CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- eng knowageIn Knowage through 6.1.1, an authenticated user who accesses the datasources page will gain...8.8 High
- floragunn search guardSearch Guard versions before 23.1 had an issue that an administrative user is able to retrieve...4.9 Medium
- zebra 220xi4 firmware, zt220 firmware, zt230 firmware +5 more +7 moreZebra Industrial Printers All Versions, Zebra printers are shipped with unrestricted end-user...7.5 High
- dell emc powerconnect 8024, dell emc powerconnect 7000 firmware, emc powerconnect 8024 firmware +9 more +11 moreDell EMC PowerConnect 8024, 7000, M6348, M6220, M8024 and M8024-K running firmware versions prior...7.2 High
- gradleThe HTTP client in the Build tool in Gradle before 5.6 sends authentication credentials...9.8 Critical
- jenkins eggplant, jenkins project eggplant plugin +1 moreJenkins eggplant-plugin Plugin stores credentials in plain text6.5 Medium
- google cloud messaging notification, jenkins project google cloud messaging notification plugin +1 moreJenkins Google Cloud Messaging Notification Plugin stores credentials in plain text6.5 Medium
- jenkins testlink, jenkins project testlink plugin +1 moreJenkins TestLink Plugin stores credentials in plain text5.3 Medium
- microdigital mdc-n2190v firmware, mdc-n4090 firmware, mdc-n4090w firmware +2 moreA cleartext password storage issue was discovered on MicroDigital N-series cameras with firmware...9.8 Critical
- cloud foundry cf cli, anynines elasticsearch, logme +45 more +47 moreCF CLI writes the client id and secret to config file6.3 Medium
- jenkins skytap cloud ci, jenkins project skytap cloud ci plugin +1 moreSkytap Cloud CI Plugin stored credentials in plain text6.5 Medium
- jenkins project maven release plugin, jenkins m2release +1 moreJenkins Maven Release Plug-in Plugin stored credentials in plain text5.5 Medium
- jenkins configuration as code, jenkins project configuration as code plugin +1 morePlaintext Storage of a Password in Jenkins Configuration as Code Plugin5.5 Medium
- fleetFleet before 2.1.2 allows exposure of SMTP credentials.7.5 High
- jenkins credentials binding, jenkins credentials binding plugin jenkins +1 moreJenkins Credentials Binding Plugin Stores Passwords in a Recoverable Format6.5 Medium
- rdbrck shiftRedbrick Shift through 3.4.3 allows an attacker to extract authentication tokens of services ...7.5 High
- aquaverde aquarius cmsAquaverde GmbH Aquarius CMS prior to version 4.1.1 is affected by: Incorrect Access Control. The...9.8 Critical
- alarm adc-v522ir firmwareAlarm.com ADC-V522IR 0100b9 devices have Incorrect Access Control, a different issue than CVE...7.8 High
- jenkins mashup portlets, jenkins project mashup portlets plugin +1 moreStored credentials unencrypted in Jenkins Mashup Portlets Plugin8.8 High
- dropboxDropbox.exe (and QtWebEngineProcess.exe in the Web Helper) in the Dropbox desktop application 71...7.8 High
- fortinet fcm-mb40 firmwareDynacolor FCM-MB40 v1.2.0.0 use /etc/appWeb/appweb.pass to store administrative web-interface...9.8 Critical
- jetbrains intellij ideaIn several versions of JetBrains IntelliJ IDEA Ultimate, creating Task Servers configurations...9.8 Critical
- jetbrains intellij ideaIn several versions of JetBrains IntelliJ IDEA Ultimate, creating run configurations for cloud...8.1 High
- jetbrains hubIn JetBrains Hub versions earlier than 2018.4.11298, the audit events for SMTPSettings show a...7.2 High
- jetbrains intellij ideaIn several JetBrains IntelliJ IDEA versions, creating remote run configurations of JavaEE...9.8 Critical
- calamaresCalamares through 3.2.4 copies a LUKS encryption keyfile from /crypto_keyfile.bin (mode 0600...7.5 High
