Citrix Metaframe Password Manager 2.5 and earlier stores a password in cleartext although it is obfuscated when presented to a user, which allows users to view their secondary passwords even if it is not allowed by policy.
http://www.securityfocus.com/bid/24041
http://support.citrix.com/kb/entry.jspa?externalID=CTX105762
http://support.citrix.com/kb/entry.jspa?entryID=5970&categoryID=254