CWE-522 · Insufficiently Protected Credentials (page 15)
Page 15 of 15 — CVEs classified under CWE-522, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-8225 | Critical | 9.8 | 2017-04-25 | On Wireless IP Camera (P2P) WIFICAM devices, access to .ini files (containing credentials) is not correctly checked. An attacker can bypass authentication by p… |
CVE-2017-8222 | High | 7.5 | 2017-04-25 | Wireless IP Camera (P2P) WIFICAM devices have an "Apple Production IOS Push Services" private RSA key and certificate stored in /system/www/pem/ck.pem inside t… |
CVE-2017-6528 | High | 8.1 | 2017-03-09 | An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is affected by plaintext password storage (the /home/dna/spool/.pfile file). |
CVE-2017-5140 | Critical | 9.8 | 2017-02-13 | An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. Password is stored i… |
CVE-2017-5139 | Critical | 9.8 | 2017-02-13 | An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. Any user is able to… |
CVE-2016-9360 | Medium | 6.7 | 2017-02-13 | An issue was discovered in General Electric (GE) Proficy HMI/SCADA iFIX Version 5.8 SIM 13 and prior versions, Proficy HMI/SCADA CIMPLICITY Version 9.0 and pri… |
CVE-2015-5013 | Medium | 5.5 | 2017-02-08 | The IBM Security Access Manager appliance includes configuration files that contain obfuscated plaintext-passwords which authenticated users can access. |
CVE-2015-7546 | High | 7.5 | 2016-02-03 | The identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and 8.0.x before 8.0.2 (Liberty) and keystonemiddleware (formerly python-keystonec… |
CVE-2015-5955 | | 2015-10-29 | ownCloud iOS app before 3.4.4 does not properly switch state between multiple instances, which might allow remote instance administrators to obtain sensitive c… | |
CVE-2015-3962 | | 2015-09-18 | Schneider Electric StruxureWare Building Expert MPM before 2.15 does not use encryption for the client-server data stream, which allows remote attackers to dis… | |
CVE-2014-4806 | Medium | 5.5 | 2014-08-29 | The installation process in IBM Security AppScan Enterprise 8.x before 8.6.0.2 iFix 003, 8.7.x before 8.7.0.1 iFix 003, 8.8.x before 8.8.0.1 iFix 002, and 9.0… |
CVE-2014-1812 | High | 8.8 | 2014-05-14 | The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2… |
CVE-2014-0755 | | 2014-02-05 | Rockwell Automation RSLogix 5000 7 through 20.01, and 21.0, does not properly implement password protection for .ACD files (aka project files), which allows lo… | |
CVE-2012-5627 | | 2013-10-01 | Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executions of the change_us… | |
CVE-2013-4222 | | 2013-09-30 | OpenStack Identity (Keystone) Folsom, Grizzly 2013.1.3 and earlier, and Havana before havana-3 does not properly revoke user tokens when a tenant is disabled… | |
CVE-2013-4869 | | 2013-07-18 | Cisco Unified Communications Manager (CUCM) 7.1(x) through 9.1(2) and the IM & Presence Service in Cisco Unified Presence Server through 9.1(2) use the same CT… | |
CVE-2012-3268 | | 2013-02-01 | Certain HP Access Controller, Fabric Module, Firewall, Router, Switch, and UTM Appliance products; certain HP 3Com Access Controller, Router, and Switch produc… | |
CVE-2012-3025 | | 2012-08-16 | The default configuration of Tridium Niagara AX Framework through 3.6 uses a cleartext base64 format for transmission of credentials in cookies, which allows r… | |
CVE-2012-4028 | | 2012-07-16 | Tridium Niagara AX Framework does not properly store credential data, which allows context-dependent attackers to bypass intended access restrictions by using… | |
CVE-2007-0681 | Critical | 9.8 | 2007-02-03 | profile.php in ExtCalendar 2 and earlier allows remote attackers to change the passwords of arbitrary users without providing the original password, and possib… |
CVE-2005-3435 | Critical | 9.8 | 2005-11-02 | admin_news.php in Archilles Newsworld up to 1.3.0 allows attackers to bypass authentication by obtaining the password hash for another user, for example throug… |
CVE-2000-0944 | Critical | 9.8 | 2000-12-19 | CGI Script Center News Update 1.1 does not properly validate the original news administration password during a password change operation, which allows remote… |
CVE-1999-0013 | High | 8.4 | 1998-01-22 | Stolen credentials from SSH clients via ssh-agent program, allowing other local users to access remote accounts belonging to the ssh-agent user. |