CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- jenkins blue ocean, jenkins project pipeline scm api for blue ocean plugin +1 moreInsufficiently Protected Credentials in Jenkins Pipeline SCM API for Blue Ocean Plugin6.5 Medium
- konicaminolta bizhub 226i firmware, bizhub 227 firmware, bizhub 246i firmware +42 more +44 moreKonica Minolta bizhub MFP devices before 2022-04-14 have an internal Chromium browser that...4.0 Medium
- konicaminolta bizhub 226i firmware, bizhub 227 firmware, bizhub 246i firmware +42 more +44 moreKonica Minolta bizhub MFP devices before 2022-04-14 use cleartext password storage for the /var...7.5 High
- facturascripts, neorazorx neorazorx/facturascripts +1 moreAccount Takeover in neorazorx/facturascripts9.8 Critical
- 3cxAn issue was discovered in the 3CX Phone System Management Console prior to version 18 Update 3...9.8 Critical
- strapiInsecure password handling vulnerability in Strapi7.5 High
- suse rancherExposure of repository credentials to external third-party sources7.3 High
- haxx curl, broadcom fabric operating system, debian linux +13 more +15 moreA insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak...6.5 Medium
- haxx curl, broadcom fabric operating system, debian linux +12 more +14 moreAn insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82...5.7 Medium
- dell emc repository manager, repository manager (drm) +1 moreDell EMC Repository Manager version 3.4.0 contains a plain-text password storage vulnerability. A...8.2 High
- glpi-project glpiLDAP password exposure in glpi7.5 High
- red lion da50n, redlion da50n firmware +1 moreICSA-22-104-03 Red Lion DA50N4.6 Medium
- zohocorp manageengine adselfservice plus, manageengine adaudit plus, manageengine admanager plus +1 more +3 moreZoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701,...8.8 High
- red hat ansible, redhat ansible galaxy, ansible automation platform +2 moreA flaw was found in Ansible Galaxy Collections. When collections are built manually, any files in...5.5 Medium
- jenkins google compute engine, jenkins project google compute engine plugin +1 morePrivate key stored in plain text by Jenkins Google Compute Engine Plugin4.3 Medium
- dell powerscale onefs, emc powerscale onefs +1 moreDell PowerScale OneFS, versions 8.2.2 and above, contain a password disclosure vulnerability. An...6.7 Medium
- apache nifiInsufficiently protected credentials4.3 Medium
- zohocorp manageengine adaudit plusZoho ManageEngine ADAudit Plus before 7055 allows authenticated Privilege Escalation on...8.8 High
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2021.3.3 it was possible to get passwords from protected fields8.4 High
- zauner arcAn issue was discovered in Softwarebuero Zauner ARC 4.2.0.4. There is storage of Passwords in a...5.9 Medium
- automation direct click plc cpu modules: c0-1x cpus, automationdirect c0-10are-d firmware, c0-10dd1e-d firmware +18 more +20 moreAutomation Direct CLICK PLC CPU Modules Plaintext Storage of a Password7.5 High
- kyocera multifunction printer net viewer, net viewer +1 moreKyocera Net View Address Book Exposure8.6 High
- philips vue pacs, myvue, speech +3 more +5 morePhilips Vue PACS Insufficiently Protected Credentials3.7 Low
- rsa archerThe Archer RSS feed integration for Archer 6.x through 6.9 SP1 (6.9.1.0) is affected by an...5.8 Medium
- jenkins proxmox, jenkins project proxmox plugin +1 morePassword stored in plain text by Jenkins Proxmox Plugin6.5 Medium
- jenkins instant-messaging, jenkins project instant-messaging plugin +1 morePlaintext storage in Jenkins instant-messaging Plugin6.5 Medium
- gitlabAn issue has been discovered in GitLab affecting all versions starting from 14.6 before 14.6.5,...4.2 Medium
- mcafee epolicy orchestrator, mcafee,llc mcafee epolicy orchestrator (epo) +1 moreePO password change vulnerability3.1 Low
- mcafee epolicy orchestrator, mcafee,llc mcafee epolicy orchestrator (epo) +1 moreePO database restoration vulnerability6.5 Medium
- debian linux, openstack oslo.utils, redhat openshift container platform +1 more +3 morepython-oslo-utils has improper password parsing4.9 Medium
- rockwell automation isagraf runtime, rockwellautomation aadvance controller, isagraf free runtime +14 more +16 moreRockwell Automation ISaGRAF5 Runtime Unprotected Storage of Credentials7.8 High
- ibm business automation workflow, business process manager +1 moreIBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 and IBM Business Process Manager 8.5...4.9 Medium
- jenkins incapptic connect uploader, jenkins project incapptic connect uploader plugin +1 morePersonal tokens stored in plain text by Jenkins incapptic connect uploader Plugin4.3 Medium
- jenkins vmware vrealize codestream, jenkins project vmware vrealize codestream plugin +1 morePasswords stored in plain text by Jenkins Vmware vRealize CodeStream Plugin6.5 Medium
- jenkins dbcharts, jenkins project dbcharts plugin +1 morePasswords stored in plain text by Jenkins dbCharts Plugin6.5 Medium
- jenkins gitlab authentication, jenkins project gitlab authentication plugin +1 moreClient Secret stored in plain text by Jenkins GitLab Authentication Plugin6.5 Medium
- microsoft azure site recovery, azure site recovery vmware to azure +1 moreAzure Site Recovery Elevation of Privilege Vulnerability6.5 Medium
- ibm mq, mq appliance +1 moreIBM MQ Appliance 9.2 CD and 9.2 LTS local messaging users stored with a password hash that...5.1 Medium
- sangfor vdi clientSangforCSClient.exe in Sangfor VDI Client 5.4.2.1006 allows attackers, when they are able to read...5.5 Medium
- alecto dvc-215ip firmwareSettings/network settings/wireless settings on the Alecto DVC-215IP camera version 63.1.1.173 and...8.6 High
- ibm guardium data encryption, security guardium data encryption +1 moreIBM Guardium Data Encryption (GDE) 5.0.0.2 and 5.0.0.3 could allow a remote attacker to obtain...5.9 Medium
- jqueryformForms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to...6.5 Medium
- jenkins support core, jenkins project support core plugin +1 moreJenkins Support Core Plugin stores sensitive data in plain text6.5 Medium
- jenkins project pipeline: build step plugin, jenkins pipeline\ +1 morePassword parameter default values exposed by Jenkins Pipeline: Build Step Plugin6.5 Medium
- jenkins project pipeline: groovy plugin, jenkins pipeline\ +1 moreJenkins Pipeline: Groovy Plugin has Insufficiently Protected Credentials4.3 Medium
- schneider-electric conext combox firmwareA CWE-522: Insufficiently Protected Credentials vulnerability exists that could cause Sensitive...7.5 High
- palo alto networks globalprotect app, paloaltonetworks globalprotect +1 moreGlobalProtect App: Insufficiently Protected Credentials Vulnerability on Linux4.7 Medium
- intel active management technology software development kit, core i3-1000g1 firmware, core i3-1000g4 firmware +177 more +179 moreInsufficiently protected credentials in USB provisioning for Intel(R) AMT SDK before version 16.0...4.6 Medium
- siemens simatic pcs 7 v8.2, simatic pcs 7 v9.0, simatic pcs 7 v9.1 +7 more +9 moreA vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS...8.8 High
- apache supersetAPI sensitive information leak6.5 Medium
- Show moreLoading…