CWE-522 · Insufficiently Protected Credentials (page 7)
Page 7 of 15 — CVEs classified under CWE-522, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-38465 | Critical | 9.3 | 2022-10-11 | A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS va… |
CVE-2022-39168 | High | 7.5 | 2022-09-29 | IBM Robotic Process Automation Clients are vulnerable to proxy credentials being exposed in upgrade logs. IBM X-Force ID: 235422. |
CVE-2020-15347 | Critical | 9.8 | 2022-09-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the q6xV4aW8bQ4cfD-b password for the axiros account. |
CVE-2020-15341 | High | 7.5 | 2022-09-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated update_all_realm_license API. |
CVE-2022-29089 | Medium | 6.4 | 2022-09-28 | Dell Networking OS10, versions prior to October 2021 with Smart Fabric Services enabled, contains an information disclosure vulnerability. A remote, unauthenti… |
CVE-2022-37193 | High | 7.4 | 2022-09-27 | Chipolo ONE Bluetooth tracker (2020) Chipolo iOS app version 4.13.0 is vulnerable to Incorrect Access Control. Chipolo devices suffer from access revocation ev… |
CVE-2022-41255 | Medium | 6.5 | 2022-09-21 | Jenkins CONS3RT Plugin 1.0.0 and earlier stores Cons3rt API token unencrypted in job config.xml files on the Jenkins controller where it can be viewed by users… |
CVE-2022-41247 | Medium | 4.3 | 2022-09-21 | Jenkins BigPanda Notifier Plugin 1.4.0 and earlier stores the BigPanda API key unencrypted in its global configuration file on the Jenkins controller where the… |
CVE-2022-39816 | Medium | 6.5 | 2022-09-13 | In NOKIA 1350 OMS R14.2, Insufficiently Protected Credentials (cleartext administrator password) occur in the edit configuration page. Exploitation requires an… |
CVE-2022-36617 | Medium | 4.9 | 2022-09-09 | Arq Backup 7.19.5.0 and below stores backup encryption passwords using reversible encryption. This issue allows attackers with administrative privileges to rec… |
CVE-2021-36783 | Critical | 9.9 | 2022-09-07 | A Insufficiently Protected Credentials vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners and Project Members t… |
CVE-2022-34371 | High | 8.1 | 2022-09-02 | Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.19, 9.2.1.12, 9.3.0.6, and 9.4.0.3, contain an unprotected transport of credentials vulnerabili… |
CVE-2021-39045 | Medium | 5.5 | 2022-09-01 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a local attacker to obtain information due to the autocomplete feature on password input fields. IB… |
CVE-2022-27560 | Medium | 6.0 | 2022-08-30 | HCL VersionVault Express exposes administrator credentials. |
CVE-2022-0718 | Medium | 4.9 | 2022-08-29 | A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any… |
CVE-2021-20260 | High | 7.8 | 2022-08-26 | A flaw was found in the Foreman project. The Datacenter plugin exposes the password through the API to an authenticated local attacker with view_hosts permissi… |
CVE-2021-43767 | Medium | 5.9 | 2022-08-25 | Odyssey passes to client unencrypted bytes from man-in-the-middle When Odyssey storage is configured to use the PostgreSQL server using 'trust' authentication… |
CVE-2022-34838 | High | 8.1 | 2022-08-24 | Storing Passwords in a Recoverable Format vulnerability in ABB Zenon 8.20 allows an attacker who successfully exploit the vulnerability may add or alter data p… |
CVE-2022-34837 | Medium | 6.2 | 2022-08-24 | Storing Passwords in a Recoverable Format vulnerability in ABB Zenon 8.20 allows an attacker who successfully exploit the vulnerability may add more network cl… |
CVE-2022-38665 | Medium | 6.5 | 2022-08-23 | Jenkins CollabNet Plugins Plugin 2.0.8 and earlier stores a RabbitMQ password unencrypted in its global configuration file on the Jenkins controller where it c… |
CVE-2022-38663 | Medium | 6.5 | 2022-08-23 | Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log provided by the Git Username and Passw… |
CVE-2020-35992 | Medium | 6.5 | 2022-08-23 | Fiserv Prologue through 2020-12-16 does not properly protect the database password. If an attacker were to gain access to the configuration file (specifically… |
CVE-2021-3513 | High | 7.5 | 2022-08-22 | A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled. This is due to a wrong error message di… |
CVE-2022-30944 | Medium | 5.5 | 2022-08-18 | Insufficiently protected credentials for Intel(R) AMT and Intel(R) Standard Manageability may allow a privileged user to potentially enable information disclos… |
