CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- hitachi abb power grids esomsPassword Autocomplete Vulnerability in Hitachi ABB Power Grids eSOMS Application7.5 High
- dell unity, emc unity operating environment, emc unity xt operating environment +1 more +3 moreDell EMC Unity, Unity XT, and UnityVSA versions prior to 5.1.0.0.5.394 contain a plain-text...6.4 Medium
- dell unity, emc unity operating environment, emc unity xt operating environment +1 more +3 moreDell EMC Unity, Unity XT, and UnityVSA versions prior to 5.1.0.0.5.394 contain a plain-text...6.4 Medium
- devolutions serverDevolutions Server before 2021.1.18, and LTS before 2020.3.20, allows attackers to intercept...2.6 Low
- kaseya virtual system/server administrator (vsa), vsa agent, vsa server +2 moreUnauthenticated credential leak and business logic flaw in Kaseya VSA <= v9.5.610.0 Critical
- ibm guardium data encryptionIBM Guardium Data Encryption (GDE) 4.0.0.4 uses an inadequate account lockout setting that could...5.9 Medium
- huawei emui, magic ui +1 moreThere is a Credentials Management Errors Vulnerability in Huawei Smartphone. Successful...8.1 High
- artica pandora fmsIn Artica Pandora FMS <=754 in the File Manager component, there is sensitive information exposed...5.9 Medium
- huawei emui, magic ui +1 moreThere is a Credentials Management Errors Vulnerability in Huawei Smartphone. Successful...7.5 High
- fidelis cybersecurity deception, network +1 moreUser Credentials Stored in a Recoverable Format within Fidelis Network and Deception6.5 Medium
- dlink dir-2640-us firmwareD-Link DIR-2640-US 1.01B04 is affected by Insufficiently Protected Credentials. D-Link AC2600(DIR...6.8 Medium
- zohocorp manageengine password manager proIn Zoho ManageEngine Password Manager Pro before 11.1 build 11104, attackers are able to retrieve...5.9 Medium
- tp-link tl-wpa4220 firmwareTP-Link's TL-WPA4220 4.0.2 Build 20180308 Rel.37064 username and password are sent via the cookie.7.5 High
- broadcom sannavBrocade SANnav before version 2.1.1 contains an Improper Authentication vulnerability that allows...7.5 High
- intland codebeamerAn insufficiently protected credentials issue was discovered in Intland codeBeamer ALM 10.x...7.5 High
- dlink dir-868l firmwareThe D-Link router DIR-868L 3.01 is vulnerable to credentials disclosure in telnet service through...7.5 High
- dlink dir-885l-mfc firmwareThe D-link router DIR-885L-MFC 1.15b02, v1.21b05 is vulnerable to credentials disclosure in...7.5 High
- dlink dir-880l firmwareThe D-Link router DIR-880L 1.07 is vulnerable to credentials disclosure in telnet service through...7.5 High
- cisco thousandeyes recorder, thousandeyes recorder application +1 moreCisco ThousandEyes Recorder Information Disclosure Vulnerability6.2 Medium
- huawei emui, magic ui +1 moreThere is a Credentials Management Errors vulnerability in Huawei Smartphone. Successful...7.5 High
- f5 nginx controllerThe NGINX Controller 2.0.0 thru 2.9.0 and 3.x before 3.15.0 Administrator password may be exposed...7.8 High
- ibm cognos analytics, netapp oncommand insight +1 moreIBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain credentials from a...4.6 Medium
- ibm cognos analytics, netapp oncommand insight +1 moreIBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain credentials from a...4.6 Medium
- project quay quayA flaw was found in Red Hat Quay, where it does not properly protect the authorization token when...4.3 Medium
- versa-networks versa analytics, versa director, versa operating system +2 moreIn Versa Director, Versa Analytics and VOS, Passwords are not hashed using an adaptive...5.5 Medium
