Weakness (CWE)
CWE-549: Missing Password Field Masking
The product does not mask passwords during entry, increasing the potential for attackers to observe and capture passwords.
How to prevent it (1 mitigation)
-
Implementation, Requirements
Recommendations include requiring all password fields in your web application be masked to prevent other users from seeing this information.
Source: MITRE CWE-549
4 results · Clear filters · Feed
-
Low 3.8
sudo-rs: Partial password reveal is possible after timeout
sudo-rs is a memory safe implementation of sudo and su written in Rust. Starting in version 0.2.7 and prior to version 0.2.10, if a user begins entering a password but does not press return for an extended period, a password timeout may occur. When this happe…
-
Low 3.1
Jenkins Zoho QEngine Plugin Displays Unmasked API Keys
Jenkins Zoho QEngine Plugin 1.0.29.vfa_cc23396502 and earlier does not mask the QEngine API Key form field, increasing the potential for attackers to observe and capture it.
-
Low 2.6
Zoom Jenkins Marketplace plugin - Missing Password Field Masking
Missing password field masking in the Zoom Jenkins Marketplace plugin before version 1.6 may allow an unauthenticated user to conduct a disclosure of information via adjacent network access.
-
Low 2.7
Topdata Inner Rep Plus WebServer Operator Details Form InnerRepPlus.html missing password field masking
A vulnerability was found in Topdata Inner Rep Plus WebServer 2.01. It has been classified as problematic. Affected is an unknown function of the file /InnerRepPlus.html of the component Operator Details Form. The manipulation leads to missing password field …