CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- zohocorp manageengine servicedesk plusZoho ManageEngine Service Plus before 11.1 build 11112 allows low-privilege authenticated users...6.5 Medium
- jetstream jetselectAn issue was discovered in all versions of Bond JetSelect. Within the JetSelect Application, the...6.5 Medium
- jetstream jetselectBond JetSelect (all versions) has an issue in the Java class (ENCtool.jar) and corresponding...9.8 Critical
- jetstream jetselectThe administrative passwords for all versions of Bond JetSelect are stored within an unprotected...6.5 Medium
- google androidAn issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (with TEEGRIS) software...7.5 High
- avira free antivirus** DISPUTED ** Avira Free Antivirus through 15.0.2005.1866 allows local users to discover user...5.5 Medium
- signond project signond, ubports ubuntu touch, ubuntu signon +2 moreOnline Accounts Signon daemon gives out all oauth tokens to any app5.9 Medium
- wavlink wn530hg4 firmware, wn531g3 firmware, wn572hg3 firmware +2 moreAn issue was discovered on Wavlink WL-WN530HG4 M30HG4.V5030.191116 devices. A page is exposed...7.5 High
- wavlink wn530hg4 firmware, wn531g3 firmware, wn533a8 firmware +1 more +3 moreAn issue was discovered on Wavlink WL-WN530HG4 M30HG4.V5030.191116 devices, affecting /cgi-bin...7.5 High
- wavlink jetstream ac3000 firmware, jetstream erac3000 firmware, wl-wn575a3 firmware +10 more +12 moreAn issue was discovered on Wavlink WL-WN579G3 - M79X3.V5030.180719 and WL-WN575A3 - RPT75A3.V4300...7.5 High
- blaauwproducts remote kiln controlBlaauw Remote Kiln Control through v3.00r4 allows an unauthenticated attacker to access MySQL...9.8 Critical
- jenkins credentials binding, jenkins project credentials binding plugin +1 moreImproper masking of some secrets in Jenkins Credentials Binding Plugin4.3 Medium
- jenkins credentials binding, jenkins project credentials binding plugin +1 moreSecrets are not masked by Jenkins Credentials Binding Plugin in builds without build steps6.5 Medium
- bmcsoftware control-m\/agentBMC Control-M/Agent 7.0.00.000 has Insecure Password Storage.7.5 High
- rukovoditelIn Rukovoditel 2.5.2, users' passwords and usernames are stored in a cookie with URL encoding,...5.3 Medium
- testlinkIn TestLink 1.9.20, a crafted login.php viewer parameter exposes cleartext credentials.7.5 High
- ibm urbancode deployIBM UrbanCode Deploy (UCD) 7.0.4.0 stores user credentials in plain in clear text which can be...6.2 Medium
- netgear d6220 firmware, d6400 firmware, d8500 firmware +15 more +17 moreCertain NETGEAR devices are affected by administrative password disclosure. This affects D6220...8.4 High
- busch-jaeger 6186/11 telefon-gateway, abb tg/s 3.2 telephone gateway, tg\/s3.2 firmware +1 more +3 moreABB/Busch-Jaeger Telephone Gateway TG/S 3.2 Plaintext storing of credentials6.2 Medium
- evenroute iqrouter firmwareIn IQrouter through 3.3.1, there is a root user without a password, which allows attackers to...9.8 Critical
- evenroute iqrouter firmwareIn IQrouter through 3.3.1, the Lua function diag_set_password in the web-panel allows remote...7.5 High
- dlink dsl-2640b firmwareAn issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. A cfm UDP service listening on...9.8 Critical
- netgear d7000 firmware, r6700 firmware, r6800 firmware +2 moreCertain NETGEAR devices are affected by disclosure of administrative credentials. This affects...8.4 High
- netgear d7000 firmware, r6700 firmware, r6800 firmware +2 moreCertain NETGEAR devices are affected by disclosure of administrative credentials. This affects...8.4 High
- netgear r6700 firmware, r6800 firmware +1 moreCertain NETGEAR devices are affected by disclosure of administrative credentials. This affects...8.4 High
- git, canonical ubuntu linux, debian linux +1 more +3 moreMalicious URLs can still cause Git to send a stored credential to the wrong server4.0 Medium
- microfocus enterprise developer, enterprise server +1 moreInsufficiently protected credentials vulnerability on Micro Focus enterprise developer and...8.8 High
- mikrotik winboxMikroTik WinBox 3.22 and below stores the user's cleartext password in the settings.cfg.viw...5.5 Medium
- sap se business objects business intelligence platform, sap businessobjects business intelligence platform +1 moreSAP Business Objects Business Intelligence Platform (CMC), version 4.1, 4.2, shows cleartext...6.4 Medium
- git, canonical ubuntu linux, debian linux +2 more +4 moremalicious URLs may cause Git to present stored credentials to the wrong server9.3 Critical
- jetbrains pycharmIn JetBrains PyCharm 2019.2.5 and 2019.3 on Windows, Apple Notarization Service credentials were...7.5 High
- pivotal vmware tanzu application service for vms, vmware tanzu application service for vms +1 morePCF Autoscaling logs its database credentials6.5 Medium
- auth0 auth0.jsInformation disclosure through error object5.5 Medium
- castlerock snmpc onlineAn issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. It allows remote...7.5 High
- castlerock snmpc onlineAn issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. It includes the...7.5 High
- paloaltonetworks pan-os, vm-series, palo alto networks vm-series plugin +2 moreVM-Series on Microsoft Azure: Inadvertent collection of credentials in Tech support files on HA configured VMs5.8 Medium
- primekey ejbcaAn issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. The External Command...7.2 High
- google androidAn issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.0)...6.5 Medium
- google androidAn issue was discovered on Samsung mobile devices with L(5.0/5.1), M(6.0), and N(7.0) software....7.5 High
- nchsoftware express invoiceNCH Express Invoice 7.25 allows local users to discover the cleartext password by reading the...7.8 High
- abb esomsABB eSOMS: REDIS clear text credentials6.1 Medium
- advantech webaccessAdvantech WebAccess 8.3.4 does not properly restrict an RPC call that allows unauthenticated,...7.5 High
- technicolor tc7337 firmwareAn issue was discovered on Technicolor TC7337 8.89.17 devices. An attacker can discover admin...7.5 High
- teradici pcoip management consoleTeradici PCoIP Management Console 20.01.0 and 19.11.1 is vulnerable to unauthenticated password...8.1 High
- jenkins project artifactory plugin, jfrog artifactory +1 morePasswords transmitted in plain text by Jenkins Artifactory Plugin7.5 High
- jenkins project artifactory plugin, jfrog artifactory +1 morePasswords stored in plain text by Jenkins Artifactory Plugin6.5 Medium
- rconfigAn issue was discovered in includes/head.inc.php in rConfig before 3.9.4. An unauthenticated...7.5 High
- suitecrmSuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 mishandles API access tokens and...7.5 High
- netsas enigma network management solutionNETSAS Enigma NMS 65.0.0 and prior utilises basic authentication over HTTP for enforcing access...7.5 High
- dlink dsl-2875al firmware, dsl-2877al firmware +1 moreD-Link DSL-2875AL and DSL-2877AL devices through 1.00.05 are prone to information disclosure via...7.5 High
- Show moreLoading…