- nortekcontrol linear emerge elite firmware, linear emerge essential firmware +1 moreLinear eMerge E3-Series devices have Cleartext Credentials in a Database.9.8 Critical
- nortekcontrol linear emerge 5000p firmware, linear emerge 50p firmware +1 moreNortek Linear eMerge 50P/5000P devices have Default Credentials.9.8 Critical
- logitech r500 firmwareThe Logitech R500 presentation clicker allows attackers to determine the AES key, leading to...6.5 Medium
- spring security, vmware spring security, debian linux +2 morePlaintextPasswordEncoder authenticates encoded passwords that are null7.3 High
- ibm spectrum protect plusIBM Spectrum Protect Plus 10.1.2 may display the vSnap CIFS password in the IBM Spectrum Protect...5.9 Medium
- cloud foundry boshBosh Deployment logs leak sensitive information6.0 Medium
- ibm cloud private, mq advanced cloud pak (ibm cloud private on redhat openshift), mq advanced cloud pak (ibm cloud private) +2 moreIBM MQ Advanced Cloud Pak (IBM Cloud Private 1.0.0 through 3.0.1) stores user credentials in...6.2 Medium
- intel open cloud integrity tehnology, openattestation +1 moreInsufficient password protection in the attestation database for Open CIT may allow an...4.4 Medium
- intel open cloud integrity tehnology, openattestation +1 moreInsufficient password protection in the attestation database for Open CIT may allow an...3.3 Low
- intel open cloud integrity tehnology, openattestation +1 moreInsufficient password protection in the attestation database for Open CIT may allow an...3.3 Low
- intel open cloud integrity tehnology, openattestation +1 moreInsufficient password protection in the attestation database for Open CIT may allow an...4.4 Medium
- intel open cloud integrity tehnology, openattestation +1 moreInsufficient password protection in the attestation database for Open CIT may allow an...4.4 Medium
- intel open cloud integrity tehnology, openattestation +1 moreInsufficient password protection in the attestation database for Open CIT may allow an...3.6 Low
- intel open cloud integrity tehnology, openattestation +1 moreInsufficient password protection in the attestation database for Open CIT may allow an...4.4 Medium
- fujielectric v-serverFuji Electric V-Server before 6.0.33.0 stores database credentials in project files as plaintext....9.8 Critical
- siemens scalance x-200 switch family (incl. siplus net variants), scalance x-200irt switch family (incl. siplus net variants), scalance x-300 switch family (incl. x408 and siplus net variants) +5 more +7 moreA vulnerability has been identified in SCALANCE X-200 (All Versions < V5.2.4), SCALANCE X-200IRT ...5.5 Medium
- python, canonical ubuntu linux, debian linux +14 more +16 moreA security regression of CVE-2019-9636 was discovered in python since commit...9.8 Critical
- kyocera command center rxKyocera Command Center RX TASKalfa4501i and TASKalfa5052ci allows remote attackers to abuse the...8.8 High
- auo solar data recorderAn issue was discovered in AUO Solar Data Recorder before 1.3.0. The web portal uses HTTP Basic...9.8 Critical
- carel pcoweb card firmwareAn issue was discovered in Carel pCOWeb prior to B1.2.4. In /config/pw_changeusers.html the...8.8 High
- schneider-electric citectscada, aveva vijeo citect and citectscada, schneider-electric scada expert vijeo citect +2 moreIn Vijeo Citect 7.30 and 7.40, and CitectSCADA 7.30 and 7.40, a vulnerability has been identified...7.8 High
- eficode influxdb, jenkins project influxdb plugin +1 morePlaintext password storage in Jenkins InfluxDB Plugin8.8 High
- traefikContainous Traefik Exposes Password Hashes7.5 High
- ibm spectrum control standard edition, spectrum control +1 moreIBM Tivoli Storage Productivity Center 5.2.13 through 5.3.0.1 could allow a remote attacker to...5.9 Medium
- Show moreLoading…