CWE-523: Unprotected Transport of Credentials
Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.
A kind of CWE-522 Insufficiently Protected Credentials.
From the CWE List. © The MITRE Corporation.
Newest
- mozilla thunderbird Account password sent unencrypted during Exchange account setup 5.9 Medium
- ibm financial transaction manager, financial transaction manager (ftm) for redhat openshift +1 more IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities 5.3 Medium
- hclsoftware intelliops event management HCL IEM was affected with Strict transport security not enforced 3.7 Low
- corewcf CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality 7.4 High
- progress chef chef360 Hardcoded credentials in embedded content 2.3 Low
- No product listed Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 transmits DDNS credentials over... 5.9 Medium
- avantra Password re-initialization mechanism sends passwords in plain text 5.9 Medium
- accellion kiteworks, kiteworks secure data forms +1 more Kiteworks Secure Data Forms has a potential Unprotected Transport of Credentials 6.5 Medium
- linuxfoundation spinnaker Spinnaker vulnerable to SSRF due to improper restrictions on http from user input 7.9 High
- osc ondemand, open ondemand +1 more Open OnDemand affected by Apache proxy passing sensitive headers 7.6 High
- brightpick ai mission control / internal logic control Brightpick Mission Control / Internal Logic Control Unprotected Transport of Credentials 6.0 Medium
- brightpick ai mission control / internal logic control Brightpick Mission Control / Internal Logic Control Unprotected Transport of Credentials 7.1 High
- No product listed Mobile Scanner Android App version 2.12.38 (package name com.glority.everlens), developed by... 7.5 High
- phoenix contact quint4-ups/24dc/24dc/10/eip, quint4-ups/24dc/24dc/20/eip, quint4-ups/24dc/24dc/40/eip +1 more +3 more Phoenix Contact: WebSocket Message Interception Leaks Webfrontend Credentials 6.8 Medium
- advplyr audiobookshelf Audiobookshelf vulnerable to OIDC token exfiltration and account takeover 8.8 High
- brocade ascg, broadcom brocade active support connectivity gateway +1 more Brocade ASCG 3.2.0 web interface does not enforce HSTS, as defined by RFC 6797 for ports 8030 and 8100 7.6 High
- opentext™ documentum™ server, opentext documentum content server +1 more Security vulnerability exists in Documentum server cloud releases that could allow access to sensitive information which can impact system Operation. 7.1 High
- cisco webex teams A vulnerability in the media retrieval functionality of Cisco Webex App could allow an... 6.4 Medium
- jberet, red hat build of keycloak, data grid 8 +11 more +13 more Jberet: jberet-core logging database credentials 6.5 Medium
- piigab m-bus softwarepack, m-bus 900s, m-bus 900s firmware +2 more PiiGAB M-Bus Unprotected Transport of Credentials 7.5 High
- ibm aspera cargo, aspera connect +1 more IBM Aspera information disclosure 5.9 Medium
- apache tomcat Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations 4.3 Medium
- codesys development system, edge gateway for windows, gateway +13 more +15 more Insecure transmission of credentials 7.5 High
- moxa mxview, mxview network management software +1 more Moxa MXview Network Management Software 7.5 High
- secomea sitemanager, sitemanager firmware +1 more Configuration service port remains open 10 minutes after reboot even when already provisioned 8.0 High
- gehealthcare 1.5t brivo mr355 firmware, 3.0t signa hd 16 firmware, 3.0t signa hd 23 firmware +109 more +111 more GE Healthcare Imaging and Ultrasound Products may allow specific credentials to be exposed during... 9.8 Critical
- hitachienergy ellipse An Unprotected Transport of Credentials issue was discovered in ABB Ellipse 8.3 through Ellipse 8... 8.8 High