CWE-522 · Insufficiently Protected Credentials (page 6)
Page 6 of 15 — CVEs classified under CWE-522, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-47376 | High | 7.3 | 2023-06-13 | The Alaris Infusion Central software, versions 1.1 to 1.3.2, may contain a recoverable password after the installation. No patient health data is stored in the… |
CVE-2023-33620 | Medium | 5.9 | 2023-06-13 | GL.iNET GL-AR750S-Ext firmware v3.215 uses an insecure protocol in its communications which allows attackers to eavesdrop via a man-in-the-middle attack. |
CVE-2023-26204 | Low | 3.7 | 2023-06-13 | A plaintext storage of a password vulnerability [CWE-256] in FortiSIEM 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions, 6.3 all versions… |
CVE-2023-29168 | Low | 3.7 | 2023-06-07 | The local Vuforia web application does not support HTTPS, and federated credentials are passed via basic authentication. |
CVE-2023-27126 | Medium | 4.6 | 2023-06-06 | The AES Key-IV pair used by the TP-Link TAPO C200 camera V3 (EU) on firmware version 1.1.22 Build 220725 is reused across all cameras. An attacker with physica… |
CVE-2023-22862 | Medium | 5.9 | 2023-06-05 | IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5 transmits authentication credentials, but it uses an insecure method that is susceptible to unauthorized in… |
CVE-2023-25740 | High | 8.8 | 2023-06-02 | After downloading a Windows <code>.scf</code> script from the local filesystem, an attacker could supply a remote path that would lead to unexpected network re… |
CVE-2023-31187 | Medium | 6.5 | 2023-05-30 | Avaya IX Workforce Engagement v15.2.7.1195 - CWE-522: Insufficiently Protected Credentials |
CVE-2023-32687 | High | 7.7 | 2023-05-29 | tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12.1, instance users with the list chat bots permiss… |
CVE-2023-33263 | High | 7.5 | 2023-05-25 | In WFTPD 3.25, usernames and password hashes are stored in an openly viewable wftpd.ini configuration file within the WFTPD directory. NOTE: this is a product… |
CVE-2023-2881 | Medium | 4.9 | 2023-05-25 | Storing Passwords in a Recoverable Format in GitHub repository pimcore/customer-data-framework prior to 3.3.10. |
CVE-2023-33264 | Medium | 4.3 | 2023-05-22 | In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuration properly. This al… |
CVE-2023-1763 | Medium | 6.5 | 2023-05-17 | Canon IJ Network Tool/Ver.4.7.5 and earlier (supported OS: OS X 10.9.5-macOS 13),IJ Network Tool/Ver.4.7.3 and earlier (supported OS: OS X 10.7.5-OS X 10.8) al… |
CVE-2023-2633 | Medium | 4.3 | 2023-05-16 | Jenkins Code Dx Plugin 3.1.0 and earlier does not mask Code Dx server API keys displayed on the configuration form, increasing the potential for attackers to o… |
CVE-2023-2632 | Medium | 4.3 | 2023-05-16 | Jenkins Code Dx Plugin 3.1.0 and earlier stores Code Dx server API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed… |
CVE-2023-33000 | High | 7.5 | 2023-05-16 | Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.149 and earlier does not mask credentials displayed on the configuration form, increasing the pote… |
CVE-2023-32988 | Medium | 4.3 | 2023-05-16 | A missing permission check in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers with Overall/Read permission to enumerate credenti… |
CVE-2022-47880 | Medium | 5.3 | 2023-05-12 | An Information disclosure vulnerability in /be/rpc.php in Jedox GmbH Jedox 2020.2.5 allow remote, authenticated users with permissions to modify database conne… |
CVE-2022-40685 | Medium | 6.5 | 2023-05-10 | Insufficiently protected credentials in the Intel(R) DCM software before version 5.0.1 may allow an authenticated user to potentially enable information disclo… |
CVE-2023-20046 | High | 8.8 | 2023-05-09 | A vulnerability in the key-based SSH authentication feature of Cisco StarOS Software could allow an authenticated, remote attacker to elevate privileges on an… |
CVE-2023-31136 | Low | 3.7 | 2023-05-09 | PostgresNIO is a Swift client for PostgreSQL. Any user of PostgresNIO prior to version 1.14.2 connecting to servers with TLS enabled is vulnerable to a man-in-… |
CVE-2023-28764 | Low | 3.7 | 2023-05-09 | SAP BusinessObjects Platform - versions 420, 430, Information design tool transmits sensitive information as cleartext in the binaries over the network. This c… |
CVE-2023-24506 | High | 7.5 | 2023-05-08 | Milesight NCR/camera version 71.8.0.6-r5 exposes credentials through an unspecified request. |
CVE-2022-45859 | Medium | 4.1 | 2023-05-03 | An insufficiently protected credentials vulnerability [CWE-522] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.0 all vers… |
