CWE-522 · Insufficiently Protected Credentials (page 5)
Page 5 of 15 — CVEs classified under CWE-522, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-34147 | Medium | 4.3 | 2024-05-02 | Jenkins Telegram Bot Plugin 1.4.0 and earlier stores the Telegram Bot token unencrypted in its global configuration file on the Jenkins controller where it can… |
CVE-2024-28961 | Medium | 6.3 | 2024-04-29 | Dell OpenManage Enterprise, versions 4.0.0 and 4.0.1, contains a sensitive information disclosure vulnerability. A local low privileged malicious user could po… |
CVE-2024-28325 | Medium | 6.1 | 2024-04-26 | Asus RT-N12+ B1 router stores credentials in cleartext, which could allow local attackers to obtain unauthorized access and modify router settings. |
CVE-2024-32238 | Critical | 9.8 | 2024-04-22 | H3C ER8300G2-X is vulnerable to Incorrect Access Control. The password for the router's management system can be accessed via the management system page login… |
CVE-2023-37400 | High | 7.8 | 2024-04-19 | IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to escalate their privileges due to insecure credential storage. IBM X-Force ID: 259677. |
CVE-2024-29992 | Medium | 5.5 | 2024-04-09 | Azure Identity Library for .NET Information Disclosure Vulnerability |
CVE-2023-41677 | High | 7.5 | 2024-04-09 | A insufficiently protected credentials in Fortinet FortiProxy 7.4.0, 7.2.0 through 7.2.6, 7.0.0 through 7.0.12, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1… |
CVE-2024-20282 | Medium | 6.0 | 2024-04-03 | A vulnerability in Cisco Nexus Dashboard could allow an authenticated, local attacker with valid rescue-user credentials to elevate privileges to root on an af… |
CVE-2023-50311 | Low | 3.1 | 2024-03-31 | IBM CICS Transaction Gateway for Multiplatforms 9.2 and 9.3 could disclose sensitive path information to an attacker that could reveal through debugging or err… |
CVE-2024-29216 | Medium | 6.1 | 2024-03-25 | Exposed IOCTL with insufficient access control issue exists in cg6kwin2k.sys prior to 2.1.7.0. By sending a specific IOCTL request, a user without the administ… |
CVE-2024-29071 | High | 8.8 | 2024-03-25 | HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue. A network-adjacent unauthenticated attacker may change the system settings. |
CVE-2022-47037 | High | 7.5 | 2024-03-18 | Siklu TG Terragraph devices before 2.1.1 allow attackers to discover valid, randomly generated credentials via GetCredentials. |
CVE-2021-38938 | Medium | 6.2 | 2024-03-15 | IBM Host Access Transformation Services (HATS) 9.6 through 9.6.1.4 and 9.7 through 9.7.0.3 stores user credentials in plain clear text which can be read by a l… |
CVE-2024-0368 | High | 8.6 | 2024-03-13 | The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and i… |
CVE-2024-28110 | High | 7.5 | 2024-03-06 | Go SDK for CloudEvents is the official CloudEvents SDK to integrate applications with CloudEvents. Prior to version 2.15.2, using cloudevents.WithRoundTripper… |
CVE-2024-21815 | Critical | 9.1 | 2024-03-05 | Insufficiently protected credentials (CWE-522) for third party DVR integrations to the Command Centre Server are accessible to authenticated but unprivileged… |
CVE-2023-50436 | Medium | 5.3 | 2024-02-29 | An issue was discovered in Couchbase Server before 7.2.4. ns_server admin credentials are leaked in encoded form in the diag.log file. The earliest affected ve… |
CVE-2024-26133 | Medium | 5.5 | 2024-02-21 | EventStoreDB (ESDB) is an operational database built to store events. A vulnerability has been identified in the projections subsystem in versions 20 prior to… |
CVE-2023-6259 | High | 7.1 | 2024-02-19 | Insufficiently Protected Credentials, : Improper Access Control vulnerability in Brivo ACS100, ACS300 allows Password Recovery Exploitation, Bypassing Physical… |
