CWE-522 · Insufficiently Protected Credentials (page 4)
Page 4 of 15 — CVEs classified under CWE-522, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-23040 | Medium | 6.6 | 2025-01-15 | GitHub Desktop is an open-source Electron-based GitHub app designed for git development. An attacker convincing a user to clone a repository directly or throug… |
CVE-2024-46480 | High | 8.4 | 2025-01-13 | An NTLM hash leak in Venki Supravizio BPM up to 18.0.1 allows authenticated attackers with Application Administrator access to escalate privileges on the under… |
CVE-2024-42172 | Medium | 5.3 | 2025-01-11 | HCL MyXalytics is affected by broken authentication. It allows attackers to compromise keys, passwords, and session tokens, potentially leading to identity th… |
CVE-2025-21111 | High | 7.5 | 2025-01-08 | Dell VxRail, versions 8.0.000 through 8.0.311, contain(s) a Plaintext Storage of a Password vulnerability. A high privileged attacker with local access could p… |
CVE-2025-21102 | High | 7.5 | 2025-01-08 | Dell VxRail, versions 7.0.000 through 7.0.532, contain(s) a Plaintext Storage of a Password vulnerability. A high privileged attacker with local access could p… |
CVE-2024-56354 | Medium | 5.5 | 2024-12-20 | In JetBrains TeamCity before 2024.12 password field value were accessible to users with view settings permission |
CVE-2020-9250 | Low | 3.3 | 2024-12-20 | There is an insufficient authentication vulnerability in some Huawei smart phone. An unauthenticated, local attacker can crafts software package to exploit thi… |
CVE-2022-33954 | Medium | 4.6 | 2024-12-19 | IBM Robotic Process Automation 21.0.1, 21.0.2, and 21.0.3 could allow a user with psychical access to the system to obtain sensitive information due to insuffi… |
CVE-2024-49817 | Medium | 4.4 | 2024-12-17 | IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 stores user credentials in configuration files which can be read by a local privileged… |
CVE-2024-54471 | Medium | 5.5 | 2024-12-12 | This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. A malicious… |
CVE-2024-53292 | High | 7.2 | 2024-12-11 | Dell VxVerify, versions prior to x.40.405, contain a Plain-text Password Storage Vulnerability in the shell wrapper. A local high privileged attacker could pot… |
CVE-2024-46341 | High | 8.0 | 2024-12-10 | TP-Link TL-WR845N(UN)_V4_190219 was discovered to transmit credentials in base64 encoded form, which can be easily decoded by an attacker executing a man-in-th… |
CVE-2024-50699 | High | 8.0 | 2024-12-10 | TP-Link TL-WR845N(UN)_V4_201214, TL-WR845N(UN)_V4_200909 and TL-WR845N(UN)_V4_190219 were discovered to contain weak default credentials for the Administrator… |
CVE-2024-53832 | Medium | 4.6 | 2024-12-10 | A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V05.30). The affected devices contain a secure element which is… |
CVE-2024-40583 | Critical | 9.1 | 2024-12-09 | Pentaminds CuroVMS v2.0.1 was discovered to contain exposed credentials. |
CVE-2023-48010 | Critical | 9.8 | 2024-12-05 | STMicroelectronics SPC58 is vulnerable to Missing Protection Mechanism for Alternate Hardware Interface. Code running as Supervisor on the SPC58 PowerPC microc… |
CVE-2024-51546 | High | 7.5 | 2024-12-05 | Credentials Disclosure vulnerabilities allow access to on board project back-up bundles. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series… |
CVE-2024-51545 | Critical | 10.0 | 2024-12-05 | Username Enumeration vulnerabilities allow access to application level username add, delete, modify and list functions. Affected products: ABB ASPECT - Ente… |
CVE-2024-42457 | Medium | 6.5 | 2024-12-04 | A vulnerability in Veeam Backup & Replication allows users with certain operator roles to expose saved credentials by leveraging a combination of methods in a… |
CVE-2024-11856 | Low | 3.7 | 2024-12-02 | A security vulnerability in HPE IceWall products could be exploited remotely to cause Unauthorized Data Modification. |
CVE-2019-17082 | | 2024-11-26 | Insufficiently Protected Credentials vulnerability in OpenText™ AccuRev allows Authentication Bypass. When installed on a Linux or Solaris system the vulnerab… | |
CVE-2024-11703 | Medium | 5.7 | 2024-11-26 | On Android, Firefox may have inadvertently allowed viewing saved passwords without the required device PIN authentication. This vulnerability affects Firefox <… |
CVE-2024-6749 | Medium | 6.3 | 2024-11-26 | Seth Fogie, member of the AXIS Camera Station Pro Bug Bounty Program, has found that the Incident report feature may expose sensitive credentials on the AXIS C… |
