CWE-522

CodexBar before 0.33.0 contains a credential forwarding vulnerability that allows network-adjacent attackers to intercep

IBM Concert 1.0.0 through 2.2.0 could allow a local user to obtain sensitive information due to missing function level a

Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database Explorer

Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:auth command creates $DOKKU_ROOT/.netrc using bash's touch comm

In HCL DevOps Deploy 8.1.2.0 through 8.1.2.3, a user with LLM configuration privileges may be able to recover a credenti

PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has an Insufficiently Protected Credentials vulnerability,

In ExtremeCloud IQ – Site Engine (XIQ‑SE) before 26.2.10, a vulnerability in the NAC administration interface allows an

In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit logging feature might log user credentials from users log

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From ve

Insufficiently protected credentials vulnerability in IPSpeaker component in Synology Surveillance Station before 9.2.2-

GitLab has remediated an issue in GitLab EE affecting all versions from 9.5 before 18.11.7, 19.0 before 19.0.4, and 19.1

Unnecessary transmission of sensitive cryptographic material. The following products are affected: Acronis Cyber Protect

HCL BigFix Service Management (SM) is vulnerable to insufficiently protected credentials for a short duration while comm

go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-gi

In preloader, there is a possible read of device unique identifiers due to a logic error. This could lead to local infor

This issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS T

Administrative credentials may be exposed in plaintext within the Ebyte device's management interface, increasing the r

A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, e

A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engi

Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only per

Insufficiently protected credentials in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing ove

A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS

IBM Security QRadar EDR 3.12 through 3.12.24 stores user credentials in plain text which can be read by a local privileg

A vulnerability has been identified in the NeuVector scanner where the scanner process accepts registry and controller c

HCL AION is affected by an Autocomplete HTML Attribute Not Disabled for Password Field vulnerability. This can allow au

HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sensitive information such as: Va

A vulnerability was identified in Besen BS20 EV Charging Station up to 20260426. Affected is an unknown function of the

A weakness has been identified in tufantunc ssh-mcp up to 1.5.0. Impacted is an unknown function of the file src/index.t

HCL AION is affected by a vulnerability where basic authorization tokens are used for authentication. Use of basic autho

A insufficiently protected credentials vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4 all

Tanium addressed an information disclosure vulnerability in Tanium Server.

HCL BigFix RunBookAI is affected by a Continued availability of Less-Secure “Input Text” Vulnerability . A component con

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec

YugabyteDB Anywhere displays LDAP bind passwords configured via gflags in cleartext within the web UI. An authenticated

Gradio is an open-source Python package designed for quick prototyping. Starting in version 4.16.0 and prior to version

Cache misconfiguration vulnerability in OpenText Identity Manager on Windows, Linux allows remote authenticated users to

Insufficiently Protected Credentials vulnerability in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client reveals

A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead

StrongDM Desktop Application before 23.74.0 (Desktop Client before 53.77.0) on Microsoft Windows stores authentication s

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an attack chain utilizing

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NP

uniFLOW Universal Login Manager (ULM) Standalone contains an information disclosure vulnerability that may allow an auth

ICU Scandinavia Boomerang is vulnerable to an information disclosure flaw where sensitive credential files are exposed v

@hapi/wreck is an HTTP client utility. Prior to 18.1.1, when @hapi/wreck follows a 3xx redirect to a different hostname,

CWE-522 Insufficiently Protected Credentials vulnerability exists that could cause authentication bypass and unauthorize

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior

A security bypass vulnerability in the Account Protection feature of Palo Alto Networks Prisma® Browser enables a user

An information disclosure vulnerability in the Account Protection feature of Palo Alto Networks Prisma® Browser enables