CWE-522 · Insufficiently Protected Credentials (page 9)
Page 9 of 15 — CVEs classified under CWE-522, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-15381 | High | 7.5 | 2021-06-09 | Brocade SANnav before version 2.1.1 contains an Improper Authentication vulnerability that allows cleartext transmission of authentication credentials of the j… |
CVE-2020-26515 | High | 7.5 | 2021-06-08 | An insufficiently protected credentials issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. The remember-me cookie (CB_LOGIN) issued by the a… |
CVE-2020-29323 | High | 7.5 | 2021-06-04 | The D-link router DIR-885L-MFC 1.15b02, v1.21b05 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an un… |
CVE-2020-29322 | High | 7.5 | 2021-06-04 | The D-Link router DIR-880L 1.07 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an unauthenticated att… |
CVE-2020-29321 | High | 7.5 | 2021-06-04 | The D-Link router DIR-868L 3.01 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an unauthenticated att… |
CVE-2021-1537 | Medium | 6.2 | 2021-06-04 | A vulnerability in the installer software of Cisco ThousandEyes Recorder could allow an unauthenticated, local attacker to access sensitive information that is… |
CVE-2019-4724 | High | 7.5 | 2021-06-01 | IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings in New Content… |
CVE-2019-4723 | High | 7.5 | 2021-06-01 | IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings in New Data Se… |
CVE-2021-23019 | High | 7.8 | 2021-06-01 | The NGINX Controller 2.0.0 thru 2.9.0 and 3.x before 3.15.0 Administrator password may be exposed in the systemd.txt file that is included in the NGINX support… |
CVE-2020-27831 | Medium | 4.3 | 2021-05-27 | A flaw was found in Red Hat Quay, where it does not properly protect the authorization token when authorizing email addresses for repository email notification… |
CVE-2020-27839 | Medium | 5.4 | 2021-05-26 | A flaw was found in ceph-dashboard. The JSON Web Token (JWT) used for user authentication is stored by the frontend application in the browser’s localStorage w… |
CVE-2019-25030 | Medium | 5.5 | 2021-05-26 | In Versa Director, Versa Analytics and VOS, Passwords are not hashed using an adaptive cryptographic hash function or key derivation function prior to storage… |
CVE-2021-29253 | Medium | 5.1 | 2021-05-26 | The Tableau integration in RSA Archer 6.4 P1 (6.4.0.1) through 6.9 P2 (6.9.0.2) is affected by an insecure credential storage vulnerability. An malicious attac… |
CVE-2021-20389 | High | 7.8 | 2021-05-24 | IBM Security Guardium 11.2 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 195770. |
CVE-2020-12061 | Critical | 9.8 | 2021-05-21 | An issue was discovered in Nitrokey FIDO U2F firmware through 1.1. Communication between the microcontroller and the secure element transmits credentials in pl… |
CVE-2020-24396 | High | 7.5 | 2021-05-20 | homee Brain Cube v2 (2.28.2 and 2.28.4) devices have sensitive SSH keys within downloadable and unencrypted firmware images. This allows remote attackers to us… |
CVE-2021-29043 | Medium | 5.9 | 2021-05-17 | The Portal Store module in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 b… |
CVE-2021-3528 | High | 8.8 | 2021-05-13 | A flaw was found in noobaa-operator in versions before 5.7.0, where internal RPC AuthTokens between the noobaa operator and the noobaa core are leaked into log… |
CVE-2021-20997 | High | 7.5 | 2021-05-13 | In multiple managed switches by WAGO in different versions it is possible to read out the password hashes of all Web-based Management users. |
CVE-2021-27941 | Medium | 4.6 | 2021-05-06 | Unconstrained Web access to the device's private encryption key in the QR code pairing mode in the eWeLink mobile application (through 4.9.2 on Android and thr… |
