugin
- Hard-coded credentials
- CWE-256
<1.0.13 · fixed in 1.0.13

GHSA-rm7r-xv53-xwc3 · CVE-2020-2314 Not analysed yet 24 May 2022
org.jenkins-ci.plugins:soapui-pro-functional-testing Maven

CVSS 4.3 Medium

Passwords stored in plain text by Jenkins ReadyAPI Functional Testing Plugin
- Weak cryptography or TLS
- CWE-256
<1.4 · fixed in 1.4

GHSA-ccwp-633j-g29v · CVE-2020-2250 Not analysed yet 24 May 2022
org.jenkins-ci.plugins:Parameterized-Remote-Trigger Maven

CVSS 3.3 Low

Secret stored in plain text by Jenkins Parameterized Remote Trigger Plugin
- Weak cryptography or TLS
- CWE-256
<3.1.4 · fixed in 3.1.4

GHSA-wphq-j78p-fhgp · CVE-2020-2239 Not analysed yet 24 May 2022
org.jenkins-ci.plugins:tfs Maven

CVSS 3.3 Low

Credentials stored in plain text by Jenkins tfs Plugin
- Weak cryptography or TLS
- CWE-256
<=5.157.1 · no fixed version yet

GHSA-w6c2-jrhh-jrxg · CVE-2020-2249 Not analysed yet 24 May 2022
org.jenkins-ci.plugins:hp-quality-center Maven

CVSS 3.3 Low

Password stored in plain text by Jenkins HP ALM Quality Center Plugin
- Hard-coded credentials
- CWE-256
<=1.6 · no fixed version yet

GHSA-fc3j-cfqv-pfrm · CVE-2020-2218 Not analysed yet 24 May 2022