CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- ibm cognos command centerIBM Cognos Command Center information disclosure4.3 Medium
- pgadmin 4, pgadmin.org pgadmin 4 +1 moreOAuth2 client id and secret exposed through the web browser in pgAdmin 49.9 Critical
- ibm cognos analytics, cognos analytics reports +1 moreIBM Cognos Analytics information disclosure5.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2024.3.44799 token could be revealed on Imports page4.1 Medium
- grafana-plugin-sdk-go grafana plugin sdkInformation Leakage in grafana-plugin-sdk-go9.1 Critical
- syscomgo omflowThe SYSCOM Group OMFLOW - Information Leakage7.5 High
- eaton foreseer, foreseer electrical power monitoring system +1 moreThe Eaton Foreseer software provides the feasibility for the user to configure external servers...6.3 Medium
- hitachi vantara pentaho data integration & analyticsHitachi Vantara Pentaho Data Integration & Analytics - Insufficiently Protected Credentials8.5 High
- cisco ios xr software, ios xr +1 moreCisco Routed Passive Optical Network Cleartext Password Vulnerability8.4 High
- hathway skyworth cm5100-511 firmware, skyworthdigital cm5100 firmware +1 moreAn issue in Hathway Skyworth Router CM5100 v.4.1.1.24 allows a physically proximate attacker to...4.6 Medium
- veeam backup and recovery, backup \& replication +1 moreA series of related high-severity vulnerabilities, the most notable enabling remote code...8.8 High
- echostar fusion, hughes network systems wl3000 fusion software +1 moreHughes Network Systems Insufficiently Protected Credentials4.1 Medium
- visual planning admin centerInsufficient access checks in Visual Planning Admin Center 8 before v.1 Build 240207 allow...8.8 High
- ibm infosphere information serverIBM InfoSphere Information Server information disclosure4.9 Medium
- prison management system project management system, sourcecodester prison management system +1 moreSourceCodester Prison Management System Profile Image insufficiently protected credentials6.9 Medium
- gncchome gncc c2 firmwareAuthentication Bypass in GNCC's GC2 Indoor Security Camera 1080P allows an attacker with physical...6.8 Medium
- zoom workplace, workplace app, zoom communications inc. workplace apps and sdks +4 more +6 moreZoom Workplace Apps and SDKs - Protection Mechanism Failure7.5 High
- zabbixFront-end audit log shows passwords in plaintext8.1 High
- hamastar meetinghub paperless meetingsHamastar MeetingHub Paperless Meetings - Plaintext Storage of a Password9.3 Critical
- incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 moreForminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure7.5 High
- plug&track sensor net connect v2, proges sensor net connect, sensor net connect firmware v2 +2 moreA “CWE-256: Plaintext Storage of a Password” affecting the administrative account allows an...4.2 Medium
- devolutions remote desktop managerExposure of Sensitive Information in edge browser session proxy feature in Devolutions Remote...7.4 High
- ibm datacap, datacap navigator +1 moreIBM Datacap Navigator information disclosure5.5 Medium
- avalara for salesforce cpqThe Avalara for Salesforce CPQ app before 7.0 for Salesforce allows attackers to read an API key....7.5 High
- kiloview p1/p2, p1 4g video encoder firmware, p2 4g video encoder firmware +2 moreInsufficiently protected credentials in Kiloview P1/P2 devices8.8 High
- jetbrains teamcityIn JetBrains TeamCity before 2024.03.3 application token could be exposed in EC2 Cloud Profile...5.0 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2024.03.3 private key could be exposed via testing GitHub App...4.1 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2024.2.34646 user access token was sent to the third-party site5.3 Medium
- hcl software dryice optibot reset stationHCL DRYiCE Optibot Reset Station is impacted by a missing Strict Transport Security Header3.7 Low
- motorola solutions vigilant fixed lpr coms box (bcav1f2-c600), motorolasolutions vigilant fixed lpr coms box bcav1f2 c600 +1 moreInsufficiently Protected Credentials in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)7.0 High
- motorola solutions vigilant fixed lpr coms box (bcav1f2-c600), motorolasolutions vigilant fixed lpr coms box bcav1f2 c600 +1 moreInsufficiently Protected Credentials in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)8.5 High
- ibm jazz reporting serviceIBM Jazz Reporting Service information disclosure4.4 Medium
- siemens sinec traffic analyzerA vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions ...4.8 Medium
- No product listedAn issue was discovered in Kape CyberGhostVPN 8.4.3.12823 on Windows. After a successful logout,...6.5 Medium
- jetbrains aqua, clion, datagrip +10 more +12 moreGitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1...9.3 Critical
- born05 craftcms plugin - two-factor authentication, two-factor authentication +1 moreCraftCMS Plugin - Two-Factor Authentication - Password Hash Disclosure3.7 Low
- chainguard-dev apkoapko Exposure of HTTP basic auth credentials in log output7.5 High
- baxter welch allyn configuration toolVulnerability in Welch Allyn Configuration Tool Software9.4 Critical
simplesamlphp/simplesamlphpPackagistSimpleSAMLphp exposes credentials in session storage5.3 Medium- cisolutions ci out of office managerci solution CI-Out-of-Office Manager through 6.0.0.77 uses a Hard-coded Cryptographic Key.6.5 Medium
- aquasecurity trivyTrivy possibly leaks registry credential when scanning images from malicious registries5.5 Medium
- westermo edw-100Westermo EDW-100 devices through 2024-05-03 allow an unauthenticated user to download a...9.8 Critical
- hcl software bigfix platformHCL BigFix Platform is susceptible to insufficiently protected credentials6.7 Medium
- ge healthcare echopac software only, echopac turnkey, imagevault +2 more +4 moreInsufficiently protected credentials in GE HealthCare EchoPAC products7.6 High
- siemens simatic rtls locating managerA vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All...4.8 Medium
- siemens simatic rtls locating managerA vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All...4.8 Medium
- ibm txseries for multiplatforms, txseries for multiplatform +1 moreIBM TXSeries for Multiplatforms information disclosure6.2 Medium
- dell update manager plugin, openmanage enterprise update manager +1 moreDell Update Manager Plugin, versions 1.4.0 through 1.5.0, contains a Plain-text Password Storage...3.5 Low
- vmware avi load balancerVMware Avi Load Balancer updates address multiple vulnerabilities6.5 Medium
- hcl software bigfix complianceHCL BigFix Compliance is potentially affected by Oracle database credentials stored at endpoint6.5 Medium
- Show moreLoading…