CWE-522 · Insufficiently Protected Credentials (page 14)
Page 14 of 15 — CVEs classified under CWE-522, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-16714 | Critical | 9.8 | 2018-09-06 | In Ice Qube Thermal Management Center versions prior to version 4.13, passwords are stored in plaintext in a file that is accessible without authentication. |
CVE-2018-13822 | High | 7.5 | 2018-08-30 | Unprotected storage of credentials in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows attackers to access sensitive infor… |
CVE-2018-1139 | High | 8.1 | 2018-08-22 | A flaw was found in the way samba before 4.7.9 and 4.8.4 allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabled. A man-in-the-m… |
CVE-2018-10622 | Medium | 5.2 | 2018-08-10 | Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials for network au… |
CVE-2017-1411 | Medium | 5.9 | 2018-08-06 | IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 does not require that users should have strong passwords by default, which makes it easi… |
CVE-2018-11050 | High | 8.8 | 2018-08-01 | Dell EMC NetWorker versions between 9.0 and 9.1.1.8 through 9.2.1.3, and the version 18.1.0.1 contain a Clear-Text authentication over network vulnerability in… |
CVE-2018-5543 | High | 8.8 | 2018-07-31 | The F5 BIG-IP Controller for Kubernetes 1.0.0-1.5.0 (k8s-bigip-crtl) passes BIG-IP username and password as command line parameters, which may lead to disclosu… |
CVE-2018-8851 | Critical | 9.8 | 2018-07-24 | Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. The devices store… |
CVE-2017-5704 | Medium | 6.7 | 2018-07-10 | Platform sample code firmware included with 4th Gen Intel Core Processor, 5th Gen Intel Core Processor, 6th Gen Intel Core Processor, and 7th Gen Intel Core Pr… |
CVE-2018-1000404 | High | 7.8 | 2018-07-09 | Jenkins project Jenkins AWS CodeBuild Plugin version 0.26 and earlier contains a Insufficiently Protected Credentials vulnerability in AWSClientFactory.java, C… |
CVE-2018-1000403 | High | 7.8 | 2018-07-09 | Jenkins project Jenkins AWS CodeDeploy Plugin version 1.19 and earlier contains a Insufficiently Protected Credentials vulnerability in AWSCodeDeployPublisher… |
CVE-2018-1000401 | High | 7.8 | 2018-07-09 | Jenkins project Jenkins AWS CodePipeline Plugin version 0.36 and earlier contains a Insufficiently Protected Credentials vulnerability in AWSCodePipelineSCM.ja… |
CVE-2017-2665 | Medium | 4.8 | 2018-07-06 | The skyring-setup command creates random password for mongodb skyring database but it writes password in plain text to /etc/skyring/skyring.conf file which is… |
CVE-2018-11639 | High | 8.1 | 2018-07-03 | Plaintext Storage of Passwords within Cookies in /var/www/xms/application/controllers/verifyLogin.php in the administrative console in Dialogic PowerMedia XMS… |
CVE-2018-11634 | High | 7.8 | 2018-07-03 | Plaintext Storage of Passwords in the administrative console in Dialogic PowerMedia XMS before 3.5 SU2 allows local users to access the web application's user… |
CVE-2018-7782 | High | 8.8 | 2018-07-03 | In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, authenticated users can view passwords in clear… |
CVE-2018-11746 | High | 8.6 | 2018-07-03 | In Puppet Discovery prior to 1.2.0, when running Discovery against Windows hosts, WinRM connections can fall back to using basic auth over insecure channels if… |
CVE-2018-13014 | High | 7.8 | 2018-06-29 | Storing password in recoverable format in safensec.com (SysWatch service) in SAFE'N'SEC SoftControl/SafenSoft SysWatch, SoftControl/SafenSoft TPSecure, and Sof… |
CVE-2017-16718 | Medium | 5.9 | 2018-06-27 | Beckhoff TwinCAT 3 supports communication over ADS. ADS is a protocol for industrial automation in protected environments. This protocol uses user configured r… |
