Filtered by CWE-522
Filtered by vendor Subscriptions
Total 1365 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-7565 1 Lb-link 2 Bl-ac3600, Bl-ac3600 Firmware 2025-07-17 5.3 Medium
A vulnerability, which was classified as critical, was found in LB-LINK BL-AC3600 up to 1.0.22. This affects the function geteasycfg of the file /cgi-bin/lighttpd.cgi of the component Web Management Interface. The manipulation of the argument Password leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-38291 1 Extremenetworks 1 Xiq-se 2025-07-11 8.8 High
In XIQ-SE before 24.2.11, a low-privileged user may be able to access admin passwords, which could lead to privilege escalation.
CVE-2020-9250 1 Huawei 2 Mate 20 Pro, Mate 20 Pro Firmware 2025-07-11 3.3 Low
There is an insufficient authentication vulnerability in some Huawei smart phone. An unauthenticated, local attacker can crafts software package to exploit this vulnerability. Due to insufficient verification, successful exploitation may impact the service. (Vulnerability ID: HWPSIRT-2019-12302) This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2020-9250.
CVE-2024-50699 1 Tp-link 2 Tl-wr845n, Tl-wr845n Firmware 2025-07-02 8 High
TP-Link TL-WR845N(UN)_V4_201214, TL-WR845N(UN)_V4_200909 and TL-WR845N(UN)_V4_190219 were discovered to contain weak default credentials for the Administrator account.
CVE-2025-4679 1 Synology 1 Active Backup For Microsoft 365 2025-07-02 6.5 Medium
A vulnerability in Synology Active Backup for Microsoft 365 allows remote authenticated attackers to obtain sensitive information via unspecified vectors.
CVE-2023-29055 1 Apache 1 Kylin 2025-06-20 7.5 High
In Apache Kylin version 2.0.0 to 4.0.3, there is a Server Config web interface that displays the content of file 'kylin.properties', that may contain serverside credentials. When the kylin service runs over HTTP (or other plain text protocol), it is possible for network sniffers to hijack the HTTP payload and get access to the content of kylin.properties and potentially the containing credentials. To avoid this threat, users are recommended to  * Always turn on HTTPS so that network payload is encrypted. * Avoid putting credentials in kylin.properties, or at least not in plain text. * Use network firewalls to protect the serverside such that it is not accessible to external attackers. * Upgrade to version Apache Kylin 4.0.4, which filters out the sensitive content that goes to the Server Config web interface.
CVE-2024-46341 1 Tp-link 2 Tl-wr845n, Tl-wr845n Firmware 2025-06-20 8 High
TP-Link TL-WR845N(UN)_V4_190219 was discovered to transmit credentials in base64 encoded form, which can be easily decoded by an attacker executing a man-in-the-middle attack.
CVE-2023-50125 1 Hozard 1 Alarm System 2025-06-20 5.9 Medium
A default engineer password set on the Hozard alarm system (Alarmsysteem) v1.0 allows an attacker to bring the alarm system to a disarmed state.
CVE-2023-6421 1 W3eden 1 Download Manager 2025-06-18 7.5 High
The Download Manager WordPress plugin before 3.2.83 does not protect file download's passwords, leaking it upon receiving an invalid one.
CVE-2023-29447 1 Ptc 3 Kepware Kepserverex, Thingworx Industrial Connectivity, Thingworx Kepware Server 2025-06-17 5.7 Medium
An insufficiently protected credentials vulnerability in KEPServerEX could allow an adversary to capture user credentials as the web server uses basic authentication.
CVE-2024-22312 1 Ibm 1 Storage Defender Resiliency Service 2025-06-10 4.4 Medium
IBM Storage Defender - Resiliency Service 2.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 278748.
CVE-2023-36266 1 Keepersecurity 2 Keeper, Keeperfill 2025-06-09 5.5 Medium
An issue was discovered in Keeper Password Manager for Desktop version 16.10.2 (fixed in 17.2), and the KeeperFill Browser Extensions version 16.5.4 (fixed in 17.2), allows local attackers to gain sensitive information via plaintext password storage in memory after the user is already logged in, and may persist after logout. NOTE: the vendor disputes this for two reasons: the information is inherently available during a logged-in session when the attacker can read from arbitrary memory locations, and information only remains available after logout because of memory-management limitations of web browsers (not because the Keeper technology itself is retaining the information).
CVE-2021-43978 1 Allegro 1 Allegro 2025-05-30 7.1 High
Allegro WIndows 3.3.4152.0, embeds software administrator database credentials into its binary files, which allows users to access and modify data using the same credentials.
CVE-2019-12046 2 Debian, Lemonldap-ng 2 Debian Linux, Lemonldap\ 2025-05-28 N/A
LemonLDAP::NG -2.0.3 has Incorrect Access Control.
CVE-2022-41255 1 Jenkins 1 Cons3rt 2025-05-28 6.5 Medium
Jenkins CONS3RT Plugin 1.0.0 and earlier stores Cons3rt API token unencrypted in job config.xml files on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
CVE-2022-41247 1 Jenkins 1 Bigpanda Notifier 2025-05-27 4.3 Medium
Jenkins BigPanda Notifier Plugin 1.4.0 and earlier stores the BigPanda API key unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
CVE-2018-16153 1 Apereo 1 Opencast 2025-05-27 7.5 High
An issue was discovered in Apereo Opencast 4.x through 10.x before 10.6. It sends system digest credentials during authentication attempts to arbitrary external services in some situations.
CVE-2018-5446 1 Medtronic 2 2090 Carelink Programmer, 2090 Carelink Programmer Firmware 2025-05-22 4.9 Medium
Medtronic 2090 CareLink Programmer uses a per-product username and password that is stored in a recoverable format.
CVE-2018-10622 1 Medtronic 4 Mycarelink 24950 Patient Monitor, Mycarelink 24950 Patient Monitor Firmware, Mycarelink 24952 Patient Monitor and 1 more 2025-05-22 4.9 Medium
Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials for network authentication and encryption of local data at rest.
CVE-2022-37193 1 Chipolo 2 Chipolo, Chipolo One 2025-05-22 7.4 High
Chipolo ONE Bluetooth tracker (2020) Chipolo iOS app version 4.13.0 is vulnerable to Incorrect Access Control. Chipolo devices suffer from access revocation evasion attacks once the malicious sharee obtains the access credentials.