By weakness (CWE)

CWE-256: related vulnerabilities

CVEs classified under CWE-256. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

6 published vulnerabilities

• CVE-2018-25396HIGH 7.5

  Heatmiser Wifi Thermostat version 1.7 exposes administrator credentials in plaintext to anyone with network access. An attacker can visit a specific page (networkSetup.htm) without logging in and retrieve the admin username and password directly from the HTML. This is a serious problem because it bypasses all authentication and gives attackers full control of the device.

• CVE-2026-14867MEDIUM 5.5

  PcVue projects store built-in user credentials in an insecure manner within the User directory. A local attacker with limited system access can retrieve these credentials without elevated privileges. Active Directory-integrated accounts are unaffected. The vulnerability exists in all versions before 17.0.0.

• CVE-2026-36174MEDIUM 4.6

  GNCC GP5 devices running version 7.1.76 transmit sensitive wireless network credentials in readable form to the serial console during normal operation. An attacker with physical access to the device's serial port can intercept these credentials, compromising network security. This is a localized but consequential exposure for organizations operating these devices in shared or less-controlled physical environments.

• CVE-2026-57302MEDIUM 4.3

  Jenkins FitNesse Plugin versions 1.36 and earlier fail to encrypt passwords before storing them in job configuration files on the Jenkins controller. This means any Jenkins user granted Extended Read permission—or anyone with direct file system access to the controller—can read these plaintext credentials. The vulnerability is localized to the Jenkins instance itself and does not enable remote code execution or wider system compromise, but it does create an unauthorized information disclosure risk for sensitive authentication data.

• CVE-2024-45636MEDIUM 4.1

  IBM Security QRadar EDR versions 3.12 through 3.12.24 contain a credential storage flaw where user passwords and authentication tokens are stored in plain text on disk. A local attacker with elevated system privileges can read these credentials directly, potentially gaining unauthorized access to QRadar EDR or downstream systems that those credentials protect. This is a local-only attack requiring existing high-level access to the affected system.

• CVE-2026-50268LOW 1.9

  Steeltoe.Configuration.Encryption versions 4.0.0 through 4.1.0 contain a configuration bug where the OAEP encryption algorithm setting does not work as intended. When administrators configure the system to use OAEP (a stronger RSA encryption variant), the software incorrectly falls back to the weaker PKCS#1 v1.5 algorithm instead. This occurs due to an incorrect transformation string passed to the BouncyCastle cryptographic library. The vulnerability requires local access and administrative privileges to exploit, making it a low-risk issue in most environments. Version 4.2.0 corrects this defect.