CVE-2018-1000610 | High | 8.8 | 2018-06-26 | A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in DataBoundConfigurator.java, Attribute… |
CVE-2018-1000608 | High | 7.2 | 2018-06-26 | A exposure of sensitive information vulnerability exists in Jenkins z/OS Connector Plugin 1.2.6.1 and earlier in SCLMSCM.java that allows an attacker with loca… |
CVE-2018-12260 | Medium | 6.7 | 2018-06-12 | An issue was discovered on Momentum Axel 720P 5.1.8 devices. The root password can be obtained in cleartext by issuing the command 'showKey' from the root CLI… |
CVE-2018-1075 | Medium | 5.0 | 2018-06-12 | ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning. When engine-setup was run and one chooses to pro… |
CVE-2018-4190 | High | 8.8 | 2018-06-08 | An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTu… |
CVE-2018-0335 | High | 7.8 | 2018-06-07 | A vulnerability in the web portal authentication process of Cisco Prime Collaboration Provisioning could allow an unauthenticated, local attacker to view sensi… |
CVE-2018-7510 | Critical | 9.8 | 2018-06-06 | In the web application in BeaconMedaes TotalAlert Scroll Medical Air Systems running software versions prior to 4107600010.23, passwords are presented in plain… |
CVE-2017-7933 | Critical | 9.8 | 2018-06-06 | In ABB IP GATEWAY 3.39 and prior, some configuration files contain passwords stored in plain-text, which may allow an attacker to gain unauthorized access. |
CVE-2018-11544 | Critical | 9.8 | 2018-05-29 | The Olive Tree Ftp Server application 1.32 for Android has Insecure Data Storage because a username and password are stored in the /data/data/com.theolivetree… |
CVE-2018-7518 | Critical | 9.8 | 2018-05-24 | In TotalAlert Web Application in BeaconMedaes Scroll Medical Air Systems prior to v4107600010.23, an attacker with network access to the integrated web server… |
CVE-2018-10355 | High | 7.0 | 2018-05-23 | An authentication weakness vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to recover user passwords on vulnerable installati… |
CVE-2017-9637 | Medium | 4.1 | 2018-05-18 | Schneider Electric Ampla MES 6.4 provides capability to interact with data from third party databases. When connectivity to those databases is configured to us… |
CVE-2018-10327 | High | 7.0 | 2018-05-17 | PrinterOn Enterprise 4.1.3 stores the Active Directory bind credentials using base64 encoding, which allows local users to obtain credentials for a domain user… |
CVE-2017-12127 | Medium | 4.4 | 2018-05-14 | A password storage vulnerability exists in the operating system functionality of Moxa EDR-810 V4.1 build 17030317. An attacker with shell access could extract… |
CVE-2017-12123 | High | 8.8 | 2018-05-14 | An exploitable clear text transmission of password vulnerability exists in the web server and telnet functionality of Moxa EDR-810 V4.1 build 17030317. An atta… |
CVE-2018-6618 | High | 7.8 | 2018-05-11 | Easy Hosting Control Panel (EHCP) v0.37.12.b allows attackers to obtain sensitive information by leveraging cleartext password storage. |
CVE-2018-5446 | Medium | 4.9 | 2018-05-04 | Medtronic 2090 CareLink Programmer uses a per-product username and password that is stored in a recoverable format. |
CVE-2018-1074 | High | 7.7 | 2018-04-26 | ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentials, including cleart… |
CVE-2017-9654 | High | 8.8 | 2018-04-24 | The Philips DoseWise Portal web-based application versions 1.1.7.333 and 2.1.1.3069 stores login credentials in clear text within backend system files. CVSS v3… |
CVE-2017-1764 | High | 7.0 | 2018-04-23 | IBM Cognos Business Intelligence 10.2, 10.2.1, 10.2.1.1, and 10.2.2, under specialized circumstances, could expose plain text credentials to a local user. IBM… |
CVE-2018-10286 | High | 8.8 | 2018-04-22 | The Ericsson-LG iPECS NMS A.1Ac web application discloses sensitive information such as the NMS admin credentials and the PostgreSQL database credentials to lo… |
