CWE-260: Password in Configuration File
The product stores a password in a configuration file that might be accessible to actors who do not know the password.
A kind of CWE-522 Insufficiently Protected Credentials.
From the CWE List. © The MITRE Corporation.
Newest
- itron mv-90 xi Improperly Stored Credentials 5.3 Medium
- hisilicon hiipcam Hisilicon HiIpcam V100R003 Information Disclosure via Directory Traversal 8.7 High
- talelin lin-cms TaleLin Lin-CMS Tests Folder config.py password in configuration file 6.3 Medium
- minidvblinux, minidvblinux minidvblinux(tm) distribution (mld) +1 more MiniDVBLinux 5.4 Unauthenticated Configuration Download via Backup Endpoint 8.7 High
- tinycontrol lk, lan controller v +1 more Tinycontrol LAN Controller v3 LK3 1.58a Unauthenticated Configuration Backup Disclosure 9.9 Critical
- ibm qradar security information and event management, qradar security information and event manager +1 more IBM QRadar SIEM Information Disclosure 6.5 Medium
- ibm sterling b2b integrator, sterling file gateway +1 more IBM Sterling B2B Integrator information disclosure 5.5 Medium
- ibm mq IBM MQ information disclosure 5.1 Medium
- kristoferfannar eslint-ban-moment eslint-ban-moment exposed a sensitive Supabase URI in .env (Credential leak) 9.8 Critical
- No product listed EzGED3 3.5.0 stores user passwords using an insecure hashing scheme: md5(md5(password)). This... 5.3 Medium
- bizerba brain2 BRAIN2 Configuration file for database access not sufficiently secured 9.3 Critical
- ibm cloud pak for security, qradar suite software, qradar suite +2 more IBM QRadar Suite Software and IBM Cloud Pak for Security information disclosure 9.6 Critical
- mici network co. ltd. netfax server MICI Network Co. Ltd. NetFax Server Disclosure of Stored Passwords in Cleartext 5.3 Medium
- ibm sterling partner engagement manager IBM Sterling Partner Engagement Manager information disclosure 7.5 High
- acme.sh project acme.sh The Docker image from acme.sh before 40b6db6 is based on a .github/workflows/dockerhub.yml file... 8.7 High
- ibm security verify bridge directory sync, security verify gateway for radius, security verify gateway for windows login +2 more IBM Security Verify Bridge information disclosure 5.5 Medium
- ibm security guardium key lifecycle manager IBM Security Guardium Key Lifecycle Manager information disclosure 4.4 Medium
- sonicwall analytics, gms, global management system +2 more Tomcat application credentials are hardcoded in SonicWall GMS and Analytics configuration file.... 9.8 Critical
- totolink n200re, n200re firmware +1 more TOTOLINK N200RE Telnet Service custom.conf password in configuration file 2.3 Low
- zyxel wsr30 firmware, nbg6818 series firmware, nbg6818 firmware +9 more +11 more A vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30... 7.8 High
- mikrotik winbox MikroTik WinBox 3.22 and below stores the user's cleartext password in the settings.cfg.viw... 5.5 Medium
- kie kie-server Password in config file in KIE server 5.9 Medium
- cloudfoundry container runtime, cloud foundry container runtime (cfcr) +1 more Cloud Foundry Container Runtime Leaks IAAS Credentials 9.1 Critical
- dahuasecurity dh-hcvr4xxx firmware, dh-hcvr5xxx firmware, dh-ipc-hdbw13a0sn firmware +12 more +14 more A Password in Configuration File issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC... 9.8 Critical
- hikvision ds-2cd2032-i firmware, ds-2cd2112-i firmware, ds-2cd2132-i firmware +55 more +57 more A Password in Configuration File issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0... 8.8 High
- hospira mednet Hospira MedNet Password in Configuration File 6.8