CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- dlink dsl-2875al firmwareD-Link DSL-2875AL devices through 1.00.05 are prone to password disclosure via a simple crafted ...7.5 High
- comba ac2400 firmwareComba AP2600-I devices through A02,0202N00PD2 are prone to password disclosure via a simple...7.5 High
- comba ap2600-i - a02 - 0202n00pd2 firmwareComba AP2600-I devices through A02,0202N00PD2 are prone to password disclosure via an insecure...7.5 High
- django-nopassword project django-nopassworddjango-nopassword stores secrets in cleartext7.5 High
- aquaforest tiff serverAquaforest TIFF Server 4.0 allows Unauthenticated SMB Hash Capture via UNC.7.5 High
- opcfoundation netstandard.opc.ua, ua-.netstandard +1 moreInsufficient Nonce Validation in Eclipse Milo Client7.4 High
- netgear cg3700b firmwareThe Voo branded NETGEAR CG3700b custom firmware V2.02.03 uses HTTP Basic Authentication over...9.8 Critical
- barracuda load balancer adc, load balancer adc firmware +1 moreLDAP Credential Exposure in Barracuda Load Balancer ADC8.7 High
- moxa mb3170 firmware, mb3180 firmware, mb3270 firmware +3 more +5 moreAn issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480...9.8 Critical
- moxa mb3170 firmware, mb3180 firmware, mb3270 firmware +3 more +5 moreAn issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480...6.2 Medium
- westerndigital sandisk x600 sd9sb8w-128g firmware, sandisk x600 sd9sb8w-1t00 firmware, sandisk x600 sd9sb8w-256g firmware +17 more +19 moreWestern Digital SanDisk X600 devices in certain configurations, a vulnerability in the access...7.5 High
- westerndigital sandisk x300 sd7sb6s-128g firmware, sandisk x300 sd7sb6s-256g firmware, sandisk x300 sd7sb7s-010t firmware +56 more +58 moreWestern Digital SanDisk SanDisk X300, X300s, X400, and X600 devices: The firmware update...6.3 Medium
- westerndigital sandisk x300 sd7sb6s-128g firmware, sandisk x300 sd7sb6s-256g firmware, sandisk x300 sd7sb7s-010t firmware +56 more +58 moreWestern Digital SanDisk X300, X300s, X400, and X600 devices: A vulnerability in the wear-leveling...5.5 Medium
- jenkins zephyr enterprise test management, jenkins project zephyr enterprise test management plugin +1 moreCredentials stored in plain text by Zephyr Enterprise Test Management Plugin5.5 Medium
- mi mdz-25-dt firmwareAn issue was discovered on XIAOMI AI speaker MDZ-25-DT 1.34.36, and 1.40.14. Attackers can get...6.8 Medium
- commscope arris tg1692a firmwareARRIS TG1692A devices allow remote attackers to discover the administrator login name and...7.5 High
- broadcom reactor nettyAuthentication Leak On Redirect With Reactor Netty HttpClient6.5 Medium
- apple ios, ipados, safari +1 more +3 moreThe issue was addressed with improved UI handling. This issue is fixed in iOS 13.3.1 and iPadOS...6.5 Medium
- cloud foundry capi, cloudfoundry capi-release, cf-deployment +2 moreCloud Controller logs environment variables from app manifests8.0 High
- golfbuddyglobal course managerIn GolfBuddy Course Manager 1.1, passwords are sent (with base64 encoding) via a GET request.6.5 Medium
- xerox workcentre 3655 firmware, workcentre 3655i firmware, workcentre 5845 firmware +15 more +17 moreCertain Xerox WorkCentre printers before 073.xxx.000.02300 do not require the user to reenter or...8.8 High
- redhat ansibleAnsible sets unsafe permissions for sources.list5.5 Medium
- redhat ansibleAnsible discloses credential information5.5 Medium
- iteris vantage velocity firmwareIteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have two users that are not documented...9.8 Critical
- mozilla thunderbird, canonical ubuntu linux +1 moreIf a user saved passwords before Thunderbird 60 and then later set a master password, an...6.5 Medium
- voatzThe Voatz application 2020-01-01 for Android allows only 100 million different PINs, which makes...5.9 Medium
- jenkins applatix, jenkins project applatix plugin +1 morePassword stored in plain text by Applatix Plugin6.5 Medium
- jenkins parasoft environment manager, jenkins project parasoft environment manager plugin +1 morePassword stored in plain text by Parasoft Environment Manager Plugin6.5 Medium
- jenkins harvest scm, jenkins project harvest scm plugin +1 morePasswords stored in plain text by Harvest SCM Plugin6.5 Medium
- jenkins harvest scm, jenkins project harvest scm plugin +1 morePasswords stored in plain text by Harvest SCM Plugin6.5 Medium
- jenkins eagle tester, jenkins project eagle tester plugin +1 morePlaintext Storage of a Password in Jenkins Eagle Tester Plugin6.5 Medium
- jenkins ecx copy data management, jenkins project ecx copy data management plugin +1 morePassword stored in plain text by ECX Copy Data Management Plugin4.3 Medium
- jenkins bmc release package and deployment, jenkins project bmc release package and deployment plugin +1 moreCredential stored in plain text by BMC Release Package and Deployment Plugin4.3 Medium
- jenkins digitalocean, jenkins project digitalocean plugin +1 moreToken stored in plain text by DigitalOcean Plugin4.3 Medium
- jenkins debian package builder, jenkins project debian package builder plugin +1 moreCredentials stored in plain text by debian-package-builder Plugin4.3 Medium
- jenkins dynamic extended choice parameter, jenkins project dynamic extended choice parameter plugin +1 morePassword stored in plain text by Dynamic Extended Choice Parameter Plugin4.3 Medium
- jenkins azure ad, jenkins project azure ad plugin +1 moreClient secret transmitted in plain text by Azure AD Plugin5.3 Medium
- jenkins s3 publisher, jenkins project s3 publisher plugin +1 moreJenkins S3 Publisher Plugin transmits credentials in plain text during configuration7.5 High
- eyesofnetworkAn issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key (hardcoded...9.8 Critical
- automation direct c-more touch panels ea9 series, automationdirect c-more ea9-rhi firmware, c-more ea9-t10cl firmware +9 more +11 moreIt is possible to unmask credentials and other sensitive information on ?unprotected? project...9.8 Critical
- canonical cloud-init, debian linux, opensuse leap +2 moreIn cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a...5.5 Medium
- dlink dir-100 firmwareD-Link DIR-100 4.03B07 has PPTP and poe information disclosure9.8 Critical
- dlink dir-100 firmwareD-Link DIR-100 4.03B07: security bypass via an error in the cliget.cgi script9.8 Critical
- cmsjunkie j-businessdirectoryThe J-BusinessDirectory extension before 5.2.9 for Joomla! allows Reverse Tabnabbing. In some...6.5 Medium
- brother mfc-9970cdw firmwareBrother MFC-9970CDW devices with firmware 0D allow cleartext submission of passwords.7.5 High
- paessler prtg network monitorAn issue was discovered in PRTG 7.x through 19.4.53. Due to insufficient access control on local...5.5 Medium
- zohocorp manageengine remote access plusAn authorization issue was discovered in the Credential Manager feature in Zoho ManageEngine...4.3 Medium
- logmein lastpassLastPass prior to 2.5.1 has an insecure PIN implementation.6.8 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2019.1.5, some server-stored passwords could be shown via the web UI.7.5 High
- jetbrains teamcityIn JetBrains TeamCity before 2019.1.5, reverse tabnabbing was possible on several pages.4.3 Medium
- Show moreLoading…