CVE-2023-4538 | Medium | 6.2 | 2024-02-15 | The database access credentials configured during installation are stored in a special table, and are encrypted with a shared key, same among all Comarch ERP X… |
CVE-2024-23306 | High | 7.1 | 2024-02-14 | A vulnerability exists in BIG-IP Next CNF and SPK systems that may allow access to undisclosed sensitive files. Note: Software versions which have reached End… |
CVE-2023-27975 | High | 7.1 | 2024-02-14 | CWE-522: Insufficiently Protected Credentials vulnerability exists that could cause unauthorized access to the project file in EcoStruxure Control Expert when… |
CVE-2023-32280 | Medium | 5.3 | 2024-02-14 | Insufficiently protected credentials in some Intel(R) Server Product OpenBMC firmware before versions egs-1.05 may allow an unauthenticated user to enable info… |
CVE-2022-34311 | Medium | 4.3 | 2024-02-12 | IBM CICS TX Standard and Advanced 11.1 could allow a user with physical access to the web browser to gain access to the user's session due to insufficiently pr… |
CVE-2022-38714 | Medium | 4.9 | 2024-02-12 | IBM DataStage on Cloud Pak for Data 4.0.6 to 4.5.2 stores sensitive credential information that can be read by a privileged user. IBM X-Force ID: 235060. |
CVE-2024-22312 | Medium | 4.4 | 2024-02-10 | IBM Storage Defender - Resiliency Service 2.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 278748. |
CVE-2023-50291 | High | 7.5 | 2024-02-09 | Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of… |
CVE-2024-24595 | Medium | 6.0 | 2024-02-05 | Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaking all user email… |
CVE-2024-21869 | Medium | 6.2 | 2024-02-02 | In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the affected product stores plaintext credentials in various places. This may allow an att… |
CVE-2023-29055 | High | 7.5 | 2024-01-29 | In Apache Kylin version 2.0.0 to 4.0.3, there is a Server Config web interface that displays the content of file 'kylin.properties', that may contain serversid… |
CVE-2024-22432 | High | 7.8 | 2024-01-25 | Networker 19.9 and all prior versions contains a Plain-text Password stored in temporary config file during backup duration in NMDA MySQL Database backups. Us… |
CVE-2023-6573 | Medium | 5.5 | 2024-01-23 | HPE OneView may have a missing passphrase during restore. |
CVE-2023-49106 | Medium | 4.6 | 2024-01-16 | Missing Password Field Masking vulnerability in Hitachi Device Manager on Windows, Linux (Device Manager Agent component).This issue affects Hitachi Device Man… |
CVE-2023-50125 | Medium | 5.9 | 2024-01-11 | A default engineer password set on the Hozard alarm system (Alarmsysteem) v1.0 allows an attacker to bring the alarm system to a disarmed state. |
CVE-2023-29447 | Medium | 5.7 | 2024-01-10 | An insufficiently protected credentials vulnerability in KEPServerEX could allow an adversary to capture user credentials as the web server uses basic authenti… |
CVE-2023-6421 | High | 7.5 | 2024-01-01 | The Download Manager WordPress plugin before 3.2.83 does not protect file download's passwords, leaking it upon receiving an invalid one. |
CVE-2022-39820 | Medium | 6.5 | 2023-12-25 | In Network Element Manager in NOKIA NFM-T R19.9, an Unprotected Storage of Credentials vulnerability occurs under /root/RestUploadManager.xml.DRC and /DEPOT/KE… |
CVE-2023-47741 | Medium | 5.3 | 2023-12-18 | IBM i 7.3, 7.4, 7.5, IBM i Db2 Mirror for i 7.4 and 7.5 web browser clients may leave clear-text passwords in browser memory that can be viewed using common b… |
CVE-2023-6791 | Medium | 4.9 | 2023-12-13 | A credential disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to obtain the plaintext credential… |
