CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- jenkins mabl, jenkins project mabl plugin +1 moreJenkins mabl Plugin vulnerable to exposure of system-scooped credentials6.5 Medium
- keepersecurity keeper, keeperfill +1 moreAn issue was discovered in Keeper Password Manager for Desktop version 16.10.2, and the...5.5 Medium
- microsoft windows server 2016, windows server 2016 (server core installation), windows server 2019 +2 more +4 moreActive Directory Federation Service Security Feature Bypass Vulnerability6.5 Medium
- nixos calamares-nixos-extensions`calamares-nixos-extensions` LUKS keyfile exposure7.9 High
- apereo cas, central authentication service +1 moreLDAP password leak in Apereo CAS - GHSL-2023-0094.0 Medium
- cmseasyAn issue was discovered in cmseasy v7.0.0 that allows user credentials to be sent in clear text...7.5 High
- rabbitmq-c project rabbitmq-cAn issue was discovered in the C AMQP client library (aka rabbitmq-c) through 0.13.0 for RabbitMQ...5.5 Medium
- fortinet fortisiemA plaintext storage of a password vulnerability [CWE-256] in FortiSIEM 6.7 all versions, 6.6 all...3.6 Low
- gl-inet gl-ar750s firmwareGL.iNET GL-AR750S-Ext firmware v3.215 uses an insecure protocol in its communications which...5.9 Medium
- bd alaris infusion centralThe Alaris Infusion Central software, versions 1.1 to 1.3.2, may contain a recoverable password...7.3 High
- ptc vuforia studioPTC Vuforia Studio Insufficiently Protected Credentials3.7 Low
- tp-link tapo c200 firmwareThe AES Key-IV pair used by the TP-Link TAPO C200 camera V3 (EU) on firmware version 1.1.22 Build...4.6 Medium
- ibm aspera cargo, aspera connect +1 moreIBM Aspera information disclosure5.9 Medium
- mozilla firefoxAfter downloading a Windows <code>.scf</code> script from the local filesystem, an attacker could...8.8 High
- avaya ix workforce engagementAvaya IX Workforce Engagement - CWE-522: Insufficiently Protected Credentials6.5 Medium
- tgstation tgstation-serverInsufficiently Protected ChatBot Credentials in tgstation-server7.7 High
- wftpd project wftpdIn WFTPD 3.25, usernames and password hashes are stored in an openly viewable wftpd.ini...7.5 High
- pimcore pimcore/customer-data-framework, customer management framework +1 moreStoring Passwords in a Recoverable Format in pimcore/customer-data-framework6.7 Medium
- hazelcastHazelcast vulnerable to unmasked password exposure4.3 Medium
- canon ij network tool, canon inc. ij nw tool +1 moreCanon IJ Network Tool/Ver.4.7.5 and earlier (supported OS: OS X 10.9.5-macOS 13),IJ Network Tool...6.5 Medium
- jenkins code dx, code dx plugin +1 moreAPI keys stored and displayed in plain text by Code Dx Plugin4.3 Medium
- jenkins code dx, code dx plugin +1 moreAPI keys stored and displayed in plain text by Code Dx Plugin4.3 Medium
- jenkins ns-nd integration performance publisher, jenkins project ns-nd integration performance publisher plugin +1 moreJenkins NS-ND Integration Performance Publisher Plugin displays credentials without masking7.5 High
- jenkins azure vm agents, jenkins project azure vm agents plugin +1 moreJenkins Azure VM Agents Plugin missing permission checks4.3 Medium
- jedox, jedox cloud +1 moreAn Information disclosure vulnerability in /be/rpc.php in Jedox GmbH Jedox 2020.2.5 allow remote,...5.3 Medium
- intel data center managerInsufficiently protected credentials in the Intel(R) DCM software before version 5.0.1 may allow...6.5 Medium
- vapor postgresnio, postgres-nio +1 morePostgresNIO processes unencrypted bytes from man-in-the-middle3.7 Low
- cisco staros, asr 5000 series software, ultra cloud core - user plane function +2 moreA vulnerability in the key-based SSH authentication feature of Cisco StarOS Software could allow an authenticated, remote attacker to elevate privileges on an affected device. This vulnerability is du…8.8 High
- sap businessobjects, sap se businessobjects platform +1 moreInformation Disclosure vulnerability in SAP BusinessObjects Platform3.7 Low
- milesight ncr/camera, ncr\/camera firmware +1 moreMilesight NCR/Camera CWE-522: Insufficiently Protected Credentials7.5 High
- fortinet fortinac, fortinac-f +1 moreAn insufficiently protected credentials vulnerability [CWE-522] in FortiNAC-F 7.2.0, FortiNAC 9.4...3.9 Low
- lenovo thinkagile hx1021 firmware, thinkagile hx1320 firmware, thinkagile hx1321 firmware +107 more +109 moreA valid, authenticated administrative user can query a web interface API to reveal the configured...4.9 Medium
- 42gears surelock, surelock windows +1 morePlaintext Password in Registry6.5 Medium
- gajshield data security firewall, data security firewall firmware +1 moreDefault Credential Vulnerability in GajShield Data Security Firewall10.0 Critical
- microsoft typed-rest-clienttyped-rest-client vulnerable to potential leak of authentication data to 3rd parties9.1 Critical
- sangoma freepbx linux 7Sangoma FreePBX 1805 through 2302 (when obtained as a ,.ISO file) places AMPDBUSER, AMPDBPASS,...8.1 High
- hewlett packard enterprise hpe oneview, hpe oneview global dashboard, hp oneview +1 more +3 moreHPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokens5.5 Medium
- hewlett packard enterprise (hpe) hpe oneview, hp oneview +1 moreAn HPE OneView appliance dump may expose SNMPv3 read credentials5.5 Medium
- hewlett packard enterprise (hpe) hpe oneview, hp oneview +1 moreAn HPE OneView appliance dump may expose FTP credentials for c7000 Interconnect Modules7.1 High
- hewlett packard enterprise (hpe) hpe oneview, hp oneview +1 moreAn HPE OneView appliance dump may expose SAN switch administrative credentials7.8 High
- hewlett packard enterprise (hpe) hpe oneview, hp oneview +1 moreAn HPE OneView appliance dump may expose OneView user accounts5.5 Medium
- hewlett packard enterprise (hpe) hpe oneview, hp oneview +1 moreAn HPE OneView appliance dump may expose proxy credential settings5.5 Medium
- apache supersetApache Superset: Database connection password leak4.9 Medium
- expo software development kit, expo.io expo authsession module +1 moreExpo SDK has an OAuth vulnerability9.6 Critical
- ribose rnpRibose RNP before 0.15.1 does not implement a required step in a cryptographic algorithm,...7.5 High
- secomea gatemanagerClear-text passwords in configuration files6.1 Medium
- uniguest tripleplayIncorrect Access Control in Tripleplay Platform releases prior to Caveman 3.4.0 allows...8.8 High
- aten pe8108 firmwareAten PE8108 2.4.232 is vulnerable to Incorrect Access Control. The device allows unauthenticated...7.5 High
- aten pe8108 firmwareAten PE8108 2.4.232 is vulnerable to Incorrect Access Control. Restricted users have read access...7.2 High
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could leak through an API method used in...6.1 Medium
- Show moreLoading…