CWE-522 · Insufficiently Protected Credentials (page 3)
Page 3 of 15 — CVEs classified under CWE-522, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-62157 | Medium | 6.5 | 2025-10-14 | Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Argo Workflows versions prior to 3.6.12 and ve… |
CVE-2025-35054 | Medium | 5.3 | 2025-10-09 | Newforma Info Exchange (NIX) stores credentials used to configure NPCS in 'HKLM\Software\WOW6432Node\Newforma\<version>\Credentials'. The credentials are encr… |
CVE-2025-61776 | Medium | 4.7 | 2025-10-07 | Dependency-Track is a component analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior to version 4.13.5… |
CVE-2025-37728 | Medium | 5.4 | 2025-10-07 | Insufficiently Protected Credentials in the Crowdstrike connector can lead to Crowdstrike credentials being leaked. A malicious user can access cached credenti… |
CVE-2025-27231 | Medium | 4.9 | 2025-10-03 | The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate t… |
CVE-2025-34207 | Critical | 9.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 22.0.1049 and Application prior to 20.0.2786 (VA and SaaS deployments) configure the SSH c… |
CVE-2025-34196 | Critical | 9.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application prior to 25.1.1413 (Windows client deployments) contain… |
CVE-2025-10880 | High | 7.5 | 2025-09-25 | All versions of Dingtian DT-R002 are vulnerable to an Insufficiently Protected Credentials vulnerability that could allow an attacker to extract the proprietar… |
CVE-2025-10879 | Medium | 5.3 | 2025-09-25 | All versions of Dingtian DT-R002 are vulnerable to an Insufficiently Protected Credentials vulnerability that could allow an attacker to retrieve the current u… |
CVE-2025-40838 | High | 7.5 | 2025-09-25 | Ericsson Indoor Connect 8855 contains a vulnerability where server-side security can be bypassed in the client which if exploited can lead to unauthorized disc… |
CVE-2025-10360 | | 2025-09-24 | In Puppet Enterprise versions 2025.4.0 and 2025.5, the encryption key used for encrypting content in the Infra Assistant database was not excluded from the fil… | |
CVE-2025-54467 | Medium | 5.3 | 2025-09-17 | When a Java command with password parameters is executed and terminated by NeuVector for Process rule violation the password will appear in the NeuVector secur… |
CVE-2025-23342 | High | 8.2 | 2025-09-09 | The NVIDIA NVDebug tool contains a vulnerability that may allow an actor to gain access to a privileged account . A successful exploit of this vulnerability ma… |
CVE-2025-42933 | High | 8.8 | 2025-09-09 | When a user logs in via SAP Business One native client, the SLD backend service fails to enforce proper encryption of certain APIs. This leads to exposure of s… |
CVE-2025-41682 | High | 8.8 | 2025-09-08 | An authenticated, low-privileged attacker can obtain credentials stored on the charge controller including the manufacturer password. |
CVE-2025-58366 | | 2025-09-05 | Onyxia is a data science environment for kubernetes. In versions 4.6.0 through 4.8.0, Onyxia-API leaked the credentials of private helm repositories in the pub… | |
CVE-2025-55739 | | 2025-09-05 | api is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© (PBX). In versions lower than 15.0.13, 16.0.2 through 16.0.14, 17… | |
CVE-2025-57806 | | 2025-09-03 | Local Deep Research is an AI-powered research assistant for deep, iterative research. Versions 0.2.0 through 0.6.7 stored confidential information, including A… | |
CVE-2025-6519 | Critical | 9.8 | 2025-09-02 | E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY" with a daily generated password. An attacker can predictably generate the pas… |
