CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- ericsson indoor connect 8855, indoor connect 8855 firmware +1 moreEricsson Indoor Connect 8855 - Insufficiently Protected Credentials Vulnerability5.1 Medium
- perforce puppet enterpriseInsufficiently Protected Credentials in Puppet Enterprise 2025.4 and 2025.56.9 Medium
- nvidia nvdebug, nvdebug tool +1 moreThe NVIDIA NVDebug tool contains a vulnerability that may allow an actor to gain access to a...8.2 High
- sap se business one (sld)Insecure Storage of Sensitive Information in SAP Business One (SLD)8.8 High
- bender cc612, cc613, icc13xx +1 more +3 moreCredential Disclosure via Insecure Storage on Charge Controller8.8 High
- inseefrlab onyxiaOnyxia private helm repository credentials are leaked through unauthenticated API9.4 Critical
- freepbx apiapi: Shared OAuth Signing Key Between Different Instances5.1 Medium
- learningcircuit local-deep-researchLocal Deep Research's API keys are stored in plain text6.9 Medium
- copeland e3 supervisory controller firmware, copeland lp e3 supervisory control +1 morePredictable root linux password generation9.2 Critical
- copeland e3 supervisory controller firmware, copeland lp e3 supervisory control +1 morePrivilege escalation in the application services7.7 High
- copeland e3 supervisory controller firmware, copeland lp e3 supervisory control +1 moreConsistent predictable generation of the password for the default admin user "ONEDAY" to the application services9.3 Critical
- suse neuvectorNeuVector process with sensitive arguments lead to leakage5.3 Medium
- pdq smart deployAn issue in PDQ Smart Deploy V.3.0.2040 allows an attacker to escalate privileges via the...9.8 Critical
- mouy-leng genx fxGenX_FX authentication bypass in JWT validation9.8 Critical
- santesoft sante pacs serverSantesoft Sante PACS Server Cleartext Transmission of Sensitive Information9.1 Critical
m00nl1ght-dev/steam-workshop-deployGitHub Actions,BoldestDungeon/steam-workshop-deployGitHub Actions +1 morem00nl1ght-dev/steam-workshop-deploy: Exposure of Version-Control Repository to an Unauthorized Control Sphere and Insufficiently Protected Credentials10.0 Critical- siemens simatic rtls locating managerA vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.3)....4.8 Medium
- himmelblau-idm himmelblauHimmelblau's Kerberos credential cache collection is world readable7.1 High
- netwrix directory managerNetwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 has...5.3 Medium
- bmc control-m, control-m/server, control-m\/server +2 moreBMC Control-M/Server cleartext database credentials in process lists and logs4.8 Medium
- janssenproject jansJans CLI stores plaintext passwords in the local cli_cmd.log file6.9 Medium
- dell digital deliveryDell Digital Delivery, versions prior to 5.6.1.0, contains an Insufficiently Protected...7.2 High
- glpi-project glpiGLPI's MailCollector Receiver is vulnerable to credential exfiltration6.5 Medium
- tsplus remote accessRetrievable password hash protecting TSplus admin console4.8 Medium
- sandboxie-plus sandboxieSandboxie exposes encrypted sandbox key during password change6.9 Medium
- musombi123 revelacode-backendRevelaCode exposes Sensitive MongoDB Atlas URI in .env (potential credential leak)9.8 Critical
- apereo opencastOpencast still publishes global system account credentials6.5 Medium
- sitecore experience commerce (xc), experience manager (xm), experience platform (xp) +1 more +3 moreSitecore XM/XP/XC and Managed Cloud 8.0 - 10.4 Arbitrary File Read8.7 High
- mattermost, mattermost server +1 moreInvite token is used as part of the secure communication2.2 Low
- lb-link bl-ac3600, bl-ac3600 firmware +1 moreLB-LINK BL-AC3600 Web Management Interface lighttpd.cgi geteasycfg information disclosure6.9 Medium
- jenkins applitools eyes, jenkins project applitools eyes plugin +1 moreJenkins Applitools Eyes Plugin vulnerability does not mask API keys on its job configuration form5.3 Medium
- jenkins nouvola divecloud, jenkins project nouvola divecloud plugin +1 moreJenkins Nouvola DiveCloud Plugin vulnerability does not mask keys on its job configuration form6.5 Medium
- jenkins vaddy, jenkins project vaddy plugin +1 moreJenkins VAddy Plugin vulnerability exposes plaintext keys on its job configuration form4.3 Medium
- jenkins project dead man's snitch plugin, jenkins dead man\'s snitch +1 moreJenkins Dead Man's Snitch Plugin vulnerability does not mask tokens5.3 Medium
- jenkins project dead man's snitch plugin, jenkins dead man\'s snitch +1 moreJenkins Dead Man's Snitch Plugin vulnerability stores tokens in plain text6.5 Medium
- jenkins apica loadtest, jenkins project apica loadtest plugin +1 moreJenkins Apica Loadtest Plugin vulnerability exposes authentication tokens4.3 Medium
- jenkins apica loadtest, jenkins project apica loadtest plugin +1 moreJenkins Apica Loadtest Plugin vulnerability exposes authentication tokens6.5 Medium
- jenkins ibm cloud devops, jenkins project ibm cloud devops plugin +1 moreJenkins IBM Cloud DevOps Plugin vulnerability exposes SonarQube authentication tokens6.5 Medium
- jenkins ifttt build notifier, jenkins project ifttt build notifier plugin +1 moreJenkins IFTTT Build Notifier Plugin vulnerability exposes IFTTT Maker Channel Keys6.5 Medium
- jenkins testsigma test plan run, jenkins project testsigma test plan run plugin +1 moreJenkins Testsigma Test Plan vulnerability exposes API keys via job configuration form4.3 Medium
- jenkins qmetry test management, jenkins project qmetry test management plugin +1 moreJenkins QMetry Test Management Plugin vulnerability exposes API keys4.3 Medium
- jenkins readyapi functional testing, jenkins project readyapi functional testing plugin +1 moreJenkins ReadyAPI Functional Testing Plugin vulnerability exposes secrets4.3 Medium
- jenkins readyapi functional testing, jenkins project readyapi functional testing plugin +1 moreJenkins ReadyAPI Functional Testing Plugin vulnerability stores unencrypted authentication credentials6.5 Medium
- jenkins statistics gatherer, jenkins project statistics gatherer plugin +1 moreJenkins Statistics Gatherer Plugin vulnerability exposes AWS Secret Key6.5 Medium
- jenkins aqua security scanner, jenkins project aqua security scanner plugin +1 moreJenkins Aqua Security Scanner Plugin vulnerability exposes scanner tokens4.3 Medium
- jenkins credentials binding, jenkins project credentials binding plugin +1 moreJenkins Credentials Binding Plugin vulnerability can expose sensitive information in logger messages7.3 High
- broadcom symantec it management suiteOffline Extraction of Account Connectivity Credentials (ACCs) in IT Management Suite6.4 Medium
- nsclient++, nsclient nsclient\+\+ +1 moreNSClient++ 0.5.2.35 Local Privilege Escalation via ExternalScripts and Web Interface7.3 High
- one identity onelogin active directory connector (adc)OneLogin AD Connector API Credential and Signing Key Exposure5.7 Medium
- konica minolta bizhub 227 multifunction printersPass-back attack in Konica Minolta bizhub 227 multifunctional printers6.8 Medium
- Show moreLoading…