CWE-522 · Insufficiently Protected Credentials (page 10)
Page 10 of 15 — CVEs classified under CWE-522, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-8339 | Medium | 4.3 | 2020-09-15 | A cross-site scripting inclusion (XSSI) vulnerability was reported in the legacy IBM BladeCenter Advanced Management Module (AMM) web interface prior to versio… |
CVE-2020-16097 | High | 7.3 | 2020-09-15 | On controllers running versions of v8.20 prior to vCR8.20.200221b (distributed in v8.20.1093(MR2)), v8.10 prior to vGR8.10.179 (distributed in v8.10.1211(MR5))… |
CVE-2020-15791 | Medium | 6.5 | 2020-09-09 | A vulnerability has been identified in SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions), SIMATIC S7-400 CPU family (incl… |
CVE-2020-7299 | Medium | 5.0 | 2020-09-04 | Cleartext Storage of Sensitive Information in Memory vulnerability in Microsoft Windows client in McAfee True Key (TK) prior to 6.2.109.2 allows a local user l… |
CVE-2020-3547 | Medium | 4.3 | 2020-09-04 | A vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appliance (ESA), Cisco Content Security Management App… |
CVE-2020-6874 | Critical | 9.1 | 2020-09-01 | A ZTE product is impacted by the cryptographic issues vulnerability. The encryption algorithm is not properly used, so remote attackers could use this vulnerab… |
CVE-2019-4697 | Medium | 6.5 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 stores user credentials in plain in clear text which can be read by an authenticated user. IBM X-Force ID… |
CVE-2019-4693 | Medium | 4.4 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 stores user credentials in plain in clear text which can be read by a local privileged user. IBM X-Force ID… |
CVE-2020-24622 | Medium | 4.9 | 2020-08-25 | In Sonatype Nexus Repository 3.26.1, an S3 secret key can be exposed by an admin user. |
CVE-2020-4593 | Medium | 4.4 | 2020-08-24 | IBM Security Guardium Insights 2.0.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 184747. |
CVE-2020-16280 | Medium | 5.5 | 2020-08-20 | Multiple Rangee GmbH RangeeOS 8.0.4 modules store credentials in plaintext including credentials of users for several external facing administrative services… |
CVE-2020-8210 | High | 7.5 | 2020-08-17 | Insufficient protection of secrets in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and… |
CVE-2020-7307 | Medium | 5.2 | 2020-08-13 | Unprotected Storage of Credentials vulnerability in McAfee Data Loss Prevention (DLP) for Mac prior to 11.5.2 allows local users to gain access to the RiskDB u… |
CVE-2020-7306 | Medium | 5.2 | 2020-08-13 | Unprotected Storage of Credentials vulnerability in McAfee Data Loss Prevention (DLP) for Mac prior to 11.5.2 allows local users to gain access to the ADRMS us… |
CVE-2020-17489 | Medium | 4.3 | 2020-08-11 | An issue was discovered in certain configurations of GNOME gnome-shell through 3.36.4. When logging out of an account, the password box from the login dialog r… |
CVE-2020-9404 | High | 7.1 | 2020-08-11 | In PACTware before 4.1 SP6 and 5.x before 5.0.5.31, passwords are stored in an insecure manner, and may be modified by an attacker with no knowledge of the cur… |
CVE-2020-9403 | Medium | 5.5 | 2020-08-11 | In PACTware before 4.1 SP6 and 5.x before 5.0.5.31, passwords are stored in a recoverable format, and may be retrieved by any user with access to the PACTware… |
CVE-2020-15661 | Medium | 6.5 | 2020-08-10 | A rogue webpage could override the injected WKUserScript used by the logins autofill, this exploit could result in leaking a password for the current domain. T… |
CVE-2020-9525 | High | 8.1 | 2020-08-10 | CS2 Network P2P through 3.x, as used in millions of Internet of Things devices, suffers from an authentication flaw that allows remote attackers to perform a m… |
CVE-2020-15062 | High | 8.8 | 2020-08-07 | DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to elevate privileges because the administrative pass… |
CVE-2020-15058 | High | 8.8 | 2020-08-07 | Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to elevate privileges because the administrative pass… |
CVE-2020-15054 | High | 8.8 | 2020-08-07 | TP-Link USB Network Server TL-PS310U devices before 2.079.000.t0210 allow an attacker on the same network to elevate privileges because the administrative pass… |
CVE-2020-14334 | High | 8.8 | 2020-07-31 | A flaw was found in Red Hat Satellite 6 which allows privileged attacker to read cache files. These cache credentials could help attacker to gain complete cont… |
CVE-2020-2078 | Medium | 6.5 | 2020-07-29 | Passwords are stored in plain text within the configuration of SICK Package Analytics software up to and including V04.1.1. An authorized attacker could access… |
