CWE-522 · Insufficiently Protected Credentials (page 11)
Page 11 of 15 — CVEs classified under CWE-522, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-10706 | Medium | 6.3 | 2020-03-10 | Western Digital SanDisk SanDisk X300, X300s, X400, and X600 devices: The firmware update authentication method relies on a symmetric HMAC digest. The key used… |
CVE-2020-2145 | Medium | 5.5 | 2020-03-09 | Jenkins Zephyr Enterprise Test Management Plugin 1.9.1 and earlier stores its Zephyr password in plain text on the Jenkins master file system. |
CVE-2020-5404 | Medium | 5.9 | 2020-03-03 | The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak du… |
CVE-2020-6794 | Medium | 6.5 | 2020-03-02 | If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is becau… |
CVE-2020-3841 | Medium | 6.5 | 2020-02-27 | The issue was addressed with improved UI handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, Safari 13.0.5. A local user may unknowingly send a pass… |
CVE-2020-5400 | Medium | 6.5 | 2020-02-27 | Cloud Foundry Cloud Controller (CAPI), versions prior to 1.91.0, logs properties of background jobs when they are run, which may include sensitive information… |
CVE-2014-4659 | Medium | 5.5 | 2020-02-20 | Ansible before 1.5.5 sets 0644 permissions for sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumst… |
CVE-2014-4660 | Medium | 5.5 | 2020-02-20 | Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtai… |
CVE-2020-2133 | Medium | 6.5 | 2020-02-12 | Jenkins Applatix Plugin 1.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extend… |
CVE-2020-2132 | Medium | 6.5 | 2020-02-12 | Jenkins Parasoft Environment Manager Plugin 2.14 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed… |
CVE-2020-2131 | Medium | 6.5 | 2020-02-12 | Jenkins Harvest SCM Plugin 0.5.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with… |
CVE-2020-2130 | Medium | 6.5 | 2020-02-12 | Jenkins Harvest SCM Plugin 0.5.1 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it can be viewed by use… |
CVE-2020-2129 | Medium | 6.5 | 2020-02-12 | Jenkins Eagle Tester Plugin 1.0.9 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it can be viewed by us… |
CVE-2020-2128 | Medium | 4.3 | 2020-02-12 | Jenkins ECX Copy Data Management Plugin 1.9 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by u… |
CVE-2020-2127 | Medium | 4.3 | 2020-02-12 | Jenkins BMC Release Package and Deployment Plugin 1.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where t… |
CVE-2020-2126 | Medium | 4.3 | 2020-02-12 | Jenkins DigitalOcean Plugin 1.1 and earlier stores a token unencrypted in the global config.xml file on the Jenkins master where it can be viewed by users with… |
CVE-2020-2125 | Medium | 4.3 | 2020-02-12 | Jenkins Debian Package Builder Plugin 1.6.11 and earlier stores a GPG passphrase unencrypted in its global configuration file on the Jenkins master where it ca… |
CVE-2020-2124 | Medium | 4.3 | 2020-02-12 | Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be… |
CVE-2020-2119 | Medium | 5.3 | 2020-02-12 | Jenkins Azure AD Plugin 1.1.2 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resultin… |
CVE-2020-2114 | High | 7.5 | 2020-02-12 | Jenkins S3 publisher Plugin 0.11.4 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially res… |
CVE-2020-6969 | Critical | 9.8 | 2020-02-05 | It is possible to unmask credentials and other sensitive information on “unprotected” project files, which may allow an attacker to remotely access the C-More… |
CVE-2013-7055 | Critical | 9.8 | 2020-02-04 | D-Link DIR-100 4.03B07 has PPTP and poe information disclosure |
CVE-2013-7052 | Critical | 9.8 | 2020-02-04 | D-Link DIR-100 4.03B07: security bypass via an error in the cliget.cgi script |
CVE-2013-2672 | High | 7.5 | 2020-02-03 | Brother MFC-9970CDW devices with firmware 0D allow cleartext submission of passwords. |
CVE-2019-19119 | Medium | 5.5 | 2020-02-03 | An issue was discovered in PRTG 7.x through 19.4.53. Due to insufficient access control on local registry keys for the Core Server Service, a non-administrativ… |
