CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- typebot, baptistearno typebot.io +1 moreTypebot Vulnerable to Credential Theft via Client-Side Script Execution and API Authorization Bypass7.4 High
- dataeaseDataEase Vulnerable to Brute-Force Attack on Admin JWT Secret Derived from Password that Enables Full Account Takeover8.8 High
- anthropic claude code, anthropics claude-code +1 moreClaude Code Leaks Data via Malicious Environment Configuration Before Trust Confirmation5.3 Medium
- milner imagedirector captureInsufficient Configuration Protections Enable Database Credential Interception in Milner ImageDirector Capture8.5 High
- milner imagedirector captureInsecure Masked Credential Fields Enable Database Credential Access in Milner ImageDirector Capture8.5 High
- browan communications prismx mx100 ap controllerBROWAN COMMUNICATIONS ｜PrismX MX100 AP controller - Insufficiently Protected Credentials6.9 Medium
- zalando skipperSkipper arbitrary code execution through lua filters8.8 High
- ttyplus mtputtyMTPutty 1.0.1.21 - SSH Password Disclosure6.8 Medium
- sick tdc-x401gl firmware, sick ag tdc-x401gl +1 moreFirmware update files may expose password hashes for system accounts, which could allow a remote...5.3 Medium
- bluspark global bluvoyixPlaintext Passwords Vulnerability in BLUVOYIX10.0 Critical
- broadcom dx netops spectrumSpectrum basic authentication in use2.3 Low
- rustfsRustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting5.7 Medium
- hclsoftware devops deploy, hcltechsw hcl devops deploy +1 moreHCL DevOps Deploy is susceptible to insufficiently protected credentials4.9 Medium
- curlbearer token leak on cross-protocol redirect5.3 Medium
- difyDify Vulnerable to Plaintext API Key Exposure via Model Provider Configuration Endpoint8.4 High
- coollabs coolifyCoolify members can see private key of root user10.0 Critical
- nuvation energy multi-stack controller (msc), nuvationenergy nplatform +1 moreNuvation Energy Multi-Stack Controller Private Key Stored on Device7.2 High
- zblchina zbl epon onu broadband routerZBL EPON ONU Broadband Router V100R001 Privilege Escalation via Configuration Endpoint8.7 High
- nucom 11n wireless routerNuCom 11N Wireless Router 5.07.90 Privilege Escalation via Configuration Backup8.7 High
- ksenia security s.p.a. lares, kseniasecurity lares firmware +1 moreKsenia Security lares Home Automation 1.6 Remote Code Execution via MPFS Upload9.3 Critical
- osc ondemand, open ondemand +1 moreOpen OnDemand affected by Apache proxy passing sensitive headers7.6 High
- ibm devops deploy, ucd - ibm devops deploy +1 moreIBM DevOps Deploy is susceptible to a Insufficiently Protected Credentials vulnerability6.5 Medium
- apache fineractApache Fineract: Server Key not masked9.1 Critical
- howfor qihang media web digital signageQiHang Media Web Digital Signage 3.0.9 Cleartext Credentials Disclosure8.7 High
- adobe coldfusionColdFusion | Insufficiently Protected Credentials (CWE-522)5.3 Medium
- waveshare rs232\/485 to wifi eth \(b\) firmwareWaveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2...5.7 Medium
- devolutions serverExposure of credentials in unintended requests in Devolutions Server.This issue affects Server:...3.5 Low
- digiwin easyflow gpDigiwin｜EasyFlow GP - Insufficiently Protected Credentials6.9 Medium
- digiwin easyflow gpDigiwin｜EasyFlow GP - Insufficiently Protected Credentials6.9 Medium
- intelbras icip, icip 30 firmware +1 moreIntelbras ICIP acessodeusuario.xml credentials storage6.9 Medium
- ibm aix, vios +1 moreAIX Insufficiently Protected Credentials9.0 Critical
- axis communications ab osA 3rd-party component exposed its password in process arguments, allowing for low-privileged...6.0 Medium
- sap se business one (sld)Information Disclosure vulnerability in SAP Business One (SLD)5.3 Medium
- ubia ubox android, ubox ios +1 moreUbia Ubox7.1 High
- radiometrics vizairInsufficiently Protected Credentials in Radiometrics VizAir10.0 Critical
- nagios log serverNagios Log Server < 2024R2.0.2 AD/LDAP Import Password Not Obfuscated6.9 Medium
- grupo castilla epsilon rhUnprotected access to parts of the application in Epsilon RH by Grupo Castilla6.9 Medium
- richardoc github-workflow-updater-extensionGitHub Workflow Updater stored the optional Github token in plaintext3.8 Low
- No product listedImproper handling of OTP/TOTP/HOTP values in NetKnights GmbH privacyIDEA Authenticator v.4.3.0 on...7.2 High
- oxford nano technologies minknowOxford Nanopore Technologies MinKNOW Insufficiently Protected Credentials7.3 High
- hcl software traveler for microsoft outlookHCL Traveler for Microsoft Outlook (HTMO) is susceptible to a credential leakage5.5 Medium
- argoproj argo workflows, argo-workflows +1 moreArgo Workflows exposes artifact repository credentials in workflow-controller logs8.5 High
- newforma project centerNewforma Info Exchange (NIX) insufficiently protected credentials4.8 Medium
- dependencytrack dependency-trackDependency-Track possibly discloses private NuGet repository credentials to api.nuget.org4.7 Medium
- elastic kibanaKibana Insufficiently Protected Credentials in the CrowdStrike Connector5.4 Medium
- zabbixLDAP 'Bind password' field value can be leaked by a Zabbix Super Admin4.3 Medium
- vasion virtual appliance host, print application, print virtual appliance host +1 more +3 moreVasion Print (formerly PrinterLogic) Insecure SSH Client Configuration7.9 High
- vasion virtual appliance host, print application, print virtual appliance host +1 more +3 moreVasion Print (formerly PrinterLogic) Hardcoded PrinterLogic CA Private Key and Hardcoded Password9.3 Critical
- dingtian dt-r002, dingtian-tech dt-r002 firmware +1 moreInsufficiently Protected Credentials in Dingtian DT-R0028.7 High
- dingtian dt-r002, dingtian-tech dt-r002 firmware +1 moreInsufficiently Protected Credentials in Dingtian DT-R0028.7 High
- Show moreLoading…