CWE-522 · Insufficiently Protected Credentials (page 12)
Page 12 of 15 — CVEs classified under CWE-522, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-10422 | Medium | 6.5 | 2019-09-25 | Jenkins Call Remote Job Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Rea… |
CVE-2019-10421 | Medium | 4.3 | 2019-09-25 | Jenkins Azure Event Grid Build Notifier Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users w… |
CVE-2019-10420 | Medium | 5.5 | 2019-09-25 | Jenkins Assembla Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to… |
CVE-2019-10419 | Medium | 5.5 | 2019-09-25 | Jenkins vFabric Application Director Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by u… |
CVE-2019-10416 | Medium | 6.5 | 2019-09-25 | Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be v… |
CVE-2019-10415 | Medium | 6.5 | 2019-09-25 | Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they c… |
CVE-2019-10414 | Medium | 6.5 | 2019-09-25 | Jenkins Git Changelog Plugin 2.17 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users… |
CVE-2019-10413 | Medium | 6.5 | 2019-09-25 | Jenkins Data Theorem: CI/CD Plugin 1.3 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by u… |
CVE-2019-5505 | Critical | 9.8 | 2019-09-24 | ONTAP Select Deploy administration utility versions 2.2 through 2.12.1 transmit credentials in plaintext. |
CVE-2019-15635 | Medium | 4.9 | 2019-09-23 | An issue was discovered in Grafana 5.4.0. Passwords for data sources used by Grafana (e.g., MySQL) are not encrypted. An admin user can reveal passwords for an… |
CVE-2019-16649 | Critical | 10.0 | 2019-09-21 | On Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and authentication problems in the virtual media service allows capture of… |
CVE-2019-11664 | Medium | 6.5 | 2019-09-18 | Clear text password in browser in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9… |
CVE-2019-11663 | Medium | 6.5 | 2019-09-18 | Clear text credentials are used to access managers app in Tomcat in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41… |
CVE-2019-5534 | High | 7.7 | 2019-09-18 | VMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j) contains an information disclosure vulnerability where Virtual Mach… |
CVE-2018-7820 | Critical | 9.8 | 2019-09-17 | A Credentials Management CWE-255 vulnerability exists in the APC UPS Network Management Card 2 AOS v6.5.6, which could cause Remote Monitoring Credentials to b… |
CVE-2019-10398 | Medium | 5.5 | 2019-09-12 | Jenkins Beaker Builder Plugin 1.9 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed… |
CVE-2019-11769 | High | 7.8 | 2019-09-11 | An issue was discovered in TeamViewer 14.2.2558. Updating the product as a non-administrative user requires entering administrative credentials into the GUI. S… |
CVE-2019-13349 | Medium | 4.9 | 2019-09-05 | In Knowage through 6.1.1, an authenticated user that accesses the users page will obtain all user password hashes. |
CVE-2019-13348 | High | 8.8 | 2019-08-28 | In Knowage through 6.1.1, an authenticated user who accesses the datasources page will gain access to any data source credentials in cleartext, which includes… |
CVE-2019-13421 | Medium | 4.9 | 2019-08-23 | Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes of other users configured in the internal… |
CVE-2019-10960 | High | 7.5 | 2019-08-20 | Zebra Industrial Printers All Versions, Zebra printers are shipped with unrestricted end-user access to front panel options. If the option to use a passcode to… |
CVE-2019-3753 | Medium | 6.5 | 2019-08-20 | Dell EMC PowerConnect 8024, 7000, M6348, M6220, M8024 and M8024-K running firmware versions prior to 5.1.15.2 contain a plain-text password storage vulnerabili… |
CVE-2019-15052 | Critical | 9.8 | 2019-08-14 | The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle… |
CVE-2019-10385 | Medium | 6.5 | 2019-08-07 | Jenkins eggPlant Plugin 2.2 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Ext… |
CVE-2019-10379 | Medium | 6.5 | 2019-08-07 | Jenkins Google Cloud Messaging Notification Plugin 1.0 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where… |
CVE-2019-10378 | Medium | 5.3 | 2019-08-07 | Jenkins TestLink Plugin 3.16 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by user… |
