CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- zyxel gs1900-10hp firmware, gs1900-16 firmware, gs1900-24 firmware +6 more +8 moreAn issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. The firmware...7.5 High
- mcafee advanced threat defense (atd), advanced threat defense +1 moreAdvanced Threat Defense (ATD) - Unprotected storage of shared credentials vulnerability9.8 Critical
- microsoft windows, windows 10 version 1903 for 32-bit systems, windows 10 version 1903 for arm64-based systems +11 more +13 moreA security feature bypass vulnerability exists where a NETLOGON message is able to obtain the...9.9 Critical
- mysql-gui-tools, fedoraproject fedora +1 moreMySQL-GUI-tools (mysql-administrator) leaks passwords into process list after with launch of...5.5 Medium
- arubanetworks clearpassAruba ClearPass Policy Manager before 6.5.7 and 6.6.x before 6.6.2 allows attackers to obtain...9.8 Critical
- [unknown] cloudformsCloudForms stores user passwords in recoverable format5.5 Medium
- postgresqlPostgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable...6.7 Medium
- ibm security guardium big data intelligenceIBM Security Guardium Big Data Intelligence (SonarG) 4.0 stores user credentials in plain in...5.1 Medium
- inea me-rtu firmware, mitsubishielectric smartrtu firmware +1 moreAn issue was discovered on Mitsubishi Electric ME-RTU devices through 2.02 and INEA ME-RTU...9.8 Critical
- jenkins zulip, jenkins project zulip plugin +1 moreJenkins Zulip Plugin vulnerable to Insufficiently Protected Credentials7.8 High
- jenkins sonar gerrit, jenkins project sonar gerrit plugin +1 moreJenkins Sonar Gerrit Plugin stores credentials unencrypted6.5 Medium
- jenkins dynatrace application monitoring, jenkins project dynatrace application monitoring plugin +1 moreJenkins Dynatrace Plugin vulnerable to Insufficiently Protected Credentials7.8 High
- jenkins bitbucket oauth, jenkins project bitbucket oauth plugin +1 moreJenkins Bitbucket OAuth Plugin contains Insufficiently Protected Credentials7.8 High
- jenkins mattermost notification, jenkins project mattermost notification plugin +1 moreJenkins Mattermost Notification Plugin contains unencrypted storage of secret token6.5 Medium
- verodin directorAn Information Disclosure issue in Verodin Director 3.5.3.1 and earlier reveals usernames and...7.7 High
- tomedo serverThe Customer's Tomedo Server in Version 1.7.3 communicates to the Vendor Tomedo Server via HTTP ...9.8 Critical
- broadcom reactor nettyReactor Netty authentication leak in redirects6.8 Medium
- cybelsoft thinvncThinVNC 1.0b1 is vulnerable to arbitrary file read, which leads to a compromise of the VNC server...9.8 Critical
- jenkins extensive testing, jenkins project extensive testing plugin +1 moreCleartext Storage of Sensitive Information in Jenkins Extensive Testing Plugin8.8 High
- infinitestudio infinite designThe Infinite Design application 3.4.12 for Android sends a username and password via TCP without...6.5 Medium
- pdf-xchange editorTracker PDF-XChange Editor before 8.0.330.0 has an NTLM SSO hash theft vulnerability using...6.5 Medium
- cobham plc explorer 710, cobham explorer 710 firmware +1 moreThe root password of the Cobham EXPLORER 710 is the same for all versions of firmware up to and including v1.089.8 Critical
- juniper sbr carrierSBR Carrier: A vulnerability in the identity and access management certificate generation procedure allows a local attacker to gain access to confidential information.5.6 Medium
- jenkins gitlab logo, jenkins project gitlab logo plugin +1 moreJenkins GitLab Logo Plugin stores credentials unencrypted5.5 Medium
- jenkins gem publisher, jenkins project gem publisher plugin +1 moreJenkins Gem Publisher Plugin stores credentials as plaintext5.5 Medium