CVE-2020-21994 | Critical | 9.8 | 2021-04-28 | AVE DOMINAplus <=1.10.x suffers from clear-text credentials disclosure vulnerability that allows an unauthenticated attacker to issue a request to an unprotect… |
CVE-2021-30169 | Medium | 5.3 | 2021-04-28 | The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant user’s credential. |
CVE-2021-30168 | Critical | 9.8 | 2021-04-28 | The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant administrator’s credential and further control… |
CVE-2021-30167 | Critical | 9.8 | 2021-04-28 | The manage users profile services of the network camera device allows an authenticated. Remote attackers can modify URL parameters and further amend user’s inf… |
CVE-2021-29262 | High | 7.5 | 2021-04-13 | When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider and no existing security… |
CVE-2020-15942 | Medium | 4.3 | 2021-04-12 | An information disclosure vulnerability in Web Vulnerability Scan profile of Fortinet's FortiWeb version 6.2.x below 6.2.4 and version 6.3.x below 6.3.5 may al… |
CVE-2021-22115 | Medium | 6.5 | 2021-04-08 | Cloud Controller API versions prior to 1.106.0 logs service broker credentials if the default value of db logging config field is changed. CAPI database logs s… |
CVE-2021-28171 | Critical | 9.8 | 2021-04-06 | The Vangene deltaFlow E-platform does not take properly protective measures. Attackers can obtain privileged permissions remotely by tampering with users’ data… |
CVE-2020-11925 | High | 8.8 | 2021-04-02 | An issue was discovered in Luvion Grand Elite 3 Connect through 2020-02-25. Authentication to the device is based on a username and password. The root credenti… |
CVE-2021-21634 | Medium | 6.5 | 2021-03-30 | Jenkins Jabber (XMPP) notifier and control Plugin 1.41 and earlier stores passwords unencrypted in its global configuration file on the Jenkins controller wher… |
CVE-2021-29255 | High | 7.5 | 2021-03-26 | MicroSeven MYM71080i-B 2.0.5 through 2.0.20 devices send admin credentials in cleartext to pnp.microseven.com TCP port 7007. An attacker on the same network as… |
CVE-2021-27372 | Critical | 9.8 | 2021-03-25 | Realtek xPON RTL9601D SDK 1.9 stores passwords in plaintext which may allow attackers to possibly gain access to the device with root permissions via the build… |
CVE-2021-1392 | High | 7.8 | 2021-03-24 | A vulnerability in the CLI command permissions of Cisco IOS and Cisco IOS XE Software could allow an authenticated, local attacker to retrieve the password for… |
CVE-2019-10225 | Medium | 6.3 | 2021-03-19 | A flaw was found in atomic-openshift of openshift-4.2 where the basic-user RABC role in OpenShift Container Platform doesn't sufficiently protect the GlusterFS… |
CVE-2021-3141 | High | 7.8 | 2021-03-18 | In Unisys Stealth (core) before 6.0.025.0, the Keycloak password is stored in a recoverable format that might be accessible by a local attacker, who could gain… |
CVE-2021-3344 | High | 8.8 | 2021-03-16 | A privilege escalation flaw was found in OpenShift builder. During build time, credentials outside the build context are automatically mounted into the contain… |
CVE-2021-27935 | High | 7.5 | 2021-03-03 | An issue was discovered in AdGuard before 0.105.2. An attacker able to get the user's cookie is able to bruteforce their password offline, because the hash of… |
CVE-2021-22681 | Critical | 9.8 | 2021-03-03 | Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communi… |
CVE-2021-25284 | Medium | 4.4 | 2021-02-27 | An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level. |
CVE-2021-1731 | Medium | 5.5 | 2021-02-25 | PFX Encryption Security Feature Bypass Vulnerability |