CVE-2020-14489 | Medium | 6.2 | 2020-07-29 | OpenClinic GA 5.09.02 and 5.89.05b stores passwords using inadequate hashing complexity, which may allow an attacker to recover passwords using known password… |
CVE-2020-13915 | High | 7.5 | 2020-07-28 | Insecure permissions in emfd/libemf in Ruckus Wireless Unleashed through 200.7.10.102.92 allow a remote attacker to overwrite admin credentials via an unauthen… |
CVE-2020-10609 | High | 7.5 | 2020-07-27 | Grundfos CIM 500 v06.16.00 stores plaintext credentials, which may allow sensitive information to be read or allow modification to system settings by someone w… |
CVE-2020-4408 | Medium | 4.6 | 2020-07-27 | The IBM QRadar Advisor 1.1 through 2.5.2 with Watson App for IBM QRadar SIEM does not adequately mask all passwords during input, which could be obtained by a… |
CVE-2020-4372 | High | 7.8 | 2020-07-22 | IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 179009 |
CVE-2020-4095 | Medium | 6.0 | 2020-07-16 | "BigFix Platform is storing clear text credentials within the system's memory. An attacker who is able to gain administrative privileges can use a program to c… |
CVE-2020-3180 | High | 7.8 | 2020-07-16 | A vulnerability in Cisco SD-WAN Solution Software could allow an unauthenticated, local attacker to access an affected device by using an account that has a de… |
CVE-2020-10287 | Critical | 9.8 | 2020-07-15 | The IRC5 family with UAS service enabled comes by default with credentials that can be found on publicly available manuals. ABB considers this a well documente… |
CVE-2020-2218 | Low | 3.3 | 2020-07-02 | Jenkins HP ALM Quality Center Plugin 1.6 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it can be viewe… |
CVE-2020-2213 | Medium | 4.3 | 2020-07-02 | Jenkins White Source Plugin 19.1.1 and earlier stores credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins maste… |
CVE-2020-2212 | Medium | 4.3 | 2020-07-02 | Jenkins GitHub Coverage Reporter Plugin 1.8 and earlier stores secrets unencrypted in its global configuration file on the Jenkins master where they can be vie… |
CVE-2020-2209 | Medium | 4.3 | 2020-07-02 | Jenkins TestComplete support Plugin 2.4.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by use… |
CVE-2020-2208 | Medium | 4.3 | 2020-07-02 | Jenkins Slack Upload Plugin 1.7 and earlier stores a secret unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Exte… |
CVE-2020-3391 | Medium | 6.5 | 2020-07-02 | A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an authenticated, remote attacker to view sensitive information in clear text. T… |
CVE-2020-5899 | High | 7.8 | 2020-07-01 | In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted and stored in the database in plain text, which allows an at… |
CVE-2019-18256 | Medium | 4.6 | 2020-06-29 | BIOTRONIK CardioMessenger II, The affected products use individual per-device credentials that are stored in a recoverable format. An attacker with physical ac… |
CVE-2020-10727 | Medium | 5.5 | 2020-06-26 | A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis… |
CVE-2020-14930 | High | 8.1 | 2020-06-19 | An issue was discovered in BT CTROMS Terminal OS Port Portal CT-464. Account takeover can occur because the password-reset feature discloses the verification t… |
CVE-2018-21248 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.4.0. It mishandles possession of superfluous authentication credentials. |
CVE-2020-0540 | High | 7.5 | 2020-06-15 | Insufficiently protected credentials in Intel(R) AMT versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow an unauthenticated user to potentially e… |
CVE-2020-10752 | High | 7.5 | 2020-06-12 | A flaw was found in the OpenShift API Server, where it failed to sufficiently protect OAuthTokens by leaking them into the logs when an API Server panic occurr… |
CVE-2020-10755 | Medium | 6.5 | 2020-06-10 | An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-c… |
CVE-2020-6239 | Medium | 4.4 | 2020-06-10 | Under certain conditions SAP Business One (Backup service), versions 9.3, 10.0, allows an attacker with admin permissions to view SYSTEM user password in clear… |
CVE-2020-11681 | High | 8.1 | 2020-06-04 | Castel NextGen DVR v1.0.0 stores and displays credentials for the associated SMTP server in cleartext. Low privileged users can exploit this to create an admin… |
CVE-2018-21239 | Medium | 5.3 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.2. It allows NTLM credential theft via a GoToE or GoToR action. |