CVE-2013-5113 | Medium | 6.8 | 2020-01-31 | LastPass prior to 2.5.1 has an insecure PIN implementation. |
CVE-2020-7909 | High | 7.5 | 2020-01-30 | In JetBrains TeamCity before 2019.1.5, some server-stored passwords could be shown via the web UI. |
CVE-2020-2107 | Medium | 4.3 | 2020-01-29 | Jenkins Fortify Plugin 19.1.29 and earlier stores proxy server passwords unencrypted in job config.xml files on the Jenkins master where they can be viewed by… |
CVE-2014-3445 | Critical | 9.8 | 2020-01-28 | backup.php in HandsomeWeb SOS Webpages before 1.1.12 does not require knowledge of the cleartext password, which allows remote attackers to bypass authenticati… |
CVE-2014-2581 | High | 7.5 | 2020-01-28 | Smb4K before 1.1.1 allows remote attackers to obtain credentials via vectors related to the cuid option in the "Additional options" line edit. |
CVE-2019-19539 | Medium | 5.5 | 2020-01-27 | An issue was discovered in Idelji Web ViewPoint H01ABO-H01BY and L01ABP-L01ABZ, Web ViewPoint Plus H01AAG-H01AAQ and L01AAH-L01AAR, and Web ViewPoint Enterpris… |
CVE-2019-19823 | High | 7.5 | 2020-01-27 | A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) stores cleartext administrative passwords in flash memory and… |
CVE-2020-6961 | Critical | 10.0 | 2020-01-24 | In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE… |
CVE-2012-6663 | High | 7.5 | 2020-01-23 | General Electric D20ME devices are not properly configured and reveal plaintext passwords. |
CVE-2019-19898 | High | 7.5 | 2020-01-23 | In IXP EasyInstall 6.2.13723, there are cleartext credentials in network communication on TCP port 20050 when using the Administrator console remotely. |
CVE-2019-19843 | Critical | 9.8 | 2020-01-22 | Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote credential fetch via an unauthenticated HTTP r… |
CVE-2020-7233 | Critical | 9.8 | 2020-01-19 | KMS Controls BAC-A1616BC BACnet devices have a cleartext password of snowman in the BACKDOOR_NAME variable in the BC_Logon.swf file. |
CVE-2019-19696 | Medium | 5.5 | 2020-01-18 | A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by… |
CVE-2019-12423 | High | 7.5 | 2020-01-16 | Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the si… |
CVE-2020-2095 | Medium | 4.3 | 2020-01-15 | Jenkins Redgate SQL Change Automation Plugin 2.0.4 and earlier stored an API key unencrypted in job config.xml files on the Jenkins master where they could be… |
CVE-2014-6039 | High | 7.5 | 2020-01-13 | ManageEngine EventLog Analyzer version 7 through 9.9 build 9002 has a Credentials Disclosure Vulnerability. Fixed version 10 Build 10000. |
CVE-2014-5381 | Critical | 9.8 | 2020-01-13 | Grand MA 300 allows a brute-force attack on the PIN. |
CVE-2012-3823 | High | 7.5 | 2020-01-10 | Arial Campaign Enterprise before 11.0.551 stores passwords in clear text and these may be retrieved. |
CVE-2019-4508 | High | 7.8 | 2020-01-10 | IBM QRadar SIEM 7.3.0 through 7.3.3 uses weak credential storage in some instances which could be decrypted by a local attacker. IBM X-Force ID: 164429. |
CVE-2014-5093 | Critical | 9.8 | 2020-01-10 | Status2k does not remove the install directory allowing credential reset. |
CVE-2019-6700 | Medium | 6.5 | 2020-01-07 | An information exposure vulnerability in the external authentication profile form of FortiSIEM 5.2.2 and earlier may allow an authenticated attacker to retriev… |
CVE-2019-5990 | High | 7.5 | 2020-01-06 | Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allow remote attackers to obtain a login password via HTTP referer. |
CVE-2019-19310 | Medium | 4.9 | 2020-01-03 | GitLab Enterprise Edition (EE) 9.0 and later through 12.5 allows Information Disclosure. |
CVE-2013-3620 | High | 7.5 | 2020-01-02 | Hardcoded WSMan credentials in Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before 3.15 (SMT_X9_315… |
CVE-2019-10205 | Medium | 6.3 | 2020-01-02 | A flaw was found in the way Red Hat Quay stores robot account tokens in plain text. An attacker able to perform database queries in the Red Hat Quay database c… |