CVE-2021-3252 | High | 7.5 | 2021-02-23 | KACO New Energy XP100U Up to XP-JAVA 2.0 is affected by incorrect access control. Credentials will always be returned in plain-text from the local server durin… |
CVE-2021-20445 | Medium | 6.5 | 2021-02-18 | IBM Maximo for Civil Infrastructure 7.6.2 could allow a user to obtain sensitive information due to insecure storeage of authentication credentials. IBM X-Forc… |
CVE-2020-9306 | High | 8.8 | 2021-02-18 | Tesla SolarCity Solar Monitoring Gateway through 5.46.43 has a "Use of Hard-coded Credentials" issue because Digi ConnectPort X2e uses a .pyc file to store the… |
CVE-2021-20410 | Medium | 5.3 | 2021-02-12 | IBM Security Verify Information Queue 1.0.6 and 1.0.7 sends user credentials in plain clear text which can be read by an authenticated user using man in the mi… |
CVE-2021-27187 | High | 7.5 | 2021-02-12 | The Sovremennye Delovye Tekhnologii FX Aggregator terminal client 1 stores authentication credentials in cleartext in login.sav when the Save Password box is c… |
CVE-2020-14391 | Medium | 5.5 | 2021-02-08 | A flaw was found in the GNOME Control Center in Red Hat Enterprise Linux 8 versions prior to 8.2, where it improperly uses Red Hat Customer Portal credentials… |
CVE-2020-10554 | High | 7.5 | 2021-02-05 | An issue was discovered in Psyprax beforee 3.2.2. Passwords used to encrypt the data are stored in the database in an obfuscated format, which can be easily re… |
CVE-2020-29005 | High | 7.5 | 2021-01-29 | The API in the Push extension for MediaWiki through 1.35 used cleartext for ApiPush credentials, allowing for potential information disclosure. |
CVE-2020-27258 | Medium | 6.5 | 2021-01-19 | In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, an information disclosure vulnerability in the communication protocol of the insulin pump… |
CVE-2020-27270 | Medium | 5.7 | 2021-01-19 | SOOIL Developments CoLtd DiabecareRS, AnyDana-i ,AnyDana-A, communication protocol of the insulin pump & AnyDana-i,AnyDana-A mobile apps doesnt use adequate me… |
CVE-2021-0220 | Medium | 6.8 | 2021-01-15 | The Junos Space Network Management Platform has been found to store shared secrets in a recoverable format that can be exposed through the UI. An attacker who… |
CVE-2021-0212 | Medium | 5.0 | 2021-01-15 | An Information Exposure vulnerability in Juniper Networks Contrail Networking allows a locally authenticated attacker able to read files to retrieve administra… |
CVE-2021-22132 | Medium | 4.8 | 2021-01-14 | Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store… |
CVE-2021-1126 | Medium | 5.5 | 2021-01-13 | A vulnerability in the storage of proxy server credentials of Cisco Firepower Management Center (FMC) could allow an authenticated, local attacker to view cred… |
CVE-2020-4602 | Medium | 4.4 | 2021-01-13 | IBM Security Guardium Insights 2.0.2 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 184836. |
CVE-2021-21614 | Medium | 5.5 | 2021-01-13 | Jenkins Bumblebee HP ALM Plugin 4.1.5 and earlier stores credentials unencrypted in its global configuration file on the Jenkins controller where they can be v… |
CVE-2021-21612 | Medium | 5.5 | 2021-01-13 | Jenkins TraceTronic ECU-TEST Plugin 2.23.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins controller where they can… |
CVE-2020-28390 | Medium | 5.5 | 2021-01-12 | A vulnerability has been identified in Opcenter Execution Core (V8.2), Opcenter Execution Core (V8.3). The application contains an information leakage vulnerab… |
CVE-2020-4913 | Medium | 4.4 | 2021-01-04 | IBM Cloud Pak System 2.3 could reveal credential information in the HTTP response to a local privileged user. IBM X-Force ID: 191288. |