CVE-2018-21237 | Medium | 5.3 | 2020-06-04 | An issue was discovered in Foxit PhantomPDF before 8.3.7. It allows NTLM credential theft via a GoToE or GoToR action. |
CVE-2020-7030 | Medium | 5.5 | 2020-06-04 | A sensitive information disclosure vulnerability was discovered in the web interface component of IP Office that may potentially allow a local user to gain una… |
CVE-2020-2198 | Medium | 6.5 | 2020-06-03 | Jenkins Project Inheritance Plugin 19.08.02 and earlier does not redact encrypted secrets in the 'getConfigAsXML' API URL when transmitting job config.xml data… |
CVE-2014-9702 | High | 7.5 | 2020-06-01 | system/classes/DbPDO.php in Cmfive through 2015-03-15, when database connectivity malfunctions, allows remote attackers to obtain sensitive information (userna… |
CVE-2014-8938 | High | 7.8 | 2020-06-01 | Lexiglot through 2014-11-20 allows local users to obtain sensitive information by listing a process because the username and password are on the command line. |
CVE-2019-13023 | Medium | 6.5 | 2020-05-14 | An issue was discovered in all versions of Bond JetSelect. Within the JetSelect Application, the web interface hides RADIUS secrets, WPA passwords, and SNMP st… |
CVE-2014-1423 | Medium | 5.9 | 2020-05-07 | signond before 8.57+15.04.20141127.1-0ubuntu1, as used in Ubuntu Touch, did not properly restrict applications from querying oath tokens due to incorrect check… |
CVE-2020-10972 | High | 7.5 | 2020-05-07 | An issue was discovered where a page is exposed that has the current administrator password in cleartext in the source code of the page. No authentication is r… |
CVE-2019-18868 | Critical | 9.8 | 2020-05-07 | Blaauw Remote Kiln Control through v3.00r4 allows an unauthenticated attacker to access MySQL credentials in cleartext in /engine/db.inc, /lang/nl.bak, or /lan… |
CVE-2020-2182 | Medium | 4.3 | 2020-05-06 | Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets containing a `$` character in some circumstances. |
CVE-2020-2181 | Medium | 6.5 | 2020-05-06 | Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets in the build log when the build contains no build step… |
CVE-2019-19218 | High | 7.5 | 2020-04-30 | BMC Control-M/Agent 7.0.00.000 has Insecure Password Storage. |
CVE-2020-11821 | Medium | 5.3 | 2020-04-27 | In Rukovoditel 2.5.2, users' passwords and usernames are stored in a cookie with URL encoding, base64 encoding, and hashing. Thus, an attacker can easily apply… |
CVE-2020-12273 | High | 7.5 | 2020-04-27 | In TestLink 1.9.20, a crafted login.php viewer parameter exposes cleartext credentials. |
CVE-2019-4668 | Medium | 5.5 | 2020-04-23 | IBM UrbanCode Deploy (UCD) 7.0.4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 171250. |
CVE-2019-19105 | Medium | 6.2 | 2020-04-22 | The backup function in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway saves the current settings and configuration of the application… |
CVE-2017-18777 | High | 7.8 | 2020-04-22 | Certain NETGEAR devices are affected by administrative password disclosure. This affects D6220 before V1.0.0.28, D6400 before V1.0.0.60, D8500 before V1.0.3.29… |
CVE-2020-11008 | Medium | 4.0 | 2020-04-21 | Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is simi… |
CVE-2017-18845 | High | 7.8 | 2020-04-20 | Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects R6700v2 before 1.1.0.38 and R6800 before 1.1.0.38. |
CVE-2017-18844 | High | 7.8 | 2020-04-20 | Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects R6700v2 before 1.1.0.38, R6800 before 1.1.0.38, and D7000 before… |
CVE-2017-18843 | High | 7.8 | 2020-04-20 | Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects R6700v2 before 1.1.0.38, R6800 before 1.1.0.38, and D7000 before… |
CVE-2020-9523 | High | 8.8 | 2020-04-17 | Insufficiently protected credentials vulnerability on Micro Focus enterprise developer and enterprise server, affecting all version prior to 4.0 Patch Update 1… |
CVE-2020-5721 | Medium | 5.5 | 2020-04-15 | MikroTik WinBox 3.22 and below stores the user's cleartext password in the settings.cfg.viw configuration file when the Keep Password field is set and no Maste… |
CVE-2020-5260 | Critical | 9.3 | 2020-04-14 | Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses externa… |
CVE-2020-6195 | Critical | 9.8 | 2020-04-14 | SAP Business Objects Business Intelligence Platform (CMC), version 4.1, 4.2, shows cleartext password in the response, leading to Information Disclosure. It in… |
CVE-2020-11694 | High | 7.5 | 2020-04-10 | In JetBrains PyCharm 2019.2.5 and 2019.3 on Windows, Apple Notarization Service credentials were included. This is fixed in 2019.2.6 and 2019.3.3. |
