CWE-257 · Storing Passwords in a Recoverable Format

65 CVEs classified under CWE-257 (Storing Passwords in a Recoverable Format). Browse by severity and year.

Top CVEs for CWE-257
CVESeverityScorePublishedSummary
CVE-2025-8904High8.52025-08-13Amazon EMR Secret Agent creates a keytab file containing Kerberos credentials. This file is stored in the /tmp/ directory. A user with access to this directory…
CVE-2025-6996High8.42025-07-08Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a local authenticated attacker…
CVE-2025-6995High8.42025-07-08Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a local authenticated attacker…
CVE-2016-15058High8.12026-04-03Hirschmann HiLCOS Classic Platform switches Classic L2E, L2P, L3E, L3P versions prior to 09.0.06 and Classic L2B prior to 05.3.07 contain a credential exposure…
CVE-2022-34838High8.12022-08-24Storing Passwords in a Recoverable Format vulnerability in ABB Zenon 8.20 allows an attacker who successfully exploit the vulnerability may add or alter data p…
CVE-2023-31150High8.02023-05-10 A Storing Passwords in a Recoverable Format vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) database syste…
CVE-2022-32519High8.02023-01-30A CWE-257: Storing Passwords in a Recoverable Format vulnerability exists that could result in unwanted access to a DCE instance when performed over a network…
CVE-2023-21726High7.82023-01-10Windows Credential Manager User Interface Elevation of Privilege Vulnerability
CVE-2022-22251High7.82022-10-18On cSRX Series devices software permission issues in the container filesystem and stored files combined with storing passwords in a recoverable format in Junip…
CVE-2017-9942High7.82017-08-08A vulnerability was discovered in Siemens SiPass integrated (All versions before V2.70) that could allow an attacker with local access to the SiPass integrated…
CVE-2026-65309High7.52026-07-31ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores and transmits user passwords using a reversible format instead of a one-way password hash…
CVE-2026-20128High7.52026-02-25A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user pr…
CVE-2025-0280High7.52025-09-03A security vulnerability in HCL Compass can allow attacker to gain unauthorized database access.
CVE-2024-1480High7.52024-04-19Unitronics Vision Standard line of controllers allow the Information Mode password to be retrieved without authentication.
CVE-2023-5627High7.52023-11-01A vulnerability has been identified in NPort 6000 Series, making the authentication mechanism vulnerable. This vulnerability arises from the incorrect implemen…
CVE-2021-27485High7.52021-06-16ZOLL Defibrillator Dashboard, v prior to 2.2,The application allows users to store their passwords in a recoverable format, which could allow an attacker to re…
CVE-2022-47376High7.32023-06-13The Alaris Infusion Central software, versions 1.1 to 1.3.2, may contain a recoverable password after the installation. No patient health data is stored in the…
CVE-2019-3736High7.22019-09-27Dell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a password storage vulnerability in the ACM component. A remote authenticated malic…
CVE-2025-57796Medium6.82026-01-28Explorance Blue versions prior to 8.14.12 use reversible symmetric encryption with a hardcoded static key to protect sensitive data, including user passwords a…
CVE-2024-32932Medium6.82024-07-02Under certain circumstances the web interface users credentials may be recovered by an authenticated user.
All CVEs classified under CWE-257 — newest first (page 1 of 1)
CVESeverityScorePublishedSummary
CVE-2026-65309High7.52026-07-31ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores and transmits user passwords using a reversible format instead of a one-way password hash…
CVE-2026-18362026-06-12The system stores the username and password from the login form after submitting the request. This could allow an attacker with access to the platform to retur…
CVE-2026-22576Medium4.32026-04-14A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7…
CVE-2026-22574Medium4.12026-04-14A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7…
CVE-2025-80952026-04-14The OECH1 prefix encoding is intended to obfuscate values across the OpenEdge platform.  It has been identified as cryptographically weak and unsuitable for st…
CVE-2016-15058High8.12026-04-03Hirschmann HiLCOS Classic Platform switches Classic L2E, L2P, L3E, L3P versions prior to 09.0.06 and Classic L2B prior to 05.3.07 contain a credential exposure…
CVE-2026-22614Medium6.12026-03-10The encryption mechanism used in Eaton's EasySoft project file was insecure and susceptible to brute force attacks, an attacker with access to this file and th…
CVE-2026-30785Medium5.52026-03-05Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'), Use of Password Hash With Insufficient Computational Effort vulnerab…
CVE-2026-20128High7.52026-02-25A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user pr…
CVE-2025-57796Medium6.82026-01-28Explorance Blue versions prior to 8.14.12 use reversible symmetric encryption with a hardcoded static key to protect sensitive data, including user passwords a…
CVE-2025-142952026-01-22Storing Passwords in a Recoverable Format vulnerability in Automated Logic WebCTRL on Windows, Carrier i-Vu on Windows. Storing Passwords in a Recoverable Form…
CVE-2025-83072026-01-08Asseco InfoMedica is a comprehensive solution used to manage both administrative and medical tasks in the healthcare sector. Passwords of all users are stored…
CVE-2025-341802025-12-15NetSupport Manager < 14.12.0001 relies on a shared Gateway Key for authentication between Manager/Control, Client, and Connectivity Server components. The key…
CVE-2025-40774Medium4.42025-10-14A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications store user passwords encrypted in its database. De…
CVE-2025-35054Medium5.32025-10-09Newforma Info Exchange (NIX) stores credentials used to configure NPCS in 'HKLM\Software\WOW6432Node\Newforma\<version>\Credentials'. The credentials are encr…
CVE-2025-0280High7.52025-09-03A security vulnerability in HCL Compass can allow attacker to gain unauthorized database access.
