CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- microfocus filrAdministrator equivalent Filr user can access proxy administrator credentials7.2 High
- xwiki change request, xwiki-contrib application-changerequest +1 moreData leak of password hash through xwiki change request7.7 High
- dell powerprotect data manager dm5500 appliance, powerprotect data manager dm5500 firmware +1 moreDell DM5500 5.14.0.0, contain a Plain-text Password Storage Vulnerability in PPOE. A local...5.5 Medium
- connectize ac21000 g6 firmwareAn Insecure Credential Management issue discovered in Connectize AC21000 G6 641.139.1.1256 allows...6.8 Medium
- jenkins jira, jenkins project jira plugin +1 moreJenkins Jira Plugin vulnerable to exposure of system-scoped credentials6.5 Medium
- otrsPassword is send back to client8.1 High
- dell rvtoolsRVTools, Version 3.9.2 and above, contain a sensitive data exposure vulnerability in the...7.5 High
- fortinet fortisiemAn exposure of sensitive information to an unauthorized actor [CWE-200] in FortiSIEM version 7.0...4.2 Medium
- spotfire analyst, for aws marketplace, server +4 more +6 moreTIBCO Spotfire Insufficiently Protected Credential vulnerability5.0 Medium
- samsung open source oneA vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web...9.8 Critical
- egroupwareAn issue was discovered in eGroupWare 17.1.20190111. An Improper Password Storage vulnerability...4.9 Medium
- univention ucs\@schoolIncorrect LDAP ACLs in ucs-school-ldap-acls-master in UCS@school before 4.4v5-errata allow remote...6.5 Medium
- jenkins warnings, jenkins project warnings plugin +1 moreJenkins Warnings Plugin exposures system-scoped credentials6.5 Medium
- writercmsIncorrect access control in writercms v1.1.0 allows attackers to directly obtain backend account...7.5 High
- tauriUpdater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli8.4 High
- sophos firewallA password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers...7.1 High
- eaton easysoftInsecure storage of password in easySoft5.9 Medium
- tsplus remote workTSplus Remote Work 16.0.0.0 places a cleartext password on the "var pass" line of the HTML source...9.8 Critical
- netapp snapgathersInformation Disclosure Vulnerability in SnapGathers6.5 Medium
- hcl software bigfix insights for vulnerability remediationHCL BigFix Insights for Vulnerability Remediation (IVR) is vulnerable to weak cryptography6.5 Medium
- hcl software bigfix insights for vulnerability remediationHCL BigFix Insights for Vulnerability Remediation (IVR) is vulnerable to improper credential handling6.5 Medium
- hcl software bigfix patch managementHCL BigFix Patch Management is vulnerable to insecurely stored credentials4.6 Medium
- qnap qvpn, qnap systems inc. qvpn windows +1 moreQVPN Device Client6.7 Medium
- acronis cyber protect 15, cyber protect +1 moreSensitive information disclosure due to insufficient token field masking. The following products...3.5 Low
- openstack barbican, rdo openstack rdo, red hat openstack platform 13 (queens) +4 more +6 moreInsecure barbican configuration file leaking credential6.6 Medium
- lf-edge, zededa eve os, linuxfoundation edge virtualization engine +1 moreSSH as Root Unlockable Without Triggering Measured Boot8.8 High
- lf-edge, zededa eve os, lfedge eve +1 moreDebug Functions Unlockable Without Triggering Measured Boot8.8 High
- lf-edge, zededa eve os, lfedge eve +1 moreConfig Partition Not Protected by Measured Boot8.8 High
- lf-edge, zededa eve os, linuxfoundation edge virtualization engine +1 moreVault Key Sealed With SHA1 PCRs8.8 High
- lf-edge, zededa eve os, linuxfoundation edge virtualization engine +1 moreConfig Partition Not Measured From 2 Fronts8.8 High
- ormazabal ekorccp, ekorccp firmware, ekorrci +1 more +3 moreUnprotected Storage of Credentials in Ormazabal products7.3 High
- nvidia dgx h100 bmc, dgx h100 firmware +1 moreNVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause insufficient...6.5 Medium
- nvidia dgx h100 bmc, dgx h100 firmware +1 moreNVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause insufficient...7.6 High
- sichuan tianyi kanghe communication co ltd china telecom tianyi home gateway, tianyisc tewa-700g firmware +1 moreInsecure Permissions vulnerability in Sichuan Tianyi Kanghe Communication Co., Ltd China Telecom...5.5 Medium
- ibm sterling secure proxy, sterling external authentication server +1 moreIBM Sterling Secure Proxy information disclosure5.1 Medium
- tenable nessusPass-back vulnerability in Nessus4.1 Medium
- fresenius-kabi pharmahelp firmwareAn issue was discovered in Fresenius Kabi PharmaHelp 5.1.759.0 allows attackers to gain escalated...9.8 Critical
- fobybus social-media-skeletonUnsalted passwords in fobybus/social-media-skeleton7.5 High
- zohocorp manageengine admanager plusIncorrect access control in Zoho ManageEngine ADManager Plus Build 7180 allows unauthenticated...6.5 Medium
- jenkins project maven artifact choicelistprovider (nexus) plugin, jenkins maven artifact choicelistprovider \(nexus\) +1 moreJenkins Maven Artifact ChoiceListProvider (Nexus) Plugin vulnerable to exposure of system-scoped credentials6.5 Medium
- jenkins delphix, jenkins project delphix plugin +1 moreJenkins Delphix Plugin vulnerable to exposure of system-scoped credentials6.5 Medium
- broadcom raid controller web interface, lsi storage authority (lsa) +1 moreBroadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any local user on Linux5.5 Medium
- broadcom raid controller web interface, lsi storage authority (lsa) +1 moreBroadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any local user on Linux5.5 Medium
- gatesair flexiva fax 150w, flexiva fax 150w firmware +1 moreAn isssue in GatesAIr Flexiva FM Transmitter/Exiter Fax 150W allows a remote attacker to gain...9.8 Critical
- google androidIn processMessageImpl of ClientModeImpl.java, there is a possible credential disclosure in the...9.8 Critical
- infodrom e-invoice approval systemPlaintext Storage of a Password in Infodrom Sofwares E-Invoice Approval System7.5 High
- weintek weincloudWeintek Weincloud Improper Authentication7.2 High
- weave gitops terraform controller, weaveworks tf-controller +1 moreInformation Disclosure Vulnerability in Weave GitOps Terraform Controller8.5 High
- sonicwall analytics, gms, global management system +2 moreTomcat application credentials are hardcoded in SonicWall GMS and Analytics configuration file....9.8 Critical
- dericia deliciaAn issue found in DERICIA Co. Ltd, DELICIA v.13.6.1 allows a remote attacker to gain access to...7.5 High
- Show moreLoading…