CWE-256.

Turms Server v0.10.0-SNAPSHOT and earlier contains a plaintext password storage vulnerability in the administrator authentication system.

• Information disclosure
• CWE-256

Insecure Password Storage in WODESYS WD-R608U router

• WODESYS WD-R608U
• WODESYS WDR28
• CWE-256

HCL Workload Scheduler is vulnerable to plain text storage of a password

• HCL Software Workload Scheduler
• CWE-256

SGAI Space1 NAS N1211DS gsaiagent JSONAPI GET_USER_INFO credentials storage

• SGAI Space1 NAS N1211DS
• CWE-255
• CWE-256

Plaintext password storage in Kotaemon 0.11.0 in the client's localStorage.

• CWE-256

Intelbras UnniTI usuarios.xml credentials storage

• Intelbras UnniTI
• CWE-255
• CWE-256

Intelbras ICIP acessodeusuario.xml credentials storage

• Intelbras ICIP
• CWE-255
• CWE-256

Hard-coded admin credentials in Quick.CMS

• OpenSolution QuickCMS
• CWE-256

Plaintext password storage in Dell CloudLink

• Dell CloudLink
• CWE-256

Plaintext password storage in Lenovo Tab M11 TB330FU TB330XU and others

• Lenovo Tab M11 TB330FU TB330XU
• Lenovo Tab K11 TB330FU TB330FUP TB330XU TB330XUP
• CWE-256

IBM Sterling B2B Integrator information disclosure

• IBM Sterling B2B Integrator
• IBM Sterling File Gateway
• CWE-256
• CWE-260

Minecraft RCON Terminal: Plain Text Password Storage in Configuration

• jaketcooper Minecraft-rcon
• CWE-256

Vasion Print (formerly PrinterLogic) Readable Cleartext Passwords

• Vasion Print Virtual Appliance Host
• Vasion Print Application
• CWE-256

Plaintext password storage in Dell PowerProtect Data Manager

• Dell PowerProtect Data Manager
• CWE-256

Multi Linux Manager epxoses the plain text HTTP Proxy user:password in logs

• Container suse/manager/4.3/proxy-httpd:4.3.16.9.67.1
• Container suse/manager/5.0/x86_64/proxy-httpd:5.0.5.7.23.1
• CWE-256

SoftPerfect Pty Ltd Connection Quality Monitor v1.1 was discovered to store all credentials in plaintext.

• CWE-256

Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to store credentials in plaintext.

• CWE-256

Plaintext Storage of a Password in LITEON IC48A and IC80A EV Chargers

• LITEON IC48A EV Charger
• LITEON IC80A EV Charger
• CWE-256

Jenkins VAddy Plugin vulnerability exposes plaintext keys on its job configuration form

• Hard-coded credentials
• CWE-256

<=1.2.8 · no fixed version yet

Jenkins Warrior Framework Plugin vulnerability exposes unencrypted passwords to certain authenticated users

• CWE-256

<=1.2 · no fixed version yet

Jenkins Xooa Plugin vulnerability does not mask its Xooa Deployment Token

• CWE-256

<=0.0.7 · no fixed version yet

Jenkins Sensedia API Platform Plugin vulnerability exposes unencrypted tokens

• CWE-256

<=1.0 · no fixed version yet

Jenkins Apica Loadtest Plugin vulnerability exposes authentication tokens

• Hard-coded credentials
• CWE-256

<=1.10 · no fixed version yet

Jenkins IFTTT Build Notifier Plugin vulnerability exposes IFTTT Maker Channel Keys

• Hard-coded credentials
• CWE-256

<=1.2 · no fixed version yet

Jenkins QMetry Test Management Plugin vulnerability exposes API keys

• Hard-coded credentials
• CWE-256

<=1.13 · no fixed version yet

Jenkins ReadyAPI Functional Testing Plugin vulnerability stores unencrypted authentication credentials

• Hard-coded credentials
• CWE-256

<=1.11 · no fixed version yet

Jenkins Nouvola DiveCloud Plugin vulnerability does not mask keys on its job configuration form