CVE-2025-58049Medium5.82025-08-28XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions from 14.4.2 to before 16.4.8, 16.5.0-rc-1…
CVE-2025-57789Medium5.42025-08-20During the brief window between installation and the first administrator login, remote attackers may exploit the default credential to gain admin control. This…
CVE-2025-8904High8.52025-08-13Amazon EMR Secret Agent creates a keytab file containing Kerberos credentials. This file is stored in the /tmp/ directory. A user with access to this directory…
CVE-2025-44958Medium5.32025-08-04RUCKUS Network Director (RND) before 4.5 stores passwords in a recoverable format.
CVE-2025-6996High8.42025-07-08Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a local authenticated attacker…
CVE-2025-6995High8.42025-07-08Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a local authenticated attacker…
CVE-2025-27459Medium4.42025-07-03The VNC application stores its passwords encrypted within the registry but uses DES for encryption. As DES is broken, the original passwords can be recovered.
CVE-2024-51552Medium6.02025-05-22Weak password storage vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS S…
CVE-2025-25983Low3.42025-04-18An issue in Macro-video Technologies Co.,Ltd V380 Pro android application 2.1.44 and V380 Pro android application 2.1.64 allows an attacker to obtain sensitive…
CVE-2024-32122Low2.32025-04-08A storing passwords in a recoverable format in Fortinet FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versio…
CVE-2025-24852Medium4.62025-03-31Storing passwords in a recoverable format issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If this issue is exploited, an attacker who can acce…
CVE-2024-87742025-03-24The SIMPLE.ERP client stores superuser password in a recoverable format, allowing any authenticated SIMPLE.ERP user to escalate privileges to a database admini…
CVE-2024-32151Medium5.92024-11-26User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the deta…
CVE-2024-20462Medium5.52024-10-16A vulnerability in the web-based management interface of Cisco ATA 190 Series Multiplatform Analog Telephone Adapter firmware could allow an authenticated, loc…
CVE-2024-45744Low3.02024-09-27TopQuadrant TopBraid EDG stores external credentials insecurely. An authenticated attacker with file system access can read edg-setup.properites and obtain the…
CVE-2024-6694Low2.72024-07-20The WP Mail SMTP plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 4.0.1. This is due to plugin providing the SM…
CVE-2024-32932Medium6.82024-07-02Under certain circumstances the web interface users credentials may be recovered by an authenticated user.
CVE-2024-32756Medium6.82024-07-02Under certain circumstances the Linux users credentials may be recovered by an authenticated user.
CVE-2024-3073Low2.72024-06-13The Easy WP SMTP by SendLayer – WordPress SMTP and Email Log Plugin plugin for WordPress is vulnerable to information exposure in all versions up to, and inclu…
CVE-2024-32042Medium4.92024-05-15The key used to encrypt passwords stored in the database can be found in the CyberPower PowerPanel application code, allowing the passwords to be recovered.
CVE-2023-42955Medium4.92024-05-14Claris International has successfully resolved an issue of potentially exposing password information to front-end websites when signed in to the Admin Console…
CVE-2024-3543Medium6.42024-05-02 Use of reversible password encryption algorithm allows attackers to decrypt passwords.  Sensitive information can be easily unencrypted by the attacker, stole…
CVE-2024-1480High7.52024-04-19Unitronics Vision Standard line of controllers allow the Information Mode password to be retrieved without authentication.
