CWE-260 · 23 records

Password in Configuration File

CVEs in this class

23 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
54Plan	CVE-2017-7925Proof of concept	A Password in Configuration File issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-Idahuasecurity · dh-ipc-hdbw23a0rn-zs firmware · CWE-260 Pre-auth	Critical9.8	—	51.4%	May 5, 2017
39Monitor	CVE-2016-7043No exploit	It has been reported that KIE server and Busitess Central before version 7.21.0.Final contain username and password as plaintext Java properredhat · kie-server · CWE-260 Pre-auth	Critical9.8	—	1.5%	May 15, 2019
39Monitor	CVE-2023-34128No exploit	Tomcat application credentials are hardcoded in SonicWall GMS and Analytics configuration file.sonicwall · analytics · CWE-260 Pre-auth	Critical9.8	—	0.7%	Jul 12, 2023
39Monitor	CVE-2023-53739No exploit	Tinycontrol LAN Controller v3 LK3 1.58a Unauthenticated Configuration Backup Disclosuretinycontrol · tinycontrol lan controller v · CWE-260 Pre-auth Auth bypass	Critical9.9	—	0.6%	Dec 9, 2025
39Monitor	CVE-2025-57754No exploit	eslint-ban-moment exposed a sensitive Supabase URI in .env (Credential leak)kristoferfannar · eslint-ban-moment · CWE-260 Pre-auth	Critical9.8	—	0.3%	Aug 21, 2025
37Monitor	CVE-2025-6513No exploit	BRAIN2 Configuration file for database access not sufficiently securedbizerba se & co. kg · brain2 · CWE-260	Critical9.3	—	0.1%	Jun 23, 2025
36Monitor	CVE-2017-7923No exploit	A Password in Configuration File issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xhikvision · ds-2cd2032-i firmware · CWE-260	High8.8	—	2.3%	May 5, 2017
35Monitor	CVE-2019-3780No exploit	Cloud Foundry Container Runtime Leaks IAAS Credentialscloudfoundry · container runtime · CWE-260	High8.8	—	1.4%	Mar 8, 2019
35Monitor	CVE-2025-25022No exploit	IBM QRadar Suite Software and IBM Cloud Pak for Security information disclosureibm · cloud pak for security · CWE-260 Pre-auth	High8.8	—	0.3%	Jun 3, 2025
34Monitor	CVE-2023-53770No exploit	MiniDVBLinux 5.4 Unauthenticated Configuration Download via Backup Endpointminidvblinux · minidvblinux · CWE-260 Pre-auth	High8.7	—	0.5%	Dec 9, 2025
34Monitor	CVE-2019-25465No exploit	Hisilicon HiIpcam V100R003 Information Disclosure via Directory Traversalhisilicon · hiipcam · CWE-260 Pre-auth Path traversal	High8.7	—	0.5%	Mar 11, 2026
34Monitor	CVE-2025-32111No exploit	The Docker image from acme.sh before 40b6db6 is based on a .github/workflows/dockerhub.yml file that lacks "persist-credentials: false" for acme.sh project · acme.sh · CWE-260 Pre-auth	High8.7	—	0.4%	Apr 4, 2025
31Monitor	CVE-2021-35033No exploit	A vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-configured password managemzyxel · nbg6818 firmware · CWE-260	High7.8	—	0.4%	Nov 23, 2021
30Monitor	CVE-2025-33093No exploit	IBM Sterling Partner Engagement Manager information disclosureibm · sterling partner engagement manager · CWE-260 Pre-auth	High7.5	—	0.3%	May 7, 2025
26Monitor	CVE-2025-33119No exploit	IBM QRadar SIEM Information Disclosureibm · qradar security information and event manager · CWE-260	Medium6.5	—	0.2%	Nov 12, 2025
22Monitor	CVE-2020-5721No exploit	MikroTik WinBox 3.22 and below stores the user's cleartext password in the settings.cfg.viw configuration file when the Keep Password field mikrotik · winbox · CWE-260	Medium5.5	—	0.3%	Apr 15, 2020
22Monitor	CVE-2023-2790No exploit	TOTOLINK N200RE Telnet Service custom.conf password in configuration filetotolink · n200re firmware · CWE-260	Medium5.5	—	0.2%	May 18, 2023
22Monitor	CVE-2025-36002No exploit	IBM Sterling B2B Integrator information disclosureibm · sterling b2b integrator · CWE-260	Medium5.5	—	0.1%	Oct 16, 2025
22Monitor	CVE-2024-45673No exploit	IBM Security Verify Bridge information disclosureibm · security verify bridge directory sync · CWE-260	Medium5.5	—	0.1%	Feb 21, 2025
22Monitor	CVE-2025-36100No exploit	IBM MQ information disclosureibm · mq · CWE-260	Medium5.5	—	0.1%	Sep 6, 2025
21Monitor	CVE-2025-51540No exploit	EzGED3 3.5.0 stores user passwords using an insecure hashing scheme: md5(md5(password)).CWE-260 Pre-auth	Medium5.3	—	0.2%	Aug 19, 2025
17Monitor	CVE-2024-49817No exploit	IBM Security Guardium Key Lifecycle Manager information disclosureibm · security guardium key lifecycle manager · CWE-260 Local privilege escalation	Medium4.4	—	0.1%	Dec 17, 2024
8Monitor	CVE-2014-5400No exploit	Hospira MedNet Password in Configuration Filehospira · mednet · CWE-260	Low2.1	—	0.3%	Apr 3, 2015

