CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- eclipse edc connector, eclipse foundation edc +1 moreEclipse EDC: OAuth2 Credential Exfiltration Vulnerability6.8 Medium
- integrated control technology tsecCredential Cloning8.0 High
- lg simple editorLG Simple Editor checkServer Authentication Bypass Vulnerability7.5 High
- lg simple editorLG Simple Editor getServerSetting Authentication Bypass Vulnerability7.5 High
- kemptechnologies loadmasterLoadMaster Reversible Password Encryption Algorithm6.4 Medium
- jenkins telegram bot, jenkins project telegram bot plugin, jenkins jenkins-telegram-bot +2 moreJenkins Telegram Bot Plugin stores the Telegram Bot token in plaintext4.3 Medium
- dell openmanage enterpriseDell OpenManage Enterprise, versions 4.0.0 and 4.0.1, contains a sensitive information disclosure...6.3 Medium
- claris filemaker serverClaris International has successfully resolved an issue of potentially exposing password...4.9 Medium
- asus rt-n12\+ b1Asus RT-N12+ B1 router stores credentials in cleartext, which could allow local attackers to...6.1 Medium
- h3c er8300g2-xH3C ER8300G2-X is vulnerable to Incorrect Access Control. The password for the router's...9.8 Critical
- ibm aspera faspexIBM Aspera Faspex privilege escalation7.8 High
- hashgraph guardian, nozomi networks cmc, nozominetworks central management control +2 moreInformation disclosure via audit records for OpenAPI requests in Guardian/CMC before 23.4.17.5 High
- microsoft azure identity library for .net, azure identity +1 moreAzure Identity Library for .NET Information Disclosure Vulnerability5.5 Medium
- fortinet fortios, fortiproxy +1 moreA insufficiently protected credentials in Fortinet FortiProxy 7.4.0, 7.2.0 through 7.2.6, 7.0.0...7.5 High
- cisco nexus dashboardA vulnerability in Cisco Nexus Dashboard could allow an authenticated, local attacker with valid...6.0 Medium
- dotcms, dotcms core +1 moreDatabase Credential Exposure in the Logs4.5 Medium
- ibm cics transaction gateway for multiplatforms, cics transaction gateway +1 moreIBM CICS Transaction Gateway for Multiplatforms information disclosure3.1 Low
- sangoma technologies cg6kwin2k.sysExposed IOCTL with insufficient access control issue exists in cg6kwin2k.sys prior to 2.1.7.0. By...6.1 Medium
- kddi corporation hgw bl1500hm, kddi hgw bli500hm firmware +1 moreHGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue. A network...8.8 High
- siklu tg terragraph, tg firmware +1 moreSiklu TG Terragraph devices before 2.1.1 allow attackers to discover valid, randomly generated...7.5 High
- ibm host access transformation servicesIBM Host Access Transformation Services information disclosure6.2 Medium
- wpmudev hustle, hustle – email marketing, lead generation, optins, popups +1 moreHustle <= 7.8.3 - Sensitive Information Exposure via Exposed Hubspot API Keys8.6 High
- cloudevents go sdk, sdk-go, sdk go +2 moreGo SDK for CloudEvents's use of WithRoundTripper to create a Client leaks credentials7.5 High
- gallagher command centre server, command centre +1 moreInsufficiently protected credentials (CWE-522) for third party DVR integrations to the Command...9.1 Critical
- couchbase serverAn issue was discovered in Couchbase Server before 7.2.4. ns_server admin credentials are leaked...5.3 Medium
- eventstore, kurrent eventstoredb +1 moreEventStoreDB Projections Subsystem has potential password leak5.5 Medium
- brivo acs100, acs300, acs100 firmware, acs300 firmware +2 moreLocal Access to Sensitive Data in Brivo ACS100 and ACS3007.1 High
- comarch erp xlShared Key in Comarch ERP XL6.2 Medium
- schneider electric ecostruxure control expert, ecostruxure process expert +1 moreCWE-522: Insufficiently Protected Credentials vulnerability exists that could cause unauthorized...7.1 High
- f5 big-ip next cnf, big-ip next spk, big-ip next cloud-native network functions +2 moreBIG-IP Next CNF & SPK vulnerability7.1 High
- intel openbmc, eagle stream +1 moreInsufficiently protected credentials in some Intel(R) Server Product OpenBMC firmware before...5.3 Medium
- ibm cics tx standard, cics tx, cics tx advanced +2 moreIBM CICS TX session fixation4.3 Medium
- ibm datastage, datastage on cloud pak for data +1 moreIBM DataStage on Cloud Pak for Data information disclosure4.9 Medium
- ibm storage defender - resiliency service, storage defender resiliency service +1 moreIBM Storage Defender - Resiliency Service information disclosure4.4 Medium
- apache solrApache Solr: System Property redaction logic inconsistency can lead to leaked passwords7.5 High
- allegro.ai clearmlAllegro AI ClearML Stores Credentials in Plaintext in MongoDB Instance6.0 Medium
- rapid software llc scada, rapidscada rapid scada +1 morePlaintext Storage of a Password in Rapid SCADA6.2 Medium
- apache kylinApache Kylin: Insufficiently protected credentials in config file7.5 High
- dell networker, networker module for databases and applications - oracle +1 moreNetworker 19.9 and all prior versions contains a Plain-text Password stored in temporary config...7.8 High
- hewlett packard enterprise hpe oneview, hp oneview +1 moreHPE OneView may have a missing passphrase during restore.5.5 Medium
- hitachi device managerMissing Password Field Masking Vulnerability in Hitachi Device Manager4.6 Medium
- hozard alarm systemA default engineer password set on the Hozard alarm system (Alarmsysteem) v1.0 allows an attacker...5.9 Medium
- ptc kepware kepserverex, thingworx industrial connectivity, thingworx kepware server +2 moreInsufficiently Protected Credentials in PTC's Kepware KEPServerEX5.7 Medium
- codename065 download managerDownload Manager < 3.2.83 - Unauthenticated Protected File Download Password Leak7.5 High
- nokia network functions manager for transportIn Network Element Manager in NOKIA NFM-T R19.9, an Unprotected Storage of Credentials...6.5 Medium
- ibm db2 mirror for i, i +1 moreIBM i information disclosure5.3 Medium
- palo alto networks pan-os, cloud ngfw, prisma access +2 morePAN-OS: Plaintext Disclosure of External System Integration Credentials4.9 Medium
- jenkins openid, jenkins project openid connect authentication plugin +1 morePassword stored in a recoverable format by Jenkins OpenId Connect Authentication Plugin6.7 Medium
- relyum rely-pcie firmware, rely-rec firmware +1 moreAn issue discovered in Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 allows for unauthorized...9.8 Critical
- ibm api connectIBM API Connect information disclosure6.2 Medium
- Show moreLoading…