CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- jenkins sshJenkins SSH Plugin user passwords for encrypted SSH keys stored in plaintext9.8 Critical
- lenovo service framework, lenovo group ltd. service framework application +1 moreThe Lenovo Service Framework Android application uses a set of nonsecure credentials when...8.1 High
- intel nuc7i3bnh firmware, nuc7i3bnk firmware, nuc7i5bnh firmware +3 more +5 moreInsufficient protection of password storage in system firmware for Intel NUC7i3BNK, NUC7i3BNH,...8.4 High
- loytec lvis-3me firmwareAn Insufficiently Protected Credentials issue was discovered in LOYTEC LVIS-3ME versions prior to...7.5 High
- ibm tivoli storage manager, spectrum protect for virtual environments +1 moreIBM Spectrum Protect 7.1 and 8.1 (formerly Tivoli Storage Manager) disclosed unencrypted login...7.8 High
- ibm bigfix compliance analytics, bigfix security compliance analytics +1 moreIBM BigFix Compliance Analytics 1.9.79 (TEMA SUAv1 SCA SCM) stores user credentials in clear text...7.8 High
- ibm security identity managerIBM Security Identity Manager Adapters 6.0 and 7.0 stores user credentials in plain in clear text...7.8 High
- dlink dir-850l firmwareThe D-Link NPAPI extension, as used in conjunction with D-Link DIR-850L REV. B (with firmware...8.1 High
- lexmark scan to networkLexmark Scan To Network (SNF) 3.2.9 and earlier stores network configuration credentials in...9.8 Critical
- elasticsearch x-pack, elastic x-pack reporting +1 moreImproper Privilege Management in X-Pack5.3 Medium
- postgresqlPostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to...8.8 High
- vmware vcenter serverVMware vCenter Server (6.5 prior to 6.5 U1) contains an information disclosure vulnerability....9.8 Critical
- televes coaxdata gateway 1gbps firmwareTeleves COAXDATA GATEWAY 1Gbps devices doc-wifi-hgw_v1.02.0014 4.20 have cleartext credentials in...9.8 Critical
- thermofisher dt8x firmwaredataTaker DT8x dEX 1.72.007 allows remote attackers to compose programs or schedules, for...9.8 Critical
- ibm mq, websphere mq +1 moreIBM WebSphere MQ 9.0.1 and 9.0.2 Java/JMS application can incorrectly transmit user credentials...8.1 High
- cisco ultra services frameworkA vulnerability in the AutoVNF tool for the Cisco Ultra Services Framework could allow an...9.8 Critical
- ibm websphere message broker, integration bus +1 moreIBM WebSphere Message Broker stores user credentials in plain in clear text which can be read by...5.5 Medium
- humaxdigital hg100r firmwareAn issue was discovered on Humax Digital HG100R 2.0.6 devices. To download the backup file it's...9.8 Critical
- progress sitefinity, telerik ui for asp.net ajax, progress asp.net ajax and sitefinity +2 moreTelerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity...9.8 Critical
- ge multilin sr 369 motor protection relay firmware, multilin sr 469 motor protection relay firmware, multilin sr 489 generator protection relay firmware +7 more +9 moreA Weak Cryptography for Passwords issue was discovered in General Electric (GE) Multilin SR 750...9.8 Critical
- sierra wireless airlink raven xe firmware, airlink raven xt firmware +1 moreAn Insufficiently Protected Credentials issue was discovered in Sierra Wireless AirLink Raven XE,...7.5 High
- schneider-electric modicon m241 firmware, modicon m251 firmware +1 moreAn Insufficiently Protected Credentials issue was discovered in Schneider Electric Modicon PLCs...9.8 Critical
- tpm 2.0 tools tpm2-tools, tpm2-tools project tpm2.0-tools +1 moretpm2-tools versions before 1.1.1 are vulnerable to a password leak due to transmitting password...7.5 High
- milwaukee tool one-keyThe Milwaukee ONE-KEY Android mobile application stores the master token in plaintext in the apk...7.5 High
- synology photo stationA design flaw in authentication in Synology Photo Station 6.0-2528 through 6.7.1-3419 allows...7.8 High