CVE-2024-47142 | Medium | 5.5 | 2024-11-22 | AIPHONE IXG SYSTEM IXG-2C7 firmware Ver.2.03 and earlier and IXG-2C7-L firmware Ver.2.03 and earlier contain an issue with insufficiently protected credentials… |
CVE-2024-39290 | Medium | 6.5 | 2024-11-22 | Insufficiently protected credentials issue exists in AIPHONE IX SYSTEM and IXG SYSTEM. A network-adjacent unauthenticated attacker may obtain sensitive informa… |
CVE-2021-1232 | Medium | 6.5 | 2024-11-18 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to read arbitrary fil… |
CVE-2022-45157 | Critical | 9.1 | 2024-11-13 | A vulnerability has been identified in the way that Rancher stores vSphere's CPI (Cloud Provider Interface) and CSI (Container Storage Interface) credentials u… |
CVE-2024-47588 | Medium | 4.7 | 2024-11-12 | In SAP NetWeaver Java (Software Update Manager 1.1), under certain conditions when a software upgrade encounters errors, credentials are written in plaintext t… |
CVE-2024-51240 | High | 8.0 | 2024-11-05 | An issue in the luci-mod-rpc package in OpenWRT Luci LTS allows for privilege escalation from an admin account to root via the JSON-RPC-API, which is exposed b… |
CVE-2024-34885 | Medium | 6.8 | 2024-11-04 | Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to read SMTP accounts passwords via… |
CVE-2024-34887 | Medium | 4.9 | 2024-11-04 | Insufficiently protected credentials in AD/LDAP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to send AD/LDAP administrators ac… |
CVE-2024-34883 | Medium | 4.9 | 2024-11-04 | Insufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100 allow remote administrators to read proxy-server accounts password… |
CVE-2024-34882 | Medium | 4.9 | 2024-11-04 | Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to send SMTP account passwords to an… |
CVE-2023-50310 | Medium | 4.9 | 2024-10-23 | IBM CICS Transaction Gateway for Multiplatforms 9.2 and 9.3 transmits or stores authentication credentials, but it uses an insecure method that is susceptible… |
CVE-2024-43812 | High | 8.4 | 2024-10-22 | Kieback & Peter's DDC4000 series has an insufficiently protected credentials vulnerability, which may allow an unauthenticated attacker with access to /etc/pas… |
CVE-2024-9677 | Medium | 5.5 | 2024-10-22 | The insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H series uOS firmware version V1.21 and earlier versions could allow… |
CVE-2024-44000 | Critical | 9.8 | 2024-10-20 | Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Authentication Bypass.This issue affects Li… |
CVE-2024-7755 | High | 8.2 | 2024-10-17 | The EWON FLEXY 202 transmits credentials using a weak encoding method base64. An attacker who is present in the network can sniff the traffic and decode the cr… |
CVE-2024-49396 | | 2024-10-17 | The affected product is vulnerable due to insufficiently protected credentials, which may allow an attacker to impersonate Elvaco and send false information. | |
CVE-2024-20462 | Medium | 5.5 | 2024-10-16 | A vulnerability in the web-based management interface of Cisco ATA 190 Series Multiplatform Analog Telephone Adapter firmware could allow an authenticated, loc… |
CVE-2024-47161 | Medium | 4.3 | 2024-10-08 | In JetBrains TeamCity before 2024.07.3 password could be exposed via Sonar runner REST API |
CVE-2024-47805 | High | 7.5 | 2024-10-02 | Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentials using the `Secr… |
CVE-2024-37187 | Medium | 5.7 | 2024-09-27 | Advantech ADAM-5550 share user credentials with a low level of encryption, consisting of base 64 encoding. |
CVE-2024-34542 | Medium | 5.7 | 2024-09-27 | Advantech ADAM-5630 shares user credentials plain text between the device and the user source device during the login process. |
CVE-2024-45744 | Low | 3.0 | 2024-09-27 | TopQuadrant TopBraid EDG stores external credentials insecurely. An authenticated attacker with file system access can read edg-setup.properites and obtain the… |
CVE-2024-31899 | Medium | 4.3 | 2024-09-26 | IBM Cognos Command Center 10.2.4.1 and 10.2.5 could disclose highly sensitive user information to an authenticated user with physical access to the device. |
CVE-2024-9014 | Critical | 9.9 | 2024-09-23 | pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the c… |
CVE-2024-40703 | Medium | 5.5 | 2024-09-22 | IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and IBM Cognos Analytics Reports for iOS 11.0.0.7 could allow a lo… |
CVE-2024-47162 | Medium | 4.1 | 2024-09-19 | In JetBrains YouTrack before 2024.3.44799 token could be revealed on Imports page |