CVE-2022-30601 | Critical | 9.8 | 2022-08-18 | Insufficiently protected credentials for Intel(R) AMT and Intel(R) Standard Manageability may allow an unauthenticated user to potentially enable information d… |
CVE-2022-30296 | High | 7.5 | 2022-08-18 | Insufficiently protected credentials in the Intel(R) Datacenter Group Event iOS application, all versions, may allow an unauthenticated user to potentially ena… |
CVE-2022-29507 | Medium | 5.5 | 2022-08-18 | Insufficiently protected credentials in the Intel(R) Team Blue mobile application in all versions may allow an authenticated user to potentially enable informa… |
CVE-2022-26844 | High | 7.8 | 2022-08-18 | Insufficiently protected credentials in the installation binaries for Intel(R) SEAPI in all versions may allow an authenticated user to potentially enable esca… |
CVE-2020-10710 | Medium | 4.4 | 2022-08-16 | A flaw was found where the Plaintext Candlepin password is disclosed while updating Red Hat Satellite through the satellite-installer. This flaw allows an atta… |
CVE-2022-29959 | Medium | 5.5 | 2022-08-16 | Emerson OpenBSI through 2022-04-29 mishandles credential storage. It is an engineering environment for the ControlWave and Bristol Babcock line of RTUs. This e… |
CVE-2022-36308 | Critical | 9.1 | 2022-08-16 | Airspan AirVelocity 1500 web management UI displays SNMP credentials in plaintext on software versions older than 15.18.00.2511, and stores SNMPv3 credentials… |
CVE-2022-36307 | Medium | 6.8 | 2022-08-16 | The AirVelocity 1500 prints SNMP credentials on its physically accessible serial port during boot. This was fixed in AirVelocity 1500 software version 15.18.00… |
CVE-2022-22983 | Medium | 5.9 | 2022-08-10 | VMware Workstation (16.x prior to 16.2.4) contains an unprotected storage of credentials vulnerability. A malicious actor with local user privileges to the vic… |
CVE-2022-20914 | Medium | 4.9 | 2022-08-10 | A vulnerability in the External RESTful Services (ERS) API of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to ob… |
CVE-2022-33169 | Medium | 6.5 | 2022-08-01 | IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to insufficiently protected credentials for users created via a bulk upload. IBM X-Forc… |
CVE-2021-27785 | Low | 3.9 | 2022-07-30 | HCL Commerce's Remote Store server could allow a local attacker to obtain sensitive personal information. The vulnerability requires the victim to first perfor… |
CVE-2021-22640 | High | 7.5 | 2022-07-28 | An attacker can decrypt the Ovarro TBox login password by communication capture and brute force attacks. |
CVE-2022-36901 | Medium | 6.5 | 2022-07-27 | Jenkins HTTP Request Plugin 1.15 and earlier stores HTTP Request passwords unencrypted in its global configuration file on the Jenkins controller where they ca… |
CVE-2022-1766 | High | 7.5 | 2022-07-20 | Anchore Enterprise anchorectl version 0.1.4 improperly stored credentials when generating a Software Bill of Materials. anchorectl will add the credentials use… |
CVE-2022-27544 | Medium | 5.0 | 2022-07-19 | BigFix Web Reports authorized users may see SMTP credentials in clear text. |
CVE-2022-22998 | High | 8.0 | 2022-07-12 | Implemented protections on AWS credentials that were not properly protected. |
CVE-2022-1794 | Medium | 5.5 | 2022-07-11 | The CODESYS OPC DA Server prior V3.5.18.20 stores PLC passwords as plain text in its configuration file so that it is visible to all authorized Microsoft Windo… |
CVE-2022-35411 | Critical | 9.8 | 2022-07-08 | rpc.py through 0.6.0 allows Remote Code Execution because an unpickle occurs when the "serializer: pickle" HTTP header is sent. In other words, although JSON (… |
CVE-2022-27548 | Medium | 4.9 | 2022-07-06 | HCL Launch stores user credentials in plain clear text which can be read by a local user. |
CVE-2022-23725 | High | 7.7 | 2022-06-30 | PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances. |
CVE-2022-34816 | Medium | 6.5 | 2022-06-30 | Jenkins HPE Network Virtualization Plugin 1.0 stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed… |
CVE-2022-34809 | Medium | 6.5 | 2022-06-30 | Jenkins RQM Plugin 2.8 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users wit… |
CVE-2022-34808 | Medium | 4.3 | 2022-06-30 | Jenkins Cisco Spark Plugin 1.1.1 and earlier stores bearer tokens unencrypted in its global configuration file on the Jenkins controller where they can be view… |
CVE-2022-34807 | Medium | 6.5 | 2022-06-30 | Jenkins Elasticsearch Query Plugin 1.2 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be vie… |
CVE-2022-34806 | Medium | 6.5 | 2022-06-30 | Jenkins Jigomerge Plugin 0.9 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with… |