- jenkins google calendar, jenkins project google calendar plugin +1 moreJenkins Google Calendar Plugin has Insufficiently Protected Credentials6.5 Medium
- jenkins eloyente, jenkins project eloyente plugin +1 moreJenkins elOyente Plugin has Insufficiently Protected Credentials5.5 Medium
- jenkins codescan, jenkins project codescan plugin +1 moreJenkins CodeScan Plugin has Insufficiently Protected Credentials5.5 Medium
- jenkins call remote job, jenkins project call remote job plugin +1 moreJenkins Call Remote Job Plugin has Insufficiently Protected Credentials6.5 Medium
- jenkins project azure event grid build notifier plugin, jenkins azure event grid notifier +1 moreJenkins Azure Event Grid Build Notifier Plugin has Insufficiently Protected Credentials4.3 Medium
- jenkins assembla, jenkins project assembla plugin +1 moreJenkins Assembla Plugin has Insufficiently Protected Credentials5.5 Medium
- jenkins vfabric application director, jenkins project vfabric application director plugin +1 moreJenkins vFabric Application Director Plugin Insufficiently Protected Credentials5.5 Medium
- jenkins violation comments to gitlab, jenkins project violation comments to gitlab plugin +1 moreViolation Comments to GitLab Plugin has Insufficiently Protected Credentials6.5 Medium
- jenkins violation comments to gitlab, jenkins project violation comments to gitlab plugin +1 moreJenkins Violation Comments to GitLab Plugin has Insufficiently Protected Credentials6.5 Medium
- jenkins git changelog, jenkins project git changelog plugin +1 moreJenkins Git Changelog Plugin has Insufficiently Protected Credentials6.5 Medium
- jenkins project data theorem: ci/cd plugin, jenkins data theorem mobile app security +1 moreJenkins Data Theorem Mobile Security: CI/CD Plugin has Insufficiently Protected Credentials6.5 Medium
- netapp ontap select deploy administration utilityONTAP Select Deploy administration utility versions 2.2 through 2.12.1 transmit credentials in...9.8 Critical
- grafanaAn issue was discovered in Grafana 5.4.0. Passwords for data sources used by Grafana (e.g., MySQL...4.9 Medium
- supermicro a1sa2-2750f firmware, a1sai-2550f firmware, a1sai-2750f firmware +333 more +335 moreOn Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and...10.0 Critical
- micro focus service managerClear text password in browser in Micro Focus Service Manager product versions 9.30, 9.31, 9.32,...6.5 Medium
- micro focus service managerClear text credentials are used to access managers app in Tomcat in Micro Focus Service Manager...6.5 Medium
- vmware vcenter serverVMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j)...7.7 High
- vmware vcenter serverVMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j)...7.7 High
- schneider electric se apc ups network management card 2 aos, schneider-electric ap9630 firmware, ap9631 firmware +2 more +4 moreA Credentials Management CWE-255 vulnerability exists in the APC UPS Network Management Card 2...9.8 Critical
- logmein lastpassLogMeIn LastPass before 4.33.0 allows attackers to construct a crafted web site that captures the...8.2 High
- jenkins beaker builder, jenkins project beaker builder plugin +1 moreJenkins Beaker Builder Plugin has Insufficiently Protected Credentials5.5 Medium
- teamviewerAn issue was discovered in TeamViewer 14.2.2558. Updating the product as a non-administrative...7.8 High
- buildah project buildah, redhat enterprise linux, openshift container platform +3 more +5 morecontainers/image library Insufficiently Protects Credentials6.4 Medium
- knowage-suite knowageIn Knowage through 6.1.1, an authenticated user that accesses the users page will obtain all user...4.9 Medium
- red hat ansible, debian linux, opensuse backports sle +1 more +3 moreAnsible password prompts could expose passwords6.4 Medium
- Show moreLoading…