CVE-2024-8986 | | 2024-09-19 | The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the repository URI for the plugin being built, as retrieved… | |
CVE-2024-8777 | High | 7.5 | 2024-09-16 | OMFLOW from The SYSCOM Group has an information leakage vulnerability, allowing unauthorized remote attackers to read arbitrary system configurations. If LDAP… |
CVE-2024-31415 | Medium | 6.3 | 2024-09-13 | The Eaton Foreseer software provides the feasibility for the user to configure external servers for multiple purposes such as network management, user manageme… |
CVE-2024-28981 | High | 8.5 | 2024-09-12 | Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.8, including 8.3.x, discloses database passwords when searching metadat… |
CVE-2024-20489 | High | 8.4 | 2024-09-11 | A vulnerability in the storage method of the PON Controller configuration file could allow an authenticated, local attacker with low privileges to obtain the M… |
CVE-2024-44815 | Medium | 4.6 | 2024-09-10 | Vulnerability in Hathway Skyworth Router CM5100 v.4.1.1.24 allows a physically proximate attacker to obtain user credentials via SPI flash Firmware W25Q64JV. |
CVE-2024-40710 | High | 8.8 | 2024-09-07 | A series of related high-severity vulnerabilities, the most notable enabling remote code execution (RCE) as the service account and extraction of sensitive inf… |
CVE-2024-39278 | Medium | 4.2 | 2024-09-05 | Credentials to access device configuration information stored unencrypted in flash memory. These credentials would allow read-only access to network configurat… |
CVE-2023-49233 | High | 8.8 | 2024-09-03 | Insufficient access checks in Visual Planning Admin Center 8 before v.1 Build 240207 allow attackers in possession of a non-administrative Visual Planning acco… |
CVE-2024-40704 | Medium | 4.9 | 2024-08-15 | IBM InfoSphere Information Server 11.7 could allow a privileged user to obtain sensitive information from authentication request headers. IBM X-Force ID: 29… |
CVE-2024-31800 | Medium | 6.8 | 2024-08-15 | Authentication Bypass in GNCC's GC2 Indoor Security Camera 1080P allows an attacker with physical access to gain a privileged command shell via the UART Debugg… |
CVE-2024-7813 | Medium | 5.3 | 2024-08-15 | A vulnerability, which was classified as problematic, has been found in SourceCodester Prison Management System 1.0. This issue affects some unknown processing… |
CVE-2024-39818 | High | 7.5 | 2024-08-14 | Protection mechanism failure for some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct information disclosure via network access. |
CVE-2024-36460 | High | 8.1 | 2024-08-12 | The front-end audit log allows viewing of unprotected plaintext passwords, where the passwords are displayed in plain text. |
CVE-2024-6118 | Critical | 9.1 | 2024-08-05 | A Plaintext Storage of a Password vulnerability in ebooknote function in Hamastar MeetingHub Paperless Meetings 2021 allows remote attackers to obtain the othe… |
CVE-2024-7389 | High | 7.5 | 2024-08-02 | The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.29.1 via class-forminator-addon-hub… |
CVE-2024-3082 | Medium | 4.2 | 2024-07-31 | A “CWE-256: Plaintext Storage of a Password” affecting the administrative account allows an attacker with physical access to the machine to retrieve the passwo… |
CVE-2024-6492 | High | 7.4 | 2024-07-16 | Exposure of Sensitive Information in edge browser session proxy feature in Devolutions Remote Desktop Manager 2024.2.14.0 and earlier on Windows allows an atta… |
CVE-2024-39733 | Medium | 5.5 | 2024-07-14 | IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 29… |
CVE-2024-38453 | High | 7.5 | 2024-07-03 | The Avalara for Salesforce CPQ app before 7.0 for Salesforce allows attackers to read an API key. NOTE: the current version is 11 as of mid-2024. |
CVE-2023-41926 | High | 8.8 | 2024-07-02 | The webserver utilizes basic authentication for its user login to the configuration interface. As encryption is disabled on port 80, it enables potential eaves… |
CVE-2024-39879 | Medium | 5.0 | 2024-07-01 | In JetBrains TeamCity before 2024.03.3 application token could be exposed in EC2 Cloud Profile settings |
CVE-2024-39878 | Medium | 4.1 | 2024-07-01 | In JetBrains TeamCity before 2024.03.3 private key could be exposed via testing GitHub App Connection |
CVE-2024-38505 | Medium | 5.3 | 2024-06-18 | In JetBrains YouTrack before 2024.2.34646 user access token was sent to the third-party site |