CVE-2019-14709 | Critical | 9.8 | 2019-08-06 | A cleartext password storage issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. The file in question is /usr/local/ipsca/m… |
CVE-2019-3800 | Medium | 6.3 | 2019-08-05 | CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-cred… |
CVE-2019-10366 | Medium | 6.5 | 2019-07-31 | Jenkins Skytap Cloud CI Plugin 2.06 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by user… |
CVE-2019-10361 | Medium | 5.5 | 2019-07-31 | Jenkins Maven Release Plugin 0.14.0 and earlier stored credentials unencrypted on the Jenkins master where they could be viewed by users with access to the mas… |
CVE-2019-10345 | Medium | 5.5 | 2019-07-31 | Jenkins Configuration as Code Plugin 1.20 and earlier did not treat the proxy password as a secret to be masked when logging or encrypted for export. |
CVE-2019-1020009 | High | 7.5 | 2019-07-29 | Fleet before 2.1.2 allows exposure of SMTP credentials. |
CVE-2019-1010241 | Medium | 6.5 | 2019-07-19 | Jenkins Credentials Binding Plugin Jenkins 1.17 is affected by: CWE-257: Storing Passwords in a Recoverable Format. The impact is: Authenticated users can reco… |
CVE-2019-8932 | High | 7.5 | 2019-07-17 | Redbrick Shift through 3.4.3 allows an attacker to extract authentication tokens of services (such as Gmail, Outlook, etc.) used in the application. |
CVE-2019-1010308 | Critical | 9.8 | 2019-07-15 | Aquaverde GmbH Aquarius CMS prior to version 4.1.1 is affected by: Incorrect Access Control. The impact is: The access to the log file is not restricted. It co… |
CVE-2019-9657 | High | 7.8 | 2019-07-11 | Alarm.com ADC-V522IR 0100b9 devices have Incorrect Access Control, a different issue than CVE-2018-19588. This occurs because of incorrect protection of VPN ce… |
CVE-2019-10347 | High | 8.8 | 2019-07-11 | Jenkins Mashup Portlets Plugin stored credentials unencrypted on the Jenkins master where they can be viewed by users with access to the master file system. |
CVE-2019-12171 | High | 7.8 | 2019-07-08 | Dropbox.exe (and QtWebEngineProcess.exe in the Web Helper) in the Dropbox desktop application 71.4.108.0 store cleartext credentials in memory upon successful… |
CVE-2019-13400 | Critical | 9.8 | 2019-07-08 | Dynacolor FCM-MB40 v1.2.0.0 use /etc/appWeb/appweb.pass to store administrative web-interface credentials in cleartext. These credentials can be retrieved via… |
CVE-2019-9873 | Critical | 9.8 | 2019-07-03 | In several versions of JetBrains IntelliJ IDEA Ultimate, creating Task Servers configurations leads to saving a cleartext unencrypted record of the server cred… |
CVE-2019-9872 | High | 8.1 | 2019-07-03 | In several versions of JetBrains IntelliJ IDEA Ultimate, creating run configurations for cloud application servers leads to saving a cleartext unencrypted reco… |
CVE-2019-9823 | Critical | 9.8 | 2019-07-03 | In several JetBrains IntelliJ IDEA versions, creating remote run configurations of JavaEE application servers leads to saving a cleartext record of the server… |
CVE-2019-12847 | High | 7.2 | 2019-07-03 | In JetBrains Hub versions earlier than 2018.4.11298, the audit events for SMTPSettings show a cleartext password to the admin user. It is only relevant in case… |
CVE-2019-13179 | High | 7.5 | 2019-07-02 | Calamares versions 3.1 through 3.2.10 copies a LUKS encryption keyfile from /crypto_keyfile.bin (mode 0600 owned by root) to /boot within a globally readable i… |
CVE-2019-7260 | Critical | 9.8 | 2019-07-02 | Linear eMerge E3-Series devices have Cleartext Credentials in a Database. |
CVE-2019-7271 | Critical | 9.8 | 2019-07-01 | Nortek Linear eMerge 50P/5000P devices have Default Credentials. |
CVE-2019-13054 | Medium | 6.5 | 2019-06-29 | The Logitech R500 presentation clicker allows attackers to determine the AES key, leading to keystroke injection. On Windows, any text may be injected by using… |
CVE-2019-11272 | High | 7.3 | 2019-06-26 | Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application usi… |
CVE-2019-4385 | Medium | 6.5 | 2019-06-19 | IBM Spectrum Protect Plus 10.1.2 may display the vSnap CIFS password in the IBM Spectrum Protect Plus Joblog. This can result in an attacker gaining access to… |
