Skip to content
OpenAdvisories

Weakness (CWE)

CWE-522: Insufficiently Protected Credentials

Class Incomplete

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

How to prevent it (3 mitigations)

  1. Architecture and Design

    Use an appropriate security mechanism to protect the credentials.

  2. Architecture and Design

    Make appropriate use of cryptography to protect the credentials.

  3. Implementation

    Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).

Source: MITRE CWE-522

All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Medium 5.5
    CVE-2026-92680 Public exploit

    Araxis Merge insufficiently protected credentials

    Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and un…

    Araxis Merge
  • Medium 5.9
    CVE-2026-81861 Public exploit

    CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information…

    Schneider Electric SCADAPack 47x SCADAPack 57x SCADAPack 47xi ICS / OT
  • Medium 6.5
    CVE-2026-39908 Public exploit

    OpenBullet2 0.3.2 NTLMv2 Hash Disclosure via UNC Path Proxy Source

    OpenBullet2 through version 0.3.2 on Windows contains a credential disclosure vulnerability that allows remote attackers to capture the NTLMv2 hash of the process user by configuring a job proxy source with a UNC path pointing to an attacker-controlled server…

    openbullet openbullet2
  • Medium 6.5
    CVE-2025-15617 Public exploit

    Wazuh GitHub Actions Workflow Exposure of Sensitive Credentials

    Wazuh version 4.12.0 contains an exposure vulnerability in GitHub Actions workflow artifacts that allows attackers to extract the GITHUB_TOKEN from uploaded artifacts. Attackers can use the exposed token within a limited time window to perform unauthorized ac…

    wazuh Wazuh (GitHub Actions)
  • Medium 5.3
    CVE-2026-21852 Public exploit EPSS 28%

    Claude Code Leaks Data via Malicious Environment Configuration Before Trust Confirmation

    Claude Code is an agentic coding tool. Prior to version 2.0.65, vulnerability in Claude Code's project-load flow allowed malicious repositories to exfiltrate data including Anthropic API keys before users confirmed trust. An attacker-controlled repository cou…

    anthropics claude-code @anthropic-ai/claude-code npm
  • Medium 6.5
    CVE-2025-4679 Public exploit

    A vulnerability in Synology Active Backup for Microsoft 365 allows remote authenticated attackers to obtain sensitive i…

    Synology Active Backup for Microsoft 365
  • Medium 6.6
    CVE-2025-23040 Public exploit

    Maliciously crafted remote URLs could lead to credential leak in GitHub Desktop

    GitHub Desktop is an open-source Electron-based GitHub app designed for git development. An attacker convincing a user to clone a repository directly or through a submodule can allow the attacker access to the user's credentials through the use of maliciously…

    desktop desktop
  • Medium 6.8
    CVE-2022-47880 Public exploit

    An Information disclosure vulnerability in /be/rpc.php in Jedox GmbH Jedox 2020.2.5 allow remote, authenticated users w…

  • Medium 6.5
    CVE-2022-38121 Public exploit

    POWERCOM CO., LTD. UPSMON PRO - Insufficiently Protected Credentials

    UPSMON PRO configuration file stores user password in plaintext under public user directory. A remote attacker with general user privilege can access all users‘ and administrators' account names and passwords via this unprotected configuration file.

    POWERCOM UPSMON PRO
  • Medium 5.5
    CVE-2020-7030 Public exploit

    IPO Information Disclosure

    A sensitive information disclosure vulnerability was discovered in the web interface component of IP Office that may potentially allow a local user to gain unauthorized access to the component. Affected versions of IP Office include: 9.x, 10.0 through 10.1.0.…

    Avaya IP Office