CWE-522 · Insufficiently Protected Credentials (page 8)
Page 8 of 15 — CVEs classified under CWE-522, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-0862 | Low | 3.1 | 2022-03-23 | A lack of password change protection vulnerability in a depreciated API of McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote… |
CVE-2022-0859 | Medium | 6.5 | 2022-03-23 | McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a local attacker to point an ePO server to an arbitrary SQL server during the resto… |
CVE-2020-25184 | High | 7.8 | 2022-03-18 | Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x stores the password in plaintext in a file that is in the same directory as the executable file. ISaGR… |
CVE-2021-39046 | Medium | 4.9 | 2022-03-18 | IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 and IBM Business Process Manager 8.5 and 8.6 stores user credentials in plain clear text which can… |
CVE-2022-27218 | Medium | 4.3 | 2022-03-15 | Jenkins incapptic connect uploader Plugin 1.15 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed… |
CVE-2022-27217 | Medium | 6.5 | 2022-03-15 | Jenkins Vmware vRealize CodeStream Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be view… |
CVE-2022-27216 | Medium | 6.5 | 2022-03-15 | Jenkins dbCharts Plugin 0.5.2 and earlier stores JDBC connection passwords unencrypted in its global configuration file on the Jenkins controller where they ca… |
CVE-2022-27206 | Medium | 6.5 | 2022-03-15 | Jenkins GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global config.xml file on the Jenkins controller where… |
CVE-2021-23222 | Medium | 5.9 | 2022-03-02 | A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption. |
CVE-2022-22908 | Medium | 5.5 | 2022-02-26 | SangforCSClient.exe in Sangfor VDI Client 5.4.2.1006 allows attackers, when they are able to read process memory, to discover the contents of the Username and… |
CVE-2022-24610 | High | 8.6 | 2022-02-24 | Settings/network settings/wireless settings on the Alecto DVC-215IP camera version 63.1.1.173 and below shows the Wi-Fi passphrase hidden, but by editing/remov… |
CVE-2022-24982 | Medium | 6.5 | 2022-02-16 | Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to access the cleartext credentials of all other form users. admin.p… |
CVE-2022-25184 | Medium | 6.5 | 2022-02-15 | Jenkins Pipeline: Build Step Plugin 2.15 and earlier reveals password parameter default values when generating a pipeline script using the Pipeline Snippet Gen… |
CVE-2021-22798 | High | 7.5 | 2022-02-11 | A CWE-522: Insufficiently Protected Credentials vulnerability exists that could cause Sensitive data such as login credentials being exposed when a Network is… |
CVE-2022-0019 | Medium | 4.7 | 2022-02-10 | An insufficiently protected credentials vulnerability exists in the Palo Alto Networks GlobalProtect app on Linux that exposes the hashed credentials of Global… |
CVE-2021-33107 | Medium | 4.6 | 2022-02-09 | Insufficiently protected credentials in USB provisioning for Intel(R) AMT SDK before version 16.0.3, Intel(R) SCS before version 12.2 and Intel(R) MEBx before… |
CVE-2021-40360 | High | 8.8 | 2022-02-09 | A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMA… |
CVE-2021-44451 | Medium | 6.5 | 2022-02-01 | Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. This information could be accessed… |
CVE-2022-23223 | High | 7.5 | 2022-01-25 | On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or… |
CVE-2022-22554 | High | 8.2 | 2022-01-24 | Dell EMC System Update, version 1.9.2 and prior, contain an Unprotected Storage of Credentials vulnerability. A local attacker with user privleges could potent… |
CVE-2021-23207 | Medium | 6.5 | 2022-01-21 | An attacker with physical access to the host can extract the secrets from the registry and create valid JWT tokens for the Fresenius Kabi Vigilant MasterMed ve… |
CVE-2021-23196 | High | 7.3 | 2022-01-21 | The web application on Agilia Link+ version 3.0 implements authentication and session management mechanisms exclusively on the client-side and does not protect… |
CVE-2021-32039 | Medium | 5.5 | 2022-01-20 | Users with appropriate file access may be able to access unencrypted user credentials saved by MongoDB Extension for VS Code in a binary file. These credential… |
CVE-2022-0184 | Medium | 4.3 | 2022-01-17 | Insufficiently protected credentials vulnerability in 'TEPRA' PRO SR5900P Ver.1.080 and earlier and 'TEPRA' PRO SR-R7900P Ver.1.030 and earlier allows an attac… |
CVE-2022-23117 | High | 7.5 | 2022-01-12 | Jenkins Conjur Secrets Plugin 1.0.9 and earlier implements functionality that allows attackers able to control agent processes to retrieve all username/passwor… |