CVE-2025-52549 | Critical | 9.8 | 2025-09-02 | E3 Site Supervisor Control (firmware version < 2.31F01) generates the root linux password on each boot. An attacker can generate the root linux password for a… |
CVE-2025-52545 | High | 7.5 | 2025-09-02 | E3 Site Supervisor Control (firmware version < 2.31F01) RCI service contains an API call to read users info, which returns all usernames and password hashes fo… |
CVE-2025-52095 | Critical | 9.8 | 2025-08-22 | An issue in PDQ Smart Deploy V.3.0.2040 allows an attacker to escalate privileges via the Credential encryption routines in SDCommon.dll |
CVE-2025-55306 | Critical | 9.8 | 2025-08-19 | GenX_FX is an advance IA trading platform that will focus on forex trading. A vulnerability was identified in the GenX FX backend where API keys and authentica… |
CVE-2025-54156 | High | 7.4 | 2025-08-18 | The Sante PACS Server Web Portal sends credential information without encryption. |
CVE-2025-40751 | Medium | 6.3 | 2025-08-12 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.3). Affected SIMATIC RTLS Locating Manager Report Clients do not proper… |
CVE-2025-48709 | Low | 3.8 | 2025-08-07 | BMC Control-M/Server 9.0.21.300 displays cleartext database credentials in process lists and logs. An authenticated attacker with shell access could observe th… |
CVE-2025-54394 | Medium | 5.3 | 2025-08-07 | Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 has Insufficiently Protected Credentials for requests to remote Excel resour… |
CVE-2025-54882 | High | 7.1 | 2025-08-07 | Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. In versions 0.8.0 through 0.9.21 and 1.0.0-beta through 1.1.0, Himmelblau stor… |
CVE-2025-54876 | | 2025-08-06 | The Janssen Project is an open-source identity and access management (IAM) platform. In versions 1.9.0 and below, Janssen stores passwords in plaintext in the… | |
CVE-2025-38739 | High | 7.2 | 2025-08-04 | Dell Digital Delivery, versions prior to 5.6.1.0, contains an Insufficiently Protected Credentials vulnerability. A remote unauthenticated attacker could poten… |
CVE-2025-53008 | Medium | 6.5 | 2025-07-30 | GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses… |
CVE-2025-5922 | | 2025-07-29 | Access to TSplus Remote Access Admin Tool is restricted to administrators (unless "Disable UAC" option is enabled) and requires a PIN code. In versions below v… | |
CVE-2025-54422 | Medium | 5.5 | 2025-07-29 | Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. In versions 1.16.1 and below, a critical security vul… |
CVE-2025-54428 | Critical | 9.8 | 2025-07-28 | RevelaCode is an AI-powered faith-tech project that decodes biblical verses, prophecies and global events into accessible language. In versions below 1.0.1, a… |
CVE-2025-54380 | Medium | 6.5 | 2025-07-26 | Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to version 17.6, Opencast would incorrectly se… |
CVE-2025-34139 | | 2025-07-25 | A vulnerability exists in Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud that could allow an unauthent… | |
CVE-2025-6227 | Low | 2.2 | 2025-07-18 | Mattermost versions 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to negotiate a new token when accepting the invite which allows a user that intercepts both invite… |
CVE-2025-7565 | Medium | 5.3 | 2025-07-14 | A vulnerability, which was classified as critical, was found in LB-LINK BL-AC3600 up to 1.0.22. This affects the function geteasycfg of the file /cgi-bin/light… |
CVE-2025-53743 | Medium | 5.3 | 2025-07-09 | Jenkins Applitools Eyes Plugin 1.16.5 and earlier does not mask Applitools API keys displayed on the job configuration form, increasing the potential for attac… |