CVE-2020-2499 | Medium | 6.3 | 2020-12-24 | A hard-coded password vulnerability has been reported to affect earlier versions of QES. If exploited, this vulnerability could allow attackers to log in with… |
CVE-2020-29583 | Critical | 9.8 | 2020-12-22 | Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found i… |
CVE-2020-24680 | High | 7.0 | 2020-12-22 | In S+ Operations and S+ Historian, the passwords of internal users (not Windows Users) are encrypted but improperly stored in a database. |
CVE-2020-27781 | High | 7.1 | 2020-12-18 | User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila, resulting in potential privilege escalation. An Open Stack Manil… |
CVE-2019-14480 | Critical | 9.8 | 2020-12-16 | AdRem NetCrunch 10.6.0.4587 has an Improper Session Handling vulnerability in the NetCrunch web client, which can lead to an authentication bypass or escalatio… |
CVE-2019-14477 | Medium | 5.5 | 2020-12-16 | AdRem NetCrunch 10.6.0.4587 has Improper Credential Storage since the internal user database is readable by low-privileged users and passwords in the database… |
CVE-2020-25235 | High | 7.5 | 2020-12-14 | A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). The password used for authentication for the LOGO! Website and… |
CVE-2020-25175 | Critical | 9.8 | 2020-12-14 | GE Healthcare Imaging and Ultrasound Products may allow specific credentials to be exposed during transport over the network. |
CVE-2020-28219 | High | 7.8 | 2020-12-11 | A CWE-522: Insufficiently Protected Credentials vulnerability exists in EcoStruxure Geo SCADA Expert 2019 (Original release and Monthly Updates to September 20… |
CVE-2020-29380 | Medium | 5.9 | 2020-11-29 | An issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57, V1600D4L V1.01.49, V1600D-MINI V1.01.48, V1600G1 V2.0.7 and V1.9.7, and V1600G2 V1.1.4 OLT devic… |
CVE-2020-29054 | Critical | 9.8 | 2020-11-24 | An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S… |
CVE-2020-28330 | Medium | 6.5 | 2020-11-24 | Barco wePresent WiPG-1600W devices have Unprotected Transport of Credentials. Affected Version(s): 2.5.1.8. An attacker armed with hardcoded API credentials (r… |
CVE-2020-24227 | High | 7.5 | 2020-11-23 | Playground Sessions v2.5.582 (and earlier) for Windows, stores the user credentials in plain text allowing anyone with access to UserProfiles.sol to extract th… |
CVE-2020-26079 | Medium | 4.9 | 2020-11-18 | A vulnerability in the web UI of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to obtain hashes of user passwords on an… |
CVE-2020-27557 | Medium | 5.5 | 2020-11-17 | Unprotected Storage of Credentials vulnerability in BASETech GE-131 BT-1837836 firmware 20180921 allows local users to gain access to the video streaming usern… |
CVE-2020-27554 | High | 7.5 | 2020-11-17 | Cleartext Transmission of Sensitive Information vulnerability in BASETech GE-131 BT-1837836 firmware 20180921 exists which could leak sensitive information tra… |
CVE-2020-26508 | Critical | 9.8 | 2020-11-16 | The WebTools component on Canon Oce ColorWave 3500 5.1.1.0 devices allows attackers to retrieve stored SMB credentials via the export feature, even though thes… |
CVE-2020-8259 | High | 8.1 | 2020-11-16 | Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the encryption keys. |
CVE-2020-8152 | Medium | 4.4 | 2020-11-16 | Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the public key to decrypt them later on. |
CVE-2020-12333 | High | 7.8 | 2020-11-12 | Insufficiently protected credentials in the Intel(R) QAT for Linux before version 1.7.l.4.10.0 may allow an authenticated user to potentially enable escalation… |
CVE-2020-12316 | Medium | 5.5 | 2020-11-12 | Insufficiently protected credentials in the Intel(R) EMA before version 1.3.3 may allow an authorized user to potentially enable information disclosure via loc… |