CVE-2023-50770 | Medium | 6.7 | 2023-12-13 | Jenkins OpenId Connect Authentication Plugin 2.6 and earlier stores a password of a local user account used as an anti-lockout feature in a recoverable format… |
CVE-2023-47577 | Critical | 9.8 | 2023-12-13 | An issue discovered in Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 allows for unauthorized password changes due to no check for current password. |
CVE-2018-16153 | High | 7.5 | 2023-12-12 | An issue was discovered in Apereo Opencast 4.x through 10.x before 10.6. It sends system digest credentials during authentication attempts to arbitrary externa… |
CVE-2023-47722 | Medium | 6.2 | 2023-12-09 | IBM API Connect V10.0.5.3 and V10.0.6.0 stores user credentials in browser cache which can be read by a local user. IBM X-Force ID: 271912. |
CVE-2023-32268 | High | 7.2 | 2023-12-06 | Exposure of Proxy Administrator Credentials An authenticated administrator equivalent Filr user can access the credentials of proxy administrators. |
CVE-2023-49280 | High | 7.7 | 2023-12-04 | XWiki Change Request is an XWiki application allowing to request changes on a wiki without publishing directly the changes. Change request allows to edit any p… |
CVE-2023-24047 | Medium | 6.8 | 2023-12-04 | An Insecure Credential Management issue discovered in Connectize AC21000 G6 641.139.1.1256 allows attackers to gain escalated privileges via use of weak hashin… |
CVE-2023-44300 | Medium | 5.5 | 2023-12-04 | Dell DM5500 5.14.0.0, contain a Plain-text Password Storage Vulnerability in the appliance. A local attacker with privileges could potentially exploit this… |
CVE-2023-49653 | Medium | 6.5 | 2023-11-29 | Jenkins Jira Plugin 3.11 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access a… |
CVE-2023-6254 | High | 8.1 | 2023-11-27 | A Vulnerability in OTRS AgentInterface and ExternalInterface allows the reading of plain text passwords which are send back to the client in the server respons… |
CVE-2023-44303 | High | 7.5 | 2023-11-24 | RVTools, Version 3.9.2 and above, contain a sensitive data exposure vulnerability in the password encryption utility (RVToolsPasswordEncryption.exe) and main… |
CVE-2023-41676 | Medium | 4.3 | 2023-11-14 | An exposure of sensitive information to an unauthorized actor [CWE-200] in FortiSIEM version 7.0.0 and before 6.7.5 may allow an attacker with access to windo… |
CVE-2023-26221 | Medium | 5.0 | 2023-11-08 | The Spotfire Connectors component of TIBCO Software Inc.'s Spotfire Analyst, Spotfire Server, and Spotfire for AWS Marketplace contains an easily exploitable v… |
CVE-2023-38548 | Medium | 4.3 | 2023-11-07 | A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of the account used by… |
CVE-2023-38328 | Medium | 4.9 | 2023-10-26 | An issue was discovered in eGroupWare 17.1.20190111. An Improper Password Storage vulnerability affects the setup panel of under setup/manageheader.php, which… |
CVE-2020-17477 | Medium | 6.5 | 2023-10-26 | Incorrect LDAP ACLs in ucs-school-ldap-acls-master in UCS@school before 4.4v5-errata allow remote teachers, staff, and school administrators to read LDAP passw… |
CVE-2023-43905 | High | 7.5 | 2023-10-26 | Incorrect access control in writercms v1.1.0 allows attackers to directly obtain backend account passwords via unspecified vectors. |
CVE-2023-46651 | Medium | 6.5 | 2023-10-25 | Jenkins Warnings Plugin 10.5.0 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to ac… |
CVE-2023-46115 | High | 8.4 | 2023-10-20 | Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a… |
CVE-2023-5552 | High | 7.1 | 2023-10-18 | A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to decrypt PDFs in Sophos Firewall version… |
CVE-2023-27132 | Critical | 9.8 | 2023-10-17 | TSplus Remote Work 16.0.0.0 places a cleartext password on the "var pass" line of the HTML source code for the secure single sign-on web portal. NOTE: CVE-2023… |