CVE-2023-25495 | Medium | 4.9 | 2023-04-28 | A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password used by XCC to authenticate to an extern… |
CVE-2023-2335 | Medium | 6.5 | 2023-04-27 | Plaintext Password in Registry vulnerability in 42gears surelock windows surelockwinsetupv2.40.0.Exe on Windows (Registery modules) allows Retrieve Admin… |
CVE-2023-1778 | Critical | 10.0 | 2023-04-27 | This vulnerability exists in GajShield Data Security Firewall firmware versions prior to v4.28 (except v4.21) due to insecure default credentials which allows… |
CVE-2023-30846 | Critical | 9.1 | 2023-04-26 | typed-rest-client is a library for Node Rest and Http Clients with typings for use with TypeScript. Users of the typed-rest-client library version 1.7.3 or low… |
CVE-2023-26567 | High | 8.1 | 2023-04-26 | Sangoma FreePBX 1805 through 2302 (when obtained as a ,.ISO file) places AMPDBUSER, AMPDBPASS, AMPMGRUSER, and AMPMGRPASS in the list of global variables. This… |
CVE-2023-28084 | Medium | 5.5 | 2023-04-25 | HPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokens |
CVE-2023-28090 | Medium | 5.5 | 2023-04-25 | An HPE OneView appliance dump may expose SNMPv3 read credentials |
CVE-2023-28089 | High | 7.1 | 2023-04-25 | An HPE OneView appliance dump may expose FTP credentials for c7000 Interconnect Modules |
CVE-2023-28088 | High | 7.8 | 2023-04-25 | An HPE OneView appliance dump may expose SAN switch administrative credentials |
CVE-2023-28087 | Medium | 5.5 | 2023-04-25 | An HPE OneView appliance dump may expose OneView user accounts |
CVE-2023-28086 | Medium | 5.5 | 2023-04-25 | An HPE OneView appliance dump may expose proxy credential settings |
CVE-2023-30776 | Medium | 4.9 | 2023-04-24 | An authenticated user with specific data permissions could access database connections stored passwords by requesting a specific REST API. This issue affects A… |
CVE-2023-28131 | Critical | 9.6 | 2023-04-24 | A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that configured the "Expo Aut… |
CVE-2021-33589 | High | 7.5 | 2023-04-21 | Ribose RNP before 0.15.1 does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than on the tin of the algorithm. |
CVE-2023-25760 | High | 8.8 | 2023-04-19 | Incorrect Access Control in Tripleplay Platform releases prior to Caveman 3.4.0 allows authenticated user to modify other users passwords via a crafted request… |
CVE-2022-4308 | Medium | 6.1 | 2023-04-19 | Plaintext Storage of a Password vulnerability in Secomea GateManager (USB wizard) allows Authentication abuse on SiteManager, if the generated file is leaked. |
CVE-2023-25413 | High | 7.5 | 2023-04-11 | Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control. The device allows unauthenticated access to Telnet and SNMP credentials. |
CVE-2023-25407 | High | 7.2 | 2023-04-11 | Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control. Restricted users have read access to administrator credentials. |
CVE-2023-1574 | Medium | 6.5 | 2023-04-02 | Information disclosure in the user creation feature of a MSSQL data source in Devolutions Remote Desktop Manager 2023.1.9 and below on Windows allows an attack… |
CVE-2022-48433 | Medium | 6.1 | 2023-03-29 | In JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could leak through an API method used in the IntelliJ IDEA built-in web server. |
CVE-2023-1518 | High | 7.8 | 2023-03-28 | CP Plus KVMS Pro versions 2.01.0.T.190521 and prior are vulnerable to sensitive credentials being leaked because they are insufficiently protected. |
CVE-2023-1137 | Medium | 6.5 | 2023-03-27 | Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which a low-level user could extract files and plaintext credenti… |
CVE-2023-25686 | Medium | 6.2 | 2023-03-21 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 stores user credentials in plain clear text which can be read by a local user. IBM… |
CVE-2023-0457 | High | 7.5 | 2023-03-03 | Plaintext Storage of a Password vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series, MELSEC iQ-R Series, MELSEC-Q Series and MELSEC-L Series al… |
CVE-2022-45599 | Critical | 9.8 | 2023-02-22 | Aztech WMB250AC Mesh Routers Firmware Version 016 2020 is vulnerable to PHP Type Juggling in file /var/www/login.php, allows attackers to gain escalated privil… |
CVE-2022-41614 | Medium | 5.5 | 2023-02-16 | Insufficiently protected credentials in the Intel(R) ON Event Series Android application before version 2.0 may allow an authenticated user to potentially enab… |
