CWE-522 · Insufficiently Protected Credentials (page 13)
Page 13 of 15 — CVEs classified under CWE-522, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-10291 | High | 8.8 | 2019-04-04 | Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older stored credentials unencrypted in its global configuration file on the Jenkins master where they could be… |
CVE-2019-10288 | High | 8.8 | 2019-04-04 | Jenkins Jabber Server Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with acces… |
CVE-2019-10287 | High | 8.8 | 2019-04-04 | Jenkins youtrack-plugin Plugin 0.7.1 and older stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed… |
CVE-2019-10286 | High | 8.8 | 2019-04-04 | Jenkins DeployHub Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read perm… |
CVE-2019-10285 | High | 8.8 | 2019-04-04 | Jenkins Minio Storage Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with acces… |
CVE-2019-10284 | High | 8.8 | 2019-04-04 | Jenkins Diawi Upload Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read p… |
CVE-2019-10283 | High | 8.8 | 2019-04-04 | Jenkins mabl Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permissio… |
CVE-2019-10282 | High | 8.8 | 2019-04-04 | Jenkins Klaros-Testmanagement Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extend… |
CVE-2019-10281 | High | 8.8 | 2019-04-04 | Jenkins Relution Enterprise Appstore Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be v… |
CVE-2019-10280 | High | 8.8 | 2019-04-04 | Jenkins Assembla Auth Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users… |
CVE-2019-10277 | High | 8.8 | 2019-04-04 | Jenkins StarTeam Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permi… |
CVE-2019-1003097 | Medium | 6.5 | 2019-04-04 | Jenkins Crowd Integration Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by u… |
CVE-2019-1003096 | Medium | 6.5 | 2019-04-04 | Jenkins TestFairy Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read perm… |
CVE-2019-1003045 | Medium | 6.5 | 2019-03-28 | A vulnerability in Jenkins ECS Publisher Plugin 1.0.0 and earlier allows attackers with Item/Extended Read permission, or local file system access to the Jenki… |
CVE-2018-19466 | Critical | 9.8 | 2019-03-27 | A vulnerability was found in Portainer before 1.20.0. Portainer stores LDAP credentials, corresponding to a master password, in cleartext and allows their retr… |
CVE-2017-7510 | High | 8.8 | 2019-03-25 | In ovirt-engine 4.1, if a host was provisioned with cloud-init, the root password could be revealed through the REST interface. |
CVE-2019-9868 | High | 7.2 | 2019-03-21 | An issue was discovered in the Web Console in Veritas NetBackup Appliance through 3.1.2. The SMTP password is displayed to an administrator. |
CVE-2019-9867 | High | 7.2 | 2019-03-21 | An issue was discovered in the Web Console in Veritas NetBackup Appliance through 3.1.2. The proxy server password is displayed to an administrator. |
CVE-2019-5723 | Critical | 9.8 | 2019-03-21 | An issue was discovered in portier vision 4.4.4.2 and 4.4.4.6. Passwords are stored using reversible encryption rather than as a hash value, and the used Vigen… |
CVE-2018-17500 | Low | 2.9 | 2019-03-21 | Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of hardcoded OAuth… |
CVE-2019-1003039 | High | 8.8 | 2019-03-08 | An insufficiently protected credentials vulnerability exists in JenkinsAppDynamics Dashboard Plugin 1.0.14 and earlier in src/main/java/nl/codecentric/jenkins/… |
CVE-2019-1003038 | High | 7.8 | 2019-03-08 | An insufficiently protected credentials vulnerability exists in Jenkins Repository Connector Plugin 1.2.4 and earlier in src/main/java/org/jvnet/hudson/plugins… |