CVE-2023-43777 | Medium | 5.9 | 2023-10-17 | Eaton easySoft software is used to program easy controllers and displays for configuring, programming and defining parameters for all the intelligent relays. T… |
CVE-2023-27315 | Medium | 6.5 | 2023-10-12 | SnapGathers versions prior to 4.9 are susceptible to a vulnerability which could allow a local authenticated attacker to discover plaintext domain user crede… |
CVE-2022-44758 | Medium | 6.5 | 2023-10-11 | BigFix Insights/IVR fixlet uses improper credential handling within certain fixlet content. An attacker can gain access to information that is not explicitly… |
CVE-2022-44757 | Medium | 6.5 | 2023-10-11 | BigFix Insights for Vulnerability Remediation (IVR) uses weak cryptography that can lead to credential exposure. An attacker could gain access to sensitive in… |
CVE-2022-42451 | Medium | 4.6 | 2023-10-11 | Certain credentials within the BigFix Patch Management Download Plug-ins are stored insecurely and could be exposed to a local privileged user. |
CVE-2023-23370 | Medium | 6.7 | 2023-10-06 | An insufficiently protected credentials vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local authent… |
CVE-2023-44158 | High | 7.5 | 2023-09-27 | Sensitive information disclosure due to insufficient token field masking. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before… |
CVE-2023-1633 | Medium | 6.6 | 2023-09-24 | A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to sens… |
CVE-2023-43634 | High | 8.8 | 2023-09-21 | When sealing/unsealing the “vault” key, a list of PCRs is used, which defines which PCRs are used. In a previous project, CYMOTIVE found that the configurati… |
CVE-2023-43633 | High | 8.8 | 2023-09-21 | On boot, the Pillar eve container checks for the existence and content of “/config/GlobalConfig/global.json”. If the file exists, it overrides the existing c… |
CVE-2023-43631 | High | 8.8 | 2023-09-21 | On boot, the Pillar eve container checks for the existence and content of “/config/authorized_keys”. If the file is present, and contains a supported public… |
CVE-2023-43635 | High | 8.8 | 2023-09-20 | Vault Key Sealed With SHA1 PCRs The measured boot solution implemented in EVE OS leans on a PCR locking mechanism. Different parts of the system update… |
CVE-2023-43630 | High | 8.8 | 2023-09-20 | PCR14 is not in the list of PCRs that seal/unseal the “vault” key, but due to the change that was implemented in commit “7638364bc0acf8b5c481b5ce5fea11ad44ad7f… |
CVE-2022-47561 | High | 7.3 | 2023-09-20 | The web application stores credentials in clear text in the "admin.xml" file, which can be accessed without logging into the website, which could allow an atta… |
CVE-2023-25532 | Medium | 6.5 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause insufficient protection of credentials. A successful exploit of this vulnerab… |
CVE-2023-25531 | High | 7.6 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause insufficient protection of credentials. A successful exploit of this vulnerab… |
CVE-2023-41010 | Medium | 5.5 | 2023-09-14 | Insecure Permissions vulnerability in Sichuan Tianyi Kanghe Communication Co., Ltd China Telecom Tianyi Home Gateway v.TEWA-700G allows a local attacker to obt… |
CVE-2023-32338 | Medium | 5.1 | 2023-09-05 | IBM Sterling Secure Proxy and IBM Sterling External Authentication Server 6.0.3 and 6.1.0 stores user credentials in plain clear text which can be read by a lo… |
CVE-2023-3251 | Medium | 4.1 | 2023-08-29 | A pass-back vulnerability exists where an authenticated, remote attacker with administrator privileges could uncover stored SMTP credentials within the Nessus… |
