CWE-522

IBM Sterling Partner Engagement Manager 6.1.0, 6.2.0, 6.2.2 JWT secret is stored in public Helm Charts and is not stored

CyberData 011209 Intercom does not properly store or protect web server admin credentials.

E3 Site Supervisor Control (firmware version < 2.31F01) RCI service contains an API call to read users info, which retur

Ericsson Indoor Connect 8855 contains a vulnerability where server-side security can be bypassed in the client which if

All versions of Dingtian DT-R002 are vulnerable to an Insufficiently Protected Credentials vulnerability that could allo

QiHang Media Web Digital Signage 3.0.9 contains a cleartext credentials vulnerability that allows unauthenticated attack

NuCom 11N Wireless Router 5.07.90 contains a privilege escalation vulnerability that allows non-privileged users to acce

ZBL EPON ONU Broadband Router V100R001 contains a privilege escalation vulnerability that allows limited administrative

The Sante PACS Server Web Portal sends credential information without encryption.

Insufficiently protected credentials in Azure Local Cluster allows an authorized attacker to disclose information locall

Jenkins Credentials Binding Plugin 687.v619cb_15e923f and earlier does not properly mask (i.e., replace with asterisks)

Dell Digital Delivery, versions prior to 5.6.1.0, contains an Insufficiently Protected Credentials vulnerability. A remo

Improper handling of OTP/TOTP/HOTP values in NetKnights GmbH privacyIDEA Authenticator v.4.3.0 on Android allows local a

phpgt/Dom provides access to modern DOM APIs. Versions of phpgt/Dom prior to 4.1.8 expose the GITHUB_TOKEN in the Dom wo

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. In versions 0.8.0 through 0.9.21 and 1.

Cryptographic key extraction from internal flash in Minut M2 with firmware version #15142 allows physically proximate at

An authenticated attacker can reconfigure the target device to use an external service (such as LDAP or FTP) controlled

Insufficiently Protected Credentials in LDAP in Konica Minolta bizhub 227 Multifunction printers version GCQ-Y3 or earli

GitHub Desktop is an open-source Electron-based GitHub app designed for git development. An attacker convincing a user t

BEC Technologies Multiple Routers Insufficiently Protected Credentials Information Disclosure Vulnerability. This vulner

A vulnerability in Synology Active Backup for Microsoft 365 allows remote authenticated attackers to obtain sensitive in

MedDream WEB DICOM Viewer Cleartext Transmission of Credentials Information Disclosure Vulnerability. This vulnerability

IBM Controller 11.0.0, 11.0.1, and 11.1.0 application could allow an authenticated user to obtain sensitive credentials

Jenkins Statistics Gatherer Plugin 2.0.3 and earlier stores the AWS Secret Key unencrypted in its global configuration f

Jenkins Nouvola DiveCloud Plugin 1.08 and earlier does not mask DiveCloud API Keys and Credentials Encryption Keys displ

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to vers

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provide

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Argo Wo

The Ubia camera ecosystem fails to adequately secure API credentials, potentially enabling an attacker to connect to ba

IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.3 could allow an authenticated user with LLM integration configuration pri

Extraction of Account Connectivity Credentials (ACCs) from the IT Management Agent secure storage

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauth

A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.3). Affected SIMATIC RTLS Locati

IBM Common Licensing 9.0 stores user credentials in plain clear text which can be read by a local user.

A 3rd-party component exposed its password in process arguments, allowing for low-privileged users to access it.

GRAU DATA Blocky before 3.1 stores passwords encrypted rather than hashed. At the login screen, the user's password is c

Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.00

A password is exposed locally.

Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. In versions 1.

HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a credential leakage which could allow an attacker to access

Insufficiently Protected Credentials in the Crowdstrike connector can lead to Crowdstrike credentials being leaked. A ma

HCL MyXalytics is affected by broken authentication. It allows attackers to compromise keys, passwords, and session tok

IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.3 UI could disclosure the installation path

Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to

Jenkins Dead Man's Snitch Plugin 0.1 does not mask Dead Man's Snitch tokens displayed on the job configuration form, inc

Jenkins Applitools Eyes Plugin 1.16.5 and earlier does not mask Applitools API keys displayed on the job configuration f

A vulnerability, which was classified as critical, was found in LB-LINK BL-AC3600 up to 1.0.22. This affects the functio

Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 has Insufficiently Protected Credenti

When a Java command with password parameters is executed and terminated by NeuVector for Process rule violation the pass

All versions of Dingtian DT-R002 are vulnerable to an Insufficiently Protected Credentials vulnerability that could allo