CWE-522

Newforma Info Exchange (NIX) stores credentials used to configure NPCS in 'HKLM\Software\WOW6432Node\Newforma\<version>

Due to information disclosure vulnerability in anonymous API provided by SAP Business One (SLD), an attacker with normal

A security vulnerability has been detected in Intelbras ICIP 2.0.20. Affected is an unknown function of the file /xml/si

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Insufficiently Protected Credentials vulnera

Unsafe password recovery from configuration in M-Files Server before 25.1 allows a highly privileged user to recover ext

The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host

Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the AD/LDAP user import functionality as it fa

EasyFlow GP developed by Digiwin has an Insufficiently Protected Credentials vulnerability, allowing privileged remote a

EasyFlow GP developed by Digiwin has an Insufficiently Protected Credentials vulnerability, allowing privileged remote a

Dependency-Track is a component analysis platform that allows organizations to identify and reduce risk in the software

In Nintex Automation 5.6 and 5.7 before 5.8, the K2 SmartForms Designer folder has configuration files (web.config) cont

Jenkins ReadyAPI Functional Testing Plugin 1.11 and earlier does not mask SLM License Access Keys, client secrets, and p

Jenkins QMetry Test Management Plugin 1.13 and earlier does not mask Qmetry Automation API Keys displayed on the job con

Jenkins Testsigma Test Plan run Plugin 1.6 and earlier does not mask Testsigma API keys displayed on the job configurati

Jenkins VAddy Plugin 1.2.8 and earlier does not mask Vaddy API Auth Keys displayed on the job configuration form, increa

BMC Control-M/Server 9.0.21.300 displays cleartext database credentials in process lists and logs. An authenticated atta

GitHub Workflow Updater is a VS Code extension that automatically pins GitHub Actions to specific commits for enhanced s

Exposure of credentials in unintended requests in Devolutions Server.This issue affects Server: through 2025.2.20, throu

A vulnerability, which was classified as problematic, has been found in 70mai M300 up to 20250611. This issue affects so

A Credential Disclosure vulnerability exists where an administrator could extract the stored SMTP account credentials du

Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Insufficien

Mattermost versions 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to negotiate a new token when accepting the invite which al

Insufficiently Protected Credentials vulnerability in OpenText Identity Manager Advanced Edition on Windows, Linux, 64 b

Pass-Back vulnerability in versions prior to 2025.35.000 of Sage 200 Spain. This vulnerability allows an authenticated a

The exposure of credentials in the call forwarding configuration module in MeetMe products in versions prior to 2024-09

Insufficiently Protected Credentials vulnerability in SicommNet BASEC on SaaS allows Password Recovery. Passwords are ei

MinIO Operator STS is a native IAM Authentication for Kubernetes. Prior to version 7.1.0, if no audiences are provided f

tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a private key can be extracted on signing

An information disclosure vulnerability exists in OneLogin AD Connector versions prior to 6.1.5 via the /api/adc/v4/conf

A vulnerability exists in Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Mana

Access to TSplus Remote Access Admin Tool is restricted to administrators (unless "Disable UAC" option is enabled) and r

The Janssen Project is an open-source identity and access management (IAM) platform. In versions 1.9.0 and below, Jansse

Local Deep Research is an AI-powered research assistant for deep, iterative research. Versions 0.2.0 through 0.6.7 store

api is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© (PBX). In versions lower t

Onyxia is a data science environment for kubernetes. In versions 4.6.0 through 4.8.0, Onyxia-API leaked the credentials

In Puppet Enterprise versions 2025.4.0 and 2025.5, the encryption key used for encrypting content in the Infra Assistant

This vulnerability allows an attacker to access parts of the application that are not protected by any type of access co

Username Enumeration vulnerabilities allow access to application level username add, delete, modify and list functions. 

pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows

H3C ER8300G2-X is vulnerable to Incorrect Access Control. The password for the router's management system can be accesse

Westermo EDW-100 devices through 2024-05-03 allow an unauthenticated user to download a configuration file containing a

Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Auth

STMicroelectronics SPC58 is vulnerable to Missing Protection Mechanism for Alternate Hardware Interface. Code running as

GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ

Insufficiently protected credentials (CWE-522) for third party DVR integrations to the Command Centre Server are access

A Plaintext Storage of a Password vulnerability in ebooknote function in Hamastar MeetingHub Paperless Meetings 2021 all

A vulnerability has been identified in the way that Rancher stores vSphere's CPI (Cloud Provider Interface) and CSI (Con

Pentaminds CuroVMS v2.0.1 was discovered to contain exposed credentials.

HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue. A network-adjacent unauthenticated at

The webserver utilizes basic authentication for its user login to the configuration interface. As encryption is disabled