• Hard-coded credentials
• CWE-256

<=1.08 · no fixed version yet

Jenkins Apica Loadtest Plugin vulnerability exposes authentication tokens

• Hard-coded credentials
• CWE-256

<=1.10 · no fixed version yet

Jenkins Statistics Gatherer Plugin does not mask AWS Secret Key

• CWE-256

<=2.0.3 · no fixed version yet

CVE-2025-1709

• Endress+Hauser MEAC300-FNADE4
• CWE-256

Hunt Electronic Hybrid DVR - Exposure of Sensitive System Information

• Hunt Electronic HBF-09KD
• Hunt Electronic HBF-16NK
• Information disclosure
• CWE-256

Sapido Wireless Router - Exposure of Sensitive Information

• Sapido BR071n
• Sapido BR261c
• CWE-256

Honding Technology Smart Parking Management System - Exposure of Sensitive Information

• Honding Technology Smart Parking Management System
• Information disclosure
• CWE-256

Simple History <= 5.8.1 - Authenticated (Administrator+) Sensitive Information Exposure via Detective Mode

• eskapism Simple History – Track, Log, and Audit WordPress Changes
• CWE-256

Plaintext password storage in Hitachi Energy Asset Suite

• Hitachi Energy Asset Suite
• CWE-256

MICI Network Co. Ltd. NetFax Server Disclosure of Stored Passwords in Cleartext

• MICI Network Co. Ltd. NetFax Server
• CWE-256

IBM Controller information disclosure

• IBM Controller
• IBM Cognos Controller
• CWE-256

Information Disclosure vulnerability in SAP GUI for Windows

• SAP_SE SAP GUI for Windows
• CWE-256

Exposure of Device Configuration without Authentication in WF2220

• Netis Systems WF2220
• Authentication bypass
• CWE-256

On affected platforms running Arista EOS with a gNMI transport enabled, running the gNOI File TransferToRemote RPC with credentials for a remote server may cause these remote-server credentials to be…

• Arista Networks EOS
• CWE-256

Intelbras InControl Dispositivos Edição Page credentials storage

• Intelbras InControl
• CWE-255
• CWE-256

BEC Technologies Multiple Routers Cleartext Password Storage Information Disclosure Vulnerability

• BEC Technologies Multiple Routers
• CWE-256

An issue in Macro-video Technologies Co.,Ltd V380E6_C1 IP camera (Hw_HsAKPIQp_WF_XHR) 1020302 allows a physically proximate attacker to execute arbitrary code via the /mnt/mtd/mvconf/wifi.ini and /mn…

• CWE-256

MySQL K8s charm could leak credentials for root-level user `serverconfig`

• canonical mysql-k8s-operator
• CWE-256

Jenkins Cadence vManager Plugin Stores Verisium Manager vAPI keys Unencrypted

• Information disclosure
• CWE-256

<4.0.1 · fixed in 4.0.1

IBM InfoSphere Information Server information disclosure

• IBM InfoSphere Information Server
• CWE-256

Insufficiently Protected Credentials in transformeroptimus/superagi

• transformeroptimus/superagi
• CWE-256

BlackVue App API Endpoint credentials storage

• BlackVue App
• CWE-255
• CWE-256

IBM QRadar EDR information disclosure

• IBM QRadar EDR
• CWE-256

Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Password in URL OVE-20230524-0005.

• CWE-256

Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Password Stored in Process List V-2023-011.

• CWE-256

Bosscomm IF740 Firmware versions:11001.7078 & v11001.0000 and System versions: 6.25 & 6.00 were discovered to store passwords in cleartext.

• CWE-256

Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 21…

• CWE-256

Camera passwords stored in clear text

• ABB System 800xA
• CWE-256

IBM Common Licensing information disclosure

• IBM Common Licensing
• CWE-256

Plaintext default credentials in firmware

• Iocharger firmware for AC models
• Hard-coded credentials
• CWE-256

Plaintext password storage in Dell VxRail HCI

• Dell VxRail HCI
• CWE-256

Plaintext password storage in Dell VxRail HCI

• Dell VxRail HCI
• CWE-256

IBM Storage Defender - Resiliency Service information disclosure

• IBM Storage Defender - Resiliency Service
• CWE-256

IBM Storage Defender - Resiliency Service information disclosure

• IBM Storage Defender - Resiliency Service
• CWE-256