CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- tibco jasperreports server, tibco software inc. jasperreports server - community edition, jasperreports server - developer edition +3 more +5 moreTIBCO JasperReports FTP Password exposed9.0 Critical
- sap business oneDebug function of Admin UI of SAP Business One Integration is enabled by default. This allows...4.9 Medium
- moxa mxview, mxview network management software +1 moreMoxa MXview Network Management Software7.5 High
- scrapy, debian linux +1 moreHTTP authentication credential leak to target websites in scrapy5.7 Medium
- fortinet fortianalyzer, fortimanager, fortimanager, fortianalyzer +2 moreAn information disclosure vulnerability [CWE-200] in FortiAnalyzerVM and FortiManagerVM versions...3.2 Low
- fortinet fortisdnconnectorA insufficiently protected credentials in Fortinet FortiSDNConnector version 1.1.7 and below...4.3 Medium
- cli, docker command line interface, fedoraproject fedora +2 moreDocker CLI leaks private registry credentials to registry-1.docker.io5.4 Medium
- bosch indracontrol xlc firmware, rexroth indramotion mlc l20 firmware, rexroth indramotion mlc l25 firmware +11 more +13 moreInformation disclosure8.6 High
- dell enterprise sonic osDell Enterprise SONiC OS, versions 3.3.0 and earlier, contains a sensitive information disclosure...7.1 High
- ecoa ecs router controller ecs (flash), ecs router controller-ecs firmware, graphic control software +6 more +8 moreECOA BAS controller - Insufficiently Protected Credentials-29.8 Critical
- ecoa ecs router controller ecs (flash), ecs router controller-ecs firmware, graphic control software +6 more +8 moreECOA BAS controller - Insufficiently Protected Credentials-18.8 High
- credova financialCredova_Financial <= 1.4.8 Sensitive Information Disclosure5.3 Medium
- dell cpg bios, latitude 5285 2-in-1 firmware, latitude 5289 2-in-1 firmware +26 more +28 moreDell BIOS contains a Credentials Management issue. A local authenticated malicious user may...8.2 High
- d-link dir-605 router, dlink dir-605l, dir-605l firmware +2 moreAn informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker...7.5 High
- dlink dir-615 firmwareAn information disclosure issue exist in D-LINK-DIR-615 B2 2.01mt. An attacker can obtain a user...6.5 Medium
- ibm security verify bridgeIBM Security Verify Bridge 1.0.5.0 stores user credentials in plain clear text which can be read...4.1 Medium
- ibm security verify bridgeIBM Security Verify Bridge 1.0.5.0 stores user credentials in plain clear text which can be read...6.5 Medium
- cisco sd-wan vmanage, sd-wan +1 moreCisco SD-WAN vManage Software Disaster Recovery Feature Password Exposure Vulnerability6.5 Medium
- ibm tivoli netcool/omnibus, tivoli netcool\/omnibus webgui +1 moreIBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 stores user credentials...4.9 Medium
- sap business clientWhen an attacker manages to get access to the local memory, or the memory dump of a victim, for...6.1 Medium
- qnap qunetswitch, qnap systems inc. qsw-m2116p-2t2s, qnap qsw-m2116p-2t2s firmware +2 moreInsufficiently Protected Credentials Vulnerability in QSW-M2116P-2T2S and QuNetSwitch9.6 Critical
- arista metamako operating systemIn Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line,...6.3 Medium
- arista metamako operating systemIn Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line,...8.7 High
- redaxoTriggering an error page of the import process in Yakamara Media Redaxo CMS version 5.12.1 allows...6.5 Medium
- apple macos, mac os x +1 moreAn API issue in Accessibility TCC permissions was addressed with improved state management. This...6.5 Medium
- cisco prime infrastructure, evolved programmable network manager +1 moreCisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Information Disclosure Vulnerability5.5 Medium