CVE-2025-53671 | Medium | 6.5 | 2025-07-09 | Jenkins Nouvola DiveCloud Plugin 1.08 and earlier does not mask DiveCloud API Keys and Credentials Encryption Keys displayed on the job configuration form, inc… |
CVE-2025-53669 | Medium | 4.3 | 2025-07-09 | Jenkins VAddy Plugin 1.2.8 and earlier does not mask Vaddy API Auth Keys displayed on the job configuration form, increasing the potential for attackers to obs… |
CVE-2025-53667 | Medium | 5.3 | 2025-07-09 | Jenkins Dead Man's Snitch Plugin 0.1 does not mask Dead Man's Snitch tokens displayed on the job configuration form, increasing the potential for attackers to… |
CVE-2025-53661 | Medium | 4.3 | 2025-07-09 | Jenkins Testsigma Test Plan run Plugin 1.6 and earlier does not mask Testsigma API keys displayed on the job configuration form, increasing the potential for a… |
CVE-2025-53660 | Medium | 4.3 | 2025-07-09 | Jenkins QMetry Test Management Plugin 1.13 and earlier does not mask Qmetry Automation API Keys displayed on the job configuration form, increasing the potenti… |
CVE-2025-53657 | Medium | 4.3 | 2025-07-09 | Jenkins ReadyAPI Functional Testing Plugin 1.11 and earlier does not mask SLM License Access Keys, client secrets, and passwords displayed on the job configura… |
CVE-2025-53654 | Medium | 6.5 | 2025-07-09 | Jenkins Statistics Gatherer Plugin 2.0.3 and earlier stores the AWS Secret Key unencrypted in its global configuration file on the Jenkins controller, where it… |
CVE-2025-53650 | High | 7.3 | 2025-07-09 | Jenkins Credentials Binding Plugin 687.v619cb_15e923f and earlier does not properly mask (i.e., replace with asterisks) credentials present in exception error… |
CVE-2025-24508 | Medium | 6.4 | 2025-07-07 | Extraction of Account Connectivity Credentials (ACCs) from the IT Management Agent secure storage |
CVE-2025-34078 | High | 7.8 | 2025-07-02 | A local privilege escalation vulnerability exists in NSClient++ 0.5.2.35 when both the web interface and ExternalScripts features are enabled. The configuratio… |
CVE-2025-34062 | | 2025-07-01 | An information disclosure vulnerability exists in OneLogin AD Connector versions prior to 6.1.5 via the /api/adc/v4/configuration endpoint. An attacker with ac… | |
CVE-2025-6081 | Medium | 6.8 | 2025-07-01 | Insufficiently Protected Credentials in LDAP in Konica Minolta bizhub 227 Multifunction printers version GCQ-Y3 or earlier allows an attacker can reconfigure t… |
CVE-2024-49364 | | 2025-07-01 | tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a private key can be extracted on signing a malicious JSON-stringifiable object… | |
CVE-2024-51984 | Medium | 6.8 | 2025-06-25 | An authenticated attacker can reconfigure the target device to use an external service (such as LDAP or FTP) controlled by the attacker. If an existing passwor… |
CVE-2025-6526 | Low | 3.1 | 2025-06-23 | A vulnerability, which was classified as problematic, has been found in 70mai M300 up to 20250611. This issue affects some unknown processing of the component… |
CVE-2025-35941 | Medium | 5.5 | 2025-06-11 | A password is exposed locally. |
CVE-2025-30183 | High | 7.5 | 2025-06-09 | CyberData 011209 Intercom does not properly store or protect web server admin credentials. |
CVE-2024-47081 | Medium | 5.3 | 2025-06-09 | Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously… |
CVE-2025-33079 | Medium | 6.5 | 2025-05-27 | IBM Controller 11.0.0, 11.0.1, and 11.1.0 application could allow an authenticated user to obtain sensitive credentials that may be inadvertently included with… |
CVE-2025-3480 | Medium | 6.5 | 2025-05-22 | MedDream WEB DICOM Viewer Cleartext Transmission of Credentials Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to d… |
CVE-2025-3079 | High | 8.7 | 2025-05-20 | A passback vulnerability which relates to office/small office multifunction printers and laser printers. |
