Advisories · Weakness
CWE-257.
Every Advisory and CVE whose sources give the weakness CWE-257, newest first.
- CVSS 9.3 CriticalCritical · CVSS 9+
Red Lion Controls N-Tron 700 Series Storing Passwords in a Recoverable Format
- Red Lion Controls 700 Series
- CWE-257
- CVSS 5.3 Medium
Improperly Stored Credentials
- Itron MV-90 xi
- CWE-257
- CWE-260
- CVSS 6.5 Medium
Windows DHCP Server Information Disclosure Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- CWE-257
- CVSS 4.7 Medium
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Plaintext Storage of a Password vulnerability.
- Dell Secure Connect Gateway 5.0 - Application
- Dell Secure Connect Gateway 5.0 - Appliance
- CWE-257
- CVSS 7.5 High
Storage of passwords in a reversible format
- ANDRITZ HIPASE-250
- ANDRITZ 250 SCALA
- Weak cryptography or TLS
- CWE-257
- CVSS 5.3 Medium
Stored credentials in Redmine
- Redmine
- CWE-257
- CVSS 4.1 Medium
Fortinet FortiSOAR PaaS: A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS…
- Fortinet FortiSOAR PaaS
- Fortinet FortiSOAR on-premise
- CWE-257
- CVSS 4.1 Medium
Fortinet FortiSOAR PaaS: A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS…
- Fortinet FortiSOAR PaaS
- Fortinet FortiSOAR on-premise
- CWE-257
- CVSS 9.1 CriticalCritical · CVSS 9+
Recoverable obfuscation using the OECH1 prefix encoding in OpenEdge
- Progress Software Corporation OpenEdge
- CWE-257
- CVSS 8.6 High
Hirschmann HiLCOS Classic Platform Password Exposure via SNMP
- Belden Hirschmann HiLCOS Classic Platform
- CWE-257
- CVSS 6.1 Medium
Eaton EasySoft: The encryption mechanism used in Eaton's EasySoft project file was insecure and…
- Eaton EasySoft
- CWE-257
- CVSS 8.2 High
RustDesk Encrypts Local Passwords with World-Readable Machine ID and Fixed Zero Nonce (XSalsa20-Poly1305)
- rustdesk-client RustDesk Client
- Weak cryptography or TLS
- Prototype pollution
- CVSS 7.5 HighCritical · KEVKEV
Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability
- Cisco Catalyst SD-WAN Manager
- CWE-257
- CVSS 6.8 Medium
Use of a hardcoded static key to protect sensitive data in Explorance Blue
- Explorance Blue
- CWE-257
- CVSS 7.0 High
Automated Logic WebCTRL and Carrier i-Vu Session Fixation
- Automated Logic WebCTRL
- Carrier i-Vu
- CWE-257
- CVSS 5.9 Medium
Recoverable passwords in Asseco Infomedica Plus
- Asseco InfoMedica Plus
- CWE-257
- CVSS 8.4 High
NetSupport Manager < 14.12.0001 Gateway Key Reversible Encoding Credential Recovery
- NetSupport Software Manager
- CWE-257
- CVSS 6.7 Medium
A vulnerability has been identified in SiPass integrated (All versions < V3.0).
- Siemens SiPass integrated
- CWE-257
- CVSS 4.8 Medium
Newforma Info Exchange (NIX) insufficiently protected credentials
- Newforma Project Center
- Hard-coded credentials
- Information disclosure
- CVSS 7.5 High
HCL Compass is affected by a security vulnerability
- HCL Software Compass
- CWE-257
- CVSS 5.8 Medium
XWiki PDF export jobs store sensitive cookies unencrypted in job statuses
- CWE-212
- CWE-257
>=14.4.2, <16.4.8 || >=16.5.0-rc-1, <16.10.7 || >=17.0.0-rc-1, <17.4.0-rc-1 · fixed in 16.4.8, 16.10.7, 17.4.0-rc-1
GHSA-9m7c-m33f-3429 · CVE-2025-58049 - CVSS 5.3 Medium
Vulnerability in Initial Administrator Login Process
- Commvault CommCell
- CWE-257
- CVSS 9.0 CriticalCritical · CVSS 9+
Privilege escalation issue in Amazon EMR Secret Agent component
- Amazon EMR
- CWE-257
- CVSS 5.3 Medium
RUCKUS Network Director (RND) before 4.5 stores passwords in a recoverable format.
