CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- puppet discoveryPuppet Discovery can leak authentication information8.6 High
- safensoft enterprise suite, syswatch, tpsecure +2 moreStoring password in recoverable format in safensec.com (SysWatch service) in SAFE'N'SEC...7.8 High
- beckhoff twincat, ics-cert beckhoff twincat +1 moreBeckhoff TwinCAT 3 supports communication over ADS. ADS is a protocol for industrial automation...5.9 Medium
- jenkins configuration as codeJenkins Configuration as Code Plugin has Insufficiently Protected Credentials8.8 High
- jenkins z\/os connectorJenkins z/OS Connector Plugin allows local attacker to retrieve configured password7.2 High
- apollotechnologiesinc momentum axel 720p firmwareAn issue was discovered on Momentum Axel 720P 5.1.8 devices. The root password can be obtained in...6.7 Medium
- [unknown] ovirt-engine, ovirt +1 moreovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db...5.0 Medium
- apple icloud, itunes, safari +3 more +5 moreAn issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11...8.8 High
- cisco prime collaborationA vulnerability in the web portal authentication process of Cisco Prime Collaboration...7.8 High
- beaconmedaes scroll medical air systems firmware, ics-cert beaconmedaes totalalert scroll medical air systems web application +1 moreIn the web application in BeaconMedaes TotalAlert Scroll Medical Air Systems running software...9.8 Critical
- abb ip gateway firmwareIn ABB IP GATEWAY 3.39 and prior, some configuration files contain passwords stored in plain-text...9.8 Critical
- theolivetree ftp serverThe Olive Tree Ftp Server application 1.32 for Android has Insecure Data Storage because a...9.8 Critical
- beaconmedaes scroll medical air systems firmware, ics-cert beaconmedæs totalalert scroll medical air systems web application +1 moreIn TotalAlert Web Application in BeaconMedaes Scroll Medical Air Systems prior to v4107600010.23,...9.8 Critical
- trend micro email encryption gatewayAn authentication weakness vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow...7.0 High
- schneider electric se ampla mes, schneider-electric ampla manufacturing execution system +1 moreSchneider Electric Ampla MES 6.4 provides capability to interact with data from third party...4.1 Medium
- printeronPrinterOn Enterprise 4.1.3 stores the Active Directory bind credentials using base64 encoding,...7.0 High
- moxa, moxa edr-810 firmware +1 moreA password storage vulnerability exists in the operating system functionality of Moxa EDR-810 V4...4.4 Medium
- moxa, moxa edr-810 firmware +1 moreAn exploitable clear text transmission of password vulnerability exists in the web server and...5.7 Medium
- ehcp easy hosting control panelEasy Hosting Control Panel (EHCP) v0.37.12.b allows attackers to obtain sensitive information by...7.8 High
- medtronic 2090 carelink programmer, 2090 carelink programmer firmware, 29901 encore programmer +2 moreMedtronic 2090 Carelink Programmer Storing Passwords in a Recoverable Format4.9 Medium
- ovirt, unspecified ovirt-engine, redhat enterprise virtualization +2 moreovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to...7.7 High
- philips dosewise, dosewise portal +1 moreThe Philips DoseWise Portal web-based application versions 1.1.7.333 and 2.1.1.3069 stores login...8.8 High
- ibm cognos business intelligenceIBM Cognos Business Intelligence 10.2, 10.2.1, 10.2.1.1, and 10.2.2, under specialized...7.0 High
- ericssonlg ipecs nmsThe Ericsson-LG iPECS NMS A.1Ac web application discloses sensitive information such as the NMS...8.8 High
- theforeman foreman, unspecified foreman-debug, redhat satellite +2 moreforeman-debug before version 1.15.0 is vulnerable to a flaw in foreman-debug's logging. An...4.7 Medium
- ubiquoss vp5208a firmwareubiQuoss Switch VP5208A creates a bcm_password file at /cgi-bin/ with the user credentials in...9.8 Critical
- apple mac os xAn issue was discovered in certain Apple products. macOS before 10.13.4 is affected. The issue...7.8 High
- sickrageSiCKRAGE Discloses Plaintext Credentials9.8 Critical
- dlink dir-601 firmwareAn issue was discovered on D-Link DIR-601 B1 2.02NA devices. Being on the same local network as,...8.0 High
- tnlsoftsolutions sentry visionThe login interface on TNLSoftSolutions Sentry Vision 3.x devices provides password disclosure by...9.8 Critical
- wanscam hw0021, hw0021 firmware +1 moreAn information leak exists in Wanscam's HW0021 network camera that allows an unauthenticated...9.8 Critical
- gitlab, debian linux, gitlab community and enterprise editions +2 moreGitlab Enterprise Edition version 10.1.0 is vulnerable to an insufficiently protected credential...7.2 High
- jenkins coverityJenkins Coverity Plugin has Insufficiently Protected Credentials7.8 High
- d-link mydlink\+An issue was discovered in D-Link mydlink+ 3.8.5 build 259 for DCS-933L 1.05.04 and DCS-934L 1.05...8.1 High
- netiq imanagerprivate SSL key embedded in JAR file in iManager4.3 Medium
- ibm security guardium big data intelligenceIBM Security Guardium Big Data Intelligence (SonarG) 3.1 stores user credentials in plain in...7.8 High
- trend micro interscan messaging security virtual applianceA vulnerability in the Trend Micro InterScan Messaging Security Virtual Appliance 9.0 and 9.1...8.1 High
- microsoft windows, windows 10, windows server 2016 +2 moreWindows 10 version 1607 and Windows Server 2016 allow an elevation of privilege vulnerability due...7.8 High
- schneider-electric igss mobileAn information disclosure vulnerability exists in Schneider Electric's IGSS Mobile application...6.7 Medium
- jenkins credentials bindingJenkins Credentials Binding Plugin has Insufficiently Protected Credentials4.3 Medium
- asus asuswrtPassword are stored in plaintext in nvram in the HTTPd server in all current versions (<= 3.0.0.4...8.8 High
- ibm cognos analytics, netapp oncommand insight +1 moreIBM Cognos Analytics 11.0 could store cached credentials locally that could be obtained by a...7.8 High
- jenkins build-publisherJenkins Build-Publisher plugin has Insufficiently Protected Credentials7.8 High
- hitachienergy ellipseAn Unprotected Transport of Credentials issue was discovered in ABB Ellipse 8.3 through Ellipse 8...8.8 High
- zivif pr115-204-p-rs firmwareCredentials for Zivif PR115-204-P-RS V2.3.4.2103 Webcams can be obtained by an unauthenticated...9.8 Critical
- d-link dir-130, dir-130 firmware, dir-330 +1 more +3 moreD-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 do not sufficiently...9.8 Critical
- philips intellispace cardiovascular, xcelera +1 moreThe workstation logging function in Philips IntelliSpace Cardiovascular (ISCV) 2.3.0 and earlier...7.2 High
- psftp psftpdThe PSFTPd 10.0.4 Build 729 server stores its configuration inside PSFTPd.dat. This file is a...5.3 Medium
- kickbase bundesliga managerThe Kickbase GmbH "Kickbase Bundesliga Manager" app before 2.2.1 -- aka kickbase-bundesliga...8.1 High
- ignitum seraSera 1.2 stores the user's login password in plain text in their home directory. This makes...7.8 High
- Show moreLoading…