CVE-2016-9593 | Medium | 4.7 | 2018-04-16 | foreman-debug before version 1.15.0 is vulnerable to a flaw in foreman-debug's logging. An attacker with access to the foreman log file would be able to view p… |
CVE-2018-10024 | Critical | 9.8 | 2018-04-11 | ubiQuoss Switch VP5208A creates a bcm_password file at /cgi-bin/ with the user credentials in cleartext when a failed login attempt occurs. The file can be rea… |
CVE-2018-4170 | High | 7.8 | 2018-04-03 | An issue was discovered in certain Apple products. macOS before 10.13.4 is affected. The issue involves the "Admin Framework" component. It allows local users… |
CVE-2018-9160 | Critical | 9.8 | 2018-03-31 | SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses. |
CVE-2018-5708 | High | 8.0 | 2018-03-30 | An issue was discovered on D-Link DIR-601 B1 2.02NA devices. Being on the same local network as, but being unauthenticated to, the administrator's panel, a use… |
CVE-2018-9031 | Critical | 9.8 | 2018-03-29 | The login interface on TNLSoftSolutions Sentry Vision 3.x devices provides password disclosure by reading an "if(pwd ==" line in the HTML source code. This mea… |
CVE-2017-11510 | Critical | 9.8 | 2018-03-28 | An information leak exists in Wanscam's HW0021 network camera that allows an unauthenticated remote attacker to recover the administrator username and password… |
CVE-2017-0925 | High | 7.2 | 2018-03-21 | Gitlab Enterprise Edition version 10.1.0 is vulnerable to an insufficiently protected credential issue in the project service integration API endpoint resultin… |
CVE-2018-1000104 | High | 7.8 | 2018-03-13 | A plaintext storage of a password vulnerability exists in Jenkins Coverity Plugin 1.10.0 and earlier in CIMInstance.java that allows an attacker with local fil… |
CVE-2018-7698 | High | 8.1 | 2018-03-05 | An issue was discovered in D-Link mydlink+ 3.8.5 build 259 for DCS-933L 1.05.04 and DCS-934L 1.05.04 devices. The mydlink+ app sends the username and password… |
CVE-2017-5189 | Medium | 4.3 | 2018-03-02 | NetIQ iManager before 3.0.3 delivered a SSL private key in a Java application (JAR file) for authentication to Sentinel, allowing attackers to extract and esta… |
CVE-2018-1377 | High | 7.8 | 2018-02-26 | IBM Security Guardium Big Data Intelligence (SonarG) 3.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 1377… |
CVE-2018-3609 | High | 8.1 | 2018-02-16 | A vulnerability in the Trend Micro InterScan Messaging Security Virtual Appliance 9.0 and 9.1 management portal could allow an unauthenticated user to access s… |
CVE-2018-0828 | High | 7.8 | 2018-02-15 | Windows 10 version 1607 and Windows Server 2016 allow an elevation of privilege vulnerability due to how the MultiPoint management account password is stored… |
CVE-2017-9969 | Medium | 6.7 | 2018-02-12 | An information disclosure vulnerability exists in Schneider Electric's IGSS Mobile application version 3.01 and prior. Passwords are stored in clear text in th… |
CVE-2018-1000057 | Medium | 4.3 | 2018-02-09 | Jenkins Credentials Binding Plugin 1.14 and earlier masks passwords it provides to build processes in their build logs. Jenkins however transforms provided pas… |
CVE-2017-15656 | High | 8.8 | 2018-01-31 | Password are stored in plaintext in nvram in the HTTPd server in all current versions (<= 3.0.0.4.380.7743) of Asus asuswrt. |
CVE-2017-1779 | High | 7.8 | 2018-01-29 | IBM Cognos Analytics 11.0 could store cached credentials locally that could be obtained by a local user. IBM X-Force ID: 136824. |
CVE-2017-1000387 | High | 7.8 | 2018-01-26 | Jenkins Build-Publisher plugin version 1.21 and earlier stores credentials to other Jenkins instances in the file hudson.plugins.build_publisher.BuildPublisher… |