CVE-2020-12309 | Medium | 4.6 | 2020-11-12 | Insufficiently protected credentialsin subsystem in some Intel(R) Client SSDs and some Intel(R) Data Center SSDs may allow an unauthenticated user to potential… |
CVE-2020-4568 | Medium | 5.5 | 2020-11-10 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, and 4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 184157. |
CVE-2020-27688 | High | 7.5 | 2020-11-05 | RVToolsPasswordEncryption.exe in RVTools 4.0.6 allows users to encrypt passwords to be used in the configuration files. This encryption used a static IV and ke… |
CVE-2020-2319 | Medium | 6.5 | 2020-11-04 | Jenkins VMware Lab Manager Slaves Plugin 0.2.8 and earlier stores a password unencrypted in the global config.xml file on the Jenkins controller where it can b… |
CVE-2020-2318 | Medium | 6.5 | 2020-11-04 | Jenkins Mail Commander Plugin for Jenkins-ci Plugin 1.0.0 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they… |
CVE-2020-2314 | Medium | 5.5 | 2020-11-04 | Jenkins AppSpider Plugin 1.0.12 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by… |
CVE-2020-8183 | High | 7.5 | 2020-11-02 | A logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it was given on the initial create API call. |
CVE-2020-27888 | High | 7.5 | 2020-10-27 | An issue was discovered on Ubiquiti UniFi Meshing Access Point UAP-AC-M 4.3.21.11325 and UniFi Controller 6.0.28 devices. Cached credentials are not erased fro… |
CVE-2020-7196 | Medium | 6.5 | 2020-10-26 | The HPE BlueData EPIC Software Platform version 4.0 and HPE Ezmeral Container Platform 5.0 use an insecure method of handling sensitive Kerberos passwords that… |
CVE-2020-1688 | Medium | 6.5 | 2020-10-16 | On Juniper Networks SRX Series and NFX Series, a local authenticated user with access to the shell may obtain the Web API service private key that is used to p… |
CVE-2020-1669 | Medium | 6.3 | 2020-10-16 | The Juniper Device Manager (JDM) container, used by the disaggregated Junos OS architecture on Juniper Networks NFX350 Series devices, stores password hashes i… |
CVE-2020-15157 | Medium | 6.1 | 2020-10-16 | In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability. If a container image manifest in the… |
CVE-2020-3483 | High | 7.1 | 2020-10-14 | Duo has identified and fixed an issue with the Duo Network Gateway (DNG) product in which some customer-provided SSL certificates and private keys were not exc… |
CVE-2018-20243 | High | 7.5 | 2020-10-13 | The implementation of POST with the username and password in the URL parameters exposed the credentials. More infomration is available in fineract jira issues… |
CVE-2020-13344 | Medium | 5.7 | 2020-10-08 | An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. Sessions keys are stored in plain-text in Redis which allows… |
CVE-2020-2297 | Low | 3.3 | 2020-10-08 | Jenkins SMS Notification Plugin 1.2 and earlier stores an access token unencrypted in its global configuration file on the Jenkins controller where it can be v… |
CVE-2020-2291 | Low | 3.3 | 2020-10-08 | Jenkins couchdb-statistics Plugin 0.3 and earlier stores its server password unencrypted in its global configuration file on the Jenkins controller where it ca… |
CVE-2020-26149 | High | 7.5 | 2020-09-30 | NATS nats.js before 2.0.0-209, nats.ws before 1.0.0-111, and nats.deno before 1.0.0-9 allow credential disclosure from a client to a server. |
CVE-2019-16211 | Critical | 9.8 | 2020-09-25 | Brocade SANnav versions before v2.1.0, contain a Plaintext Password Storage vulnerability. |
CVE-2020-7945 | Medium | 5.5 | 2020-09-18 | Local registry credentials were included directly in the CD4PE deployment definition, which could expose these credentials to users who should not have access… |