CVE-2019-11271 | High | 7.8 | 2019-06-19 | Cloud Foundry BOSH 270.x versions prior to v270.1.1, contain a BOSH Director that does not properly redact credentials when configured to use a MySQL database… |
CVE-2019-4239 | Medium | 5.5 | 2019-06-14 | IBM MQ Advanced Cloud Pak (IBM Cloud Private 1.0.0 through 3.0.1) stores user credentials in plain in clear text which can be read by a local user. IBM X-Force… |
CVE-2019-11092 | Medium | 4.4 | 2019-06-13 | Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via loca… |
CVE-2019-0183 | Low | 3.3 | 2019-06-13 | Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via loca… |
CVE-2019-0182 | Low | 3.3 | 2019-06-13 | Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via loca… |
CVE-2019-0180 | Medium | 4.4 | 2019-06-13 | Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via loca… |
CVE-2019-0179 | Medium | 4.4 | 2019-06-13 | Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via loca… |
CVE-2019-0178 | Low | 3.6 | 2019-06-13 | Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via loca… |
CVE-2019-0175 | Medium | 4.4 | 2019-06-13 | Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via loca… |
CVE-2019-3947 | Critical | 9.8 | 2019-06-12 | Fuji Electric V-Server before 6.0.33.0 stores database credentials in project files as plaintext. An attacker that can gain access to the project file can reco… |
CVE-2019-6567 | Medium | 5.5 | 2019-06-12 | A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All Versions < V5.2.4), SCALANCE X-200IRT switch family (incl… |
CVE-2019-10160 | Critical | 9.8 | 2019-06-07 | A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and… |
CVE-2019-6452 | High | 8.8 | 2019-06-06 | Kyocera Command Center RX TASKalfa4501i and TASKalfa5052ci allows remote attackers to abuse the Test button in the machine address book to obtain a cleartext F… |
CVE-2019-11367 | Critical | 9.8 | 2019-06-03 | An issue was discovered in AUO Solar Data Recorder before 1.3.0. The web portal uses HTTP Basic Authentication and provides the account and password in the WWW… |
CVE-2019-11369 | High | 8.8 | 2019-06-03 | An issue was discovered in Carel pCOWeb prior to B1.2.4. In /config/pw_changeusers.html the device stores cleartext passwords, which may allow sensitive inform… |
CVE-2019-10981 | High | 7.8 | 2019-05-31 | In Vijeo Citect 7.30 and 7.40, and CitectSCADA 7.30 and 7.40, a vulnerability has been identified that may allow an authenticated local user access to Citect u… |
CVE-2019-10329 | High | 8.8 | 2019-05-31 | Jenkins InfluxDB Plugin 1.21 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by user… |
CVE-2019-12452 | High | 7.5 | 2019-05-29 | types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable and exposed without sufficient access… |
CVE-2019-4138 | Medium | 5.9 | 2019-05-29 | IBM Tivoli Storage Productivity Center 5.2.13 through 5.3.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly… |
CVE-2019-5627 | High | 7.8 | 2019-05-22 | The iOS mobile application BlueCats Reveal before 5.14 stores the username and password in the app cache as base64 encoded strings, i.e. clear text. These pers… |
CVE-2019-5626 | High | 7.8 | 2019-05-22 | The Android mobile application BlueCats Reveal before 3.0.19 stores the username and password in a clear text file. This file persists until the user logs out… |
CVE-2019-5625 | High | 7.1 | 2019-05-22 | The Android mobile application Halo Home before 1.11.0 stores OAuth authentication and refresh access tokens in a clear text file. This file persists until the… |
CVE-2019-12046 | Critical | 9.8 | 2019-05-22 | LemonLDAP::NG -2.0.3 has Incorrect Access Control. |
CVE-2019-10139 | High | 7.8 | 2019-05-17 | During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file `/var/lib/ovirt-hosted-engine-setup/cockpit/ansibleVarFileXXXXXX.var`… |
CVE-2019-0120 | Medium | 4.4 | 2019-05-17 | Insufficient key protection vulnerability in silicon reference firmware for Intel(R) Pentium(R) Processor J Series, Intel(R) Pentium(R) Processor N Series, Int… |
CVE-2019-0881 | High | 7.8 | 2019-05-16 | An elevation of privilege vulnerability exists when the Windows Kernel improperly handles key enumeration, aka 'Windows Kernel Elevation of Privilege Vulnerabi… |
CVE-2019-10921 | High | 7.5 | 2019-05-14 | A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Unencrypted storage of passwords in the project could allow an… |