CVE-2017-7925
54Plan
A Password in Configuration File issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-I
CriticalCVSS 9.8Proof of conceptEPSS 51%
- Pre-auth
dahuasecurity · dh-ipc-hdbw23a0rn-zs firmwareMay 5, 2017
CVE-2016-7043
39Monitor
It has been reported that KIE server and Busitess Central before version 7.21.0.Final contain username and password as plaintext Java proper
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
redhat · kie-serverMay 15, 2019
CVE-2023-34128
39Monitor
Tomcat application credentials are hardcoded in SonicWall GMS and Analytics configuration file.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
sonicwall · analyticsJul 12, 2023
CVE-2023-53739
39Monitor
Tinycontrol LAN Controller v3 LK3 1.58a Unauthenticated Configuration Backup Disclosure
CriticalCVSS 9.9No exploitEPSS 0%
- Pre-auth
- Auth bypass
tinycontrol · tinycontrol lan controller vDec 9, 2025
CVE-2025-57754
39Monitor
eslint-ban-moment exposed a sensitive Supabase URI in .env (Credential leak)
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
kristoferfannar · eslint-ban-momentAug 21, 2025
CVE-2025-6513
37Monitor
BRAIN2 Configuration file for database access not sufficiently secured
CriticalCVSS 9.3No exploitEPSS 0%
bizerba se & co. kg · brain2Jun 23, 2025
CVE-2017-7923
36Monitor
A Password in Configuration File issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2x
HighCVSS 8.8No exploitEPSS 2%
hikvision · ds-2cd2032-i firmwareMay 5, 2017
CVE-2019-3780
35Monitor
Cloud Foundry Container Runtime Leaks IAAS Credentials
HighCVSS 8.8No exploitEPSS 1%
cloudfoundry · container runtimeMar 8, 2019
CVE-2025-25022
35Monitor
IBM QRadar Suite Software and IBM Cloud Pak for Security information disclosure
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
ibm · cloud pak for securityJun 3, 2025
CVE-2023-53770
34Monitor
MiniDVBLinux 5.4 Unauthenticated Configuration Download via Backup Endpoint
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
minidvblinux · minidvblinuxDec 9, 2025
CVE-2019-25465
34Monitor
Hisilicon HiIpcam V100R003 Information Disclosure via Directory Traversal
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
hisilicon · hiipcamMar 11, 2026
CVE-2025-32111
34Monitor
The Docker image from acme.sh before 40b6db6 is based on a .github/workflows/dockerhub.yml file that lacks "persist-credentials: false" for
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
acme.sh project · acme.shApr 4, 2025
CVE-2021-35033
31Monitor
A vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-configured password managem
HighCVSS 7.8No exploitEPSS 0%
zyxel · nbg6818 firmwareNov 23, 2021
CVE-2025-33093
30Monitor
IBM Sterling Partner Engagement Manager information disclosure
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
ibm · sterling partner engagement managerMay 7, 2025
CVE-2025-33119
26Monitor
IBM QRadar SIEM Information Disclosure
MediumCVSS 6.5No exploitEPSS 0%
ibm · qradar security information and event managerNov 12, 2025
CVE-2020-5721
22Monitor
MikroTik WinBox 3.22 and below stores the user's cleartext password in the settings.cfg.viw configuration file when the Keep Password field
MediumCVSS 5.5No exploitEPSS 0%
mikrotik · winboxApr 15, 2020
CVE-2023-2790
22Monitor
TOTOLINK N200RE Telnet Service custom.conf password in configuration file
MediumCVSS 5.5No exploitEPSS 0%
totolink · n200re firmwareMay 18, 2023
CVE-2025-36002
22Monitor
IBM Sterling B2B Integrator information disclosure
MediumCVSS 5.5No exploitEPSS 0%
ibm · sterling b2b integratorOct 16, 2025
CVE-2024-45673
22Monitor
IBM Security Verify Bridge information disclosure
MediumCVSS 5.5No exploitEPSS 0%
ibm · security verify bridge directory syncFeb 21, 2025
CVE-2025-36100
22Monitor
IBM MQ information disclosure
MediumCVSS 5.5No exploitEPSS 0%
ibm · mqSep 6, 2025
CVE-2025-51540
21Monitor
EzGED3 3.5.0 stores user passwords using an insecure hashing scheme: md5(md5(password)).
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
Aug 19, 2025
CVE-2024-49817
17Monitor
IBM Security Guardium Key Lifecycle Manager information disclosure
MediumCVSS 4.4No exploitEPSS 0%
- Local privilege escalation
ibm · security guardium key lifecycle managerDec 17, 2024
CVE-2014-5400
8Monitor
Hospira MedNet Password in Configuration File
LowCVSS 2.1No exploitEPSS 0%
hospira · mednetApr 3, 2015

All vulnerability classes