CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- solarwinds sftp\/scp serverIn SolarWinds SFTP/SCP Server through 2018-09-10, the configuration file is world readable and...9.8 Critical
- chipsbank umptoolChipsBank UMPTool saves the password to the NAND with a simple substitution cipher, which allows...6.8 Medium
- qbeecamInsecure Cryptographic Storage of credentials in com.vestiacom.qbeecamera_preferences.xml in the...9.8 Critical
- ismartalarmCleartext Storage of credentials in the iSmartAlarmData.xml configuration file in the iSmartAlarm...6.8 Medium
- samsung 840 evo firmwareAn issue was discovered on Samsung 840 EVO devices. Vendor-specific commands may allow access to...4.2 Medium
- foscam c2 application firmware, c2 system firmware, opticam i5 application firmware +1 more +3 moreAn issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and...9.8 Critical
- unknown circontrol circarlife all versions prior to 4.3.1, circontrol circarlife firmware +1 moreCircontrol CirCarLife all versions prior to 4.3.1, the PAP credentials of the device are stored...9.8 Critical
- ics-cert vgo robot, vecna vgo firmware +1 moreIf an attacker has access to the firmware from the VGo Robot (Versions 3.0.3.52164 and 3.0.3...9.8 Critical
- zyxel vmg3312-b10b firmwareZyXEL VMG3312-B10B 1.00(AAPP.7) devices have a backdoor root account with the tTn3+Z@!Sr0O+...9.8 Critical
- purevpnThe PureVPN client before 6.1.0 for Windows stores Login Credentials (username and password) in...7.8 High
- eaton 9px ups firmwareAn issue was discovered on Eaton UPS 9PX 8000 SP devices. The appliance discloses the SNMP...4.9 Medium
- eaton 9px ups firmwareAn issue was discovered on Eaton UPS 9PX 8000 SP devices. The appliance discloses the user's...4.9 Medium
- emc secure remote services, dell emc esrs virtual edition +1 moreDell EMC Secure Remote Services, versions prior to 3.32.00.08, contains a Plaintext Password...5.5 Medium
- dlink dir-140l firmware, dir-640l firmware, dwr-111 firmware +5 more +7 moreAn issue was discovered on D-Link DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1...9.8 Critical
- yokogawa fcj firmware, fcn-100 firmware, fcn-500 firmware +2 more +4 moreYokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The...9.8 Critical
- hclsoftware bigfix platformIBM BigFix Platform 9.5 - 9.5.9 stores user credentials in plain in clear text which can be read...4.4 Medium
- descor infocad fmAn issue was discovered in Descor Infocad FM before 3.1.0.0. An unauthenticated web service...7.5 High
- d-link dir-809 a1 firmware, dir-809 a2 firmware, dir-809 guestzone firmware +2 moreAn issue was discovered on D-Link DIR-809 A1 through 1.09, A2 through 1.11, and Guest Zone...9.8 Critical
- python requests, canonical ubuntu linux, opensuse leap +3 more +5 moreInsufficiently Protected Credentials in Requests7.5 High
- verint verba collaboration compliance and quality management platformVerba Collaboration Compliance and Quality Management Platform before 9.2.1.5545 has Incorrect...6.5 Medium
- hp compaq 14-h000 firmware, compaq 14-s000 firmware, compaq cq45-900 firmware +32 more +34 moreA BIOS password extraction vulnerability has been reported on certain consumer notebooks with...4.6 Medium
- samsung scx-6545x firmwareSamsung SCX-6545X V2.00.03.01 03-23-2012 devices allows remote attackers to discover cleartext...9.8 Critical
- puppet cisco iosPrevious releases of the Puppet cisco_ios module output SSH session debug information including...5.5 Medium
- puppet device managerPrevious releases of the Puppet device_manager module creates configuration files containing...7.8 High
- djangoproject djangoDjango allows unprivileged users to read the password hashes of arbitrary accounts4.9 Medium
- ibm security guardiumIBM Security Guardium EcoSystem 10.5 stores user credentials in plain in clear text which can be...6.2 Medium
- telegram desktopTelegram Desktop (aka tdesktop) 1.3.16 alpha, when "Use proxy" is enabled, sends credentials and...9.8 Critical
- circontrol open charge point protocolAn issue was discovered in CIRCONTROL Open Charge Point Protocol (OCPP) before 1.5.0, as used in...9.8 Critical
- synametrics synamanSynametrics SynaMan 4.0 build 1488 uses cleartext password storage for SMTP credentials.7.8 High
- squashtest squash tmSquash TM through 1.18.0 presents the cleartext passwords of external services in the...7.2 High
- contronics homeputer cl studio fur homematicHomeputer CL Studio fur HomeMatic 4.0 Rel 160808 and earlier uses cleartext to exchange the...8.1 High
- ice qube thermal management center, iceqube thermal management center firmware +1 moreIn Ice Qube Thermal Management Center versions prior to version 4.13, passwords are stored in...9.8 Critical
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreIf a user saved passwords before Firefox 58 and then later set a master password, an unencrypted...5.5 Medium
- ca technologies ppm, broadcom project portfolio management +1 moreUnprotected storage of credentials in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and...7.5 High
- samba, canonical ubuntu linux, redhat enterprise linux desktop +2 more +4 moreA flaw was found in the way samba before 4.7.9 and 4.8.4 allowed the use of weak NTLMv1...5.4 Medium
- medtronic 24950 mycarelink monitor, 24952 mycarelink monitor, mycarelink 24950 patient monitor firmware +1 more +3 moreMedtronic MyCareLink Patient Monitor Network Credential Weakness5.2 Medium
- atlassian cloudtokenCloudtoken Insufficiently Protects Credentials6.1 Medium
- ibm security identity governance and intelligenceIBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 does not require that...5.9 Medium
- dell emc networker, networker +1 moreDell EMC NetWorker versions between 9.0 and 9.1.1.8 through 9.2.1.3, and the version 18.1.0.1...8.8 High
- f5 big-ip controller, f5 networks, inc. container connector +1 moreThe F5 BIG-IP Controller for Kubernetes 1.0.0-1.5.0 (k8s-bigip-crtl) passes BIG-IP username and...8.8 High
- echelon i.lon 100, i.lon 600, smartserver 1 +5 more +7 moreEchelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON...9.8 Critical
- intel corporation core processor, intel core i3, core i5 +1 more +3 morePlatform sample code firmware included with 4th Gen Intel Core Processor, 5th Gen Intel Core...6.7 Medium
- jenkins aws codebuildInsufficiently Protected Credentials in Jenkins AWS CodeBuild Plugin7.8 High
- jenkins aws codedeployAWS CodeDeploy Plugin stored AWS Secret Key in plain text7.8 High
- jenkins aws codedeployJenkins AWS CodeDeploy Plugin has Insufficiently Protected Credentials4.3 Medium
- jenkins aws codepipelineJenkins AWS CodePipeline Plugin has Insufficiently Protected Credentials7.8 High
- mongodb, [unknown] rhscon-core, redhat storage console +2 moreThe skyring-setup command creates random password for mongodb skyring database but it writes...4.8 Medium
- dialogic powermedia xmsPlaintext Storage of Passwords within Cookies in /var/www/xms/application/controllers/verifyLogin...8.1 High
- dialogic powermedia xmsPlaintext Storage of Passwords in the administrative console in Dialogic PowerMedia XMS before 3...7.8 High
- schneider electric se pelco sarix professional v1, schneider-electric ibp1110-1er firmware, ibp219-1er firmware +18 more +20 moreIn Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions...8.8 High
- Show moreLoading…