CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- cp plus kvms proCP Plus KVMS Pro versions 2.01.0.T.190521 and prior are vulnerable to sensitive credentials being...7.8 High
- delta electronics infrasuite device masterCVE-2023-11376.5 Medium
- devolutions remote desktop managerInformation disclosure in the user creation feature of a MSSQL data source in Devolutions Remote...6.5 Medium
- ibm security key lifecycle managerIBM Security Key Lifecycle Manager information disclosure6.2 Medium
- mitsubishi electric corporation melsec iq-f series fx5-enet, melsec iq-f series fx5-enet/ip, melsec iq-f series fx5s-30mr/es +146 more +148 moreInformation Disclosure Vulnerability in MELSEC Series7.5 High
- aztech wmb250ac firmwareAztech WMB250AC Mesh Routers Firmware Version 016 2020 is vulnerable to PHP Type Juggling in file...9.8 Critical
- hewlett packard enterprise (hpe) hpe oneview for vmware vcenter,, hp oneview for vmware vcenter +1 moreHPE OneView for VMware vCenter, in certain circumstances, may disclose the “HPE OneView” Username...5.5 Medium
- intel on event seriesInsufficiently protected credentials in the Intel(R) ON Event Series Android application before...5.5 Medium
- fortinet fortinacAn insufficiently protected credentials in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5,...7.4 High
- tianjie cpe906-3, cpe906-3 firmware +1 moreTIANJIE CPE906-3 is vulnerable to password disclosure. This is present on Software Version WEB5...7.5 High
- ricoh im 2500 firmware, im 2702 firmware, im 3000 firmware +74 more +76 moreRicoh mp_c4504ex devices with firmware 1.06 mishandle credentials.9.1 Critical
- ami megarac sp-xAMI MegaRAC SPX devices allow Password Disclosure through Redfish. The fixed versions are SPx_12...7.5 High
- netgear prosafe 24 port 10/100 fs726tp, prosafe fs726tp firmware +1 moreNetgear ProSAFE 24 Port 10/100 FS726TP - CWE-522: Insufficiently Protected Credentials.7.5 High
- media cp control panel, mediacp media control panel +1 moreMedia CP Media Control Panel – insufficiently protected credential change6.5 Medium
- rifatron co., ltd. dvr, sunellsecurity sn-adr3804e1 firmware, sn-adr3808e1 firmware +5 more +7 moreSunell DVR – Insufficiently Protected Credentials5.3 Medium
- tibco hawk, operational intelligence hawk redtail +1 moreTIBCO Operational Intelligence Hawk Redtail Credential Exposure Vulnerability6.8 Medium
- redpandaRedpanda before 22.3.12 discloses cleartext AWS credentials. The import functionality in the rpk...5.5 Medium
- fujifilm driver distributorDriver Distributor v2.2.3.1 and earlier contains a vulnerability where passwords are stored in a...7.5 High
- dell powerscale onefsDell PowerScale OneFS, versions 8.2.x through 9.3.x contain a weak encoding for a password. A...6.0 Medium
- comfast project cf-wr623n firmwareCOMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1...9.8 Critical
- schneider electric data center expertA CWE-522: Insufficiently Protected Credentials vulnerability exists that could result in...8.0 High
- schneider electric data center expertA CWE-257: Storing Passwords in a Recoverable Format vulnerability exists that could result in...8.0 High
- schneider electric data center expertA CWE-522: Insufficiently Protected Credentials vulnerability exists that could result in...8.0 High
- google chrome, fedoraproject fedora +1 moreInsufficient policy enforcement in Intents in Google Chrome on Android prior to 109.0.5414.119...6.5 Medium
- revenue collection system project collection systemAn access control issue in Revenue Collection System v1.0 allows unauthenticated attackers to...9.8 Critical
- pickplugins user verificationUser Verification < 1.0.94 - Authentication Bypass9.8 Critical
- bitrix24Insufficiently Protected Credentials in the AD/LDAP server settings in 1C-Bitrix Bitrix24 through...4.9 Medium
- ge proficy historianAn unauthorized user with network access and the decryption key could decrypt sensitive data,...7.5 High
- sylabs scs-library-client, singularity container services library +1 moreUser credentials leaked to third-party service via HTTP redirect in scs-library-client5.2 Medium
- johnson controls metasys ads/adx/oas, johnsoncontrols metasys application and data server, metasys extended application and data server +1 more +3 moreInsufficiently Protected Credentials in Metasys7.8 High
- cesnet theme-cesnetCESNET theme-cesnet resetpassword.php insufficiently protected credentials3.3 Low
- prosys opc ua modbus server, ua simulation server +1 moreProsys OPC UA Simulation Server version prior to v5.3.0-64 and UA Modbus Server versions 1.4.18-5...6.5 Medium
- freeradiusIn freeradius, the EAP-PWD function compute_password_element() leaks information about the...7.5 High
- dahuasecurity dhi-dss4004-s2 firmware, dhi-dss7016d-s2 firmware, dhi-dss7016dr-s2 firmware +2 more +4 moreSome Dahua software products have a vulnerability of unauthenticated request of AES crypto key....5.3 Medium
- dahuasecurity dhi-dss4004-s2 firmware, dhi-dss7016d-s2 firmware, dhi-dss7016dr-s2 firmware +2 more +4 moreSome Dahua software products have a vulnerability of unauthenticated request of MQTT credentials....7.5 High
- ibm security verify governance, identity manager, security verify governance +1 moreIBM Security Verify Governance, Identity Manager information disclosure6.3 Medium
- click studios passwordstate, passwordstate browser extension chrome +1 moreClick Studios Passwordstate insufficiently protected credentials4.3 Medium
- siemens ruggedcom rm1224 lte(4g) eu, ruggedcom rm1224 lte(4g) nam, ruggedcom rm1224 lte\(4g\) eu firmware +252 more +254 moreAffected devices store the CLI user passwords encrypted in flash memory. Attackers with physical...5.2 Medium
- arc informatique pcvueA cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through...5.5 Medium
- western digital my cloud, westerndigital my cloud os +1 moreRemote Backups Application Discloses Stored Credentials4.1 Medium
- fuji soft incorporated +f fs040u software, fsi fs040u firmware +1 morePlaintext storage of a password vulnerability exists in +F FS040U software versions v2.3.4 and...4.6 Medium
- craftcms craft cmsCraft CMS discloses password hashes7.5 High
- airtable, airtable airtable.js +1 moreAirtable.js credentials exposed in browser builds7.6 High
- ibm maximo mobile, maximo application suite +1 moreIBM Maximo information disclosure6.2 Medium
- hcl software launch, hcltechsw hcl launch +1 moreHCL Launch is vulnerable to Insufficiently Protected LDAP Search Credentials (CVE-2022-42445)4.9 Medium
- mitsubishi electric corporation gx works3Insufficiently Protected Credentials vulnerability in Mitsubishi Electric Corporation GX Works3...6.8 Medium
- apache dolphinschedulerApache DolphinScheduler config file read by task risk7.5 High
- eyunjing yjcmsAn issue in the /index/user/user_edit.html component of YJCMS v1.0.9 allows unauthenticated...9.8 Critical
- xwiki, xwiki xwiki-platform +1 morePlaintext storage of password in org.xwiki.platform:xwiki-platform-security-authentication-default6.2 Medium
- ibm urbancode deployIBM UrbanCode Deploy information disclosure4.9 Medium
- Show moreLoading…