CVE-2020-5406 | Medium | 6.5 | 2020-04-10 | VMware Tanzu Application Service for VMs, 2.6.x versions prior to 2.6.18, 2.7.x versions prior to 2.7.11, and 2.8.x versions prior to 2.8.5, includes a version… |
CVE-2020-5263 | Medium | 5.5 | 2020-04-09 | auth0.js (NPM package auth0-js) greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an (authentication) error, the error o… |
CVE-2020-11557 | High | 7.5 | 2020-04-09 | An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. It includes the username and password values in cleartext within each request's… |
CVE-2020-11555 | High | 7.5 | 2020-04-09 | An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. It allows remote attackers to obtain sensitive credential information from back… |
CVE-2020-1978 | Medium | 5.8 | 2020-04-08 | TechSupport files generated on Palo Alto Networks VM Series firewalls for Microsoft Azure platform configured with high availability (HA) inadvertently collect… |
CVE-2020-11629 | High | 7.2 | 2020-04-08 | An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. The External Command Certificate Validator, which allows administrators to upload exte… |
CVE-2020-11560 | High | 7.8 | 2020-04-07 | NCH Express Invoice 7.25 allows local users to discover the cleartext password by reading the configuration file. |
CVE-2017-18695 | Medium | 6.5 | 2020-04-07 | An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.0) software. Attackers (who control a certain subdomain) can discov… |
CVE-2016-11029 | High | 7.5 | 2020-04-07 | An issue was discovered on Samsung mobile devices with L(5.0/5.1), M(6.0), and N(7.0) software. Attackers can read the password of the Mobile Hotspot in the lo… |
CVE-2019-19096 | Medium | 6.1 | 2020-04-02 | The Redis data structure component used in ABB eSOMS versions 6.0 to 6.0.2 stores credentials in clear text. If an attacker has file system access, this can po… |
CVE-2019-3942 | High | 7.5 | 2020-04-01 | Advantech WebAccess 8.3.4 does not properly restrict an RPC call that allows unauthenticated, remote users to read files. An attacker can use this vulnerabilit… |
CVE-2020-11449 | High | 7.5 | 2020-04-01 | An issue was discovered on Technicolor TC7337 8.89.17 devices. An attacker can discover admin credentials in the backup file, aka backupsettings.conf. |
CVE-2020-2165 | High | 7.5 | 2020-03-25 | Jenkins Artifactory Plugin 3.6.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulti… |
CVE-2020-2164 | Medium | 6.5 | 2020-03-25 | Jenkins Artifactory Plugin 3.5.0 and earlier stores its Artifactory server password unencrypted in its global configuration file on the Jenkins master where it… |
CVE-2019-18785 | High | 7.5 | 2020-03-20 | SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 mishandles API access tokens and credentials. |
CVE-2019-16067 | High | 7.5 | 2020-03-19 | NETSAS Enigma NMS 65.0.0 and prior utilises basic authentication over HTTP for enforcing access control to the web application. The use of weak authentication… |
CVE-2019-15656 | High | 7.5 | 2020-03-19 | D-Link DSL-2875AL and DSL-2877AL devices through 1.00.05 are prone to information disclosure via a simple crafted request to index.asp on the web management se… |
CVE-2019-15655 | High | 7.5 | 2020-03-19 | D-Link DSL-2875AL devices through 1.00.05 are prone to password disclosure via a simple crafted /romfile.cfg request to the web management server. This request… |
CVE-2019-15653 | High | 7.5 | 2020-03-19 | Comba AP2600-I devices through A02,0202N00PD2 are prone to password disclosure via an insecure authentication mechanism. The HTML source code of the login page… |
CVE-2020-9324 | High | 7.5 | 2020-03-18 | Aquaforest TIFF Server 4.0 allows Unauthenticated SMB Hash Capture via UNC. |
CVE-2019-13394 | Critical | 9.8 | 2020-03-13 | The Voo branded NETGEAR CG3700b custom firmware V2.02.03 uses HTTP Basic Authentication over cleartext HTTP. |
CVE-2019-5648 | Medium | 6.5 | 2020-03-12 | Authenticated, administrative access to a Barracuda Load Balancer ADC running unpatched firmware <= v6.4 allows one to edit the LDAP service configuration of t… |
CVE-2019-9104 | High | 7.5 | 2020-03-11 | An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices… |
CVE-2019-10705 | High | 7.5 | 2020-03-10 | Western Digital SanDisk X600 devices in certain configurations, a vulnerability in the access control mechanism of the drive may allow data to be decrypted wit… |
CVE-2019-11686 | Medium | 5.5 | 2020-03-10 | Western Digital SanDisk X300, X300s, X400, and X600 devices: A vulnerability in the wear-leveling algorithm of the drive may cause cryptographically sensitive… |