CVE-2022-23114 | Low | 3.3 | 2022-01-12 | Jenkins Publish Over SSH Plugin 1.22 and earlier stores password unencrypted in its global configuration file on the Jenkins controller where it can be viewed… |
CVE-2022-23109 | Medium | 6.5 | 2022-01-12 | Jenkins HashiCorp Vault Plugin 3.7.0 and earlier does not mask Vault credentials in Pipeline build logs or in Pipeline step descriptions when Pipeline: Groovy… |
CVE-2022-20621 | Medium | 5.5 | 2022-01-12 | Jenkins Metrics Plugin 4.0.2.8 and earlier stores an access key unencrypted in its global configuration file on the Jenkins controller where it can be viewed b… |
CVE-2021-20164 | Medium | 4.9 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses credentials for the smb functionality of the device. Usernames and passwords for all smb users… |
CVE-2021-20163 | Medium | 4.9 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 leaks information via the ftp web page. Usernames and passwords for all ftp users are revealed in plaintext on the f… |
CVE-2021-37401 | Critical | 9.8 | 2021-12-28 | An attacker may obtain the user credentials from file servers, backup repositories, or ZLD files saved in SD cards. As a result, the PLC user program may be up… |
CVE-2021-37400 | Critical | 9.8 | 2021-12-28 | An attacker may obtain the user credentials from the communication between the PLC and the software. As a result, the PLC user program may be uploaded, altered… |
CVE-2021-20826 | High | 7.6 | 2021-12-24 | Unprotected transport of credentials vulnerability in IDEC PLCs (FC6A Series MICROSmart All-in-One CPU module v2.32 and earlier, FC6A Series MICROSmart Plus CP… |
CVE-2021-36318 | Medium | 6.7 | 2021-12-21 | Dell EMC Avamar versions 18.2,19.1,19.2,19.3,19.4 contain a plain-text password storage vulnerability. A high privileged user could potentially exploit this vu… |
CVE-2021-36317 | Medium | 6.7 | 2021-12-21 | Dell EMC Avamar Server version 19.4 contains a plain-text password storage vulnerability in AvInstaller. A local attacker could potentially exploit this vulner… |
CVE-2021-42913 | High | 7.5 | 2021-12-20 | The SyncThru Web Service on Samsung SCX-6x55X printers allows an attacker to gain access to a list of SMB users and cleartext passwords by reading the HTML sou… |
CVE-2021-3179 | Medium | 5.5 | 2021-12-16 | GGLocker iOS application, contains an insecure data storage of the password hash value which results in an authentication bypass. |
CVE-2021-45097 | Low | 2.9 | 2021-12-16 | KNIME Server before 4.12.6 and 4.13.x before 4.13.4 (when installed in unattended mode) keeps the administrator's password in a file without appropriate file a… |
CVE-2021-42023 | Medium | 6.5 | 2021-12-14 | A vulnerability has been identified in ModelSim Simulation (All versions), Questa Simulation (All versions). The RSA white-box implementation in affected appli… |
CVE-2021-40857 | High | 8.8 | 2021-12-13 | Auerswald COMpact 5500R devices before 8.2B allow Privilege Escalation via the passwd=1 substring. |
CVE-2021-37187 | Medium | 6.5 | 2021-12-10 | An issue was discovered on Digi TransPort devices through 2021-07-21. An authenticated attacker may read a password file (with reversible passwords) from the d… |
CVE-2021-20146 | Critical | 9.8 | 2021-12-09 | An unprotected ssh private key exists on the Gryphon devices which could be used to achieve root access to a server affiliated with Gryphon's development and i… |
CVE-2021-43978 | High | 7.1 | 2021-12-08 | Allegro WIndows 3.3.4152.0, embeds software administrator database credentials into its binary files, which allows users to access and modify data using the sa… |
CVE-2020-27413 | Medium | 4.2 | 2021-12-07 | An issue was discovered in Mahavitaran android application 7.50 and below, allows local attackers to read cleartext username and password while the user is log… |
CVE-2021-42306 | High | 8.1 | 2021-11-24 | An information disclosure vulnerability manifests when a user or an application uploads unprotected private key data as part of an authentication certificate k… |
CVE-2021-38976 | Medium | 5.5 | 2021-11-15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 stores user credentials in plain clear text which can be read by a local user. X-Force ID: 212781. |
CVE-2021-3789 | Medium | 4.2 | 2021-11-12 | An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with physical access to obta… |
CVE-2021-43332 | Medium | 6.5 | 2021-11-12 | In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potential… |
CVE-2021-41972 | Medium | 6.5 | 2021-11-12 | Apache Superset up to and including 1.3.1 allowed for database connections password leak for authenticated users. This information could be accessed in a non-t… |