- samsung drive managerSamsung Drive Manager 2.0.104 on Samsung H3 devices allows attackers to bypass intended access controls on disk management. WideCharToMultiByte, WideCharStr, and MultiByteStr can contribute to passwor…7.8 High
- jenkins nomad, jenkins project nomad plugin +1 morePassword stored in plain text by Jenkins Nomad Plugin5.5 Medium
- pepperl-fuchs wha-gw-f2d2-0-as-z2-eth.eip firmware, wha-gw-f2d2-0-as-z2-eth firmware, phoenix contact wha-gw-f2d2-0-as- z2-eth +1 more +3 moreA vulnerability in WirelessHART-Gateway <= 3.0.9 could lead to information exposure of sensitive information5.5 Medium
- apple ipados, ios and ipados, iphone os +2 moreAn inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 15.2 and iPadOS 15.2. A person with physical access to an iOS device may be able to access…4.6 Medium
- netmodule router softwareCertain NetModule devices have Insecure Password Handling (cleartext or reversible encryption),...7.5 High
- hitachi abb power grids counterparty settlement and billing (csb), retail operations, hitachienergy counterparty settlement and billing +2 morePassword in Memory Vulnerability in Retail Operations Product and Counterparty Settlement and Billing (CSB)7.7 High
- sapphireimsIn SapphireIMS 5.0, it is possible to take over an account by sending a request to the...9.8 Critical
- mitsubishielectric r08psfcpu firmware, r08sfcpu firmware, r120psfcpu firmware +5 more +7 moreInsufficiently Protected Credentials vulnerability in Mitsubishi Electric MELSEC iQ-R series CPU...9.1 Critical
- secomea sitemanager, sitemanager firmware +1 moreConfiguration service port remains open 10 minutes after reboot even when already provisioned8.0 High
- ypsomed mylife, mylife cloud +1 moreYpsomed mylife Cloud, mylife Mobile Application:Ypsomed mylife Cloud,All versions prior to 1.7.2...7.1 High
- ypsomed mylife, mylife cloud +1 moreYpsomed mylife Cloud, mylife Mobile Application:Ypsomed mylife Cloud,All versions prior to 1.7.2...7.5 High
- crestron dm-nvx-dir-160 firmware, dm-nvx-dir-80 firmware, dm-nvx-dir-ent firmware +2 moreOn Crestron DM-NVX-DIR, DM-NVX-DIR80, and DM-NVX-ENT devices before the DM-XIO/1-0-3-802 patch,...7.5 High
- nch quorumNCH Quorum v2.03 and earlier allows local users to discover cleartext login information relating...5.5 Medium
- cisco sd-wan vmanage, catalyst sd-wan manager +1 moreCisco SD-WAN vManage Software Information Disclosure Vulnerability5.5 Medium
- haxx curl, fedoraproject fedora, netapp cloud backup +16 more +18 moreWhen curl is instructed to get content using the metalink feature, and a user name and password...5.3 Medium
- dell emc repository manager (drm), emc repository manager +1 moreDell EMC Repository Manager (DRM) version 3.2 contains a plain-text password storage...8.8 High
- learning digital orca hcmLearningdigital.com, Inc. Orca HCM - Hard-code password9.8 Critical
- gatsbyjs gatsby, gatsby-source-wordpress +1 moreBasic-auth app bundle credential exposure in gatsby-source-wordpress7.5 High
- ibm security access manager, security verify access docker, security verify access +2 moreIBM Security Access Manager 9.0 and IBM Security Verify Access Docker 10.0.0 stores user...7.5 High
- depstech wifi digital microscope 3 firmwareDEPSTECH WiFi Digital Microscope 3 has a default SSID of Jetion_xxxxxxxx with a password of...6.5 Medium
- depstech wifi digital microscope 3 firmwareDEPSTECH WiFi Digital Microscope 3 allows remote attackers to change the SSID and password, and...8.1 High
- schneider-electric ecostruxure control expert, ecostruxure process expert, remoteconnect +2 moreInsufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all...5.5 Medium
- schneider-electric ecostruxure control expert, ecostruxure process expert, remoteconnect +2 moreInsufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all...7.1 High
- schneider-electric ecostruxure control expert, ecostruxure process expert, remoteconnect +2 moreInsufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all...7.1 High
- Show moreLoading…