- RUCKUS Network Director
- CWE-257
- CVSS 8.4 High
Improper Encryption in Ivanti Endpoint Manager
- Ivanti Endpoint Manager
- CWE-257
- CVSS 8.4 High
Improper Encryption in Ivanti Endpoint Manager
- Ivanti Endpoint Manager
- CWE-257
- CVSS 4.4 Medium
CVE-2025-27459
- Endress+Hauser MEAC300-FNADE4
- CWE-257
- CVSS 7.1 High
Weak Password Storage
- ABB ASPECT-Enterprise
- ABB NEXUS Series
- CWE-257
- CVSS 3.4 Low
An issue in Macro-video Technologies Co.,Ltd V380 Pro android application 2.1.44 and V380 Pro android application 2.1.64 allows an attacker to obtain sensitive information via the QE code based shari…
- CWE-257
- CWE-656
- CVSS 2.1 Low
Fortinet FortiOS: A storing passwords in a recoverable format in Fortinet FortiOS 7.4.0 through 7.4.8…
- Fortinet FortiOS
- CWE-257
- CVSS 4.6 Medium
Inaba Denki Sangyo Co., Ltd. CHOCO TEI WATCHER mini…: Storing passwords in a recoverable format issue exists in CHOCO TEI WATCHER mini…
- Inaba Denki Sangyo Co., Ltd. CHOCO TEI WATCHER mini (IB-MCT001)
- CWE-257
- CVSS 7.7 High
Privilege Escalation in SIMPLE.ERP
- Simple SA SIMPLE.ERP
- CWE-257
- CVSS 5.9 Medium
User passwords are decrypted and stored on memory before any user logged in.
- Sharp Corporation Multiple MFPs (multifunction printers)
- Toshiba Tec Corporation Multiple MFPs (multifunction printers)
- CWE-257
- CVSS 5.5 Medium
Cisco ATA 190 Series Analog Telephone Adapter Muliplatform Firmware Information Disclosure Vulnerability
- Cisco Analog Telephone Adaptor (ATA) Software
- Information disclosure
- CWE-257
- CVSS 3.0 Low
TopQuadrant TopBraid EDG password manager stores external credentials insecurely
- TopQuadrant TopBraid EDG
- Information disclosure
- CWE-257
- CVSS 2.7 Low
WP Mail SMTP <= 4.0.1 - Authenticated (Admin+) SMTP Password Exposure
- smub WP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin
- CWE-257
- CVSS 6.8 Medium
American Dynamics Illustra Essentials Gen 4 - Reversible User Credential - stored web interface
- Johnson Controls American Dynamics Illustra Essentials Gen 4
- CWE-257
- CVSS 6.8 Medium
American Dynamics Illustra Essentials Gen 4 - Reversible User Credential - Linux
- Johnson Controls American Dynamics Illustra Essentials Gen 4
- CWE-257
- CVSS 2.7 Low
Easy WP SMTP by SendLayer <= 2.3.0 - Exposure of Sensitive Information via the UI
- smub Easy WP SMTP – WordPress SMTP and Email Logs: Gmail, Office 365, Outlook, Custom SMTP, and more
- CWE-257
- CVSS 4.9 Medium
CyberPower PowerPanel business Storing Passwords in a Recoverable Format
- CyberPower PowerPanel business
- CWE-257
- CVSS 6.4 Medium
LoadMaster Reversible Password Encryption Algorithm
- Progress Software Corporation LoadMaster
- CWE-257
- CVSS 6.1 Medium
Claris FileMaker Server: Claris International has successfully resolved an issue of potentially exposing password…
- Claris FileMaker Server
- CWE-257
- CVSS 7.5 High