CVE-2022-45611 | Critical | 9.8 | 2023-08-22 | An issue was discovered in Fresenius Kabi PharmaHelp 5.1.759.0 allows attackers to gain escalated privileges via via capture of user login information. |
CVE-2023-40173 | High | 7.5 | 2023-08-18 | Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. Prior to version 1.0.5 Social media s… |
CVE-2023-31492 | Medium | 6.5 | 2023-08-17 | Zoho ManageEngine ADManager Plus version 7182 and prior disclosed the default passwords for the account restoration of unauthorized domains to the authenticate… |
CVE-2023-40347 | Medium | 6.5 | 2023-08-16 | Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin 1.14 and earlier does not set the appropriate context for credentials lookup, allowing attackers with… |
CVE-2023-40345 | Medium | 6.5 | 2023-08-16 | Jenkins Delphix Plugin 3.0.2 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Overall/Read permission to access… |
CVE-2023-4328 | Medium | 5.5 | 2023-08-15 | Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any local user on Windows |
CVE-2023-4327 | Medium | 5.5 | 2023-08-15 | Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any local user on Linux |
CVE-2023-20965 | Critical | 9.8 | 2023-08-14 | In processMessageImpl of ClientModeImpl.java, there is a possible credential disclosure in the TOFU flow due to a logic error in the code. This could lead to r… |
CVE-2023-36082 | Critical | 9.8 | 2023-08-03 | An isssue in GatesAIr Flexiva FM Transmitter/Exiter Fax 150W allows a remote attacker to gain privileges via the LDAP and SMTP credentials. |
CVE-2022-4926 | Medium | 6.5 | 2023-07-29 | Insufficient policy enforcement in Intents in Google Chrome on Android prior to 109.0.5414.119 allowed a remote attacker to bypass same origin policy via a cra… |
CVE-2023-35067 | High | 7.5 | 2023-07-25 | Plaintext Storage of a Password vulnerability in Infodrom Software E-Invoice Approval System allows Read Sensitive Strings Within an Executable. This issue af… |
CVE-2023-37362 | High | 7.2 | 2023-07-19 | Weintek Weincloud v0.13.6 could allow an attacker to abuse the registration functionality to login with testing credentials to the official website. |
CVE-2023-31824 | High | 7.5 | 2023-07-13 | An issue found in DERICIA Co. Ltd, DELICIA v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniap… |
CVE-2023-34128 | Critical | 9.8 | 2023-07-13 | Tomcat application credentials are hardcoded in SonicWall GMS and Analytics configuration file. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analyti… |
CVE-2023-37951 | Medium | 6.5 | 2023-07-12 | Jenkins mabl Plugin 0.0.46 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access… |
CVE-2023-36266 | Medium | 5.5 | 2023-07-12 | An issue was discovered in Keeper Password Manager for Desktop version 16.10.2 (fixed in 17.2), and the KeeperFill Browser Extensions version 16.5.4 (fixed in… |
CVE-2023-35348 | Medium | 6.5 | 2023-07-11 | Active Directory Federation Service Security Feature Bypass Vulnerability |
CVE-2023-36476 | High | 7.9 | 2023-06-29 | calamares-nixos-extensions provides Calamares branding and modules for NixOS, a distribution of GNU/Linux. Users of calamares-nixos-extensions version 0.3.12 a… |
CVE-2020-18406 | High | 7.5 | 2023-06-27 | An issue was discovered in cmseasy v7.0.0 that allows user credentials to be sent in clear text due to no encryption of form data. |
CVE-2023-28857 | Medium | 4.0 | 2023-06-27 | Apereo CAS is an open source multilingual single sign-on solution for the web. Apereo CAS can be configured to use authentication based on client X509 certific… |
CVE-2023-35789 | Medium | 5.5 | 2023-06-16 | An issue was discovered in the C AMQP client library (aka rabbitmq-c) through 0.13.0 for RabbitMQ. Credentials can only be entered on the command line (e.g., f… |