CVE-2019-3780 | High | 8.8 | 2019-03-08 | Cloud Foundry Container Runtime, versions prior to 0.28.0, deploys K8s worker nodes that contains a configuration file with IAAS credentials. A malicious user… |
CVE-2019-4059 | Critical | 9.8 | 2019-02-15 | IBM Rational ClearCase 1.0.0.0 GIT connector does not sufficiently protect the document database password. An attacker could obtain the password and gain unaut… |
CVE-2019-3782 | High | 7.8 | 2019-02-13 | Cloud Foundry CredHub CLI, versions prior to 2.2.1, inadvertently writes authentication credentials provided via environment variables to its persistent config… |
CVE-2019-6549 | High | 7.2 | 2019-02-12 | An attacker could retrieve plain-text credentials stored in a XML file on PR100088 Modbus gateway versions prior to Release R02 (or Software Version 1.1.13166)… |
CVE-2018-20781 | High | 7.8 | 2019-02-12 | In pam/gkr-pam-module.c in GNOME Keyring before 3.27.2, the user's password is kept in a session-child process spawned from the LightDM daemon. This can expose… |
CVE-2019-6242 | High | 7.2 | 2019-02-08 | Kentico v10.0.42 allows Global Administrators to read the cleartext SMTP Password by navigating to the SMTP configuration page. NOTE: the vendor considers this… |
CVE-2019-1000001 | Critical | 9.8 | 2019-02-04 | TeamPass version 2.1.27 and earlier contains a Storing Passwords in a Recoverable Format vulnerability in Shared password vaults that can result in all shared… |
CVE-2019-7300 | High | 7.2 | 2019-02-01 | Artica Proxy 3.06.200056 allows remote attackers to execute arbitrary commands as root by reading the ressources/settings.inc ldap_admin and ldap_password fiel… |
CVE-2018-15456 | Medium | 4.3 | 2019-01-10 | A vulnerability in the Admin Portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to view saved passwords in plain text… |
CVE-2018-0474 | High | 8.8 | 2019-01-10 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view digest cred… |
CVE-2018-1000425 | High | 7.8 | 2019-01-09 | An insufficiently protected credentials vulnerability exists in Jenkins SonarQube Scanner Plugin 2.8 and earlier in SonarInstallation.java that allows attacker… |
CVE-2018-1000424 | High | 7.8 | 2019-01-09 | An insufficiently protected credentials vulnerability exists in Jenkins Artifactory Plugin 2.16.1 and earlier in ArtifactoryBuilder.java, CredentialsConfig.jav… |
CVE-2018-1000423 | High | 7.8 | 2019-01-09 | An insufficiently protected credentials vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java, CrowdConfigura… |
CVE-2018-1000627 | Critical | 9.8 | 2018-12-28 | Battelle V2I Hub 2.5.1 could allow a remote attacker to obtain sensitive information, caused by the failure to restrict access to the API key file. An attacker… |
CVE-2018-11742 | Critical | 9.8 | 2018-12-26 | NEC Univerge Sv9100 WebPro 6.00.00 devices have Cleartext Password Storage in the Web UI. |
CVE-2018-20445 | Critical | 9.8 | 2018-12-25 | D-Link DCM-604 DCM604_C1_ViaCabo_1.04_20130606 and DCM-704 EU_DCM-704_1.10 devices allow remote attackers to discover Wi-Fi credentials via iso.3.6.1.4.1.4413… |
CVE-2018-20444 | Critical | 9.8 | 2018-12-25 | Technicolor CGA0111 CGA0111E-ES-13-E23E-c8000r5712-170217-0829-TRU devices allow remote attackers to discover Wi-Fi credentials via iso.3.6.1.4.1.4413.2.2.2.1… |
CVE-2018-20443 | Critical | 9.8 | 2018-12-25 | Technicolor TC7200.d1I TC7200.d1IE-N23E-c7000r5712-170406-HAT devices allow remote attackers to discover Wi-Fi credentials via iso.3.6.1.4.1.4413.2.2.2.1.5.4.1… |
CVE-2018-20442 | Critical | 9.8 | 2018-12-25 | Technicolor TC7110.B STC8.62.02 devices allow remote attackers to discover Wi-Fi credentials via iso.3.6.1.4.1.2863.205.10.1.30.4.1.14.1.3.32 and iso.3.6.1.4.1… |