CVE-2025-3078 | High | 8.7 | 2025-05-20 | A passback vulnerability which relates to production printers and office multifunction printers. |
CVE-2025-4679 | Medium | 6.5 | 2025-05-16 | A vulnerability in Synology Active Backup for Microsoft 365 allows remote authenticated attackers to obtain sensitive information via unspecified vectors. |
CVE-2025-33093 | High | 7.5 | 2025-05-07 | IBM Sterling Partner Engagement Manager 6.1.0, 6.2.0, 6.2.2 JWT secret is stored in public Helm Charts and is not stored as a Kubernetes secret. |
CVE-2025-46820 | High | 7.1 | 2025-05-06 | phpgt/Dom provides access to modern DOM APIs. Versions of phpgt/Dom prior to 4.1.8 expose the GITHUB_TOKEN in the Dom workflow run artifact. The ci.yml workflo… |
CVE-2025-2772 | Medium | 6.5 | 2025-04-23 | BEC Technologies Multiple Routers Insufficiently Protected Credentials Information Disclosure Vulnerability. This vulnerability allows network-adjacent attacke… |
CVE-2025-32963 | | 2025-04-22 | MinIO Operator STS is a native IAM Authentication for Kubernetes. Prior to version 7.1.0, if no audiences are provided for the `spec.audiences` field, the defa… | |
CVE-2025-28228 | High | 7.5 | 2025-04-18 | A credential exposure vulnerability in Electrolink 500W, 1kW, 2kW Medium DAB Transmitter Web v01.09, v01.08, v01.07, and Display v1.4, v1.2 allows unauthorized… |
CVE-2025-22372 | | 2025-04-14 | Insufficiently Protected Credentials vulnerability in SicommNet BASEC on SaaS allows Password Recovery. Passwords are either stored in plain text using reversi… | |
CVE-2025-27192 | Low | 2.7 | 2025-04-08 | Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Insufficiently Protected Credentials vulnerability… |
CVE-2025-26628 | High | 7.3 | 2025-04-08 | Insufficiently protected credentials in Azure Local Cluster allows an authorized attacker to disclose information locally. |
CVE-2025-2908 | | 2025-03-28 | The exposure of credentials in the call forwarding configuration module in MeetMe products in versions prior to 2024-09 allows an attacker to gain access to so… | |
CVE-2025-2311 | Critical | 9.0 | 2025-03-20 | Incorrect Use of Privileged APIs, Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in Sechard Information Te… |
CVE-2025-25650 | Critical | 9.1 | 2025-03-17 | An issue in the storage of NFC card data in Dorset DG 201 Digital Lock H5_433WBSK_v2.2_220605 allows attackers to produce cloned NFC cards to bypass authentica… |
CVE-2025-2277 | High | 7.5 | 2025-03-13 | Exposure of password in web-based SSH authentication component in Devolutions Server 2024.3.13 and earlier allows a user to unadvertently leak his SSH password… |
CVE-2025-27926 | Medium | 4.3 | 2025-03-10 | In Nintex Automation 5.6 and 5.7 before 5.8, the K2 SmartForms Designer folder has configuration files (web.config) containing passwords that are readable by u… |
CVE-2024-47109 | Medium | 5.3 | 2025-03-10 | IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.3 UI could disclosure the installation path of the server which could aid in furthe… |
CVE-2025-1886 | | 2025-03-07 | Pass-Back vulnerability in versions prior to 2025.35.000 of Sage 200 Spain. This vulnerability allows an authenticated attacker with administrator privileges t… | |
CVE-2024-12799 | | 2025-03-05 | Insufficiently Protected Credentials vulnerability in OpenText Identity Manager Advanced Edition on Windows, Linux, 64 bit allows Privilege Abuse. This vulnera… | |
CVE-2025-27650 | Critical | 9.8 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Private Keys in Docker Overlay V-2023-013. |
CVE-2025-27648 | Critical | 9.8 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.913 Application 20.0.2253 allows Cross Tenant Password Exposure V-2024-003. |