CVE-2022-34805 | Medium | 6.5 | 2022-06-30 | Jenkins Skype notifier Plugin 1.1.0 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed… |
CVE-2022-34803 | Medium | 4.3 | 2022-06-30 | Jenkins OpsGenie Plugin 1.9 and earlier stores API keys unencrypted in its global configuration file and in job config.xml files on the Jenkins controller wher… |
CVE-2022-34802 | Medium | 4.3 | 2022-06-30 | Jenkins RocketChat Notifier Plugin 1.5.2 and earlier stores the login password and webhook token unencrypted in its global configuration file on the Jenkins co… |
CVE-2022-34800 | Medium | 4.3 | 2022-06-30 | Jenkins Build Notifications Plugin 1.5.0 and earlier stores tokens unencrypted in its global configuration files on the Jenkins controller where they can be vi… |
CVE-2022-34799 | Medium | 4.3 | 2022-06-30 | Jenkins Deployment Dashboard Plugin 1.0.10 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be… |
CVE-2022-31887 | Critical | 9.8 | 2022-06-28 | Marval MSM v14.19.0.12476 has a 0-Click Account Takeover vulnerability which allows an attacker to change any user's password in the organization, this means t… |
CVE-2022-31085 | Medium | 6.1 | 2022-06-27 | LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the… |
CVE-2022-2221 | Medium | 6.5 | 2022-06-27 | Information Exposure vulnerability in My Account Settings of Devolutions Remote Desktop Manager before 2022.1.8 allows authenticated users to access credential… |
CVE-2022-28167 | Medium | 6.5 | 2022-06-27 | Brocade SANnav before Brocade SANvav v. 2.2.0.2 and Brocade SANanv v.2.1.1.8 logs the Brocade Fabric OS switch password in plain text in asyncjobscheduler-mana… |
CVE-2022-33953 | Medium | 4.6 | 2022-06-24 | IBM Robotic Process Automation 21.0.1 and 21.0.2 could allow a user with psychical access to the system to obtain sensitive information due to insufficiently p… |
CVE-2022-2103 | Critical | 9.8 | 2022-06-24 | An attacker with weak credentials could access the TCP port via an open FTP port, allowing an attacker to read sensitive files and write to remotely executable… |
CVE-2022-1666 | Medium | 6.5 | 2022-06-24 | The default password for the web application’s root user (the vendor’s private account) was weak and the MD5 hash was used to crack the password using a widely… |
CVE-2022-34213 | Medium | 6.5 | 2022-06-23 | Jenkins Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier stores passwords unencrypted in its global configuration file on the Jenkins controller w… |
CVE-2022-34202 | Medium | 6.5 | 2022-06-23 | Jenkins EasyQA Plugin 1.0 and earlier stores user passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by… |
CVE-2022-34199 | Medium | 6.5 | 2022-06-23 | Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be view… |
CVE-2022-21184 | Medium | 5.9 | 2022-06-17 | An information disclosure vulnerability exists in the License registration functionality of Bachmann Visutec GmbH Atvise 3.5.4, 3.6 and 3.7. A plaintext HTTP r… |
CVE-2020-28865 | High | 7.5 | 2022-06-16 | An issue was discovered in PowerJob through 3.2.2, allows attackers to change arbitrary user passwords via the id parameter to /appinfo/save. |
CVE-2022-31044 | High | 7.5 | 2022-06-15 | Rundeck is an open source automation service with a web console, command line tools and a WebAPI. The Key Storage converter plugin mechanism was not enabled co… |
CVE-2022-1342 | Medium | 4.6 | 2022-06-15 | A lack of password masking in Devolutions Remote Desktop Manager allows physically proximate attackers to observe sensitive data. A caching issue can cause sen… |
CVE-2022-30231 | Medium | 4.9 | 2022-06-14 | A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6). The affected application discloses password hashes of other users upon… |
CVE-2022-30587 | High | 7.5 | 2022-06-06 | Gradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to information disclosure. |
CVE-2022-22396 | High | 7.5 | 2022-06-06 | Credentials are printed in clear text in the IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.3 virgo log file in certain cases. Credentials could be the remo… |
CVE-2022-29085 | Medium | 6.4 | 2022-06-02 | Dell Unity, Dell UnityVSA, and Dell Unity XT versions prior to 5.2.0.0.5.173 contain a plain-text password storage vulnerability when certain off-array tools a… |
CVE-2022-22557 | High | 7.5 | 2022-06-02 | PowerStore contains Plain-Text Password Storage Vulnerability in PowerStore X & T environments running versions 2.0.0.x and 2.0.1.x A locally authenticated att… |
CVE-2022-27776 | Medium | 6.5 | 2022-06-02 | A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host… |
