CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- jenkins ns-nd integration performance publisher, jenkins project ns-nd integration performance publisher plugin +1 morePlaintext Storage of a Password in Jenkins NS-ND Integration Performance Publisher Plugin6.5 Medium
- jenkins reverse proxy auth, jenkins project reverse proxy auth plugin +1 moreJenkins Reverse Proxy Auth Plugin vulnerable due to plaintext storage of passwords6.5 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP Includes LDAP Credentials in the Page URL5.9 Medium
- tenda w15e firmwareThe Tenda AC1200 Router model W15Ev2 V15.11.0.10(1576) is affected by a password exposure...6.5 Medium
- camp project camppatrickfuller camp up to and including commit bbd53a256ed70e79bd8758080936afbf6d738767 is...9.8 Critical
- intel active management technology software development kit, endpoint management assistant, manageability commander +2 moreInsufficiently protected credentials in software in Intel(R) AMT SDK before version 16.0.4.1,...8.2 High
- powercom co., ltd. upsmon proPOWERCOM CO., LTD. UPSMON PRO - Insufficiently Protected Credentials6.5 Medium
- electronElectron subject to Exfiltration of hashed SMB credentials on Windows via file:// redirect7.2 High
- devolutions server, remote desktop manager +1 moreDashlane password and Keepass Server password in My Account Settings are not encrypted in the...6.5 Medium
- google bazelBazel leaks user credentials through the remote assets API5.1 Medium
- pulpproject pulp ansible, redhat ansible automation platform, satellite +1 more +3 morePlaintext storage of tokens in pulp_ansible5.5 Medium
- gradle enterpriseA credential-exposure vulnerability in the support-bundle mechanism in Gradle Enterprise 2022.3...7.5 High
- jenkins katalon, jenkins project katalon plugin +1 moreAPI keys stored in plain text by Jenkins Katalon Plugin6.5 Medium
- juniper junos, juniper networks junos os +1 morecSRX Series: Storing Passwords in a Recoverable Format and software permissions issues allows a local attacker to elevate privileges7.8 High
- passster project passsterPassster < 3.5.5.5.2 - Insecure Storage of Password5.9 Medium
- tenable nessusInsufficiently Protected Credentials: An authenticated user with debug privileges can retrieve...6.5 Medium
- red hat business-central, redhat decision manager +1 moreA flaw was found in the RHDM, where sensitive HTML form fields like Password has auto-complete...7.5 High
- grafanaGrafana data source and plugin proxy endpoints leaking authentication tokens to some destination plugins4.9 Medium
- siemens simatic drive controller family, simatic et 200sp open controller cpu 1515sp pc (incl. siplus variants), simatic et 200sp open controller cpu 1515sp pc2 (incl. siplus variants) +50 more +52 moreA vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2),...9.3 Critical
- ibm robotic process automation, robotic process automation for cloud pak, robotic process automation for services +2 moreIBM Robotic Process Automation Clients are vulnerable to proxy credentials being exposed in...4.6 Medium
- dell networking os10, smartfabric os10 +1 moreDell Networking OS10, versions prior to October 2021 with Smart Fabric Services enabled, contains...6.4 Medium
- chipoloChipolo ONE Bluetooth tracker (2020) Chipolo iOS app version 4.13.0 is vulnerable to Incorrect...7.4 High
- jenkins cons3rt, jenkins project cons3rt plugin +1 moreAPI token stored in plain text by Jenkins CONS3RT Plugin6.5 Medium
- jenkins bigpanda notifier, jenkins project bigpanda notifier plugin +1 moreJenkins BigPanda Notifier Plugin stores BigPanda API key unencrypted4.3 Medium
- nokia 1350 optical management systemIn NOKIA 1350 OMS R14.2, Insufficiently Protected Credentials (cleartext password) occur in /cgi...6.5 Medium
- haystacksoftware arq backupArq Backup 7.19.5.0 and below stores backup encryption passwords using reversible encryption....4.9 Medium
- suse rancherRancher: Failure to properly sanitize credentials in cluster template answers9.9 Critical
- dell powerscale onefs, emc powerscale onefs +1 moreDell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.19, 9.2.1.12, 9.3.0.6, and 9.4.0...8.1 High
- ibm cognos analytics, netapp oncommand insight +1 moreIBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a local attacker to obtain...6.2 Medium
- hcl software versionvault expressAn insufficiently protected credential vulnerability affects HCL VersionVault Express6.0 Medium
- the foreman foremanA flaw was found in the Foreman project. The Datacenter plugin exposes the password through the...7.8 High
- postgresqlOdyssey passes to client unencrypted bytes from man-in-the-middle When Odyssey storage is...5.9 Medium
- abb zenonABB Ability TM Operations Data Management Zenon Zenon Log Server file access control8.1 High
- abb zenonABB Ability TM Operations Data Management Zenon Zenon Log Server file access control6.2 Medium
- jenkins collabnet, jenkins project collabnet plugins plugin +1 moreRabbitMQ password stored in plain text by Jenkins CollabNet Plugins Plugin6.5 Medium
- jenkins git, jenkins project git plugin +1 moreImproper masking of credentials Jenkins in Git Plugin6.5 Medium
- fiserv prologueFiserv Prologue through 2020-12-16 does not properly protect the database password. If an...6.5 Medium
- keycloakIncorrect implementation of lockout feature in Keycloak7.5 High
- intel team blue, philips version +1 moreInsufficiently protected credentials in the Intel(R) Team Blue mobile application in all versions...5.5 Medium
- intel datacenter group event, philips version +1 moreInsufficiently protected credentials in the Intel(R) Datacenter Group Event iOS application, all...7.5 High
- philips version, intel single event api +1 moreInsufficiently protected credentials in the installation binaries for Intel(R) SEAPI in all...7.8 High
- intel standard manageability, active management technology firmware +1 moreInsufficiently protected credentials for Intel(R) AMT and Intel(R) Standard Manageability may...5.5 Medium
- intel standard manageability, active management technology firmware +1 moreInsufficiently protected credentials for Intel(R) AMT and Intel(R) Standard Manageability may...9.8 Critical
- emerson openbsiEmerson OpenBSI through 2022-04-29 mishandles credential storage. It is an engineering...5.5 Medium
- airspan airvelocity, airvelocity 1500 firmware +1 moreAirspan AirVelocity 1500 web management UI displays SNMP credentials in plaintext on software versions older than 15.18.00.2511, and stores SNMPv3 credentials unhashed on the filesystem, enabling anyo…9.1 Critical
- airspan airvelocity, airvelocity 1500 firmware +1 moreThe AirVelocity 1500 prints SNMP credentials on its physically accessible serial port during boot. This was fixed in AirVelocity 1500 software version 15.18.00.2511 and may affect other AirVelocity an…6.8 Medium
- theforeman foremanA flaw was found where the Plaintext Candlepin password is disclosed while updating Red Hat...4.4 Medium
- dlink go-rt-ac750 firmwareD-Link GO-RT-AC750 GORTAC750_revA_v101b03 & GO-RT-AC750_revB_FWv200b02 is vulnerable to Static...7.5 High
- cisco identity services engine, identity services engine software +1 moreCisco Identity Services Engine Sensitive Information Disclosure Vulnerability4.9 Medium
- vmware workstationVMware Workstation (16.x prior to 16.2.4) contains an unprotected storage of credentials...5.9 Medium
- Show moreLoading…