CWE-522

The Voo branded NETGEAR CG3700b custom firmware V2.02.03 uses HTTP Basic Authentication over cleartext HTTP.

SAP Business Objects Business Intelligence Platform (CMC), version 4.1, 4.2, shows cleartext password in the response, l

Blaauw Remote Kiln Control through v3.00r4 allows an unauthenticated attacker to access MySQL credentials in cleartext i

The IRC5 family with UAS service enabled comes by default with credentials that can be found on publicly available manua

Brocade SANnav versions before v2.1.0, contain a Plaintext Password Storage vulnerability.

The WebTools component on Canon Oce ColorWave 3500 5.1.1.0 devices allows attackers to retrieve stored SMB credentials v

An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 9716

GE Healthcare Imaging and Ultrasound Products may allow specific credentials to be exposed during transport over the net

AdRem NetCrunch 10.6.0.4587 has an Improper Session Handling vulnerability in the NetCrunch web client, which can lead t

Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The p

Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host cont

A ZTE product is impacted by the cryptographic issues vulnerability. The encryption algorithm is not properly used, so r

Insufficiently protected credentials vulnerability on Micro Focus enterprise developer and enterprise server, affecting

A flaw was found in Red Hat Satellite 6 which allows privileged attacker to read cache files. These cache credentials co

TP-Link USB Network Server TL-PS310U devices before 2.079.000.t0210 allow an attacker on the same network to elevate pri

Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to elevate pri

DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to elevate pri

Castel NextGen DVR v1.0.0 stores and displays credentials for the associated SMTP server in cleartext. Low privileged us

An issue was discovered in BT CTROMS Terminal OS Port Portal CT-464. Account takeover can occur because the password-res

CS2 Network P2P through 3.x, as used in millions of Internet of Things devices, suffers from an authentication flaw that

Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the

IBM QRadar SIEM 7.3.0 through 7.3.3 uses weak credential storage in some instances which could be decrypted by a local a

NCH Express Invoice 7.25 allows local users to discover the cleartext password by reading the configuration file.

Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects R6700v2 before 1.1.0.38,

Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects R6700v2 before 1.1.0.38,

Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects R6700v2 before 1.1.0.38 a

Certain NETGEAR devices are affected by administrative password disclosure. This affects D6220 before V1.0.0.28, D6400 b

Lexiglot through 2014-11-20 allows local users to obtain sensitive information by listing a process because the username

In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted and stored in the dat

A vulnerability in Cisco SD-WAN Solution Software could allow an unauthenticated, local attacker to access an affected d

IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 stores user credentials in plain in clear text which can be read by a local use

Insufficiently protected credentials in the Intel(R) QAT for Linux before version 1.7.l.4.10.0 may allow an authenticate

A CWE-522: Insufficiently Protected Credentials vulnerability exists in EcoStruxure Geo SCADA Expert 2019 (Original rele

Hardcoded WSMan credentials in Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generati

Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allow remote attackers to obtain a login password v

Arial Campaign Enterprise before 11.0.551 stores passwords in clear text and these may be retrieved.

ManageEngine EventLog Analyzer version 7 through 9.9 build 9002 has a Credentials Disclosure Vulnerability. Fixed versio

Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format,

In IXP EasyInstall 6.2.13723, there are cleartext credentials in network communication on TCP port 20050 when using the

General Electric D20ME devices are not properly configured and reveal plaintext passwords.

A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) stores cleartext admin

Smb4K before 1.1.1 allows remote attackers to obtain credentials via vectors related to the cuid option in the "Addition

In JetBrains TeamCity before 2019.1.5, some server-stored passwords could be shown via the web UI.

Brother MFC-9970CDW devices with firmware 0D allow cleartext submission of passwords.

Jenkins S3 publisher Plugin 0.11.4 and earlier transmits configured credentials in plain text as part of the global Jenk

Western Digital SanDisk X600 devices in certain configurations, a vulnerability in the access control mechanism of the d

An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660

Aquaforest TIFF Server 4.0 allows Unauthenticated SMB Hash Capture via UNC.

Comba AP2600-I devices through A02,0202N00PD2 are prone to password disclosure via an insecure authentication mechanism.

D-Link DSL-2875AL devices through 1.00.05 are prone to password disclosure via a simple crafted /romfile.cfg request to