CVE-2021-43397 | High | 8.8 | 2021-11-11 | LiquidFiles before 3.6.3 allows remote attackers to elevate their privileges from Admin (or User Admin) to Sysadmin. |
CVE-2021-40503 | High | 7.8 | 2021-11-10 | An information disclosure vulnerability exists in SAP GUI for Windows - versions < 7.60 PL13, 7.70 PL4, which allows an attacker with sufficient privileges on… |
CVE-2021-41023 | Medium | 5.5 | 2021-11-02 | A unprotected storage of credentials in Fortinet FortiSIEM Windows Agent version 4.1.4 and below allows an authenticated user to disclosure agent password due… |
CVE-2020-23036 | Medium | 5.9 | 2021-10-22 | MEDIA NAVI Inc SMACom v1.2 was discovered to contain an insecure session validation vulnerability in the session handling of the `password` authentication para… |
CVE-2021-28496 | Medium | 5.7 | 2021-10-21 | On systems running Arista EOS and CloudEOS with the affected release version, when using shared secret profiles the password configured for use by BiDirectiona… |
CVE-2021-40476 | High | 7.5 | 2021-10-13 | Windows AppContainer Elevation Of Privilege Vulnerability |
CVE-2021-41125 | Medium | 5.7 | 2021-10-06 | Scrapy is a high-level web crawling and scraping framework for Python. If you use `HttpAuthMiddleware` (i.e. the `http_user` and `http_pass` spider attributes)… |
CVE-2021-36178 | Medium | 4.3 | 2021-10-06 | A insufficiently protected credentials in Fortinet FortiSDNConnector version 1.1.7 and below allows attacker to disclose third-party devices credential informa… |
CVE-2021-36170 | Low | 3.2 | 2021-10-06 | An information disclosure vulnerability [CWE-200] in FortiAnalyzerVM and FortiManagerVM versions 7.0.0 and 6.4.6 and below may allow an authenticated attacker… |
CVE-2021-41092 | Medium | 5.4 | 2021-10-04 | Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running `docker login my-private-registry.ex… |
CVE-2021-36309 | High | 7.1 | 2021-10-01 | Dell Enterprise SONiC OS, versions 3.3.0 and earlier, contains a sensitive information disclosure vulnerability. An authenticated malicious user with access to… |
CVE-2021-41300 | Critical | 9.8 | 2021-09-30 | ECOA BAS controller’s special page displays user account and passwords in plain text, thus unauthenticated attackers can access the page and obtain privilege w… |
CVE-2021-41297 | High | 8.8 | 2021-09-30 | ECOA BAS controller is vulnerable to weak access control mechanism allowing authenticated user to remotely escalate privileges by disclosing credentials of adm… |
CVE-2021-39342 | Medium | 5.3 | 2021-09-29 | The Credova_Financial WordPress plugin discloses a site's associated Credova API account username and password in plaintext via an AJAX action whenever a site… |
CVE-2021-38863 | Medium | 5.5 | 2021-09-23 | IBM Security Verify Bridge 1.0.5.0 stores user credentials in plain clear text which can be read by a locally authenticated user. IBM X-Force ID: 208154. |
CVE-2021-20434 | Medium | 4.4 | 2021-09-23 | IBM Security Verify Bridge 1.0.5.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 196346. |
CVE-2021-1589 | Medium | 6.5 | 2021-09-23 | A vulnerability in the disaster recovery feature of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain unauthorized access to… |
CVE-2021-29811 | Medium | 4.9 | 2021-09-20 | IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 stores user credentials in plain clear text which can be read by an authenticated admi… |
CVE-2021-28813 | Critical | 9.6 | 2021-09-10 | A vulnerability involving insecure storage of sensitive information has been reported to affect QSW-M2116P-2T2S and QNAP switches running QuNetSwitch. If explo… |
CVE-2021-28499 | Medium | 6.3 | 2021-09-09 | In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, user account passwords set in clear text could leak to users… |
CVE-2021-28498 | High | 8.7 | 2021-09-09 | In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, user enable passwords set in clear text could result in unpri… |
CVE-2021-34733 | Medium | 5.5 | 2021-09-02 | A vulnerability in the CLI of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, local attacker to a… |
CVE-2021-39373 | High | 7.8 | 2021-09-01 | Samsung Drive Manager 2.0.104 on Samsung H3 devices allows attackers to bypass intended access controls on disk management. WideCharToMultiByte, WideCharStr, a… |
CVE-2021-21681 | Medium | 5.5 | 2021-08-31 | Jenkins Nomad Plugin 0.7.4 and earlier stores Docker passwords unencrypted in the global config.xml file on the Jenkins controller where they can be viewed by… |
CVE-2021-34560 | Medium | 5.5 | 2021-08-31 | In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.9 a form contains a password field with autocomplete enabled. The stored credentials can be captured by an attacke… |