CVE-2017-16731 | High | 8.8 | 2017-12-20 | An Unprotected Transport of Credentials issue was discovered in ABB Ellipse 8.3 through Ellipse 8.9 released prior to December 2017 (including Ellipse Select)… |
CVE-2017-17106 | Critical | 9.8 | 2017-12-19 | Credentials for Zivif PR115-204-P-RS V2.3.4.2103 Webcams can be obtained by an unauthenticated remote attacker using a standard web /cgi-bin/hi3510/param.cgi?c… |
CVE-2017-3192 | Critical | 9.8 | 2017-12-16 | D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 do not sufficiently protect administrator credentials. The tools_admin.asp page disclose… |
CVE-2017-14111 | High | 7.2 | 2017-11-17 | The workstation logging function in Philips IntelliSpace Cardiovascular (ISCV) 2.3.0 and earlier and Xcelera R4.1L1 and earlier records domain authentication c… |
CVE-2017-15272 | Medium | 5.3 | 2017-11-15 | The PSFTPd 10.0.4 Build 729 server stores its configuration inside PSFTPd.dat. This file is a Microsoft Access Database and can be extracted. The application s… |
CVE-2017-14711 | High | 8.1 | 2017-11-13 | The Kickbase GmbH "Kickbase Bundesliga Manager" app before 2.2.1 -- aka kickbase-bundesliga-manager/id678241305 -- for iOS is vulnerable to a credentials leak… |
CVE-2017-15918 | High | 7.8 | 2017-11-01 | Sera 1.2 stores the user's login password in plain text in their home directory. This makes privilege escalation trivial and also exposes the user and system k… |
CVE-2017-1000245 | Critical | 9.8 | 2017-11-01 | The SSH Plugin stores credentials which allow jobs to access remote servers via the SSH protocol. User passwords and passphrases for encrypted SSH keys are sto… |
CVE-2017-3760 | High | 8.1 | 2017-10-17 | The Lenovo Service Framework Android application uses a set of nonsecure credentials when performing integrity verification of downloaded applications and/or d… |
CVE-2017-5700 | High | 8.4 | 2017-10-11 | Insufficient protection of password storage in system firmware for Intel NUC7i3BNK, NUC7i3BNH, NUC7i5BNK, NUC7i5BNH, NUC7i7BNH versions BN0049 and below allows… |
CVE-2017-13998 | High | 7.5 | 2017-10-05 | An Insufficiently Protected Credentials issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The application does not sufficiently protect sensitiv… |
CVE-2017-1378 | High | 7.8 | 2017-10-05 | IBM Spectrum Protect 7.1 and 8.1 (formerly Tivoli Storage Manager) disclosed unencrypted login credentials to Vmware vCenter in the application trace output wh… |
CVE-2017-1201 | High | 7.8 | 2017-10-05 | IBM BigFix Compliance Analytics 1.9.79 (TEMA SUAv1 SCA SCM) stores user credentials in clear text which can be read by a local user. IBM X-Force ID: 123676. |
CVE-2017-1362 | High | 7.8 | 2017-09-25 | IBM Security Identity Manager Adapters 6.0 and 7.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 126801. |
CVE-2017-14418 | High | 8.1 | 2017-09-13 | The D-Link NPAPI extension, as used in conjunction with D-Link DIR-850L REV. B (with firmware through FW208WWb02) devices, sends the cleartext admin password o… |
CVE-2017-13771 | Critical | 9.8 | 2017-09-07 | Lexmark Scan To Network (SNF) 3.2.9 and earlier stores network configuration credentials in plaintext and transmits them in requests, which allows remote attac… |
CVE-2017-8446 | Medium | 5.3 | 2017-08-18 | The Reporting feature in X-Pack in versions prior to 5.5.2 and standalone Reporting plugin versions versions prior to 2.4.6 had an impersonation vulnerability… |
CVE-2017-7547 | High | 8.8 | 2017-08-16 | PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers to retrieve pas… |
CVE-2017-4923 | Critical | 9.8 | 2017-08-01 | VMware vCenter Server (6.5 prior to 6.5 U1) contains an information disclosure vulnerability. This issue may allow plaintext credentials to be obtained when us… |
CVE-2017-6532 | Critical | 9.8 | 2017-07-20 | Televes COAXDATA GATEWAY 1Gbps devices doc-wifi-hgw_v1.02.0014 4.20 have cleartext credentials in /mib.db. |
