Filtered by CWE-256
Filtered by vendor Subscriptions
Total 162 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-33079 1 Ibm 2 Cognos Controller, Controller 2025-08-26 6.5 Medium
IBM Controller 11.0.0, 11.0.1, and 11.1.0 application could allow an authenticated user to obtain sensitive credentials that may be inadvertently included within the source code.
CVE-2025-4286 1 Intelbras 2 Incontrol, Incontrol Web 2025-08-20 2.7 Low
A vulnerability was found in Intelbras InControl up to 2.21.59. It has been classified as problematic. Affected is an unknown function of the component Dispositivos Edição Page. The manipulation of the argument Senha de Comunicação leads to unprotected storage of credentials. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. According to the vendor this issue should be fixed in a later release.
CVE-2025-2770 1 Bectechnologies 1 Router Firmware 2025-08-15 6.5 Medium
BEC Technologies Multiple Routers Cleartext Password Storage Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of BEC Technologies routers. Authentication is required to exploit this vulnerability. The specific flaw exists within the web-based user interface. The issue results from storing credentials in a recoverable format. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-25986.
CVE-2023-50956 1 Ibm 1 Storage Defender Resiliency Service 2025-08-09 4.4 Medium
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.9 could allow a privileged user to obtain highly sensitive user credentials from secret keys that are stored in clear text.
CVE-2024-49351 1 Ibm 2 Tivoli Workload Scheduler, Workload Scheduler 2025-08-08 5.5 Medium
IBM Workload Scheduler 9.5, 10.1, and 10.2 stores user credentials in plain text which can be read by a local user.
CVE-2024-52361 1 Ibm 1 Storage Defender Resiliency Service 2025-08-08 5.7 Medium
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.9  stores user credentials in plain text which can be read by an authenticated user with access to the pod.
CVE-2025-45702 2025-07-25 6.5 Medium
SoftPerfect Pty Ltd Connection Quality Monitor v1.1 was discovered to store all credentials in plaintext.
CVE-2025-52164 2025-07-22 8.2 High
Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to store credentials in plaintext.
CVE-2025-53669 1 Jenkins 1 Vaddy 2025-07-18 4.3 Medium
Jenkins VAddy Plugin 1.2.8 and earlier does not mask Vaddy API Auth Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
CVE-2025-53665 1 Jenkins 1 Apica Loadtest 2025-07-18 4.3 Medium
Jenkins Apica Loadtest Plugin 1.10 and earlier does not mask Apica Loadtest LTP authentication tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
CVE-2025-53664 1 Jenkins 1 Apica Loadtest 2025-07-18 6.5 Medium
Jenkins Apica Loadtest Plugin 1.10 and earlier stores Apica Loadtest LTP authentication tokens unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
CVE-2025-53655 1 Jenkins 1 Statistics Gatherer 2025-07-18 5.3 Medium
Jenkins Statistics Gatherer Plugin 2.0.3 and earlier does not mask the AWS Secret Key on the global configuration form, increasing the potential for attackers to observe and capture it.
CVE-2025-53660 1 Jenkins 1 Qmetry Test Management 2025-07-18 4.3 Medium
Jenkins QMetry Test Management Plugin 1.13 and earlier does not mask Qmetry Automation API Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
CVE-2025-53656 1 Jenkins 1 Readyapi Functional Testing 2025-07-18 6.5 Medium
Jenkins ReadyAPI Functional Testing Plugin 1.11 and earlier stores SLM License Access Keys, client secrets, and passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
CVE-2025-53662 1 Jenkins 1 Ifttt Build Notifier 2025-07-18 6.5 Medium
Jenkins IFTTT Build Notifier Plugin 1.2 and earlier stores IFTTT Maker Channel Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
CVE-2025-7357 2025-07-18 N/A
LITEON IC48A firmware versions prior to 01.00.19r and LITEON IC80A firmware versions prior to 01.01.12e store FTP-server-access-credentials in cleartext in their system logs.
CVE-2025-1709 2025-07-03 6.5 Medium
Several credentials for the local PostgreSQL database are stored in plain text (partially base64 encoded).
CVE-2024-23486 2 Buffalo, Buffalo Inc 11 A2533dhp2, Wsr-2533dhp, Wsr-2533dhp2 and 8 more 2025-06-30 9.8 Critical
Plaintext storage of a password issue exists in BUFFALO wireless LAN routers, which may allow a network-adjacent unauthenticated attacker with access to the product's login page may obtain configured credentials.
CVE-2025-6560 2025-06-26 9.8 Critical
Multiple wireless router models from Sapido have an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to directly access a system configuration file and obtain plaintext administrator credentials.  The affected models are out of support; replacing the device is recommended.
CVE-2025-6561 2025-06-26 9.8 Critical
Certain hybrid DVR models ((HBF-09KD and HBF-16NK)) from Hunt Electronic have an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to directly access a system configuration file and obtain plaintext administrator credentials.