Unitronics Vision Standard Unauthenticated Password Retrieval
- Unitronics Vision230
- Unitronics Vision280
- CWE-257
- CVSS 6.8 Medium
IBM OpenPages with Watson information disclosure
- IBM OpenPages with Watson
- CWE-257
- CVSS 5.1 Medium
IBM Security Access Manager Container information disclosure
- IBM Security Verify Access Appliance
- IBM Security Verify Access Docker
- CWE-257
- CVSS 7.5 High
Incorrect Implementation of Authentication Algorithm Vulnerability
- Moxa NPort 6000 Series
- Authentication bypass
- Weak cryptography or TLS
- CVSS 4.3 Medium
Hitachi Vantara Pentaho Business Analytics Server – Password Stored in a Recoverable Format
- Hitachi Vantara Pentaho Business Analytics Server
- CWE-257
- CVSS 7.3 High
Alaris Infusion Central: The Alaris Infusion Central software, versions 1.1 to 1.3.2…
- Alaris Infusion Central
- CWE-257
- CVSS 6.7 Medium
Pimcore customers' list user password hash is disclosed
- Hard-coded credentials
- CWE-257
<3.3.10 · fixed in 3.3.10
GHSA-j65r-g7q2-f8v3 · CVE-2023-2881 - CVSS 8.0 High
Storing Passwords in a Recoverable Format
- Schweitzer Engineering Laboratories SEL-3505
- Schweitzer Engineering Laboratories SEL-3505-3
- CWE-257
- CVSS 6.5 Medium
Azure Machine Learning Compute Instance Information Disclosure Vulnerability
- Microsoft Azure Machine Learning
- CWE-257
- CVSS 8.0 High
Schneider Electric Data Center Expert: A CWE-257: Storing Passwords in a Recoverable Format vulnerability exists that could…
- Schneider Electric Data Center Expert
- CWE-257
- CVSS 7.8 High
Windows Credential Manager User Interface Elevation of Privilege Vulnerability
- Microsoft Windows 10 Version 1809
- Microsoft Windows Server 2019
- CWE-257
- CVSS 5.2 Medium
Affected devices store the CLI user passwords encrypted in flash memory.
- Siemens RUGGEDCOM RM1224 LTE(4G) EU
- Siemens RUGGEDCOM RM1224 LTE(4G) NAM
- CWE-257
- CVSS 7.8 High
cSRX Series: Storing Passwords in a Recoverable Format and software permissions issues allows a local attacker to elevate privileges
- Juniper Networks Junos OS
- CWE-257
- CWE-275
- CVSS 8.1 High
ABB Ability TM Operations Data Management Zenon Zenon Log Server file access control
- ABB Zenon
- CWE-257
- CVSS 6.2 Medium
ABB Ability TM Operations Data Management Zenon Zenon Log Server file access control
- ABB Zenon
- CWE-257
- CVSS 6.5 Medium
Jenkins Credentials Binding Plugin Stores Passwords in a Recoverable Format
- Hard-coded credentials
- CWE-257
=1.17 · no fixed version yet
GHSA-j7gw-mwfg-vqf4 · CVE-2019-1010241 - CVSS 6.5 Medium
User Credentials Stored in a Recoverable Format within Fidelis Network and Deception
- Fidelis Cybersecurity Fidelis Network
- Fidelis Cybersecurity Fidelis Deception
- CWE-257
-
ZOLL Defibrillator Dashboard: ZOLL Defibrillator Dashboard, v prior to 2.2,The application allows users to store their…
- ZOLL Defibrillator Dashboard
- CWE-257