CVE-2019-4335 | Medium | 5.5 | 2019-12-30 | IBM Watson Studio Local 1.2.3 stores key files in the user's home directory which could be obtained by another local user. IBM X-Force ID: 161413. |
CVE-2019-20047 | High | 7.5 | 2019-12-27 | An issue was discovered on Alcatel-Lucent OmniVista 4760 devices, and 8770 devices before 4.1.2. An incorrect web server configuration allows a remote unauthen… |
CVE-2019-6024 | Medium | 6.5 | 2019-12-26 | Rakuma App for Android version 7.15.0 and earlier, and for iOS version 7.16.4 and earlier allows an attacker to bypass authentication and obtain the user's aut… |
CVE-2019-3431 | Critical | 9.8 | 2019-12-23 | All versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have encryption problems vulnerability. Attackers could sniff unencrypted account and pass… |
CVE-2019-18615 | Medium | 4.9 | 2019-12-19 | In CloudVision Portal (CVP) for all releases in the 2018.2 Train, under certain conditions, the application logs user passwords in plain text for certain API c… |
CVE-2019-18572 | Critical | 9.8 | 2019-12-18 | The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain an Improper Authentication vulnerability. A… |
CVE-2019-19890 | High | 7.5 | 2019-12-18 | An issue was discovered on Humax Wireless Voice Gateway HGB10R-2 20160817_1855 devices. Admin credentials are sent over cleartext HTTP. |
CVE-2019-16572 | Medium | 5.5 | 2019-12-17 | Jenkins Weibo Plugin 1.0.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users… |
CVE-2019-16557 | Medium | 6.5 | 2019-12-17 | Jenkins Redgate SQL Change Automation Plugin 2.0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be v… |
CVE-2019-16556 | Medium | 6.5 | 2019-12-17 | Jenkins Rundeck Plugin 3.6.5 and earlier stores credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins master wher… |
CVE-2014-0241 | Medium | 5.5 | 2019-12-13 | rubygem-hammer_cli_foreman: File /etc/hammer/cli.modules.d/foreman.yml world readable |
CVE-2019-19687 | High | 8.8 | 2019-12-09 | OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials… |
CVE-2019-16673 | Medium | 6.5 | 2019-12-06 | An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Pass… |
CVE-2019-16672 | Critical | 9.8 | 2019-12-06 | An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Sens… |
CVE-2013-2106 | High | 7.5 | 2019-12-03 | webauth before 4.6.1 has authentication credential disclosure |
CVE-2019-10224 | Medium | 4.6 | 2019-11-25 | A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and dsconf commands may display sensitive inf… |
CVE-2012-5527 | Medium | 5.5 | 2019-11-25 | Claws Mail vCalendar plugin: credentials exposed on interface |
CVE-2019-10214 | Medium | 5.9 | 2019-11-25 | The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Pla… |
CVE-2019-10206 | Medium | 6.5 | 2019-11-22 | ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding… |
CVE-2013-3313 | High | 7.5 | 2019-11-21 | The Loftek Nexus 543 IP Camera stores passwords in cleartext, which allows remote attackers to obtain sensitive information via an HTTP GET request to check_us… |
CVE-2019-16544 | High | 8.8 | 2019-11-21 | Jenkins QMetry for JIRA - Test Management Plugin 1.12 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can b… |
CVE-2019-16543 | Medium | 5.5 | 2019-11-21 | Jenkins Spira Importer Plugin 3.2.2 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed… |
CVE-2019-16542 | Medium | 6.5 | 2019-11-21 | Jenkins Anchore Container Image Scanner Plugin 1.0.19 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can b… |
CVE-2018-21031 | Medium | 6.5 | 2019-11-18 | Tautulli versions 2.1.38 and below allows remote attackers to bypass intended access control in Plex Media Server because the X-Plex-Token is mishandled and ca… |
CVE-2019-3663 | Critical | 9.8 | 2019-11-14 | Unprotected Storage of Credentials vulnerability in McAfee Advanced Threat Defense (ATD) prior to 4.8 allows local attacker to gain access to the root password… |