CVE-2017-11349 | Critical | 9.8 | 2017-07-17 | dataTaker DT8x dEX 1.72.007 allows remote attackers to compose programs or schedules, for purposes such as sending e-mail messages or making outbound connectio… |
CVE-2017-1337 | High | 8.1 | 2017-07-10 | IBM WebSphere MQ 9.0.1 and 9.0.2 Java/JMS application can incorrectly transmit user credentials in plain text. IBM X-Force ID: 126245. |
CVE-2017-6709 | Critical | 9.8 | 2017-07-06 | A vulnerability in the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to access administrative credentials… |
CVE-2017-1207 | Medium | 5.5 | 2017-07-05 | IBM WebSphere Message Broker stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 123777. |
CVE-2017-7315 | Critical | 9.8 | 2017-07-04 | An issue was discovered on Humax Digital HG100R 2.0.6 devices. To download the backup file it's not necessary to use credentials, and the router credentials ar… |
CVE-2017-9248 | Critical | 9.8 | 2017-07-03 | Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.Dialog… |
CVE-2017-7905 | Critical | 9.8 | 2017-06-30 | A Weak Cryptography for Passwords issue was discovered in General Electric (GE) Multilin SR 750 Feeder Protection Relay, firmware versions prior to Version 7.4… |
CVE-2017-6046 | High | 7.5 | 2017-06-30 | An Insufficiently Protected Credentials issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Raven XT, all versi… |
CVE-2017-6028 | Critical | 9.8 | 2017-06-30 | An Insufficiently Protected Credentials issue was discovered in Schneider Electric Modicon PLCs Modicon M241, all firmware versions, and Modicon M251, all firm… |
CVE-2017-7524 | High | 7.5 | 2017-06-27 | tpm2-tools versions before 1.1.1 are vulnerable to a password leak due to transmitting password in plaintext from client to server when generating HMAC. |
CVE-2017-3214 | High | 7.5 | 2017-06-20 | The Milwaukee ONE-KEY Android mobile application stores the master token in plaintext in the apk binary. |
CVE-2017-9552 | High | 7.8 | 2017-06-13 | A design flaw in authentication in Synology Photo Station 6.0-2528 through 6.7.1-3419 allows local users to obtain credentials via cmdline. Synology Photo Stat… |
CVE-2017-6694 | Medium | 5.5 | 2017-06-13 | A vulnerability in the Virtual Network Function Manager's (VNFM) logging function of Cisco Ultra Services Platform could allow an authenticated, local attacker… |
CVE-2017-9557 | High | 7.5 | 2017-06-12 | register.ghp in EFS Software Easy Chat Server versions 2.0 to 3.1 allows remote attackers to discover passwords by sending the username parameter in conjunctio… |
CVE-2017-8837 | Critical | 9.8 | 2017-06-05 | Cleartext password storage exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_25… |
CVE-2017-7913 | Critical | 9.8 | 2017-05-29 | A Plaintext Storage of a Password issue was discovered in Moxa OnCell G3110-HSPA Version 1.3 build 15082117 and previous versions, OnCell G3110-HSDPA Version 1… |
CVE-2017-9136 | High | 7.5 | 2017-05-21 | An issue was discovered on Mimosa Client Radios before 2.2.3. In the device's web interface, there is a page that allows an attacker to use an unsanitized GET… |
CVE-2017-7486 | High | 7.5 | 2017-05-12 | PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign server passwords to any user having USAGE pri… |
CVE-2017-7925 | Critical | 9.8 | 2017-05-06 | A Password in Configuration File issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-… |
CVE-2017-8371 | Medium | 6.8 | 2017-04-30 | Schneider Electric StruxureWare Data Center Expert before 7.4.0 uses cleartext RAM storage for passwords, which might allow remote attackers to obtain sensitiv… |
CVE-2017-8296 | High | 7.5 | 2017-04-27 | kedpm 0.5 and 1.0 creates a history file in ~/.kedpm/history that is written in cleartext. All of the commands performed in the password manager are written th… |