- rsa archerThe Tableau integration in RSA Archer 6.4 P1 (6.4.0.1) through 6.9 P2 (6.9.0.2) is affected by an...5.1 Medium
- schneider-electric homelynk firmware, spacelynk firmware +1 moreInsufficiently Protected Credentials vulnerability exists in homeLYnk (Wiser For KNX) and...9.8 Critical
- ibm security guardiumIBM Security Guardium 11.2 stores user credentials in plain clear text which can be read by a...5.1 Medium
- nitrokey fido u2f firmwareAn issue was discovered in Nitrokey FIDO U2F firmware through 1.1. Communication between the...9.8 Critical
- searchbloxA local file inclusion vulnerability in the FileServlet in all SearchBlox before 9.2.2 allows...7.5 High
- hom.ee brain cube corehomee Brain Cube v2 (2.28.2 and 2.28.4) devices have sensitive SSH keys within downloadable and...7.5 High
- belden hirschmann hios, hisecos +1 moreHirschmann HiOS 07.1.01, 07.1.02, and 08.1.00 through 08.5.xx and HiSecOS 03.3.00 through 03.5.01...9.8 Critical
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP May Reveal S3 Store's Proxy Password5.9 Medium
- redhat noobaa-operatorA flaw was found in noobaa-operator in versions before 5.7.0, where internal RPC AuthTokens...8.8 High
- wago 0852-0303, 0852-0303 firmware, 0852-1305 +7 more +9 moreWAGO: Managed Switches: Unauthorized access to password hashes7.5 High
- coolkit ewelinkUnconstrained Web access to the device's private encryption key in the QR code pairing mode in...4.6 Medium
- dell emc integrated system for microsoft azure stack hub, emc integrated system for microsoft azure stack hub firmware +1 moreDell EMC Integrated System for Microsoft Azure Stack Hub, versions 1906 – 2011, contain an...8.0 High
- solarwinds serv-uAn issue was discovered in SolarWinds Serv-U before 15.2.2. Unauthenticated attackers can...7.5 High
- arubanetworks clearpass, hewlett packard enterprise (hpe) aruba clearpass policy manager +1 moreA remote disclosure of privileged information vulnerability was discovered in Aruba ClearPass...6.5 Medium
- ave dominaplus, 53ab-wbs firmware, ts01 firmware +4 more +6 moreAVE DOMINAplus <=1.10.x suffers from clear-text credentials disclosure vulnerability that allows...9.8 Critical
- merit lilin ent.co.,ltd. p2/z2/p3/z3 ip camera firmware, meritlilin p2g1022 firmware, p2g1022x firmware +39 more +41 moreMERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-25.3 Medium
- merit lilin ent.co.,ltd. p2/z2/p3/z3 ip camera firmware, meritlilin p2g1022 firmware, p2g1022x firmware +39 more +41 moreMERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-19.8 Critical
- merit lilin ent.co.,ltd. p2/z2/p3/z3 ip camera firmware, meritlilin p2g1022 firmware, p2g1022x firmware +39 more +41 moreMERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Broken Authentication9.8 Critical
- siemens siveillance video open network bridgeA vulnerability has been identified in Siveillance Video Open Network Bridge (2020 R3),...8.8 High
- apache solrMisapplied Zookeeper ACLs can result in leakage of configured authentication and authorization settings7.5 High
- fortinet fortiwebAn information disclosure vulnerability in Web Vulnerability Scan profile of Fortinet's FortiWeb...4.3 Medium
- cloudfoundry capi-release, cf-deployment +1 moreCloud Controller API versions prior to 1.106.0 logs service broker credentials if the default...6.5 Medium
natsnpmClient TLS credentials sent raw to server in npm package natsNo score- deltaflow project deltaflow, vangene deltaflow e-platform +1 moreVangene deltaFlow E-platform - Broken Authentication9.8 Critical
- luvion grand elite 3 connect, grand elite 3 connect firmware +1 moreAn issue was discovered in Luvion Grand Elite 3 Connect through 2020-02-25. Authentication to the...8.8 High
- Show moreLoading…