CVE-2019-1384 | Critical | 9.9 | 2019-11-12 | A security feature bypass vulnerability exists where a NETLOGON message is able to obtain the session key and sign messages.To exploit this vulnerability, an a… |
CVE-2010-4178 | Medium | 5.5 | 2019-11-06 | MySQL-GUI-tools (mysql-administrator) leaks passwords into process list after with launch of mysql text console |
CVE-2016-4401 | Critical | 9.8 | 2019-11-06 | Aruba ClearPass Policy Manager before 6.5.7 and 6.6.x before 6.6.2 allows attackers to obtain database credentials. |
CVE-2013-4423 | Medium | 5.5 | 2019-11-04 | CloudForms stores user passwords in recoverable format |
CVE-2019-10210 | High | 7.0 | 2019-10-29 | Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via superuser writing password to unprotected temporary file. |
CVE-2019-4307 | Medium | 5.5 | 2019-10-29 | IBM Security Guardium Big Data Intelligence (SonarG) 4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 1609… |
CVE-2019-14929 | Critical | 9.8 | 2019-10-28 | An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Stored cleartext passwords could al… |
CVE-2019-10476 | High | 7.8 | 2019-10-23 | Jenkins Zulip Plugin 1.1.0 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by user… |
CVE-2019-10467 | Medium | 6.5 | 2019-10-23 | Jenkins Sonar Gerrit Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read p… |
CVE-2019-10461 | High | 7.8 | 2019-10-23 | Jenkins Dynatrace Application Monitoring Plugin 2.1.3 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where t… |
CVE-2019-10460 | High | 7.8 | 2019-10-23 | Jenkins Bitbucket OAuth Plugin 0.9 and earlier stored credentials unencrypted in the global config.xml configuration file on the Jenkins master where they coul… |
CVE-2019-10459 | Medium | 6.5 | 2019-10-23 | Jenkins Mattermost Notification Plugin 2.7.0 and earlier stored webhook URLs containing a secret token unencrypted in its global configuration file and job con… |
CVE-2019-17393 | Critical | 9.8 | 2019-10-18 | The Customer's Tomedo Server in Version 1.7.3 communicates to the Vendor Tomedo Server via HTTP (in cleartext) that can be sniffed by unauthorized actors. Basi… |
CVE-2019-11284 | High | 8.6 | 2019-10-17 | Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may ga… |
CVE-2019-17662 | Critical | 9.8 | 2019-10-16 | ThinVNC 1.0b1 is vulnerable to arbitrary file read, which leads to a compromise of the VNC server. The vulnerability exists even when authentication is turned… |
CVE-2019-10448 | High | 8.8 | 2019-10-16 | Jenkins Extensive Testing Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended R… |
CVE-2019-17356 | Medium | 6.5 | 2019-10-15 | The Infinite Design application 3.4.12 for Android sends a username and password via TCP without any encryption during login, as demonstrated by sniffing of a… |
CVE-2019-17497 | Medium | 6.5 | 2019-10-11 | Tracker PDF-XChange Editor before 8.0.330.0 has an NTLM SSO hash theft vulnerability using crafted FDF or XFDF files (a related issue to CVE-2018-4993). For ex… |
CVE-2019-9533 | Critical | 9.8 | 2019-10-10 | The root password of the Cobham EXPLORER 710 is the same for all versions of firmware up to and including v1.08. This could allow an attacker to reverse-engine… |
CVE-2019-0072 | Medium | 5.6 | 2019-10-09 | An Unprotected Storage of Credentials vulnerability in the identity and access management certificate generation procedure allows a local attacker to gain acce… |
CVE-2019-10429 | Medium | 5.5 | 2019-09-25 | Jenkins GitLab Logo Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access… |
CVE-2019-10426 | Medium | 5.5 | 2019-09-25 | Jenkins Gem Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with acces… |
CVE-2019-10425 | Medium | 6.5 | 2019-09-25 | Jenkins Google Calendar Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Rea… |
CVE-2019-10424 | Medium | 5.5 | 2019-09-25 | Jenkins elOyente Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to… |
CVE-2019-10423 | Medium | 5.5 | 2019-09-25 | Jenkins CodeScan Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to… |