CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- ibm common licensingIBM Common Licensing information disclosure6.2 Medium
- m-files serverUnsafe stored password recovery4.6 Medium
- No product listedGRAU DATA Blocky before 3.1 stores passwords encrypted rather than hashed. At the login screen,...5.7 Medium
- desktopMaliciously crafted remote URLs could lead to credential leak in GitHub Desktop6.6 Medium
- venki supravizio bpmAn NTLM hash leak in Venki Supravizio BPM up to 18.0.1 allows authenticated attackers with...8.4 High
- hcl software dryice myxalyticsHCL MyXalytics is affected by broken authentication5.3 Medium
- dell vxrail hci, vxrail d560 firmware, vxrail d560f firmware +40 more +42 moreDell VxRail, versions 8.0.000 through 8.0.311, contain(s) a Plaintext Storage of a Password...7.5 High
- dell vxrail hci, vxrail d560 firmware, vxrail d560f firmware +40 more +42 moreDell VxRail, versions 7.0.000 through 7.0.532, contain(s) a Plaintext Storage of a Password...7.5 High
- jetbrains teamcityIn JetBrains TeamCity before 2024.12 password field value were accessible to users with view...5.5 Medium
- huawei mate 20 pro, mate 20 pro firmware +1 moreThere is an insufficient authentication vulnerability in some Huawei smart phone. An...3.3 Low
- ibm robotic process automationIBM Robotic Process Automation information disclosure4.6 Medium
- ibm security guardium key lifecycle managerIBM Security Guardium Key Lifecycle Manager information disclosure4.4 Medium
- apple macosThis issue was addressed with additional entitlement checks. This issue is fixed in macOS Sonoma...5.5 Medium
- dell vxrail hci, vxrail hyperconverged infrastructure +1 moreDell VxVerify, versions prior to x.40.405, contain a Plain-text Password Storage Vulnerability in...7.2 High
- siemens cpci85 central processing/communicationA vulnerability has been identified in CPCI85 Central Processing/Communication (All versions <...5.1 Medium
- tp-link tl-wr845n firmwareTP-Link TL-WR845N(UN)_V4_201214, TL-WR845N(UN)_V4_200909 and TL-WR845N(UN)_V4_190219 were...8.0 High
- tp-link tl-wr845n firmwareTP-Link TL-WR845N(UN)_V4_190219 was discovered to transmit credentials in base64 encoded form,...8.0 High
- pentaminds curovmsPentaminds CuroVMS v2.0.1 was discovered to contain exposed credentials.9.1 Critical
- abb matrix series, nexus series, aspect-ent-12 firmware +20 more +22 moreCredentails Disclosure8.7 High
- abb matrix series, nexus series, aspect-ent-12 firmware +20 more +22 moreUsername Enumeration9.3 Critical
- No product listedSTMicroelectronics SPC58 is vulnerable to Missing Protection Mechanism for Alternate Hardware...9.8 Critical
- veeam backup & replication, backup \& replication +1 moreA vulnerability in Veeam Backup & Replication allows users with certain operator roles to expose...7.7 High
- hewlett packard enterprise hpe icewallHPE IceWall Products, Remote Unauthorized Data Modification3.7 Low
- opentext™ accurev, opentext accurev for ldap integration +1 moreMissing Authentication for Critical Function vulnerability in OpenText™ AccuRev for LDAP...9.0 Critical
- mozilla firefoxOn Android, Firefox may have inadvertently allowed viewing saved passwords without the required...5.7 Medium
- axis communications ab camera station, camera station pro +1 moreSeth Fogie, member of the AXIS Camera Station Pro Bug Bounty Program, has found that the Incident...6.3 Medium
- aiphone co., ltd. ixg-2c7, ixg-2c7-l +1 moreAIPHONE IXG SYSTEM IXG-2C7 firmware Ver.2.03 and earlier and IXG-2C7-L firmware Ver.2.03 and...5.5 Medium
- aiphone co., ltd. ix-ba, ix-bau, ix-bb +51 more +53 moreInsufficiently protected credentials issue exists in AIPHONE IX SYSTEM and IXG SYSTEM. A network...6.5 Medium
- cisco catalyst sd-wan managerCisco SD-WAN vManage Information Disclosure Vulnerability6.5 Medium
- sap se netweaver java (software update manager)Information Disclosure vulnerability in SAP NetWeaver Java (Software Update Manager)4.7 Medium
- openwrt luciAn issue in the luci-mod-rpc package in OpenWRT Luci LTS allows for privilege escalation from an...8.0 High
- bitrix bitrix24Insufficiently protected credentials in AD/LDAP server settings in 1C-Bitrix Bitrix24 23.300.100...4.9 Medium
- bitrix bitrix24Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100...6.8 Medium
- bitrix bitrix24Insufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100...4.9 Medium
- bitrix bitrix24Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100...4.9 Medium
- suse rancherExposure of vSphere's CPI and CSI credentials in Rancher8.5 High
org.openrefine:openrefineMavenOpenRefine leaks Google API credentials in releasesNo score- ibm cics transaction gateway for multiplatforms, cics transaction gateway +1 moreIBM CICS Transaction Gateway for Multiplatforms information disclosure4.9 Medium
- kieback&peter ddc4002, ddc4002e, ddc4020e +17 more +19 moreKieback&Peter DDC4000 Series Path Traversal Insufficiently Protected Credentials8.6 High
- zyxel uos, usg flex h series uos firmware, usg flex 700h firmware +2 moreThe insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H...5.5 Medium
- litespeed technologies cache, litespeedtech litespeed cache +1 moreWordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability9.8 Critical
- hms networks ewon flexy 202HMS Networks EWON FLEXY 202 Insufficiently Protected Credentials7.1 High
- elvaco m-bus metering gateway cme3100, cme3100 firmware +1 moreInsufficiently Protected Credentials in Elvaco M-Bus Metering Gateway CMe31008.7 High
- cisco ata 191 firmware, ata 192 firmware, analog telephone adaptor (ata) software +2 moreCisco ATA 190 Series Analog Telephone Adapter Muliplatform Firmware Information Disclosure Vulnerability5.5 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2024.07.3 password could be exposed via Sonar runner REST API4.3 Medium
- openc3 cosmosOpenC3 COSMOS uses clear text storage of password/token (`GHSL-2024-129`)4.8 Medium
- jenkins credentials, jenkins project credentials plugin +1 moreJenkins Credentials plugin reveals encrypted values of credentials to users with Extended Read permission7.5 High
- advantech adam-5630, adam-5630 firmware +1 moreAdvantech ADAM-5630 Weak Encoding for Password6.9 Medium
- advantech adam 5550, adam-5550 firmware +1 moreAdvantech ADAM-5550 Weak Encoding for Password6.8 Medium
- topquadrant topbraid edgTopQuadrant TopBraid EDG password manager stores external credentials insecurely3.0 Low
- Show moreLoading…