CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- jenkins fortify, jenkins project fortify plugin +1 moreFortify Plugin stored credentials in plain text4.3 Medium
- handsomeweb sos webpagesbackup.php in HandsomeWeb SOS Webpages before 1.1.12 does not require knowledge of the cleartext...9.8 Critical
- hp web viewpoint t0320, web viewpoint t0952, web viewpoint t0986 +2 moreAn issue was discovered in Idelji Web ViewPoint H01ABO-H01BY and L01ABP-L01ABZ, Web ViewPoint...5.5 Medium
- ciktel mesh router firmware, coship emta ap firmwre, fg-products fgn-r2 firmware +14 more +16 moreA certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21)...7.5 High
- gehealthcare apexpro telemetry server firmware, carescape central station mai700 firmware, carescape central station mas700 firmware +3 more +5 moreIn ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior,...10.0 Critical
- ge d200 firmware, d20me firmware +1 moreGeneral Electric D20ME devices are not properly configured and reveal plaintext passwords.7.5 High
- ixpdata easyinstallIn IXP EasyInstall 6.2.13723, there are cleartext credentials in network communication on TCP...7.5 High
- ruckuswireless unleashed, zonedirector 1200 firmware +1 moreIncorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102...9.8 Critical
- kmccontrols bac-a1616bc firmwareKMS Controls BAC-A1616BC BACnet devices have a cleartext password of snowman in the BACKDOOR_NAME...9.8 Critical
- trend micro password manager, trend micro, inc. micro password manager +1 moreA RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where...5.5 Medium
- apache cxf, oracle commerce guided search, communications diameter signaling router +5 more +7 morePrivate key leak in Apache CXF7.5 High
- serpico project serpicoAn issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. An...6.5 Medium
- jenkins redgate sql change automation, jenkins project redgate sql change automation plugin +1 moreRedgate SQL Change Automation Plugin stored credentials in plain text4.3 Medium
- cayintech smp-pro4 firmwareAn issue was discovered on Cayin SMP-PRO4 devices. A user can discover a saved password by...6.5 Medium
- granding grand ma300 firmwareGrand MA 300 allows a brute-force attack on the PIN.9.8 Critical
- zohocorp manageengine eventlog analyzerManageEngine EventLog Analyzer version 7 through 9.9 build 9002 has a Credentials Disclosure...7.5 High
- arialsoftware campaign enterpriseArial Campaign Enterprise before 11.0.551 stores passwords in clear text and these may be retrieved.7.5 High
- ibm qradar siem, qradar security information and event manager +1 moreIBM QRadar SIEM 7.3.0 through 7.3.3 uses weak credential storage in some instances which could be...5.1 Medium
- status2kStatus2k does not remove the install directory allowing credential reset.9.8 Critical
- fortinet fortisiemAn information exposure vulnerability in the external authentication profile form of FortiSIEM 5...6.5 Medium
- anglersnet co,.ltd. access analysis cgi an-analyzer, anglers-net cgi an-anlyzer +1 moreAccess analysis CGI An-Analyzer released in 2019 June 24 and earlier allow remote attackers to...7.5 High
- gitlabGitLab Enterprise Edition (EE) 9.0 and later through 12.5 allows Information Disclosure.4.9 Medium
- huawei usg9500, usg9500 firmware +1 moreUSG9500 with software of V500R001C30SPC100; V500R001C30SPC200; V500R001C30SPC600;...8.2 High
- intel ipmi, citrix netscaler firmware, netscaler sd-wan firmware +3 more +5 moreHardcoded WSMan credentials in Intelligent Platform Management Interface (IPMI) with firmware for...7.5 High
- project quay quayA flaw was found in the way Red Hat Quay stores robot account tokens in plain text. An attacker...6.0 Medium
- ibm watson studio localIBM Watson Studio Local 1.2.3 stores key files in the user's home directory which could be...6.2 Medium
- al-enterprise omnivista 4760, omnivista 8770 +1 moreAn issue was discovered on Alcatel-Lucent OmniVista 4760 devices, and 8770 devices before 4.1.2....7.5 High
- rakuten rakuma, rakuten, inc. rakuma app +1 moreRakuma App for Android version 7.15.0 and earlier, and for iOS version 7.16.4 and earlier allows...6.5 Medium
- zte zxcloud goldendata vapAll versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have encryption problems...9.8 Critical
- apache tomcat, canonical ubuntu linux, debian linux +3 more +5 moreInsufficiently Protected Credentials in Apache Tomcat7.0 High
- arista cloudvision portalIn CloudVision Portal (CVP) for all releases in the 2018.2 Train, under certain conditions, the...4.9 Medium
- dell rsa identity governance and lifecycle, rsa identity governance & lifecycle +1 moreThe RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to...8.3 High
- humaxdigital hgb10r-02 firmwareAn issue was discovered on Humax Wireless Voice Gateway HGB10R-2 20160817_1855 devices. Admin...7.5 High
- apple macos, mac os x +1 moreA logic issue was addressed with improved state management. This issue is fixed in macOS Mojave...5.5 Medium
- jenkins weibo, jenkins project weibo plugin +1 moreJenkins Weibo Plugin stores credentials unencrypted in its global configuration file5.5 Medium
- jenkins redgate sql change automation, jenkins project redgate sql change automation plugin +1 moreJenkins Redgate SQL Change Automation Plugin has Insufficiently Protected Credentials6.5 Medium
- jenkins rundeck, jenkins project rundeck plugin +1 moreJenkins Rundeck Plugin stored credentials in plain text6.5 Medium
- barco clickshare button r9861500d01 firmwareBarco ClickShare Button R9861500D01 devices before 1.9.0 have incorrect Credentials Management....8.1 High
- redhat satellite, rubygem-hammer cli foreman cli foreman, theforeman hammer cli +2 morerubygem-hammer_cli_foreman: File /etc/hammer/cli.modules.d/foreman.yml world readable5.5 Medium
- openstack keystoneOpenStack Keystone Credential Leakage8.8 High
- weidmueller ie-sw-pl08m-6tx-2sc firmware, ie-sw-pl08m-6tx-2scs firmware, ie-sw-pl08m-6tx-2st firmware +37 more +39 moreAn issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build...7.5 High
- weidmueller ie-sw-pl08m-6tx-2sc firmware, ie-sw-pl08m-6tx-2scs firmware, ie-sw-pl08m-6tx-2st firmware +37 more +39 moreAn issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build...9.8 Critical
- stanford webauth, debian linux +1 morewebauth before 4.6.1 has authentication credential disclosure7.5 High
- claws mail vcalendar plugin, claws-mail vcalendar +1 moreClaws Mail vCalendar plugin: credentials exposed on interface5.5 Medium
- red hat 389-ds-base, fedoraproject 389 directory server +1 moreA flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose...4.3 Medium
- loftek nexus 543 firmwareThe Loftek Nexus 543 IP Camera stores passwords in cleartext, which allows remote attackers to...7.5 High
- jenkins project qmetry for jira - test management plugin, qmetry jenkins qmetry for jira +1 moreJenkins QMetry for JIRA Plugin stored credentials in plain text8.8 High
- jenkins spira importer, jenkins project spira importer plugin +1 morePlaintext Storage in Jenkins Spira Importer Plugin5.5 Medium
- jenkins anchore container image scanner, jenkins project anchore container image scanner plugin +1 moreJenkins Anchore Container Scanner Plugin vulnerable to Insufficiently Protected Credentials6.5 Medium
- plex media serverPlex Media Server 1.18.2.2029-36236cc4c allows remote attackers to bypass intended access control...6.5 Medium
- Show moreLoading…