CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- quest kace systems management applianceIn Quest KACE Systems Management Appliance (SMA) through 12.0, a hash collision is possible...9.8 Critical
- ibm robotic process automationIBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to insufficiently...5.3 Medium
- hcl commerce, hcltechsw hcl commerce +1 moreHCL Commerce could allow a local attacker to obtain sensitive personal information (CVE-2021-27785)3.9 Low
- ovarro tbox, tbox lt2-530 firmware, tbox lt2-532 firmware +6 more +8 moreOvarro TBox Insufficiently Protected Credentials7.5 High
- jenkins http request, jenkins project http request plugin +1 moreJenkins HTTP Request Plugin stores HTTP Request passwords unencrypted6.5 Medium
- omron cp1w-cif41 firmware, sysmac cj2h firmware, sysmac cj2m firmware +4 more +6 moreIn Omron CS series, CJ series, and CP series PLCs through 2022-05-18, the password for access to...7.5 High
- anchore, anchore enterprise, anchorectl +2 moreAnchore Enterprise anchorectl version 0.1.4 improperly stored credentials when generating a Software Bill of Materials. anchorectl will add the credentials used to access Anchore Enterprise API in the…7.5 High
- hcl bigfix, hcltech bigfix platform +1 moreHCL BigFix Web Reports authorized users may see sensitive information in clear text5.0 Medium
- verizon lvskihp indoorunit firmware, lvskihp outdoorunit firmware +1 moreOn Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices,...7.5 High
- western digital my cloud home, westerndigital my cloud home duo firmware, my cloud home firmware +2 moreProtecting AWS credentials stored in plaintext on My Cloud Home8.0 High
- codesys opc da serverPlaintext Storage of a password in CODESYS V3 OPC DA Server5.5 Medium
- rpc.py project rpc.pyrpc.py vulnerable to Deserialization of Untrusted Data9.8 Critical
- hcl software launch, hcltechsw hcl launch +1 moreHCL Launch is vulnerable to information disclosure which can be read by a local user.4.9 Medium
- ping identity pingid windows login, pingidentity pingid integration for windows login +1 morePingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances7.7 High
- jenkins hpe network virtualization, jenkins project hpe network virtualization plugin +1 morePasswords stored in plain text by Jenkins hpe-network-virtualization plugin6.5 Medium
- jenkins rqm, jenkins project rqm plugin +1 morePassword stored in plain text by Jenkins RQM Plugin6.5 Medium
- jenkins cisco spark, jenkins project cisco spark plugin +1 moreToken stored in plain text by Jenkins Cisco Spark Plugin4.3 Medium
- jenkins elasticsearch query, jenkins project elasticsearch query plugin +1 morePlaintext Storage of a Password in Jenkins Elasticsearch Query Plugin6.5 Medium
- jenkins jigomerge, jenkins project jigomerge plugin +1 morePlaintext Storage of a Password in Jenkins Jigomerge Plugin6.5 Medium
- jenkins skype notifier, jenkins project skype notifier plugin +1 morePlaintext Storage of a Password in Jenkins Skype notifier Plugin6.5 Medium
- jenkins opsgenie, jenkins project opsgenie plugin +1 moreJenkins OpsGenie Plugin Plaintext Storage of a Password vulnerability4.3 Medium
- jenkins rocketchat notifier, jenkins project rocketchat notifier plugin +1 morePlaintext Storage of a Password in Jenkins RocketChat Notifier Plugin4.3 Medium
- jenkins build notifications, jenkins project build notifications plugin +1 morePlaintext Storage of a Password in Jenkins Build Notifications Plugin4.3 Medium
- jenkins deployment dashboard, jenkins project deployment dashboard plugin +1 morePlaintext Storage of a Password in Jenkins Deployment Dashboard Plugin4.3 Medium
- jenkins deployment dashboard, jenkins project deployment dashboard plugin +1 moreJenkins Deployment Dashboard Plugin has Insufficiently Protected Credentials4.3 Medium
- xiongmaitech ahb7008t-mh-v2 firmware, ahb7804r-els firmware, ahb7804r-lms firmware +5 more +7 moreXiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS...9.8 Critical
- marvalglobal marval msmMarval MSM v14.19.0.12476 has a 0-Click Account Takeover vulnerability which allows an attacker...9.8 Critical
- ldap-account-manager ldap account manager, ldapaccountmanager lam, debian linux +2 moreMissing Encryption of Sensitive Data in ldap-account-manager5.5 Medium
- devolutions remote desktop managerInformation Exposure vulnerability in My Account Settings of Devolutions Remote Desktop Manager...6.5 Medium
- broadcom sannavBrocade SANnav before Brocade SANvav v. 2.2.0.2 and Brocade SANanv v.2.1.1.8 logs the Brocade...6.5 Medium
- ibm robotic process automation, robotic process automation as a service, robotic process automation for cloud pak +2 moreIBM Robotic Process Automation 21.0.1 and 21.0.2 could allow a user with psychical access to the...4.6 Medium
- secheron sepcos control and protection relay firmware package, sepcos control and protection relay firmware +1 moreSecheron SEPCOS Control and Protection Relay6.5 Medium
- secheron sepcos control and protection relay firmware package, sepcos control and protection relay firmware +1 moreSecheron SEPCOS Control and Protection Relay9.8 Critical
- broadcom symantec messaging gatewayA malicious authenticated SMG administrator user can obtain passwords for external LDAP/Active...4.9 Medium
- jenkins squash tm publisher, jenkins project squash tm publisher (squash4jenkins) plugin +1 moreSquash TM Publisher (Squash4Jenkins) Plugin stores passwords stored in plain text6.5 Medium
- jenkins easyqa, jenkins project easyqa plugin +1 moreUser passwords stored in plain text by Jenkins EasyQA Plugin6.5 Medium
- jenkins convertigo mobile platform, jenkins project convertigo mobile platform plugin +1 morePlaintext Storage of a Password in Jenkins Convertigo Mobile Platform Plugin6.5 Medium
- atviseAn information disclosure vulnerability exists in the License registration functionality of...5.9 Medium
- powerjobInsufficiently Protected Credentials in PowerJob7.5 High
- pagerduty rundeckPlaintext Storage of Keys and Passwords in Rundeck and PagerDuty Process Automation7.5 High
- devolutions remote desktop managerA lack of password masking in Devolutions Remote Desktop Manager allows physically proximate...4.6 Medium
- siemens sicam gridedge (classic), sicam gridedge essential +1 moreA vulnerability has been identified in SICAM GridEdge Essential ARM (All versions < V2.6.6),...6.9 Medium
- mechanize project mechanize, fedoraproject fedora +1 moreAuthorization header leak in rubygem Mechanize5.9 Medium
- gradle enterpriseGradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to information...7.5 High
- ibm spectrum protect plusCredentials are printed in clear text in the IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.3...6.8 Medium
- dell unity, unity operating environment, unity xt operating environment +1 more +3 moreDell Unity, Dell UnityVSA, and Dell Unity XT versions prior to 5.2.0.0.5.173 contain a plain-text...6.4 Medium
- dell powerstore, powerstoreos +1 morePowerStore contains Plain-Text Password Storage Vulnerability in PowerStore X & T environments...7.5 High
- bd pyxis anesthesia station es firmware, pyxis ciisafe firmware, pyxis logistics firmware +29 more +31 moreBD Pyxis™ Products – Default Credentials8.8 High
- gitlabMissing input masking in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6,...5.4 Medium
- mobotix mxcontrolcenterMobotix Control Center (MxCC) through 2.5.4.5 has Insufficiently Protected Credentials, Storing...8.8 High
- Show moreLoading…