CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- servmask all-in-one wp migration and backupAll-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic Header5.3 Medium
- secobserveSecObserve before 1.59.1 Information Disclosure via API Configuration7.1 High
- cisco ise passive identity connector, identity services engine, identity services engine software +1 more +3 moreCisco Identity Services Engine Hardening Release - Insuffiencently Protected Credential Vulnerabilities9.9 Critical
- jenkins project gitlab pluginJenkins GitLab Plugin 1.2149.vcfc32c82b_f7f and earlier caches the GitLab API client built for...5.4 Medium
- netcore nr255-vNetcore NR255-V 1.5.130703 IPsec PSK and RSA Key Disclosure via l2tpd_config_show.cgi Read Handlers7.1 High
- netcore nr255-vNetcore NR255-V 1.5.130703 Sensitive Information Disclosure via VPN Read Handlers7.1 High
- netcore nr255-vNetcore NR255-V 1.5.130703 Sensitive Information Disclosure via user_pass_show.cgi7.1 High
- netcore nr255-vNetcore NR255-V 1.5.130703 Plaintext DDNS Credential Disclosure via ddns_wan_list_show.cgi7.1 High
- netcore nr255-vNetcore NR255-V 1.5.130703 Sensitive Information Disclosure via l7_web_auth_user_show.cgi7.1 High
- gitlabInsertion of Sensitive Information Into Sent Data in GitLab5.3 Medium
- ibm security verify access, verify identity access, verify identity access container +1 more +3 moreSecurity vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access9.1 Critical
- go-vikunja vikunjaVikunja before 2.6.0 TOTP Secret Disclosure via API5.3 Medium
- apache software foundation storm nimbus, storm ui +1 moreApache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI6.5 Medium
- apache software foundation storm client, storm nimbus +1 moreApache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs10.0 Critical
- apache software foundation storm nimbus, storm ui +1 moreApache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page6.5 Medium
- apache software foundation syncopeApache Syncope: Nested secrets leak cleartext into audit records readable4.9 Medium
- mispMISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection8.4 High
- contec co., ltd. remote i/o coupler unit (server type) cpsn-mcb271-*Insufficiently protected credentials issue exists in Remote I/O Coupler Unit (Server Type) CPSN...8.2 High
- schneider electric scadapack 32, scadapack 3xx, scadapack 470r +4 more +6 moreCWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of...5.9 Medium
- rclonerclone: http backend forwards custom/auth headers to a different host on redirect3.7 Low
- thoda-dev nuxt-ollamaNuxt Ollama: public runtime configuration discloses the configured cloud API key7.5 High
- microsoft visual studio 2022 version 17.14, visual studio 2026 version 18.9, microsoft.diagnostics.runtime +2 more +4 more.NET Elevation of Privilege Vulnerability7.5 High
- microsoft 365 apps, 365 apps for enterprise, office 2016 +3 more +5 moreMicrosoft Office Spoofing Vulnerability6.5 Medium
- microsoft visual studio codeGitHub Copilot and Visual Studio Code Information Disclosure Vulnerability6.5 Medium
- microsoft azure cyclecloud, azure cyclecloud 8.9.2 +1 moreAzure CycleCloud Information Disclosure Vulnerability7.7 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreInsufficiently Protected Credentials in MongoDB Server Diagnostic Reporting Interface7.1 High
- snowflake connector for .net, connector for python, go driver +7 more +9 moreWorkload identity attestation generated before login host validation in Snowflake drivers8.2 High
- wwbn avideoAVideo through 29.0 Information Disclosure via restreamsActive.json.php7.1 High
- netis systems nx10Netis NX10 Credential Disclosure via sysinfo Diagnostic Endpoint9.3 Critical
- sap se cloud application programming model (cap)Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)9.4 Critical
- netbox-community netboxNetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs7.1 High
- onyx-dot-app onyxOnyx 4.6.6 Custom Tool Secret Header Disclosure via Tool Endpoints7.1 High
- ibm netezza software, netezza performance server +1 moreVulnerabilities exists in IBM Netezza Software7.5 High
- septeo it solutions upsignonUpSignOn < 7.19.0 Biometric Key Exposure via Windows PasswordVault6.9 Medium
- pnpmpnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings8.3 High
mysql2npm,@rootio/mysql2Root +1 moreMySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials8.2 High- org.mariadb r2dbc-mariadb, mariadb-corporation mariadb-connector-r2dbc +1 moreMariaDB Connector/R2DBC: Cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)5.9 Medium
- mariadb-corporation mariadb-connector-jMariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials5.9 Medium
- mariadb-corporation mariadb-connector-jMariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshake5.9 Medium
- mariadb-corporation mariadb-connector-nodejsMariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials in mariadb5.9 Medium
- mariadb-corporation mariadb-connector-nodejsMariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: true`7.5 High
- automatic1111 stable-diffusion-webuiStable Diffusion WebUI Credential Disclosure via /sdapi/v1/cmd-flags8.7 High
- gitoxidelabs gitoxidegitoxide before 0.37.1 HTTP Basic credential leak via URL parsing8.7 High
- wazuhWazuh discloses cleartext cluster key to low-privilege API users via GET /cluster/local/config6.5 Medium
- ebyte ne2-d11 firmwareEbyte NE2-D11 Insufficiently Protected Credentials5.1 Medium
- samsung open source oneA vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter...8.5 High
pantheon-agentsPyPITrojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)No score- rently smart homeInsufficiently Protected Credentials in Rently Smart Home8.7 High
- nvidia nemoclawNVIDIA NemoClaw contains a vulnerability where an attacker could cause insufficiently protected...5.6 Medium
- node-modules urlliburllib: Cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage7.5 High
- Show moreLoading…