Weakness (CWE)
CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
How to prevent it (3 mitigations)
-
Architecture and Design
Use an appropriate security mechanism to protect the credentials.
-
Architecture and Design
Make appropriate use of cryptography to protect the credentials.
-
Implementation
Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).
Source: MITRE CWE-522
1,021 results · Feed
-
Medium 4.3
private SSL key embedded in JAR file in iManager
NetIQ iManager before 3.0.3 delivered a SSL private key in a Java application (JAR file) for authentication to Sentinel, allowing attackers to extract and establish their own connections to the Sentinel appliance.
-
Unscored —CVE-2018-3609 EPSS 21%
A vulnerability in the Trend Micro InterScan Messaging Security Virtual Appliance 9.0 and 9.1 management portal could a…
-
Medium 4.3
Jenkins Credentials Binding Plugin has Insufficiently Protected Credentials
Jenkins Credentials Binding Plugin 1.14 and earlier masks passwords it provides to build processes in their build logs. Jenkins however transforms provided password values, e.g. replacing environment variable references, which could result in values different…
-
High 7.8
Jenkins Build-Publisher plugin has Insufficiently Protected Credentials
Jenkins Build-Publisher plugin version 1.21 and earlier stores credentials to other Jenkins instances in the file hudson.plugins.build_publisher.BuildPublisher.xml in the Jenkins master home directory. These credentials were stored unencrypted, allowing anyon…
-
Unscored —CVE-2017-3192 EPSS 39%
D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 do not sufficiently protect administrator creden…
-
Critical 9.8
Jenkins SSH Plugin user passwords for encrypted SSH keys stored in plaintext
The SSH Plugin stores credentials which allow jobs to access remote servers via the SSH protocol. User passwords and passphrases for encrypted SSH keys are stored in plaintext in a configuration file.
-
Unscored —
An Insufficiently Protected Credentials issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The applicatio…
-
Medium 5.3
Improper Privilege Management in X-Pack
The Reporting feature in X-Pack in versions prior to 5.5.2 and standalone Reporting plugin versions versions prior to 2.4.6 had an impersonation vulnerability. A user with the reporting_user role could execute a report with the permissions of another reportin…
-
Unscored —
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote…
-
Critical 9.8
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does no…
KEV Nov 3, 2021 -
Unscored —
An Insufficiently Protected Credentials issue was discovered in Schneider Electric Modicon PLCs Modicon M241, all firmw…
-
Unscored —
An Insufficiently Protected Credentials issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to…
-
Unscored —
tpm2-tools versions before 1.1.1 are vulnerable to a password leak due to transmitting password in plaintext from clien…
-
Unscored —
A design flaw in authentication in Synology Photo Station 6.0-2528 through 6.7.1-3419 allows local users to obtain cred…
-
Unscored —
PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign serve…
-
High 7.5
OpenStack Identity Keystone and keystonemiddleware Insufficiently Protected Credentials
The identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and 8.0.x before 8.0.2 (Liberty) and keystonemiddleware (formerly python-keystoneclient) before 1.5.4 (Kilo) and Liberty before 2.3.3 does not properly invalidate authorization token…
-
Medium —
Jenkins allows Administrators to Access API Tokens
Jenkins before 1.638 and LTS before 1.625.2 do not properly restrict access to API tokens which might allow remote administrators to gain privileges and run scripts by using an API token of another user.
-
High 8.8
The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Wind…
KEV Nov 3, 2021 -
Medium 6.0
python-keystoneclient vulnerable to context confusion in Keystone auth_token middleware
The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstan…
-
Medium 6.3
Rockwell RSLogix 5000 Insufficiently Protected Credentials
Rockwell Automation RSLogix 5000 7 through 20.01, and 21.0, does not properly implement password protection for .ACD files (aka project files), which allows local users to obtain sensitive information or modify data via unspecified vectors.
-
High 8.4
Stolen credentials from SSH clients via ssh-agent program, allowing other local users to access remote accounts belongi…