CVE-2024-41771 | High | 7.5 | 2025-03-03 | IBM Engineering Requirements Management DOORS Next 7.0.2, 7.0.3, and 7.1 could allow a remote attacker to download temporary files which could expose applicati… |
CVE-2024-41770 | High | 7.5 | 2025-03-03 | IBM Engineering Requirements Management DOORS Next 7.0.2, 7.0.3, and 7.1 could allow a remote attacker to download temporary files which could expose applicati… |
CVE-2024-44754 | Medium | 6.8 | 2025-02-28 | Cryptographic key extraction from internal flash in Minut M2 with firmware version #15142 allows physically proximate attackers to inject modified firmware int… |
CVE-2025-25570 | Critical | 9.8 | 2025-02-27 | Vue Vben Admin 2.10.1 allows unauthorized login to the backend due to an issue with hardcoded credentials. |
CVE-2024-38291 | High | 8.8 | 2025-02-27 | In XIQ-SE before 24.2.11, a low-privileged user may be able to access admin passwords, which could lead to privilege escalation. |
CVE-2025-0760 | Low | 2.7 | 2025-02-26 | A Credential Disclosure vulnerability exists where an administrator could extract the stored SMTP account credentials due to lack of encryption. |
CVE-2024-37362 | Medium | 6.3 | 2025-02-20 | The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. (… |
CVE-2025-0867 | Critical | 9.9 | 2025-02-14 | The standard user uses the run as function to start the MEAC applications with administrative privileges. To ensure that the system can startup on its own, the… |
CVE-2025-26492 | High | 7.7 | 2025-02-11 | In JetBrains TeamCity before 2024.12.2 improper Kubernetes connection settings could expose sensitive resources |
CVE-2024-43779 | High | 7.7 | 2025-02-06 | An information disclosure vulnerability exists in the Vault API functionality of ClearML Enterprise Server 3.22.5-1533. A specially crafted HTTP request can le… |
CVE-2025-0890 | Critical | 9.8 | 2025-02-04 | **UNSUPPORTED WHEN ASSIGNED** Insecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_201… |
CVE-2024-12511 | High | 7.6 | 2025-02-03 | With address book access, SMB/FTP settings could be modified, redirecting scans and possibly capturing credentials. This requires enabled scan functions and pr… |
CVE-2025-0498 | Critical | 9.8 | 2025-01-30 | A data exposure vulnerability exists in all versions prior to V15.00.001 of Rockwell Automation FactoryTalk® AssetCentre. The vulnerability exists due to insec… |
CVE-2025-0497 | Critical | 9.8 | 2025-01-30 | A data exposure vulnerability exists in all versions prior to V15.00.001 of Rockwell Automation FactoryTalk® AssetCentre. The vulnerability exists due to stori… |
CVE-2025-0477 | Critical | 9.8 | 2025-01-30 | An encryption vulnerability exists in all versions prior to V15.00.001 of Rockwell Automation FactoryTalk® AssetCentre. The vulnerability exists due to a weak… |
CVE-2024-57395 | Critical | 9.8 | 2025-01-29 | Password Vulnerability in Safety production process management system v1.0 allows a remote attacker to escalate privileges, execute arbitrary code and obtain s… |
CVE-2024-23733 | High | 7.5 | 2025-01-29 | The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before Core_Fix7 allows remote attackers to reach… |
CVE-2023-50945 | Medium | 6.2 | 2025-01-26 | IBM Common Licensing 9.0 stores user credentials in plain clear text which can be read by a local user. |
CVE-2025-0619 | Medium | 4.9 | 2025-01-23 | Unsafe password recovery from configuration in M-Files Server before 25.1 allows a highly privileged user to recover external connector passwords |
CVE-2024-42012 | Medium | 5.7 | 2025-01-22 | GRAU DATA Blocky before 3.1 stores passwords encrypted rather than hashed. At the login screen, the user's password is compared to the user's decrypted clearte… |