CVE-2018-20441 | Critical | 9.8 | 2018-12-25 | Technicolor TC7200.TH2v2 SC05.00.22 devices allow remote attackers to discover Wi-Fi credentials via iso.3.6.1.4.1.2863.205.10.1.30.4.1.14.1.3.32 and iso.3.6.1… |
CVE-2018-20440 | Critical | 9.8 | 2018-12-25 | Technicolor CWA0101 CWA0101E-A23E-c7000r5712-170315-SKC devices allow remote attackers to discover Wi-Fi credentials via iso.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1… |
CVE-2018-20439 | Critical | 9.8 | 2018-12-25 | Technicolor DPC3928SL D3928SL-PSIP-13-A010-c3420r55105-170214a devices allow remote attackers to discover Wi-Fi credentials via iso.3.6.1.4.1.4413.2.2.2.1.5.4… |
CVE-2018-20438 | Critical | 9.8 | 2018-12-25 | Technicolor TC7110.AR STD3.38.03 devices allow remote attackers to discover Wi-Fi credentials via iso.3.6.1.4.1.2863.205.10.1.30.4.1.14.1.3.32 and iso.3.6.1.4… |
CVE-2018-18698 | Critical | 9.8 | 2018-12-24 | An issue was discovered on Xiaomi Mi A1 tissot_sprout:8.1.0/OPM1.171019.026/V9.6.4.0.ODHMIFE devices. They store cleartext Wi-Fi passwords in logcat during the… |
CVE-2018-20401 | Critical | 9.8 | 2018-12-23 | Zoom 5352 v5.5.8.6Y devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP r… |
CVE-2018-20400 | Critical | 9.8 | 2018-12-23 | Ubee DVW2108 6.28.1017 and DVW2110 6.28.2012 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.44… |
CVE-2018-20399 | Critical | 9.8 | 2018-12-23 | Motorola SBG901 SBG901-2.10.1.1-GA-00-581-NOSH, SBG941 SBG941-2.11.0.0-GA-07-624-NOSH, and SVG1202 SVG1202-2.1.0.0-GA-14-LTSH devices allow remote attackers to… |
CVE-2018-20398 | Critical | 9.8 | 2018-12-23 | Skyworth CM5100 V1.1.0, CM5100-440 V1.2.1, CM5100-511 4.1.0.14, CM5100-GHD00 V1.2.2, and CM5100.g2 4.1.0.17 devices allow remote attackers to discover credenti… |
CVE-2018-20397 | Critical | 9.8 | 2018-12-23 | mplus CBC383Z CBC383Z_mplus_MDr026 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1… |
CVE-2018-20396 | Critical | 9.8 | 2018-12-23 | NET&SYS MNG2120J 5.76.1006c and MNG6300 5.83.6305jrc2 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6… |
CVE-2018-20395 | Critical | 9.8 | 2018-12-23 | NETWAVE MNG6200 C4835805jrc12FU121413.cpr devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491… |
CVE-2018-20394 | Critical | 9.8 | 2018-12-23 | Thomson DWG849 STC0.01.16, DWG850-4 ST9C.05.25, DWG855 ST80.20.26, and TWG870 STB2.01.36 devices allow remote attackers to discover credentials via iso.3.6.1.4… |
CVE-2018-20392 | Critical | 9.8 | 2018-12-23 | S-A WebSTAR DPC2100 v2.0.2r1256-060303 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4… |
CVE-2018-20391 | Critical | 9.8 | 2018-12-23 | TEKNOTEL CBW700N 81.447.392110.729.024 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4… |
CVE-2018-20390 | Critical | 9.8 | 2018-12-23 | Kaonmedia CG2001-AN22A 1.2.1, CG2001-UDBNA 3.0.8, and CG2001-UN2NA 3.0.8 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1… |
CVE-2018-20389 | Critical | 9.8 | 2018-12-23 | D-Link DCM-604 DCM604_C1_ViaCabo_1.04_20130606 and DCM-704 EU_DCM-704_1.10 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1… |
CVE-2018-20388 | Critical | 9.8 | 2018-12-23 | Comtrend CM-6200un 123.447.007 and CM-6300n 123.553mp1.005 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and is… |
CVE-2018-20387 | Critical | 9.8 | 2018-12-23 | Bnmux BCW700J 5.20.7, BCW710J 5.30.6a, and BCW710J2 5.30.16 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and i… |
CVE-2018-20386 | Critical | 9.8 | 2018-12-23 | ARRIS SBG6580-2 D30GW-SEAEAGLE-1.5.2.5-GA-00-NOSH devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4… |