CVE-2021-30948 | Medium | 4.6 | 2021-08-24 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 15.2 and iPadOS 15.2. A person with physical acce… |
CVE-2021-39289 | High | 7.5 | 2021-08-23 | Certain NetModule devices have Insecure Password Handling (cleartext or reversible encryption), These models with firmware before 4.3.0.113, 4.4.0.111, and 4.5… |
CVE-2021-35529 | High | 7.7 | 2021-08-20 | Insufficiently Protected Credentials vulnerability in client environment of Hitachi ABB Power Grids Retail Operations and Counterparty Settlement Billing (CSB)… |
CVE-2021-38165 | Medium | 5.3 | 2021-08-07 | Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SN… |
CVE-2021-20597 | Critical | 9.1 | 2021-08-06 | Insufficiently Protected Credentials vulnerability in Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16/32/120SFCPU firmware versions "26" and p… |
CVE-2021-32003 | High | 8.0 | 2021-08-05 | Unprotected Transport of Credentials vulnerability in SiteManager provisioning service allows local attacker to capture credentials if the service is used afte… |
CVE-2021-22923 | Medium | 5.3 | 2021-08-05 | When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credenti… |
CVE-2021-27495 | High | 7.1 | 2021-07-30 | Ypsomed mylife Cloud, mylife Mobile Application:Ypsomed mylife Cloud,All versions prior to 1.7.2,Ypsomed mylife App,All versions prior to 1.7.5,he Ypsomed myli… |
CVE-2021-27491 | High | 7.5 | 2021-07-30 | Ypsomed mylife Cloud, mylife Mobile Application:Ypsomed mylife Cloud,All versions prior to 1.7.2,Ypsomed mylife App,All versions prior to 1.7.5,The Ypsomed myl… |
CVE-2021-34700 | Medium | 5.5 | 2021-07-22 | A vulnerability in the CLI interface of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to read arbitrary files on the underlying fi… |
CVE-2020-5315 | High | 8.8 | 2021-07-19 | Dell EMC Repository Manager (DRM) version 3.2 contains a plain-text password storage vulnerability. Proxy server user password is stored in a plain text in a l… |
CVE-2021-35965 | Critical | 9.8 | 2021-07-19 | The Orca HCM digital learning platform uses a weak factory default administrator password, which is hard-coded in the source code of the webpage in plain text… |
CVE-2021-32770 | High | 7.5 | 2021-07-15 | Gatsby is a framework for building websites. The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP Basic Authentication var… |
CVE-2021-20439 | High | 7.5 | 2021-07-15 | IBM Security Access Manager 9.0 and IBM Security Verify Access Docker 10.0.0 stores user credentials in plain clear text which can be read by an unauthorized u… |
CVE-2021-22781 | Medium | 5.5 | 2021-07-14 | Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro)… |
CVE-2021-22780 | High | 7.1 | 2021-07-14 | Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro)… |
CVE-2021-22778 | High | 7.1 | 2021-07-14 | Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro)… |
CVE-2021-35527 | High | 7.5 | 2021-07-14 | Password autocomplete vulnerability in the web application password field of Hitachi ABB Power Grids eSOMS allows attacker to gain access to user credentials t… |
CVE-2021-21591 | Medium | 6.4 | 2021-07-12 | Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.1.0.0.5.394 contain a plain-text password storage vulnerability. A local malicious user with high pr… |
CVE-2021-21590 | Medium | 6.4 | 2021-07-12 | Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.1.0.0.5.394 contain a plain-text password storage vulnerability. A local malicious user with high pr… |
CVE-2021-36382 | Low | 2.6 | 2021-07-12 | Devolutions Server before 2021.1.18, and LTS before 2020.3.20, allows attackers to intercept private keys via a man-in-the-middle attack against the connection… |
CVE-2021-30116 | Critical | 10.0 | 2021-07-09 | Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the… |
CVE-2021-34075 | Medium | 5.9 | 2021-06-30 | In Artica Pandora FMS <=754 in the File Manager component, there is sensitive information exposed on the client side which attackers can access. |
CVE-2021-35050 | Medium | 6.5 | 2021-06-25 | User credentials stored in a recoverable format within Fidelis Network and Deception CommandPost. In the event that an attacker gains access to the CommandPost… |
CVE-2021-34204 | Medium | 6.8 | 2021-06-16 | D-Link DIR-2640-US 1.01B04 is affected by Insufficiently Protected Credentials. D-Link AC2600(DIR-2640) stores the device system account password in plain text… |
CVE-2021-28857 | High | 7.5 | 2021-06-15 | TP-Link's TL-WPA4220 4.0.2 Build 20180308 Rel.37064 username and password are sent via the cookie. |