CVE-2022-27774 | Medium | 5.7 | 2022-06-02 | An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract creden… |
CVE-2022-22767 | High | 8.8 | 2022-06-02 | Specific BD Pyxis™ products were installed with default credentials and may presently still operate with these credentials. There may be scenarios where BD Pyx… |
CVE-2022-1413 | Medium | 5.4 | 2022-05-19 | Missing input masking in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 1… |
CVE-2022-30018 | High | 8.8 | 2022-05-19 | Mobotix Control Center (MxCC) through 2.5.4.5 has Insufficiently Protected Credentials, Storing Passwords in a Recoverable Format via the MxCC.ini config file… |
CVE-2022-30952 | Medium | 6.5 | 2022-05-17 | Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with attacker-specified… |
CVE-2022-29588 | High | 7.5 | 2022-05-16 | Konica Minolta bizhub MFP devices before 2022-04-14 use cleartext password storage for the /var/log/nginx/html/ADMINPASS and /etc/shadow files. |
CVE-2022-28005 | Critical | 9.8 | 2022-05-06 | An issue was discovered in the 3CX Phone System Management Console prior to version 18 Update 3 FINAL. An unauthenticated attacker could abuse improperly secur… |
CVE-2021-46440 | High | 7.5 | 2022-05-03 | Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an attacker to access a vict… |
CVE-2022-26856 | High | 8.2 | 2022-04-21 | Dell EMC Repository Manager version 3.4.0 contains a plain-text password storage vulnerability. A local attacker could potentially exploit this vulnerability… |
CVE-2022-24867 | High | 7.5 | 2022-04-21 | GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. When you pass the c… |
CVE-2022-27179 | Medium | 4.6 | 2022-04-20 | A malicious actor having access to the exported configuration file may obtain the stored credentials and thereby gain access to the protected resource. If the… |
CVE-2022-29457 | High | 8.8 | 2022-04-18 | Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131 allow NTLM Hash disclosure during certa… |
CVE-2021-3681 | Medium | 5.5 | 2022-04-18 | A flaw was found in Ansible Galaxy Collections. When collections are built manually, any files in the repository directory that are not explicitly excluded via… |
CVE-2022-29052 | Medium | 4.3 | 2022-04-12 | Jenkins Google Compute Engine Plugin 4.3.8 and earlier stores private keys unencrypted in cloud agent config.xml files on the Jenkins controller where they can… |
CVE-2022-22550 | Medium | 6.7 | 2022-04-12 | Dell PowerScale OneFS, versions 8.2.2 and above, contain a password disclosure vulnerability. An unprivileged local attacker could potentially exploit this vul… |
CVE-2022-24978 | High | 8.8 | 2022-04-05 | Zoho ManageEngine ADAudit Plus before 7055 allows authenticated Privilege Escalation on Integrated products. This occurs because a password field is present in… |
CVE-2022-28651 | High | 8.4 | 2022-04-05 | In JetBrains IntelliJ IDEA before 2021.3.3 it was possible to get passwords from protected fields |
CVE-2021-45892 | Medium | 5.9 | 2022-04-05 | An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4. There is storage of Passwords in a Recoverable Format. |
CVE-2021-32978 | High | 7.5 | 2022-04-04 | The programming protocol allows for a previously entered password and lock state to be read by an attacker. If the previously entered password was successful… |
CVE-2022-1026 | High | 8.6 | 2022-04-04 | Kyocera multifunction printers running vulnerable versions of Net View unintentionally expose sensitive user information, including usernames and passwords, th… |
CVE-2021-33024 | Low | 3.7 | 2022-04-01 | Philips Vue PACS versions 12.2.x.x and prior transmits or stores authentication credentials, but it uses an insecure method susceptible to unauthorized interce… |
CVE-2022-26948 | Medium | 5.8 | 2022-03-30 | The Archer RSS feed integration for Archer 6.x through 6.9 SP1 (6.9.1.0) is affected by an insecure credential storage vulnerability. A malicious attacker may… |
CVE-2022-28141 | Medium | 6.5 | 2022-03-29 | Jenkins Proxmox Plugin 0.5.0 and earlier stores the Proxmox Datacenter password unencrypted in the global config.xml file on the Jenkins controller where it ca… |
CVE-2022-28135 | Medium | 6.5 | 2022-03-29 | Jenkins instant-messaging Plugin 1.41 and earlier stores passwords for group chats unencrypted in the global configuration file of plugins based on Jenkins ins… |
CVE-2022-0738 | Medium | 4.2 | 2022-03-28 | An issue has been discovered in GitLab affecting all versions starting from 14.6 before 14.6.5, all versions starting from 14.7 before 14.7.4, all versions sta… |