CVE-2023-38738Medium6.82024-01-19 IBM OpenPages with Watson 8.3 and 9.0 could provide weaker than expected security in a OpenPages environment using Native authentication. If OpenPages is usin…
CVE-2023-31001Medium5.12024-01-11IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) temporari…
CVE-2023-5627High7.52023-11-01A vulnerability has been identified in NPort 6000 Series, making the authentication mechanism vulnerable. This vulnerability arises from the incorrect implemen…
CVE-2023-2358Medium4.32023-09-27 Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.5.0.0 and 9.3.0.4, including 8.3.x.x, saves passwords of the Hadoop Copy Files step in p…
CVE-2022-47376High7.32023-06-13The Alaris Infusion Central software, versions 1.1 to 1.3.2, may contain a recoverable password after the installation. No patient health data is stored in the…
CVE-2023-2881Medium4.92023-05-25Storing Passwords in a Recoverable Format in GitHub repository pimcore/customer-data-framework prior to 3.3.10.
CVE-2023-31150High8.02023-05-10 A Storing Passwords in a Recoverable Format vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) database syste…
CVE-2023-23382Medium6.52023-02-14Azure Machine Learning Compute Instance Information Disclosure Vulnerability
CVE-2022-32519High8.02023-01-30A CWE-257: Storing Passwords in a Recoverable Format vulnerability exists that could result in unwanted access to a DCE instance when performed over a network…
CVE-2023-21726High7.82023-01-10Windows Credential Manager User Interface Elevation of Privilege Vulnerability
CVE-2022-46142Medium5.72022-12-13Affected devices store the CLI user passwords encrypted in flash memory. Attackers with physical access to the device could retrieve the file and decrypt the C…
CVE-2022-22251High7.82022-10-18On cSRX Series devices software permission issues in the container filesystem and stored files combined with storing passwords in a recoverable format in Junip…
CVE-2022-34838High8.12022-08-24Storing Passwords in a Recoverable Format vulnerability in ABB Zenon 8.20 allows an attacker who successfully exploit the vulnerability may add or alter data p…
CVE-2022-34837Medium6.22022-08-24Storing Passwords in a Recoverable Format vulnerability in ABB Zenon 8.20 allows an attacker who successfully exploit the vulnerability may add more network cl…
CVE-2021-35050Medium6.52021-06-25User credentials stored in a recoverable format within Fidelis Network and Deception CommandPost. In the event that an attacker gains access to the CommandPost…
CVE-2021-27485High7.52021-06-16ZOLL Defibrillator Dashboard, v prior to 2.2,The application allows users to store their passwords in a recoverable format, which could allow an attacker to re…
CVE-2020-8296Medium6.72021-03-03Nextcloud Server prior to 20.0.0 stores passwords in a recoverable format even when external storage is not configured.
CVE-2021-0220Medium6.82021-01-15The Junos Space Network Management Platform has been found to store shared secrets in a recoverable format that can be exposed through the UI. An attacker who…
CVE-2019-18256Medium4.62020-06-29BIOTRONIK CardioMessenger II, The affected products use individual per-device credentials that are stored in a recoverable format. An attacker with physical ac…
CVE-2019-19096Medium6.12020-04-02The Redis data structure component used in ABB eSOMS versions 6.0 to 6.0.2 stores credentials in clear text. If an attacker has file system access, this can po…
CVE-2019-3736High7.22019-09-27Dell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a password storage vulnerability in the ACM component. A remote authenticated malic…
CVE-2019-1010241Medium6.52019-07-19Jenkins Credentials Binding Plugin Jenkins 1.17 is affected by: CWE-257: Storing Passwords in a Recoverable Format. The impact is: Authenticated users can reco…
CVE-2019-6567Medium5.52019-06-12A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All Versions < V5.2.4), SCALANCE X-200IRT switch family (incl…
CVE-2019-5615Medium6.52019-04-09Users with Site-level permissions can access files containing the username-encrypted passwords of Security Console Global Administrators and clear-text passwor…
CVE-2018-5446Medium4.92018-05-04Medtronic 2090 CareLink Programmer uses a per-product username and password that is stored in a recoverable format.
CVE-2017-9942High7.82017-08-08A vulnerability was discovered in Siemens SiPass integrated (All versions before V2.70) that could allow an attacker with local access to the SiPass integrated…