CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- grundfos cim 500Grundfos CIM 500 v06.16.00 stores plaintext credentials, which may allow sensitive information to...7.5 High
- ibm qradar advisor, qradar advisory +1 moreThe IBM QRadar Advisor 1.1 through 2.5.2 with Watson App for IBM QRadar SIEM does not adequately...4.2 Medium
- midasolutions eframeworkMida eFramework through 2.9.0 has a back door that permits a change of the administrative...9.8 Critical
- ibm verify gateway (ivg), verify gateway +1 moreIBM Verify Gateway (IVG) 1.0.0 and 1.0.1 uses an inadequate account lockout setting that could...7.5 High
- ibm verify gateway (ivg), verify gateway +1 moreIBM Verify Gateway (IVG) 1.0.0 and 1.0.1 stores user credentials in plain in clear text which can...6.2 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP Potentially Reveal LDAP Server Password via Unsafe Connection8.3 High
- hcltech bigfix platform"BigFix Platform is storing clear text credentials within the system's memory. An attacker who is...6.0 Medium
- cisco sd-wan, sd-wan vmanage +1 moreCisco SD-WAN Solution Software Static Credentials Vulnerability8.4 High
- abb irb140, irb140 firmware, irc5 firmware +2 moreRVD#3326: Hardcoded default credentials on IRC 5 OPC Server9.1 Critical
- mozilla thunderbirdIf an attacker intercepts Thunderbird's initial attempt to perform automatic account setup using...5.9 Medium
- jenkins project hp alm quality center plugin, hp application lifecycle management quality center project application lifecycle management quality center +1 morePassword stored in plain text by Jenkins HP ALM Quality Center Plugin3.3 Low
- jenkins white source, jenkins project white source plugin +1 moreCredentials stored in plain text by Jenkins White Source Plugin4.3 Medium
- jenkins github coverage reporter, jenkins project github coverage reporter plugin +1 moreSecret stored in plain text by Jenkins GitHub Coverage Reporter Plugin4.3 Medium
- jenkins testcomplete support, jenkins project testcomplete support plugin +1 morePassword stored in plain text by Jenkins TestComplete support Plugin4.3 Medium
- jenkins slack upload, jenkins project slack upload plugin +1 moreSecret stored in plain text by Jenkins Slack Upload Plugin4.3 Medium
- cisco digital network architecture center, digital network architecture center (dna center) +1 moreCisco Digital Network Architecture Center Information Disclosure Vulnerability6.5 Medium
- linkplayAn issue was discovered on Zolo Halo devices via the Linkplay firmware. There is Zolo Halo LAN...9.8 Critical
- f5 nginx controllerIn NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is...7.8 High
- biotronik cardiomessenger ii-s gsm firmware, cardiomessenger ii-s t-line firmware +1 moreBIOTRONIK CardioMessenger II, The affected products use individual per-device credentials that...4.6 Medium
- apache artemis, red hat activemq artemis, netapp oncommand workflow automation +2 moreActiveMQ Artemis has Insufficiently Protected Credentials5.5 Medium
- zyxel cloudcnm secumanagerZyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated update_all_realm_license API.7.5 High
- zyxel cloudcnm secumanagerZyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the q6xV4aW8bQ4cfD-b password for the axiros account.9.8 Critical
- gitlabAmazon EKS credentials disclosure in GitLab CE/EE 12.6 and later through 13.0.1 allows other...5.3 Medium
- bt ctroms terminal project ctroms terminalAn issue was discovered in BT CTROMS Terminal OS Port Portal CT-464. Account takeover can occur...8.1 High
- mattermost serverAn issue was discovered in Mattermost Server before 5.4.0. It mishandles possession of...7.5 High
- mattermost serverAn issue was discovered in Mattermost Server before 5.8.0. It mishandles brute-force attacks...7.3 High
- octopus deployIn Octopus Deploy 2018.8.0 through 2019.x before 2019.12.2, an authenticated user with could...6.5 Medium
- netgear rbk752 firmware, rbk753 firmware, rbk753s firmware +9 more +11 moreCertain NETGEAR devices are affected by disclosure of administrative credentials. This affects...9.6 Critical
- netgear rbk752 firmware, rbk753 firmware, rbk753s firmware +9 more +11 moreCertain NETGEAR devices are affected by disclosure of administrative credentials. This affects...9.6 Critical
- netgear mk62 firmware, mk63 firmware, mr60 firmware +13 more +15 moreCertain NETGEAR devices are affected by disclosure of administrative credentials. This affects...9.6 Critical
- netgear rbk752 firmware, rbk753 firmware, rbk753s firmware +9 more +11 moreCertain NETGEAR devices are affected by disclosure of administrative credentials. This affects...9.6 Critical
- netgear rbk752 firmware, rbk753 firmware, rbk753s firmware +9 more +11 moreCertain NETGEAR devices are affected by disclosure of administrative credentials. This affects...9.6 Critical
- netgear rbk752 firmware, rbk753 firmware, rbk753s firmware +9 more +11 moreCertain NETGEAR devices are affected by disclosure of administrative credentials. This affects...9.6 Critical
- intel active management technology firmwareInsufficiently protected credentials in Intel(R) AMT versions before 11.8.77, 11.12.77, 11.22.77...7.5 High
- openshift openshift/openshift-apiserver, redhat openshift container platform +1 moreA flaw was found in the OpenShift API Server, where it failed to sufficiently protect OAuthTokens...7.5 High
- sos-berlin jobschedulerA vulnerability based on insecure user/password encryption in the JOE (job editor) component of...7.5 High
- red hat openstack-cinder, canonical ubuntu linux +1 moreOpenstack cinder Improper handling of ScaleIO backend credentials6.5 Medium
- sap business one, sap se business one (backup service) +1 moreUnder certain conditions SAP Business One (Backup service), versions 9.3, 10.0, allows an...4.4 Medium
- microsoft windows, windows 10 version 1903 for 32-bit systems, windows 10 version 1903 for arm64-based systems +14 more +16 moreA security feature bypass vulnerability exists when Windows Host Guardian Service improperly...4.3 Medium
- castel nextgen dvr firmwareCastel NextGen DVR v1.0.0 stores and displays credentials for the associated SMTP server in...8.1 High
- google androidAn issue was discovered on Samsung mobile devices with O(8.x) (with TEEGRIS) software. The...9.8 Critical
- foxitsoftware phantompdfAn issue was discovered in Foxit PhantomPDF before 8.3.10. It has mishandling of cloud...7.5 High
- foxitsoftware phantompdfAn issue was discovered in Foxit PhantomPDF before 8.3.7. It allows NTLM credential theft via a...5.3 Medium
- foxitsoftware phantompdf, reader +1 moreAn issue was discovered in Foxit Reader and PhantomPDF before 9.2. It allows NTLM credential...5.3 Medium
- avaya ip officeIPO Information Disclosure5.5 Medium
- jenkins project inheritance, jenkins project inheritance plugin +1 moreMissing permission check in Jenkins Project Inheritance Plugin6.5 Medium
- 2pisoftware cmfivesystem/classes/DbPDO.php in Cmfive through 2015-03-15, when database connectivity malfunctions,...7.5 High
- piwigo lexiglotLexiglot through 2014-11-20 allows local users to obtain sensitive information by listing a...7.8 High
- ibm security identity governance and intelligenceIBM Security Identity Governance and Intelligence 5.2.6 could allow an attacker to enumerate...5.3 Medium
- aviatrix controller, gateway +1 moreAn issue was discovered in Aviatrix Controller before 5.4.1204. It contains credentials unused by...7.5 High
- Show moreLoading…