Weakness (CWE)
CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
How to prevent it (3 mitigations)
-
Architecture and Design
Use an appropriate security mechanism to protect the credentials.
-
Architecture and Design
Make appropriate use of cryptography to protect the credentials.
-
Implementation
Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).
Source: MITRE CWE-522
1,021 results · Feed
-
High 7.5
Jenkins NS-ND Integration Performance Publisher Plugin displays credentials without masking
Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.149 and earlier does not mask credentials displayed on the configuration form, increasing the potential for attackers to observe and capture them.
-
Medium 4.3
Jenkins Azure VM Agents Plugin missing permission checks
A missing permission check in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
-
Medium 6.8CVE-2022-47880 Public exploit
An Information disclosure vulnerability in /be/rpc.php in Jedox GmbH Jedox 2020.2.5 allow remote, authenticated users w…
-
Medium 6.5
Insufficiently protected credentials in the Intel(R) DCM software before version 5.0.1 may allow an authenticated user …
-
Low 3.7
PostgresNIO processes unencrypted bytes from man-in-the-middle
PostgresNIO is a Swift client for PostgreSQL. Any user of PostgresNIO prior to version 1.14.2 connecting to servers with TLS enabled is vulnerable to a man-in-the-middle attacker injecting false responses to the client's first few queries, despite the use of …
-
Low 3.7
Information Disclosure vulnerability in SAP BusinessObjects Platform
SAP BusinessObjects Platform - versions 420, 430, Information design tool transmits sensitive information as cleartext in the binaries over the network. This could allow an unauthenticated attacker with deep knowledge to gain sensitive information such as use…
-
High 7.5
Milesight NCR/Camera CWE-522: Insufficiently Protected Credentials
Milesight NCR/camera version 71.8.0.6-r5 exposes credentials through an unspecified request.
-
Low 3.9
An insufficiently protected credentials vulnerability [CWE-522] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 an…
-
Medium 4.9
A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password …
-
Critical 9.1
typed-rest-client vulnerable to potential leak of authentication data to 3rd parties
typed-rest-client is a library for Node Rest and Http Clients with typings for use with TypeScript. Users of the typed-rest-client library version 1.7.3 or lower are vulnerable to leak authentication data to 3rd parties. The flow of the vulnerability is as fo…
-
High 8.1
Sangoma FreePBX 1805 through 2302 (when obtained as a ,.ISO file) places AMPDBUSER, AMPDBPASS, AMPMGRUSER, and AMPMGRPA…
-
Medium 5.5
HPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokens
HPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokens
-
Medium 5.5
An HPE OneView appliance dump may expose SNMPv3 read credentials
-
High 7.1
An HPE OneView appliance dump may expose FTP credentials for c7000 Interconnect Modules
-
High 7.8
An HPE OneView appliance dump may expose SAN switch administrative credentials
-
Medium 5.5
An HPE OneView appliance dump may expose OneView user accounts
-
Medium 5.5
An HPE OneView appliance dump may expose proxy credential settings
-
Medium 4.9
Apache Superset: Database connection password leak
An authenticated user with specific data permissions could access database connections stored passwords by requesting a specific REST API. This issue affects Apache Superset version 1.3.0 up to 2.0.1.
-
Critical 9.6CVE-2023-28131 EPSS 23%
Expo SDK has an OAuth vulnerability
A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that configured the "Expo AuthSession Redirect Proxy" for social sign-in. This can be achieved once a victim clicks a malicious l…
-
High 7.5
Ribose RNP before 0.15.1 does not implement a required step in a cryptographic algorithm, resulting in weaker encryptio…
-
High 8.8
Incorrect Access Control in Tripleplay Platform releases prior to Caveman 3.4.0 allows authenticated user to modify oth…
-
High 7.5
Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control. The device allows unauthenticated access to Telnet and S…
-
High 7.2
Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control. Restricted users have read access to administrator crede…
-
Medium 6.1
In JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could leak through an API method used in the IntelliJ IDEA built…
-
High 7.8
CP Plus KVMS Pro versions 2.01.0.T.190521 and prior are vulnerable to sensitive credentials being leaked because they a…
-
Medium 6.5
Information disclosure in the user creation feature of a MSSQL data source in Devolutions Remote Desktop Manager 2023.1…
-
Critical 9.8CVE-2022-45599 Public exploit
Aztech WMB250AC Mesh Routers Firmware Version 016 2020 is vulnerable to PHP Type Juggling in file /var/www/login.php, a…
-
High 7.4
An insufficiently protected credentials in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, …
-
Critical 9.1
Ricoh mp_c4504ex devices with firmware 1.06 mishandle credentials.
-
High 7.5
Netgear ProSAFE 24 Port 10/100 FS726TP - CWE-522: Insufficiently Protected Credentials.
An uspecified endpoint in the web server of the switch does not properly authenticate the user identity, and may allow downloading a config page with the password to the switch in clear text.
-
Medium 6.5
Media CP Media Control Panel – insufficiently protected credential change
Media CP Media Control Panel latest version. Insufficiently protected credential change.
-
Medium 5.3
Sunell DVR – Insufficiently Protected Credentials
Sunell DVR, latest version, Insufficiently Protected Credentials (CWE-522) may be exposed through an unspecified request.
-
High 7.5
AMI MegaRAC SPX devices allow Password Disclosure through Redfish. The fixed versions are SPx_12-update-7.00 and SPx_13…
-
Medium 6.8
TIBCO Operational Intelligence Hawk Redtail Credential Exposure Vulnerability
The Hawk Console component of TIBCO Software Inc.'s TIBCO Hawk and TIBCO Operational Intelligence Hawk RedTail contains a vulnerability that will return the EMS transport password and EMS SSL password to a privileged user. Affected releases are TIBCO Software…
-
Medium 5.5
Redpanda before 22.3.12 discloses cleartext AWS credentials. The import functionality in the rpk binary logs an AWS Acc…
-
High 7.5
Driver Distributor v2.2.3.1 and earlier contains a vulnerability where passwords are stored in a recoverable format. If…
-
High 8.0
A CWE-522: Insufficiently Protected Credentials vulnerability exists that could result in unwanted access to a DCE inst…
-
High 8.0
A CWE-522: Insufficiently Protected Credentials vulnerability exists that could result in unwanted access to a DCE inst…
-
Critical 9.8
An access control issue in Revenue Collection System v1.0 allows unauthenticated attackers to view the contents of /adm…
-
Critical 9.8
User Verification < 1.0.94 - Authentication Bypass
The User Verification WordPress plugin before 1.0.94 was affected by an Auth Bypass security vulnerability. To bypass authentication, we only need to know the user’s username. Depending on whose username we know, which can be easily queried because it is usua…