Weakness (CWE)
CWE-260: Password in Configuration File
The product stores a password in a configuration file that might be accessible to actors who do not know the password.
How to prevent it (2 mitigations)
-
Architecture and Design
Avoid storing passwords in easily accessible locations.
-
Architecture and Design
Consider storing cryptographic hashes of passwords as an alternative to storing in plaintext.
Source: MITRE CWE-260
2 results · Clear filters · Feed
-
Low 3.7
TaleLin Lin-CMS Tests Folder config.py password in configuration file
A vulnerability was determined in TaleLin Lin-CMS up to 0.6.0. This affects an unknown part of the file /tests/config.py of the component Tests Folder. This manipulation of the argument username/password causes password in configuration file. The attack is po…
-
Low 2.3
TOTOLINK N200RE Telnet Service custom.conf password in configuration file
A vulnerability classified as problematic has been found in TOTOLINK N200RE 9.3.5u.6255_B20211224. Affected is an unknown function of the file /squashfs-root/etc_ro/custom.conf of the component Telnet Service. The manipulation leads to password in configurati…