CWE-523 · Unprotected Transport of Credentials

24 CVEs classified under CWE-523 (Unprotected Transport of Credentials). Browse by severity and year.

Top CVEs for CWE-523
CVESeverityScorePublishedSummary
CVE-2020-25175Critical9.82020-12-14GE Healthcare Imaging and Ultrasound Products may allow specific credentials to be exposed during transport over the network.
CVE-2024-1509Critical9.12025-02-28Brocade ASCG before 3.2.0 Web Interface is not enforcing HSTS, as defined by RFC 6797. HSTS is an optional response header that can be configured on the ser…
CVE-2025-57800High8.82025-08-22Audiobookshelf is an open-source self-hosted audiobook server. In versions 2.6.0 through 2.26.3, the application does not properly restrict redirect callback U…
CVE-2017-16731High8.82017-12-20An Unprotected Transport of Credentials issue was discovered in ABB Ellipse 8.3 through Ellipse 8.9 released prior to December 2017 (including Ellipse Select)…
CVE-2021-32003High8.02021-08-05Unprotected Transport of Credentials vulnerability in SiteManager provisioning service allows local attacker to capture credentials if the service is used afte…
CVE-2025-61916High7.92026-01-05Spinnaker is an open source, multi-cloud continuous delivery platform. Versions prior to 2025.1.6, 2025.2.3, and 2025.3.0 are vulnerable to server-side request…
CVE-2025-66029High7.62025-12-17Open OnDemand provides remote web access to supercomputers. In versions 4.0.8 and prior, the Apache proxy allows sensitive headers to be passed to origin serve…
CVE-2025-61121High7.52025-10-30Mobile Scanner Android App version 2.12.38 (package name com.glority.everlens), developed by Glority Global Group Ltd., contains a credential leakage vulnerabi…
CVE-2023-31277High7.52023-07-06 PiiGAB M-Bus transmits credentials in plaintext format.
CVE-2022-31805High7.52022-06-24In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected.
CVE-2021-38460High7.52021-10-12A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files…
CVE-2026-54784High7.42026-07-08CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. In version 1.9.0, CoreWCF SPNEGO SecurityContextToken negotiation…
CVE-2025-64309High7.42025-11-15The affected product discloses device telemetry, configuration, and sensitive information via WebSocket traffic to unauthenticated users when they connect to a…
CVE-2025-41705Medium6.82025-10-14An unauthenticated remote attacker (MITM) can intercept the websocket messages to gain access to the login credentials for the Webfrontend.
CVE-2026-23635Medium6.52026-03-25Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, a misconfiguration of the security attributes could potential…
CVE-2025-64308Medium6.52025-11-15The Brightpick Mission Control web application exposes hardcoded credentials in its client-side JavaScript bundle to Brightpick AI's documentation portal.
CVE-2024-1102Medium6.52024-04-25A vulnerability was found in jberet-core logging. An exception in 'dbProperties' might display user credentials such as the username and password for the datab…
CVE-2024-20395Medium6.42024-07-17A vulnerability in the media retrieval functionality of Cisco Webex App could allow an unauthenticated, adjacent attacker to gain access to sensitive session i…
CVE-2026-36610Medium5.92026-06-03Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 transmits DDNS credentials over plaintext HTTP with only Base64 encoding. The firmware contains no TLS…
CVE-2026-8673Medium5.92026-05-22Unprotected transport of credentials vulnerability in syslink software AG Avantra on Linux, Windows allows Sniffing Attacks. This issue affects Avantra: befor…