CVE-2018-20385 | Critical | 9.8 | 2018-12-23 | CastleNet CBV38Z4EC 125.553mp1.39219mp1.899.007, CBV38Z4ECNIT 125.553mp1.39219mp1.899.005ITT, CBW383G4J 37.556mp5.008, and CBW38G4J 37.553mp1.008 devices allow… |
CVE-2018-20384 | Critical | 9.8 | 2018-12-23 | iNovo Broadband IB-8120-W21 139.4410mp1.004200.002 and IB-8120-W21E1 139.4410mp1.3921132mp1.899.004404.004 devices allow remote attackers to discover credentia… |
CVE-2018-20383 | Critical | 9.8 | 2018-12-23 | ARRIS DG950A 7.10.145 and DG950S 7.10.145.EURO devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1… |
CVE-2018-20382 | Critical | 9.8 | 2018-12-23 | Jiuzhou BCM93383WRG 139.4410mp1.3921132mp1.899.004404.004 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso… |
CVE-2018-17245 | Critical | 9.8 | 2018-12-20 | Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are used when generating PDF reports. If a re… |
CVE-2018-1000851 | Critical | 9.8 | 2018-12-20 | Copay Bitcoin Wallet version 5.01 to 5.1.0 included. contains a Other/Unknown vulnerability in wallet private key storage that can result in Users' private key… |
CVE-2018-15717 | Medium | 5.3 | 2018-12-12 | Open Dental before version 18.4 stores user passwords as base64 encoded MD5 hashes. |
CVE-2018-16791 | Critical | 9.8 | 2018-12-05 | In SolarWinds SFTP/SCP Server through 2018-09-10, the configuration file is world readable and writable, and stores user passwords in an insecure manner, allow… |
CVE-2018-19795 | Medium | 6.8 | 2018-12-03 | ChipsBank UMPTool saves the password to the NAND with a simple substitution cipher, which allows attackers to get full access when having physical access to th… |
CVE-2018-16223 | Critical | 9.8 | 2018-11-20 | Insecure Cryptographic Storage of credentials in com.vestiacom.qbeecamera_preferences.xml in the QBee Cam application through 1.0.5 for Android allows an attac… |
CVE-2018-16222 | Medium | 6.8 | 2018-11-20 | Cleartext Storage of credentials in the iSmartAlarmData.xml configuration file in the iSmartAlarm application through 2.0.8 for Android allows an attacker to r… |
CVE-2018-12038 | Medium | 4.2 | 2018-11-20 | An issue was discovered on Samsung 840 EVO devices. Vendor-specific commands may allow access to the disk-encryption key. |
CVE-2018-19078 | Critical | 9.8 | 2018-11-07 | An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The response to an ONVIF media GetStrea… |
CVE-2018-17922 | Critical | 9.8 | 2018-11-02 | Circontrol CirCarLife all versions prior to 4.3.1, the PAP credentials of the device are stored in clear text in a log file that is accessible without authenti… |
CVE-2018-8858 | Critical | 9.8 | 2018-10-30 | If an attacker has access to the firmware from the VGo Robot (Versions 3.0.3.52164 and 3.0.3.53662. Prior versions may also be affected) they may be able to ex… |
CVE-2018-18754 | Critical | 9.8 | 2018-10-29 | ZyXEL VMG3312-B10B 1.00(AAPP.7) devices have a backdoor root account with the tTn3+Z@!Sr0O+ password hash in the etc/default.cfg file. |
CVE-2018-18656 | High | 7.8 | 2018-10-26 | The PureVPN client before 6.1.0 for Windows stores Login Credentials (username and password) in cleartext. The location of such files is %PROGRAMDATA%\purevpn\… |
CVE-2018-9280 | Medium | 4.9 | 2018-10-24 | An issue was discovered on Eaton UPS 9PX 8000 SP devices. The appliance discloses the SNMP version 3 user's password. The web page displayed by the appliance c… |
CVE-2018-9279 | Medium | 4.9 | 2018-10-24 | An issue was discovered on Eaton UPS 9PX 8000 SP devices. The appliance discloses the user's password. The web page displayed by the appliance contains the pas… |