- cisco ultra services platformA vulnerability in the Virtual Network Function Manager's (VNFM) logging function of Cisco Ultra...5.5 Medium
- echatserver easy chat serverregister.ghp in EFS Software Easy Chat Server versions 2.0 to 3.1 allows remote attackers to...7.5 High
- peplink 1350hw2 firmware, 2500 firmware, 380hw6 firmware +3 more +5 moreCleartext password storage exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices...9.8 Critical
- moxa oncell 5004-hspa firmware, oncell 5104-hsdpa firmware, oncell 5104-hspa firmware +3 more +5 moreA Plaintext Storage of a Password issue was discovered in Moxa OnCell G3110-HSPA Version 1.3...9.8 Critical
- mimosa client radios, backhaul radios +1 moreAn issue was discovered on Mimosa Client Radios before 2.2.3. In the device's web interface,...7.5 High
- postgresqlPostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which...7.5 High
- dahuasecurity dh-hcvr4xxx firmware, dh-hcvr5xxx firmware, dh-ipc-hdbw13a0sn firmware +12 more +14 moreA Password in Configuration File issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC...9.8 Critical
- schneider-electric struxureware data center expertSchneider Electric StruxureWare Data Center Expert before 7.4.0 uses cleartext RAM storage for...6.8 Medium
- ked password manager project password managerkedpm 0.5 and 1.0 creates a history file in ~/.kedpm/history that is written in cleartext. All of...7.5 High
- wificam wireless ip camera \(p2p\) firmwareOn Wireless IP Camera (P2P) WIFICAM devices, access to .ini files (containing credentials) is not...9.8 Critical
- wificam wireless ip camera \(p2p\) firmwareWireless IP Camera (P2P) WIFICAM devices have an "Apple Production IOS Push Services" private RSA...7.5 High
- dnatools dnalimsAn issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is affected by plaintext password...8.1 High
- honeywell xl web ii controllerAn issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior,...9.8 Critical
- honeywell xl web ii controllerAn issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior,...9.8 Critical
- ge cimplicity, historian, ifix +2 moreAn issue was discovered in General Electric (GE) Proficy HMI/SCADA iFIX Version 5.8 SIM 13 and...6.7 Medium
- ibm corporation access manager, ibm security access manager 9.0 firmware, security access manager for mobile +1 more +3 moreThe IBM Security Access Manager appliance includes configuration files that contain obfuscated...5.5 Medium
- openstack keystone, keystonemiddleware, oracle solaris +2 moreOpenStack Identity Keystone and keystonemiddleware Insufficiently Protected Credentials7.5 High
- jenkins, redhat openshift +1 moreJenkins allows Administrators to Access API Tokens6.5 Medium
- owncloud clientownCloud iOS app before 3.4.4 does not properly switch state between multiple instances, which...5.0 Medium
- schneider-electric struxureware building expert multi-purpose managementSchneider Electric StruxureWare Building Expert MPM before 2.15 does not use encryption for the...5.0 Medium
- ibm security appscanThe installation process in IBM Security AppScan Enterprise 8.x before 8.6.0.2 iFix 003, 8.7.x...5.5 Medium
- smb4k project smb4k, fedoraproject fedora +1 moreSmb4K before 1.1.1 allows remote attackers to obtain credentials via vectors related to the cuid...7.5 High
- microsoft windows, windows 7, windows 8 +4 more +6 moreThe Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2...9.0 High
- openstack python-keystoneclientpython-keystoneclient vulnerable to context confusion in Keystone auth_token middleware6.0 Medium
- rockwell automation rslogix 5000 software, rockwellautomation rslogix 5000 design and configuration software +1 moreRockwell RSLogix 5000 Insufficiently Protected Credentials6.3
- Show moreLoading…