CWE-523.

Account password sent unencrypted during Exchange account setup

• Mozilla Thunderbird
• CWE-523

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

• IBM Financial Transaction Manager (FTM) for RedHat OpenShift
• CWE-523

HCL IEM was affected with Strict transport security not enforced

• HCLSoftware IntelliOps Event Management
• CWE-523

CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality

• Weak cryptography or TLS
• CWE-523

>=1.9.0, <1.9.1 · fixed in 1.9.1

Hardcoded credentials in embedded content

• Progress Chef Chef360
• CWE-523

Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 transmits DDNS credentials over plaintext HTTP with only Base64 encoding.

• Weak cryptography or TLS
• CWE-523

Password re-initialization mechanism sends passwords in plain text

• syslink software AG Avantra
• CWE-523

Kiteworks Secure Data Forms has a potential Unprotected Transport of Credentials

• kiteworks Secure Data Forms
• CWE-523

Spinnaker vulnerable to SSRF due to improper restrictions on http from user input

• Server-side request forgery (SSRF)
• CWE-20

<2025.1.6 || >=2025.2.0, <2025.2.3 · fixed in 2025.1.6, 2025.2.3

Open OnDemand affected by Apache proxy passing sensitive headers

• OSC ondemand
• Hard-coded credentials
• CWE-523

Brightpick Mission Control / Internal Logic Control Unprotected Transport of Credentials

• Brightpick AI Brightpick Mission Control / Internal Logic Control
• CWE-523

Brightpick Mission Control / Internal Logic Control Unprotected Transport of Credentials

• Brightpick AI Brightpick Mission Control / Internal Logic Control
• CWE-523

Mobile Scanner Android App version 2.12.38 (package name com.glority.everlens), developed by Glority Global Group Ltd., contains a credential leakage vulnerability.

• CWE-523

Phoenix Contact: WebSocket Message Interception Leaks Webfrontend Credentials

• Phoenix Contact QUINT4-UPS/24DC/24DC/5/EIP
• Phoenix Contact QUINT4-UPS/24DC/24DC/10/EIP
• CWE-523

Audiobookshelf vulnerable to OIDC token exfiltration and account takeover

• advplyr audiobookshelf
• Open redirect
• CWE-523

Brocade ASCG 3.2.0 web interface does not enforce HSTS, as defined by RFC 6797 for ports 8030 and 8100

• Brocade ASCG
• CWE-523

Security vulnerability exists in Documentum server cloud releases that could allow access to sensitive information which can impact system Operation.

• OpenText™ Documentum™ Server
• CWE-523

A vulnerability in the media retrieval functionality of Cisco Webex App could allow an unauthenticated, adjacent attacker to gain access to sensitive session information.

• Cisco Webex Teams
• CWE-523

Jberet: jberet-core logging database credentials

• Information disclosure
• CWE-523

<2.2.1.Final · fixed in 2.2.1.Final

PiiGAB M-Bus Unprotected Transport of Credentials

• PiiGAB M-Bus SoftwarePack
• CWE-523

IBM Aspera information disclosure

• IBM Aspera Connect
• IBM Aspera Cargo
• CWE-523

Apache Tomcat vulnerable to Unprotected Transport of Credentials

• CWE-523

>=11.0.0-M1, <11.0.0-M3 || >=10.1.0-M1, <10.1.6 || >=9.0.0-M1, <9.0.72 || >=8.5.0, <8.5.86 · fixed in 11.0.0-M3, 10.1.6, 9.0.72, 8.5.86

Insecure transmission of credentials

• CODESYS Development System
• CODESYS Gateway Client
• CWE-523

Moxa MXview Network Management Software

• Moxa MXview Network Management Software
• CWE-523

Configuration service port remains open 10 minutes after reboot even when already provisioned

• Secomea SiteManager
• CWE-523

GE Healthcare Imaging and Ultrasound Products: GE Healthcare Imaging and Ultrasound Products may allow specific credentials to be…

• GE Healthcare Imaging and Ultrasound Products
• CWE-523

ABB Ellipse: An Unprotected Transport of Credentials issue was discovered in ABB Ellipse 8.3 through…

• ABB Ellipse
• CWE-523