CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- apache fineractThe implementation of POST with the username and password in the URL parameters exposed the...7.5 High
- hackerone nextcloud server, nextcloud server +1 moreA logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it...7.5 High
- netgear cbr40 firmware, rbk752 firmware, rbk852 firmware +4 more +6 moreCertain NETGEAR devices are affected by disclosure of administrative credentials. This affects...9.6 Critical
- netgear cbr40 firmware, rbk752 firmware, rbk852 firmware +4 more +6 moreCertain NETGEAR devices are affected by disclosure of administrative credentials. This affects...9.6 Critical
- netgear cbr40 firmware, rbk752 firmware, rbk852 firmware +4 more +6 moreCertain NETGEAR devices are affected by disclosure of administrative credentials. This affects...9.6 Critical
- netgear cbr40 firmware, rbk752 firmware, rbk852 firmware +4 more +6 moreCertain NETGEAR devices are affected by disclosure of administrative credentials. This affects...9.6 Critical
- netgear cbr40 firmware, rbk752 firmware, rbk852 firmware +4 more +6 moreCertain NETGEAR devices are affected by disclosure of administrative credentials. This affects...9.6 Critical
- netgear cbr40 firmware, rbk752 firmware, rbk852 firmware +4 more +6 moreCertain NETGEAR devices are affected by disclosure of administrative credentials. This affects...9.6 Critical
- gitlabAn issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2...5.7 Medium
- jenkins sms notification, jenkins project sms notification plugin +1 moreAccess token stored in plain text by Jenkins SMS Notification Plugin3.3 Low
- jenkins couchdb-statistics, jenkins project couchdb-statistics plugin +1 morePassword stored in plain text by Jenkins couchdb-statistics Plugin3.3 Low
- linuxfoundation nats.deno, nats.js, nats.ws +2 moreSensitive data exposure in NATS7.5 High
- broadcom brocade sannav, brocade sannav +1 moreBrocade SANnav versions before v2.1.0, contain a Plaintext Password Storage vulnerability.9.8 Critical
- cpanelIn cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549).9.8 Critical
- cpanelIn cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554).9.8 Critical
- puppet continuous deliveryLocal registry credentials were included directly in the CD4PE deployment definition, which could...5.5 Medium
- ibm bladecenter amm firmware, bladecenter advanced management module firmware +1 moreA cross-site scripting inclusion (XSSI) vulnerability was reported in the legacy IBM BladeCenter...4.3 Medium
- gallagher command centreOn controllers running versions of v8.20 prior to vCR8.20.200221b (distributed in v8.20.1093(MR2)...7.3 High
- gitlabA vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab OAuth...6.5 Medium
- avast antivirusAn issue was discovered in the Login Password feature of the Password Manager component in Avast...5.5 Medium
- siemens simatic s7-300 cpu family (incl. related et200 cpus and siplus variants), simatic s7-400 cpu family (incl. siplus variants), simatic winac rtx (f) 2010 +15 more +17 moreA vulnerability has been identified in SIMATIC S7-300 CPU family (incl. related ET200 CPUs and...6.5 Medium
- mcafee true key, mcafee,llc mcafee true key windows client +1 moreSensitive Data Exposure vulnerability in McAfee True Key Windows Client5.0 Medium
- cisco asyncos, web security appliance (wsa) +1 moreCisco Email Security Appliance, Cisco Content Security Management Appliance, and Cisco Web Security Appliance Information Disclosure Vulnerability4.3 Medium
- zte zxiptv firmwareA ZTE product is impacted by the cryptographic issues vulnerability. The encryption algorithm is...9.1 Critical
- ibm guardium data encryption, security guardium data encryption, guardium for cloud key management +2 moreIBM Security Guardium Data Encryption (GDE) 3.0.0.2 stores user credentials in plain in clear...5.3 Medium
- ibm guardium data encryption, security guardium data encryption, guardium for cloud key management +2 moreIBM Security Guardium Data Encryption (GDE) 3.0.0.2 stores user credentials in plain in clear...6.0 Medium
- niscomed m1000 multipara patient monitor firmwareAn issue was discovered on Nescomed Multipara Monitor M1000 devices. The device enables an...7.8 High
- niscomed m1000 multipara patient monitor firmwareAn issue was discovered on Nescomed Multipara Monitor M1000 devices. The physical UART debug port...6.8 Medium
- sonatype nexusIn Sonatype Nexus Repository 3.26.1, an S3 secret key can be exposed by an admin user.4.9 Medium
- ibm security guardium insightsIBM Security Guardium Insights 2.0.1 stores user credentials in plain in clear text which can be...4.4 Medium
- rangee rangeeosMultiple Rangee GmbH RangeeOS 8.0.4 modules store credentials in plaintext including credentials...5.5 Medium
- treasuryxpressIn TreasuryXpress 19191105, a logged-in user can discover saved credentials, even though the UI...6.5 Medium
- citrix xenmobile serverInsufficient protection of secrets in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile...7.5 High
- mcafee data loss prevention, data loss prevention(dlp) +1 moreDLP for Mac - Unprotected Storage of Credentials5.2 Medium
- mcafee data loss prevention, data loss prevention(dlp) +1 moreDLP for Mac - Unprotected Storage of Credentials5.2 Medium
- gnome gnome-shell, canonical ubuntu linux, debian linux +1 more +3 moreAn issue was discovered in certain configurations of GNOME gnome-shell through 3.36.4. When...4.3 Medium
- pactwareIn PACTware before 4.1 SP6 and 5.x before 5.0.5.31, passwords are stored in a recoverable format,...5.5 Medium
- pactwareIn PACTware before 4.1 SP6 and 5.x before 5.0.5.31, passwords are stored in an insecure manner,...7.1 High
- mozilla firefox for ios, firefox mobile +1 moreA rogue webpage could override the injected WKUserScript used by the logins autofill, this...6.5 Medium
- cs2-network p2pCS2 Network P2P through 3.x, as used in millions of Internet of Things devices, suffers from an...8.1 High
- digitus da-70254 firmwareDIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same...8.8 High
- lindy-international 42633 firmwareLindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same...8.8 High
- tp-link tl-ps310u firmwareTP-Link USB Network Server TL-PS310U devices before 2.079.000.t0210 allow an attacker on the same...8.8 High
- swisscom internet-box 2 firmware, internet-box 3 firmware, internet-box light firmware +2 more +4 moreAn issue was discovered on Swisscom Internet Box 2, Internet Box Standard, Internet Box Plus...8.0 High
- red hat satelliteA flaw was found in Red Hat Satellite 6 which allows privileged attacker to read cache files....8.8 High
- nec sv8100 firmwareOn Aspire-derived NEC PBXes, including all versions of SV8100 devices, a set of documented,...9.8 Critical
- ibm security key lifecycle managerIBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 uses an inadequate account lockout setting that...8.6 High
- sick package analyticsPasswords are stored in plain text within the configuration of SICK Package Analytics software up...6.5 Medium
- open source openclinic ga, openclinic ga project ga +1 moreOpenClinic GA6.2 Medium
- ruckuswireless unleashed firmwareInsecure permissions in emfd/libemf in Ruckus Wireless Unleashed through 200.7.10.102.92 allow a...7.5 High
- Show moreLoading…