CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- apache shenyu, apache software foundation shenyu (incubating) +1 moreApache ShenYu Password leakage7.5 High
- dell emc system update, dellemc system update - dsu +1 moreDell EMC System Update, version 1.9.2 and prior, contain an Unprotected Storage of Credentials...8.2 High
- fresenius-kabi agilia connect, vigilant mastermed, fresenius kabi agilia partner +5 more +7 moreFresenius Kabi Agilia Connect Infusion System plaintext storage of a password6.5 Medium
- fresenius kabi agilia link+, fresenius-kabi agilia connect firmware, agilia partner maintenance software +4 more +6 moreFresenius Kabi Agilia Connect Infusion System insufficiently protected credentials7.3 High
- mongodb, mongodb inc. for vs code +1 moreMongoDB Extension for VS Code may unexpectedly store credentials locally in clear text5.5 Medium
- king jim co.,ltd. tepra pro, kingjim sma3, spc10 firmware +2 more +4 moreInsufficiently protected credentials vulnerability in 'TEPRA' PRO SR5900P Ver.1.080 and earlier...4.3 Medium
- jenkins conjur secrets, jenkins project conjur secrets plugin +1 moreAgent-to-controller security bypass in Jenkins Conjur Secrets Plugin allows retrieving all credentials7.5 High
- jenkins publish over ssh, jenkins project publish over ssh plugin +1 morePassword stored in plain text by Jenkins Publish Over SSH Plugin3.3 Low
- jenkins hashicorp vault, jenkins project hashicorp vault plugin +1 moreImproper credentials masking in Jenkins HashiCorp Vault Plugin6.5 Medium
- jenkins metrics, jenkins project metrics plugin +1 moreAccess key stored in plain text by Jenkins Metrics Plugin5.5 Medium
- apache kylinOverly broad CORS configuration7.5 High
- netgear r6700 firmwareNetgear Nighthawk R6700 version 1.0.4.120 stores sensitive information in plaintext. All...7.5 High
- netgear rax43 firmwareNetgear RAX43 version 1.0.3.96 does not have sufficient protections to the UART interface. A...6.8 Medium
- trendnet tew-827dru firmwareTrendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses credentials for the smb...4.9 Medium
- trendnet tew-827dru firmwareTrendnet AC2600 TEW-827DRU version 2.08B01 leaks information via the ftp web page. Usernames and...4.9 Medium
- idec data file manager, ft1a smartaxix lite firmware, ft1a smartaxix pro firmware +6 more +8 moreAn attacker may obtain the user credentials from the communication between the PLC and the...9.8 Critical
- idec data file manager, ft1a smartaxix lite firmware, ft1a smartaxix pro firmware +6 more +8 moreAn attacker may obtain the user credentials from file servers, backup repositories, or ZLD files...9.8 Critical
- idec data file manager, windedit, windldr +3 more +5 moreUnprotected transport of credentials vulnerability in IDEC PLCs (FC6A Series MICROSmart All-in...7.6 High
- dell avamar, emc avamar server +1 moreDell EMC Avamar versions 18.2,19.1,19.2,19.3,19.4 contain a plain-text password storage...6.7 Medium
- dell avamar, emc avamar server, emc powerprotect data protection appliance +2 moreDell EMC Avamar Server version 19.4 contains a plain-text password storage vulnerability in...6.7 Medium
- samsung syncthru web serviceThe SyncThru Web Service on Samsung SCX-6x55X printers allows an attacker to gain access to a...7.5 High
- parallels remote application server, remote application server (client) +1 moreParallels Remote Application Server credentials management errors7.1 High
- gglocker project gglockerGGLocker iOS application, contains an insecure data storage of the password hash value which...5.5 Medium
- knime serverKNIME Server before 4.12.6 and 4.13.x before 4.13.4 (when installed in unattended mode) keeps the...2.9 Low
- apereo opencastOpencast publishes global system account credentials7.5 High
- siemens modelsim, modelsim simulation, questa +1 more +3 moreA vulnerability has been identified in ModelSim Simulation (All versions), Questa Simulation (All...6.5 Medium
- auerswald commander 6000r ip firmware, commander 6000rx ip firmware, commander basic.2\(19\"\) ip firmware +7 more +9 moreAuerswald COMpact 5500R devices before 8.2B allow Privilege Escalation via the passwd=1 substring.8.8 High
- digi transport dr64 firmware, transport vc74 firmware, transport wr11 firmware +5 more +7 moreAn issue was discovered on Digi TransPort devices through 2021-07-21. An authenticated attacker...6.5 Medium
- gryphonconnect gryphon tower firmwareAn unprotected ssh private key exists on the Gryphon devices which could be used to achieve root...9.8 Critical
- allegroAllegro WIndows 3.3.4152.0, embeds software administrator database credentials into its binary...7.1 High
- huawei emui, harmonyos, magic ui +2 moreThere is a Credentials Management Errors vulnerability in Huawei Smartphone.Successful...7.5 High
- mahadiscom mahavitaranAn issue was discovered in Mahavitaran android application 7.50 and below, allows local attackers...4.2 Medium
- renesas rx65 firmware, rx65n firmware +1 moreAn issue was discovered on Renesas RX65 and RX65N devices. With a VCC glitch, an attacker can...4.6 Medium
- microsoft azure active directory, azure automation, azure migrate +2 more +4 moreAzure Active Directory Information Disclosure Vulnerability8.1 High
- zyxel wsr30 firmware, nbg6818 series firmware, nbg6818 firmware +9 more +11 moreA vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30...7.8 High
- ibm security key lifecycle manager, security guardium key lifecycle manager +1 moreIBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 stores user credentials in plain clear...6.2 Medium
- motorola binatone hubble cameras, binatoneglobal cn28 firmware, cn40 firmware +19 more +21 moreAn information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble...4.2 Medium
- motorola binatone hubble cameras, binatoneglobal cn28 firmware, cn40 firmware +19 more +21 moreA vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an...6.4 Medium
- gnu mailman, debian linux +1 moreIn GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an...6.5 Medium
- apache supersetCredentials leak6.5 Medium
- liquidfilesLiquidFiles before 3.6.3 allows remote attackers to elevate their privileges from Admin (or User...8.8 High
- postgresqlA man-in-the-middle attacker can inject false responses to the client's first few queries,...5.9 Medium
- airangel hsmx-app-1000 firmware, hsmx-app-100 firmware, hsmx-app-20000 firmware +2 more +4 moreAirangel HSMX Gateway devices through 5.2.04 have Weak SSH Credentials.9.8 Critical
- sap gui for windowsAn information disclosure vulnerability exists in SAP GUI for Windows - versions < 7.60 PL13, 7...7.8 High
- fortinet fortisiem, fortisiemwindowsagent +1 moreA unprotected storage of credentials in Fortinet FortiSIEM Windows Agent version 4.1.4 and below...5.5 Medium
- jeedomIn Jeedom through 4.1.19, a bug allows a remote attacker to bypass API access and retrieve users...7.5 High
- medianavi smacomMEDIA NAVI Inc SMACom v1.2 was discovered to contain an insecure session validation vulnerability...5.9 Medium
- arista eosIn Arista's EOS software affected releases, the shared secret profiles sensitive configuration might be leaked when displaying output over eAPI or other JSON outputs to authenticated users on the devi…5.7 Medium
- mozilla thunderbird, debian linux +1 moreThunderbird ignored the configuration to require STARTTLS security for an SMTP connection. A MITM...5.9 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +20 more +22 moreWindows AppContainer Elevation Of Privilege Vulnerability7.5 High
- Show moreLoading…