CVE-2024-30119 | Low | 3.7 | 2024-06-14 | HCL DRYiCE Optibot Reset Station is impacted by a missing Strict Transport Security Header. This could allow an attacker to intercept or manipulate data durin… |
CVE-2024-38285 | | 2024-06-13 | Logs storing credentials are insufficiently protected and can be decoded through the use of open source tools. | |
CVE-2024-38282 | | 2024-06-13 | Utilizing default credentials, an attacker is able to log into the camera's operating system which could allow changes to be made to the operations or shutdown… | |
CVE-2024-25052 | Medium | 4.4 | 2024-06-13 | IBM Jazz Reporting Service 7.0.3 stores user credentials in plain clear text which can be read by an admin user. IBM X-Force ID: 283363. |
CVE-2024-26330 | Medium | 6.5 | 2024-06-11 | An issue was discovered in Kape CyberGhostVPN 8.4.3.12823 on Windows. After a successful logout, user credentials remain in memory while the process is still o… |
CVE-2024-35208 | Medium | 6.3 | 2024-06-11 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected web server stored the password in cleart… |
CVE-2024-37051 | Critical | 9.3 | 2024-06-10 | GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 202… |
CVE-2024-5657 | Low | 3.7 | 2024-06-06 | The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitti… |
CVE-2024-36127 | High | 7.5 | 2024-06-03 | apko is an apk-based OCI image builder. apko exposures HTTP basic auth credentials from repository and keyring URLs in log output. This vulnerability is fixed… |
CVE-2024-5176 | | 2024-05-31 | Insufficiently Protected Credentials vulnerability in Baxter Welch Allyn Configuration Tool may allow Remote Services with Stolen Credentials.This issue affect… | |
CVE-2024-33849 | Medium | 6.5 | 2024-05-28 | ci solution CI-Out-of-Office Manager through 6.0.0.77 uses a Hard-coded Cryptographic Key. |
CVE-2024-35192 | Medium | 5.5 | 2024-05-20 | Trivy is a security scanner. Prior to 0.51.2, if a malicious actor is able to trigger Trivy to scan container images from a crafted malicious registry, it coul… |
CVE-2024-36081 | Critical | 9.8 | 2024-05-19 | Westermo EDW-100 devices through 2024-05-03 allow an unauthenticated user to download a configuration file containing a cleartext password. NOTE: this is a ser… |
CVE-2024-23583 | Medium | 6.7 | 2024-05-17 | An attacker could potentially intercept credentials via the task manager and perform unauthorized access to the Client Deploy Tool on Windows systems. |
CVE-2024-27109 | High | 7.6 | 2024-05-14 | Insufficiently protected credentials in GE HealthCare EchoPAC products |
CVE-2024-33497 | Medium | 6.3 | 2024-05-14 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (… |
CVE-2024-33496 | Medium | 6.3 | 2024-05-14 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (… |
CVE-2024-22345 | Medium | 6.2 | 2024-05-14 | IBM TXSeries for Multiplatforms 8.2 transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized intercep… |
CVE-2023-42955 | Medium | 4.9 | 2024-05-14 | Claris International has successfully resolved an issue of potentially exposing password information to front-end websites when signed in to the Admin Console… |
CVE-2024-28971 | Low | 3.5 | 2024-05-08 | Dell Update Manager Plugin, versions 1.4.0 through 1.5.0, contains a Plain-text Password Storage Vulnerability in Log file. A remote high privileged attacker c… |
CVE-2024-22266 | Medium | 6.5 | 2024-05-08 | VMware Avi Load Balancer contains an information disclosure vulnerability. A malicious actor with access to the system logs can view cloud connection credenti… |
CVE-2024-23551 | Medium | 6.5 | 2024-05-07 | Database scanning using username and password stores the credentials in plaintext or encoded format within files at the endpoint. This has been identified as a… |
CVE-2024-4536 | Medium | 6.8 | 2024-05-07 | In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component ( https://github.com/eclipse-edc/Connector ), an attacker might obt… |
CVE-2024-29941 | High | 8.0 | 2024-05-06 | Insecure storage of the ICT MIFARE and DESFire encryption keys in the firmware binary allows malicious actors to create credentials for any site code and card… |
CVE-2023-40511 | High | 7.5 | 2024-05-03 | LG Simple Editor checkServer Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations… |
CVE-2023-40510 | High | 7.5 | 2024-05-03 | LG Simple Editor getServerSetting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installa… |
CVE-2024-3543 | Medium | 6.4 | 2024-05-02 | Use of reversible password encryption algorithm allows attackers to decrypt passwords. Sensitive information can be easily unencrypted by the attacker, stole… |