Weakness (CWE)
CWE-260: Password in Configuration File
The product stores a password in a configuration file that might be accessible to actors who do not know the password.
How to prevent it (2 mitigations)
-
Architecture and Design
Avoid storing passwords in easily accessible locations.
-
Architecture and Design
Consider storing cryptographic hashes of passwords as an alternative to storing in plaintext.
Source: MITRE CWE-260
5 results · Clear filters · Feed
-
High 7.5
Hisilicon HiIpcam V100R003 Information Disclosure via Directory Traversal
Hisilicon HiIpcam V100R003 contains a directory traversal vulnerability that allows unauthenticated attackers to access sensitive configuration files by exploiting directory listing in the cgi-bin directory. Attackers can request the getadslattr.cgi endpoint …
-
High 8.7
MiniDVBLinux 5.4 Unauthenticated Configuration Download via Backup Endpoint
MiniDVBLinux 5.4 contains an unauthenticated configuration download vulnerability that allows remote attackers to access sensitive system configuration files through a direct object reference. Attackers can exploit the backup download endpoint by sending a GE…
-
High 7.5
IBM Sterling Partner Engagement Manager information disclosure
IBM Sterling Partner Engagement Manager 6.1.0, 6.2.0, 6.2.2 JWT secret is stored in public Helm Charts and is not stored as a Kubernetes secret.
-
High 8.7
The Docker image from acme.sh before 40b6db6 is based on a .github/workflows/dockerhub.yml file that lacks "persist-cre…
-
High 7.8
A vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-config…