CVE-2022-40678 | High | 7.4 | 2023-02-16 | An insufficiently protected credentials in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7… |
CVE-2022-43969 | Critical | 9.1 | 2023-02-16 | Ricoh mp_c4504ex devices with firmware 1.06 mishandle credentials. |
CVE-2023-24498 | High | 7.5 | 2023-02-15 | An uspecified endpoint in the web server of the switch does not properly authenticate the user identity, and may allow downloading a config page with the passw… |
CVE-2023-23466 | Medium | 6.5 | 2023-02-15 | Media CP Media Control Panel latest version. Insufficiently protected credential change. |
CVE-2023-23463 | Medium | 5.3 | 2023-02-15 | Sunell DVR, latest version, Insufficiently Protected Credentials (CWE-522) may be exposed through an unspecified request. |
CVE-2023-25191 | High | 7.5 | 2023-02-15 | AMI MegaRAC SPX devices allow Password Disclosure through Redfish. The fixed versions are SPx_12-update-7.00 and SPx_13-update-5.00. |
CVE-2022-41564 | Medium | 6.8 | 2023-02-14 | The Hawk Console component of TIBCO Software Inc.'s TIBCO Hawk and TIBCO Operational Intelligence Hawk RedTail contains a vulnerability that will return the EM… |
CVE-2023-24619 | Medium | 5.5 | 2023-02-13 | Redpanda before 22.3.12 discloses cleartext AWS credentials. The import functionality in the rpk binary logs an AWS Access Key ID and Secret in cleartext to st… |
CVE-2022-43460 | High | 7.5 | 2023-02-13 | Driver Distributor v2.2.3.1 and earlier contains a vulnerability where passwords are stored in a recoverable format. If an attacker obtains a configuration fil… |
CVE-2022-34445 | Medium | 6.0 | 2023-02-11 | Dell PowerScale OneFS, versions 8.2.x through 9.3.x contain a weak encoding for a password. A malicious local privileged attacker may potentially exploit this… |
CVE-2022-32520 | High | 8.0 | 2023-01-30 | A CWE-522: Insufficiently Protected Credentials vulnerability exists that could result in unwanted access to a DCE instance when performed over a network by a… |
CVE-2022-32519 | High | 8.0 | 2023-01-30 | A CWE-257: Storing Passwords in a Recoverable Format vulnerability exists that could result in unwanted access to a DCE instance when performed over a network… |
CVE-2022-32518 | High | 8.0 | 2023-01-30 | A CWE-522: Insufficiently Protected Credentials vulnerability exists that could result in unwanted access to a DCE instance when performed over a network by a… |
CVE-2022-46967 | Critical | 9.8 | 2023-01-26 | An access control issue in Revenue Collection System v1.0 allows unauthenticated attackers to view the contents of /admin/DBbackup/ directory. |
CVE-2022-4693 | Critical | 9.8 | 2023-01-23 | The User Verification WordPress plugin before 1.0.94 was affected by an Auth Bypass security vulnerability. To bypass authentication, we only need to know the… |
CVE-2022-38469 | High | 7.5 | 2023-01-18 | An unauthorized user with network access and the decryption key could decrypt sensitive data, such as usernames and passwords. |
CVE-2022-23538 | Medium | 5.2 | 2023-01-17 | github.com/sylabs/scs-library-client is the Go client for the Singularity Container Services (SCS) Container Library Service. When the scs-library-client is us… |
CVE-2022-41859 | High | 7.5 | 2023-01-17 | In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size o… |
CVE-2021-36204 | High | 7.8 | 2023-01-13 | Under some circumstances an Insufficiently Protected Credentials vulnerability in Johnson Controls Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versi… |
CVE-2016-15014 | Low | 3.3 | 2023-01-07 | A vulnerability has been found in CESNET theme-cesnet up to 1.x on ownCloud and classified as problematic. Affected by this vulnerability is an unknown functio… |
CVE-2022-2967 | Medium | 6.5 | 2023-01-03 | Prosys OPC UA Simulation Server version prior to v5.3.0-64 and UA Modbus Server versions 1.4.18-5 and prior do not sufficiently protect credentials, which coul… |
CVE-2022-22458 | Medium | 6.3 | 2022-12-22 | IBM Security Verify Governance, Identity Manager 10.0.1 stores user credentials in plain clear text which can be read by a remote authenticated user. IBM X-Fo… |
CVE-2022-4612 | Medium | 4.3 | 2022-12-19 | A vulnerability has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome and classified as problematic. This vulnerability affe… |
CVE-2022-46142 | Medium | 5.7 | 2022-12-13 | Affected devices store the CLI user passwords encrypted in flash memory. Attackers with physical access to the device could retrieve the file and decrypt the C… |
CVE-2022-4312 | Medium | 5.5 | 2022-12-12 | A cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3. This could allow an unauthorized user with access the… |