CVE-2018-11079 | Medium | 5.5 | 2018-10-18 | Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains a Plaintext Password Storage vulnerability. Database credentials are stored in plaintex… |
CVE-2018-12383 | Medium | 5.5 | 2018-10-18 | If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because t… |
CVE-2018-10824 | Critical | 9.8 | 2018-10-17 | An issue was discovered on D-Link DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 throu… |
CVE-2018-17900 | Critical | 9.8 | 2018-10-12 | Yokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The web application improperly protects credentials which could allo… |
CVE-2017-1231 | Medium | 4.4 | 2018-10-12 | IBM BigFix Platform 9.5 - 9.5.9 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 123910. |
CVE-2018-13789 | High | 7.5 | 2018-10-10 | An issue was discovered in Descor Infocad FM before 3.1.0.0. An unauthenticated web service allows the retrieval of files on the web server and on reachable SM… |
CVE-2018-18074 | High | 7.5 | 2018-10-09 | The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which ma… |
CVE-2018-14081 | Critical | 9.8 | 2018-10-09 | An issue was discovered on D-Link DIR-809 A1 through 1.09, A2 through 1.11, and Guest Zone through 1.09 devices. Device passwords, such as the admin password a… |
CVE-2018-17871 | Medium | 6.5 | 2018-10-04 | Verba Collaboration Compliance and Quality Management Platform before 9.2.1.5545 has Incorrect Access Control. |
CVE-2017-2751 | Medium | 4.6 | 2018-10-03 | A BIOS password extraction vulnerability has been reported on certain consumer notebooks with firmware F.22 and others. The BIOS password was stored in CMOS in… |
CVE-2018-17969 | Critical | 9.8 | 2018-10-03 | Samsung SCX-6545X V2.00.03.01 03-23-2012 devices allows remote attackers to discover cleartext credentials via iso.3.6.1.4.1.236.11.5.11.81.10.1.5.0 and iso.3… |
CVE-2018-11752 | Medium | 5.5 | 2018-10-02 | Previous releases of the Puppet cisco_ios module output SSH session debug information including login credentials to a world readable file on every run. These… |
CVE-2018-11748 | High | 7.8 | 2018-10-02 | Previous releases of the Puppet device_manager module creates configuration files containing credentials that are world readable. This issue has been resolved… |
CVE-2018-16984 | Medium | 4.9 | 2018-10-02 | An issue was discovered in Django 2.1 before 2.1.2, in which unprivileged users can read the password hashes of arbitrary accounts. The read-only password widg… |
CVE-2018-1498 | Medium | 6.2 | 2018-10-02 | IBM Security Guardium EcoSystem 10.5 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 141223. |
CVE-2018-17613 | Critical | 9.8 | 2018-09-28 | Telegram Desktop (aka tdesktop) 1.3.16 alpha, when "Use proxy" is enabled, sends credentials and application data in cleartext over the SOCKS5 protocol. |
CVE-2018-16669 | Critical | 9.8 | 2018-09-18 | An issue was discovered in CIRCONTROL Open Charge Point Protocol (OCPP) before 1.5.0, as used in CirCarLife, PowerStudio, and other products. Due to storage of… |
CVE-2018-10814 | High | 7.8 | 2018-09-14 | Synametrics SynaMan 4.0 build 1488 uses cleartext password storage for SMTP credentials. |
CVE-2018-16987 | High | 7.2 | 2018-09-13 | Squash TM through 1.18.0 presents the cleartext passwords of external services in the administration panel, as demonstrated by a ta-server-password field in th… |
CVE-2017-17691 | High | 8.1 | 2018-09-07 | Homeputer CL Studio fur HomeMatic 4.0 Rel 160808 and earlier uses cleartext to exchange the username and password between server and client instances, which al… |