CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- zte zxhn e8810 firmware, zxhn e8820 firmware, zxhn e8822 firmware +2 moreZTE E8810/E8820/E8822 series routers have an information leak vulnerability, which is caused by...7.5 High
- ceph, fedoraproject fedora, redhat ceph storage +2 more +4 moreUser credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila,...7.1 High
- kyland kps2204 6 port managed din-rail programmable serial device firmwareA sensitive information disclosure vulnerability in Kyland KPS2204 6 Port Managed Din-Rail...9.8 Critical
- epson eps tse server 8 firmwareUnrestricted access to the log downloader functionality in EPSON EPS TSE Server 8 (21.0.11)...9.8 Critical
- adremsoft netcrunchAdRem NetCrunch 10.6.0.4587 allows Credentials Disclosure. Every user can read the BSD, Linux,...8.8 High
- adremsoft netcrunchAdRem NetCrunch 10.6.0.4587 has an Improper Session Handling vulnerability in the NetCrunch web...9.8 Critical
- adremsoft netcrunchAdRem NetCrunch 10.6.0.4587 has Improper Credential Storage since the internal user database is...5.5 Medium
- siemens logo! 8 bm (incl. siplus variants), logo\! 8 bm firmware +1 moreA vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3)....7.5 High
- gehealthcare 1.5t brivo mr355 firmware, 3.0t signa hd 16 firmware, 3.0t signa hd 23 firmware +109 more +111 moreGE Healthcare Imaging and Ultrasound Products may allow specific credentials to be exposed during...9.8 Critical
- schneider-electric ecostruxure geo scada expert 2019, ecostruxure geo scada expert 2020 +1 moreA CWE-522: Insufficiently Protected Credentials vulnerability exists in EcoStruxure Geo SCADA...7.8 High
- plummac ik-401 firmwareAn improper webserver configuration on Plum IK-401 devices with firmware before 1.02 allows an...7.5 High
- lock password manager safe app project password manager safe appThe Estil Hill Lock Password Manager Safe app 2.3 for iOS has a *#06#* backdoor password. An...4.6 Medium
- vsolcn v1600d-mini firmware, v1600d4l firmware, v1600d firmware +2 more +4 moreAn issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57, V1600D4L V1.01.49, V1600D-MINI V1...5.9 Medium
- cpanelIn cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575).6.5 Medium
- cdatatec 72408a firmware, 9008a firmware, 9016a firmware +25 more +27 moreAn issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P,...9.8 Critical
- cdatatec 72408a firmware, 9008a firmware, 9016a firmware +25 more +27 moreAn issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P,...9.8 Critical
- barco wepresent wipg-1600w firmwareBarco wePresent WiPG-1600W devices have Unprotected Transport of Credentials. Affected Version(s)...6.5 Medium
- playgroundsessions playground sessionsPlayground Sessions v2.5.582 (and earlier) for Windows, stores the user credentials in plain text...7.5 High
- mutt, neomutt, debian linux +2 moreMutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $ssl_force_tls was processed...5.3 Medium
- planet nvr-1615 firmware, nvr-915 firmware +1 more** UNSUPPORTED WHEN ASSIGNED ** The firmware of the PLANET Technology Corp NVR-915 and NVR-1615...9.8 Critical
- cisco iot field network director, iot field network director (iot-fnd) +1 moreCisco IoT Field Network Director Unprotected Storage of Credentials Vulnerability4.1 Medium
- aviatrix controllerAn issue was discovered in Aviatrix Controller before R5.3.1151. An encrypted file containing...7.5 High
- basetech ge-131 bt-1837836 firmwareCleartext Transmission of Sensitive Information vulnerability in BASETech GE-131 BT-1837836...7.5 High
- basetech ge-131 bt-1837836 firmwareUse of default credentials for the telnet server in BASETech GE-131 BT-1837836 firmware 20180921...9.8 Critical