CVE-2019-8350 | Medium | 6.6 | 2019-05-13 | The Simple - Better Banking application 2.45.0 through 2.45.3 (fixed in 2.46.0) for Android was affected by an information disclosure vulnerability that leaked… |
CVE-2019-11885 | Medium | 6.8 | 2019-05-12 | eyeDisk implements the unlock feature by sending a cleartext password. The password can be discovered by sniffing USB traffic or by sending a 06 05 52 41 01 b0… |
CVE-2019-11820 | Medium | 5.5 | 2019-05-09 | Information exposure through process environment vulnerability in Synology Calendar before 2.3.3-0620 allows local users to obtain credentials via cmdline. |
CVE-2019-3938 | High | 7.8 | 2019-04-30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 stores usernames, passwords, and other configuration options in the file generated via t… |
CVE-2019-10318 | High | 8.8 | 2019-04-30 | Jenkins Azure AD Plugin 0.3.3 and earlier stored the client secret unencrypted in the global config.xml configuration file on the Jenkins master where it could… |
CVE-2019-10316 | High | 8.8 | 2019-04-30 | Jenkins Aqua MicroScanner Plugin 1.0.5 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be vi… |
CVE-2019-10313 | High | 8.8 | 2019-04-30 | Jenkins Twitter Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to t… |
CVE-2019-10239 | High | 7.8 | 2019-04-24 | Robotronic RunAsSpc 3.7.0.0 protects stored credentials insufficiently, which allows locally authenticated attackers (under the same user context) to obtain cl… |
CVE-2019-11402 | Critical | 9.8 | 2019-04-22 | In Gradle Enterprise before 2018.5.3, Build Cache Nodes did not store the credentials at rest in an encrypted format. |
CVE-2019-11350 | Critical | 9.8 | 2019-04-19 | CloudBees Jenkins Operations Center 2.150.2.3, when an expired trial license exists, allows Cleartext Password Storage and Retrieval via the proxy configuratio… |
CVE-2019-10303 | High | 8.8 | 2019-04-18 | Jenkins Azure PublisherSettings Credentials Plugin 1.2 and earlier stored credentials unencrypted in the credentials.xml file on the Jenkins master where they… |
CVE-2019-10302 | High | 8.8 | 2019-04-18 | Jenkins jira-ext Plugin 0.8 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by use… |
CVE-2019-6609 | Critical | 9.8 | 2019-04-15 | Platform dependent weakness. This issue only impacts iSeries platforms. On these platforms, in BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, F… |
CVE-2019-6525 | High | 8.8 | 2019-04-11 | AVEVA Wonderware System Platform 2017 Update 2 and prior uses an ArchestrA network user account for authentication of system processes and inter-node communica… |
CVE-2019-0035 | Medium | 6.8 | 2019-04-10 | When "set system ports console insecure" is enabled, root login is disallowed for Junos OS as expected. However, the root password can be changed using "set sy… |
CVE-2019-0032 | High | 7.8 | 2019-04-10 | A password management issue exists where the Organization authentication username and password were stored in plaintext in log files. A locally authenticated a… |
CVE-2019-5615 | Medium | 6.5 | 2019-04-09 | Users with Site-level permissions can access files containing the username-encrypted passwords of Security Console Global Administrators and clear-text passwor… |
CVE-2019-10630 | High | 8.8 | 2019-04-09 | A plaintext password vulnerability in the Zyxel NAS 326 through 5.21 allows an elevated privileged user to get the admin password of the device. |
CVE-2019-10299 | High | 8.8 | 2019-04-04 | Jenkins CloudCoreo DeployTime Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users wi… |
CVE-2019-10298 | High | 8.8 | 2019-04-04 | Jenkins Koji Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the… |
CVE-2019-10297 | High | 8.8 | 2019-04-04 | Jenkins Sametime Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to… |
CVE-2019-10296 | High | 8.8 | 2019-04-04 | Jenkins Serena SRA Deploy Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with a… |
CVE-2019-10295 | High | 8.8 | 2019-04-04 | Jenkins crittercism-dsym Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Re… |
CVE-2019-10294 | High | 8.8 | 2019-04-04 | Jenkins Kmap Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permissio… |