CVE-2022-42445 | Medium | 4.9 | 2022-12-12 | HCL Launch could allow a user with administrative privileges, including "Manage Security" permissions, the ability to recover a credential previously saved for… |
CVE-2022-29839 | Medium | 4.1 | 2022-12-09 | Insufficiently Protected Credentials vulnerability in the remote backups application on Western Digital My Cloud devices that could allow an attacker who has g… |
CVE-2022-37783 | High | 7.5 | 2022-12-05 | All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens… |
CVE-2022-43442 | Medium | 4.6 | 2022-12-05 | Plaintext storage of a password vulnerability exists in +F FS040U software versions v2.3.4 and earlier, which may allow an attacker to obtain the login passwor… |
CVE-2022-46155 | High | 7.6 | 2022-11-29 | Airtable.js is the JavaScript client for Airtable. Prior to version 0.11.6, Airtable.js had a misconfigured build script in its source package. When the build… |
CVE-2022-41732 | Medium | 6.2 | 2022-11-28 | IBM Maximo Mobile 8.7 and 8.8 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 237407. |
CVE-2022-29833 | Medium | 6.8 | 2022-11-25 | Insufficiently Protected Credentials vulnerability in Mitsubishi Electric Corporation GX Works3 versions 1.015R and later allows a remote unauthenticated attac… |
CVE-2022-41933 | Medium | 6.2 | 2022-11-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When the `reset a forgotten password` feature of XWiki… |
CVE-2022-40751 | Medium | 4.9 | 2022-11-17 | IBM UrbanCode Deploy (UCD) 6.2.7.0 through 6.2.7.17, 7.0.0.0 through 7.0.5.12, 7.1.0.0 through 7.1.2.8, and 7.2.0.0 through 7.2.3.1 could allow a user with ad… |
CVE-2022-45392 | Medium | 6.5 | 2022-11-15 | Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller whe… |
CVE-2022-45384 | Medium | 6.5 | 2022-11-15 | Jenkins Reverse Proxy Auth Plugin 1.7.3 and earlier stores the LDAP manager password unencrypted in the global config.xml file on the Jenkins controller where… |
CVE-2022-37109 | Critical | 9.8 | 2022-11-14 | patrickfuller camp up to and including commit bbd53a256ed70e79bd8758080936afbf6d738767 is vulnerable to Incorrect Access Control. Access to the password.txt fi… |
CVE-2022-26341 | High | 8.2 | 2022-11-11 | Insufficiently protected credentials in software in Intel(R) AMT SDK before version 16.0.4.1, Intel(R) EMA before version 1.7.1 and Intel(R) MC before version… |
CVE-2022-38121 | Medium | 6.5 | 2022-11-10 | UPSMON PRO configuration file stores user password in plaintext under public user directory. A remote attacker with general user privilege can access all users… |
CVE-2022-36077 | High | 7.2 | 2022-11-08 | The Electron framework enables writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions prior to 21.0.0-beta.1, 20.0.1, 19.0.11… |
CVE-2022-3781 | Medium | 6.5 | 2022-11-01 | Dashlane password and Keepass Server password in My Account Settings are not encrypted in the database in Devolutions Remote Desktop Manager 2022.2.26 and pri… |
CVE-2022-3474 | Medium | 4.3 | 2022-10-26 | A bad credential handling in the remote assets API for Bazel versions prior to 5.3.2 and 4.2.3 sends all user-provided credentials instead of only the required… |
CVE-2022-3644 | Medium | 5.5 | 2022-10-25 | The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API () in… |
CVE-2022-41575 | High | 7.5 | 2022-10-21 | A credential-exposure vulnerability in the support-bundle mechanism in Gradle Enterprise 2022.3 through 2022.3.3 allows remote attackers to access a subset of… |
CVE-2022-43419 | Medium | 6.5 | 2022-10-19 | Jenkins Katalon Plugin 1.0.32 and earlier stores API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with… |
CVE-2022-22251 | High | 7.8 | 2022-10-18 | On cSRX Series devices software permission issues in the container filesystem and stored files combined with storing passwords in a recoverable format in Junip… |
CVE-2022-28291 | Medium | 6.5 | 2022-10-17 | Insufficiently Protected Credentials: An authenticated user with debug privileges can retrieve stored Nessus policy credentials from the “nessusd” process in c… |
CVE-2019-14840 | High | 7.5 | 2022-10-17 | A flaw was found in the RHDM, where sensitive HTML form fields like Password has auto-complete enabled which may lead to leak of credentials. |
CVE-2022-3206 | Medium | 5.9 | 2022-10-17 | The Passster WordPress plugin before 3.5.5.5.2 stores the password inside a cookie named "passster" using base64 encoding method which is easy to decode. This… |
CVE-2022-31130 | Medium | 4.9 | 2022-10-13 | Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication… |