- basetech ge-131 bt-1837836 firmwareUnprotected Storage of Credentials vulnerability in BASETech GE-131 BT-1837836 firmware 20180921...5.5 Medium
- airleader master controlAirleader Master <= 6.21 devices have default credentials that can be used to access the exposed...9.8 Critical
- canon oce colorwave 3500 firmwareThe WebTools component on Canon Oce ColorWave 3500 5.1.1.0 devices allows attackers to retrieve...9.8 Critical
- hackerone nextcloud server, nextcloud server +1 moreInsufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an...8.1 High
- hackerone nextcloud server, nextcloud server +1 moreInsufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an...4.4 Medium
- intel quickassist technologyInsufficiently protected credentials in the Intel(R) QAT for Linux before version 1.7.l.4.10.0...7.8 High
- intel endpoint management assistantInsufficiently protected credentials in the Intel(R) EMA before version 1.3.3 may allow an...5.5 Medium
- intel optane ssd 900p firmware, optane ssd 905p firmware, ssd 660p firmware +12 more +14 moreInsufficiently protected credentialsin subsystem in some Intel(R) Client SSDs and some Intel(R)...4.6 Medium
- ibm security key lifecycle managerIBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, and 4.0 stores user credentials in plain in clear...6.3 Medium
- mind imind serverStored XSS in InterMind iMind Server through 3.13.65 allows any user to hijack another user's...7.8 High
- robware rvtoolsRVToolsPasswordEncryption.exe in RVTools 4.0.6 allows users to encrypt passwords to be used in...7.5 High
- jenkins vmware lab manager slaves, jenkins project vmware lab manager slaves plugin +1 morePassword stored in plain text by Jenkins VMware Lab Manager Slaves Plugin6.5 Medium
- jenkins mail commander, jenkins project mail commander plugin for jenkins-ci plugin +1 morePasswords stored in plain text by Mail Commander Plugin for Jenkins-ci Plugin6.5 Medium
- jenkins appspider, jenkins project appspider plugin +1 morePassword stored in plain text by Jenkins AppSpider Plugin5.5 Medium
- jenkins sqlplus script runner, jenkins project sqlplus script runner plugin +1 morePassword written to the build log by Jenkins SQLPlus Script Runner Plugin6.5 Medium
- gnome control centerA flaw was found in the GNOME Control Center in Red Hat Enterprise Linux 8 versions prior to 8.2,...5.5 Medium
- clickstudios passwordstateAn issue was discovered in Click Studios Passwordstate 8.9 (Build 8973).If the user of the system...6.8 Medium
- sonarsource sonarqube** DISPUTED ** SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and...7.5 High
- ui unifi controller firmware, unifi meshing access point firmware +1 moreAn issue was discovered on Ubiquiti UniFi Meshing Access Point UAP-AC-M 4.3.21.11325 and UniFi...7.5 High
- hp bluedata epic, ezmeral container platform +1 moreThe HPE BlueData EPIC Software Platform version 4.0 and HPE Ezmeral Container Platform 5.0 use an...6.5 Medium
- vmware horizon client, horizon client for windows +1 moreVMware Horizon Client for Windows (5.x prior to 5.5.0) contains an information disclosure...6.5 Medium
- biscom secure file transferBiscom Secure File Transfer (SFT) before 5.1.1082 and 6.x before 6.0.1011 allows user credential...6.5 Medium
- juniper junos, juniper networks junos os +1 moreJunos OS: SRX and NFX Series: Insufficient Web API private key protection6.5 Medium
- juniper junos, juniper networks junos os +1 moreJunos OS: NFX350: Password hashes stored in world-readable format6.3 Medium
- containerd, canonical ubuntu linux, debian linux +2 morecontainerd can be coerced into leaking credentials during image pull6.1 Medium
- cisco duo network gateway (dng), duo network gateway +1 moreDuo Network Gateway (DNG) Information Disclosure Vulnerability7.1 High
- Show moreLoading…