CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- jenkins project jabber (xmpp) notifier and control plugin, jenkins jabber \(xmpp\) notifier and control +1 morePasswords stored in plain text by Jenkins Jabber (XMPP) notifier and control Plugin6.5 Medium
- microseven mym71080i-b firmwareMicroSeven MYM71080i-B 2.0.5 through 2.0.20 devices send admin credentials in cleartext to pnp...7.5 High
- realtek xpon rtl9601d software development kitRealtek xPON RTL9601D SDK 1.9 stores passwords in plaintext which may allow attackers to possibly...9.8 Critical
- cisco ios, ios xe +1 moreCisco IOS and IOS XE Software Common Industrial Protocol Privilege Escalation Vulnerability7.8 High
- red hat atomic-openshift, redhat openshift, openshift container platform +2 moreA flaw was found in atomic-openshift of openshift-4.2 where the basic-user RABC role in OpenShift...6.3 Medium
- unisys stealthIn Unisys Stealth (core) before 6.0.025.0, the Keycloak password is stored in a recoverable...7.8 High
- taidii diibearThe Taidii Diibear Android application 2.4.0 and all its derivatives allow attackers to obtain...6.8 Medium
- taidii diibearThe Taidii Diibear Android application 2.4.0 and all its derivatives allow attackers to obtain...7.8 High
- redhat openshift builder, openshift container platform +1 moreA privilege escalation flaw was found in OpenShift builder. During build time, credentials outside the build context are automatically mounted into the container image under construction. An OpenShift…8.8 High
- lynx project lynx, debian linux, fedoraproject fedora +2 moreLynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers...5.3 Medium
- red hat ansible, redhat ansible engine, debian linux +2 more +4 moreAnsible Exposes Sensitive Information7.5 High
- redhat cephA flaw was found in ceph-dashboard. The JSON Web Token (JWT) used for user authentication is...5.4 Medium
- adguard homeAn issue was discovered in AdGuard before 0.105.2. An attacker able to get the user's cookie is...7.5 High
- rockwellautomation rslogix 5000, studio 5000 logix designer, rockwell multiple products +1 more +3 moreRockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions...9.8 Critical
- saltstack salt, debian linux, fedoraproject fedora +2 moreSaltStack Salt Cleartext Storage of Sensitive Information via cmdmod4.4 Medium
- microsoft windows 10 version 1803, windows 10 version 1809, windows 10 version 1909 +9 more +11 morePFX Encryption Security Feature Bypass Vulnerability5.5 Medium
- kaco-newenergy xp100u firmwareKACO New Energy XP100U Up to XP-JAVA 2.0 is affected by incorrect access control. Credentials...7.5 High
- ibm maximo for civil infrastructureIBM Maximo for Civil Infrastructure 7.6.2 could allow a user to obtain sensitive information due...6.5 Medium
- tesla solarcity solar monitoring gatewayTesla SolarCity Solar Monitoring Gateway through 5.46.43 has a "Use of Hard-coded Credentials"...8.8 High
- ibm security verify information queueIBM Security Verify Information Queue 1.0.6 and 1.0.7 sends user credentials in plain clear text...5.3 Medium
- xn--b1agzlht fx aggregator terminal clientThe Sovremennye Delovye Tekhnologii FX Aggregator terminal client 1 stores authentication...7.5 High
- 1password scim bridge1Password SCIM Bridge before 1.6.2 mishandles validation of requests for log files.6.5 Medium
- newmediacompany smartyAn issue was discovered in New Media Smarty before 9.10. Passwords are stored in the database in...5.5 Medium
- psypraxAn issue was discovered in Psyprax beforee 3.2.2. Passwords used to encrypt the data are stored...7.5 High
- epikurAn issue was discovered in Epikur before 20.1.1. It stores the secret passwords of the users as...5.5 Medium
- hcltechsw onetest performanceHCL OneTest Performance V9.5, V10.0, V10.1 uses basic authentication which is relatively weak. An...7.5 High
- tk-star q90 junior gps horloge firmwareAn issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. It performs...7.5 High
- mofinetwork mofi4500-4gxelte firmwareAn issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. A format error in ...9.8 Critical
- mofinetwork mofi4500-4gxelte firmwareAn issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. Authentication is not...7.5 High
- mediawikiThe API in the Push extension for MediaWiki through 1.35 used cleartext for ApiPush credentials,...7.5 High
- opmantek open-auditWithin the Open-AudIT up to version 3.5.3 application, the web interface hides SSH secrets,...5.9 Medium
- sooil anydana-a, anydana-i, dana diabecare rs firmware +2 moreIn SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, an information disclosure...6.5 Medium
- sooil anydana-a firmware, anydana-i firmware, diabecare rs firmware +2 moreSOOIL Developments CoLtd DiabecareRS, AnyDana-i ,AnyDana-A, communication protocol of the insulin...5.7 Medium
- juniper junos spaceJunos Space: Shared secrets stored in recoverable format and directly exposed through the UI6.8 Medium
- juniper contrail networkingContrail Networking: Administrator credentials are exposed in a plaintext file5.0 Medium
- elastic elasticsearch, oracle communications cloud native core automated test suite +1 moreInsufficiently Protected Credentials in Elasticsearch4.8 Medium
- cisco firepower management center, secure firewall management center +1 moreCisco Firepower Management Center Information Disclosure Vulnerability5.5 Medium
- ibm security guardium insightsIBM Security Guardium Insights 2.0.2 stores user credentials in plain in clear text which can be...4.4 Medium
- jenkins bumblebee hp alm, jenkins project bumblebee hp alm plugin +1 moreCredentials stored in plain text by Jenkins Bumblebee HP ALM Plugin5.5 Medium
- jenkins tracetronic ecu-test, jenkins project tracetronic ecu-test plugin +1 moreCredentials stored in plain text by Jenkins TraceTronic ECU-TEST Plugin5.5 Medium
- 1c 1c\The Web server in 1C:Enterprise 8 before 8.3.17.1851 sends base64 encoded credentials in the...7.5 High
- siemens opcenter execution coreA vulnerability has been identified in Opcenter Execution Core (V8.2), Opcenter Execution Core ...5.5 Medium
- sap se gui for windows, sap graphical user interface +1 moreSAP GUI for Windows, version - 7.60, allows an attacker to spoof logon credentials for...5.3 Medium
- ibm cloud pak systemIBM Cloud Pak System 2.3 could reveal credential information in the HTTP response to a local...4.4 Medium
- hgiga mailsherlock msr45/ssr45, msr45 isherlock-antispam, msr45 isherlock-audit +8 more +10 moreHGiga MailSherlock - Broken Authentication9.8 Critical
- tp-link archer c5 firmware, archer c7 firmware, mr3420 firmware +24 more +26 moreA password-disclosure issue in the web interface on certain TP-Link devices allows a remote...9.8 Critical
- qnap qesHard-coded Password Vulnerability in QES6.3 Medium
- abb ability™ symphony® plus historian, ability™ symphony® plus operations, symphony \+ historian +1 more +3 moreImproper Credential Storage in Symphony Plus7.0 High
- zyxel atp100 firmware, atp100w firmware, atp200 firmware +28 more +30 moreFirmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an...9.8 Critical
- mediawikiAn issue was discovered in the CasAuth extension for MediaWiki through 1.35.1. Due to improper...7.5 High
- Show moreLoading…