CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- bitcoinjs tiny-secp256k1tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled environment8.1 High
- brother industries, ltd ads-1700w, ads-1800w, ads-2400n +740 more +742 moreAuthenticated disclosure of external service passwords via pass-back attack affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konica Minolta…6.8 Medium
- 70mai m300, m300 firmware +1 more70mai M300 HTTP Server insufficiently protected credentials2.3 Low
- myscada mypromySCADA PRO Manager Password Disclosure5.5 Medium
- cyberdata 011209 sip emergency intercom, 011209 sip emergency intercom firmware +1 moreCyberData 011209 SIP Emergency Intercom Insufficiently Protected Credentials8.7 High
- psf requestsRequests vulnerable to .netrc credentials leak via malicious URLs5.3 Medium
- ibm controller, cognos controller +1 moreIBM Controller information disclosure6.5 Medium
- ecovacs mobile and android applicationDisclosure of Alibaba (OSS) Keys In Ecovacs Home Android and iOS Mobile Applications4.7 Medium
- meddream web dicom viewer, pacs server +1 moreMedDream WEB DICOM Viewer Cleartext Transmission of Credentials Information Disclosure Vulnerability5.3 Medium
- canon inc. i-sensys series, imageclass series, imagerunner series +1 more +3 moreA passback vulnerability which relates to office/small office multifunction printers and laser...6.3 Medium
- canon inc. imageclass series, imagepress series, imagepress v series +2 more +4 moreA passback vulnerability which relates to production printers and office multifunction printers.6.3 Medium
- synology active backup for microsoft 365A vulnerability in Synology Active Backup for Microsoft 365 allows remote authenticated attackers...6.5 Medium
- ibm sterling partner engagement managerIBM Sterling Partner Engagement Manager information disclosure7.5 High
- phpgt domphpgt/Dom exposes the GITHUB_TOKEN in Dom workflow run artifact7.1 High
- bec technologies multiple routers, bectechnologies router firmware +1 moreBEC Technologies Multiple Routers Insufficiently Protected Credentials Information Disclosure Vulnerability5.3 Medium
- minio operatorMinio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS6.9 Medium
- electrolink fm\/dab\/tv transmitter web management systemA credential exposure vulnerability in Electrolink 500W, 1kW, 2kW Medium DAB Transmitter Web v01...7.5 High
- sicommnet basecInsecure password storage in SicommNet BASEC8.4 High
- adobe commerce, commerce b2b, magento +2 moreAdobe Commerce | Insufficiently Protected Credentials (CWE-522)2.7 Low
- microsoft azure local clusterAzure Local Cluster Information Disclosure Vulnerability7.3 High
- fermax meetmeInsufficiently Protected Credentials vulnerability in MeetMe products8.5 High
- sechard information technologies sechardAuthentication Bypass in Sechard Information Technologies' SecHard9.0 Critical
- superagi, transformeroptimus transformeroptimus/superagi +1 moreInsufficiently Protected Credentials in transformeroptimus/superagi6.5 Medium
- jenkins zoho qengine, jenkins project zoho qengine plugin +1 moreJenkins Zoho QEngine Plugin Displays Unmasked API Keys3.1 Low
- No product listedAn issue in the storage of NFC card data in Dorset DG 201 Digital Lock H5_433WBSK_v2.2_220605...9.1 Critical
- devolutions serverExposure of password in web-based SSH authentication component in Devolutions Server 2024.3.13...7.5 High
- ibm sterling file gatewayIBM Sterling File Gateway information disclosure5.3 Medium
- nintex automationIn Nintex Automation 5.6 and 5.7 before 5.8, the K2 SmartForms Designer folder has configuration...4.3 Medium
- sage 200 spainPass-Back vulnerability in Sage 200 Spain7.1 High
- opentext identity manager advanced editionInsufficiently Protected Credentials10.0 Critical
- printerlogic vasion print, virtual appliance +1 moreVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014...9.8 Critical
- printerlogic vasion print, virtual appliance +1 moreVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.913 Application 20.0.2253...9.8 Critical
- ibm engineering requirements management doors nextIBM Engineering Requirements Management DOORS Next information disclosure7.5 High
- ibm engineering requirements management doors nextIBM Engineering Requirements Management DOORS Next information disclosure7.5 High
- No product listedCryptographic key extraction from internal flash in Minut M2 with firmware version #15142 allows...6.8 Medium
- No product listedVue Vben Admin 2.10.1 allows unauthorized login to the backend due to an issue with hardcoded...9.8 Critical
- extremenetworks xiq-seIn XIQ-SE before 24.2.11, a low-privileged user may be able to access admin passwords, which...8.8 High
- tenable identity exposureStored Credential Disclosure Vulnerability2.7 Low
leantime/leantimePackagistLeantime has Insufficiently Protected Credentials5.7 Medium- hitachi vantara pentaho data integration & analytics, pentaho business analytics server +1 moreHitachi Vantara Pentaho Data Integration & Analytics - Insufficiently Protected Credentials6.3 Medium
- sick ag meac300, meac300-fnade4 +1 morePrivilege Escalation in MEAC3009.9 Critical
- jetbrains teamcityIn JetBrains TeamCity before 2024.12.2 improper Kubernetes connection settings could expose...7.7 High
- clear clearml enterprise server, clearml +1 moreAn information disclosure vulnerability exists in the Vault API functionality of ClearML...7.7 High
- zyxel vmg4325-b10a firmware, sbg3300-n000 firmware, sbg3300-nb00 firmware +11 more +13 more**UNSUPPORTED WHEN ASSIGNED** Insecure default credentials for the Telnet function in the legacy...9.8 Critical
- xerox phaser 6510, versalink b400, versalink b405 +14 more +16 moreSMB/FTP Address Book Scan Pass-back attack7.6 High
- rockwell automation factorytalk® assetcentre, rockwellautomation factorytalk assetcentre +1 moreRockwell Automation FactoryTalk® AssetCentre Data Exposure Vulnerability9.3 Critical
- rockwell automation factorytalk® assetcentre, rockwellautomation factorytalk assetcentre +1 moreRockwell Automation FactoryTalk® AssetCentre Data Exposure Vulnerability7.3 High
- rockwell automation factorytalk® assetcentre, rockwellautomation factorytalk assetcentre +1 moreRockwell Automation FactoryTalk® AssetCentre Data Exposure Vulnerability7.0 High
- No product listedPassword Vulnerability in Safety production process management system v1.0 allows a remote...9.8 Critical
- No product listedThe /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG...7.5 High
- Show moreLoading…