Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

CVEs (1,467)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-2125 1Jenkins 1Debian Package Builder Jun 17, 2026 Feb 12, 2020 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 Jenkins Debian Package Builder Plugin 1.6.11 and earlier stores a GPG passphrase unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system.
CVE-2020-2124 1Jenkins 1Dynamic Extended Choice Parameter Jun 17, 2026 Feb 12, 2020 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to t...Show more Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.Show less
CVE-2020-2119 1Jenkins 1Azure Ad Jun 17, 2026 Feb 12, 2020 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Jenkins Azure AD Plugin 1.1.2 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
CVE-2020-2114 1Jenkins 1S3 Publisher Jun 17, 2026 Feb 12, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Jenkins S3 publisher Plugin 0.11.4 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
CVE-2020-6969 1Automationdirect 11C More Ea9 Rhi Firmware C More Ea9 T10cl FirmwareC More Ea9 T10wcl Firmware+8 more Jun 17, 2026 Feb 5, 2020 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 It is possible to unmask credentials and other sensitive information on “unprotected” project files, which may allow an attacker to remotely access the C-More Touch Panels EA9 series: firmware versions prior to 6.53 and...Show more It is possible to unmask credentials and other sensitive information on “unprotected” project files, which may allow an attacker to remotely access the C-More Touch Panels EA9 series: firmware versions prior to 6.53 and manipulate system configurations.Show less
CVE-2013-7055 1Dlink 1Dir 100 Firmware Nov 21, 2024 Feb 4, 2020 N/A· v4 9.8 CRITICAL· v3 5.0 MEDIUM· v2 D-Link DIR-100 4.03B07 has PPTP and poe information disclosure
CVE-2013-7052 1Dlink 1Dir 100 Firmware Nov 21, 2024 Feb 4, 2020 N/A· v4 9.8 CRITICAL· v3 5.0 MEDIUM· v2 D-Link DIR-100 4.03B07: security bypass via an error in the cliget.cgi script
CVE-2013-2672 1Brother 1Mfc 9970cdw Firmware Nov 21, 2024 Feb 3, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Brother MFC-9970CDW devices with firmware 0D allow cleartext submission of passwords.
CVE-2019-19119 1Paessler 1Prtg Network Monitor Jun 17, 2026 Feb 3, 2020 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 An issue was discovered in PRTG 7.x through 19.4.53. Due to insufficient access control on local registry keys for the Core Server Service, a non-administrative user on the local machine is able to access administrative...Show more An issue was discovered in PRTG 7.x through 19.4.53. Due to insufficient access control on local registry keys for the Core Server Service, a non-administrative user on the local machine is able to access administrative credentials.Show less
CVE-2013-5113 1Logmein 1Lastpass Nov 21, 2024 Jan 31, 2020 N/A· v4 6.8 MEDIUM· v3 1.9 LOW· v2 LastPass prior to 2.5.1 has an insecure PIN implementation.
CVE-2020-7909 1Jetbrains 1Teamcity Jun 17, 2026 Jan 30, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In JetBrains TeamCity before 2019.1.5, some server-stored passwords could be shown via the web UI.
CVE-2020-2107 1Jenkins 1Fortify Jun 17, 2026 Jan 29, 2020 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 Jenkins Fortify Plugin 19.1.29 and earlier stores proxy server passwords unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master...Show more Jenkins Fortify Plugin 19.1.29 and earlier stores proxy server passwords unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.Show less
CVE-2014-3445 1Handsomeweb 1Sos Webpages Nov 21, 2024 Jan 28, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 backup.php in HandsomeWeb SOS Webpages before 1.1.12 does not require knowledge of the cleartext password, which allows remote attackers to bypass authentication by leveraging knowledge of the administrator password hash...Show more backup.php in HandsomeWeb SOS Webpages before 1.1.12 does not require knowledge of the cleartext password, which allows remote attackers to bypass authentication by leveraging knowledge of the administrator password hash.Show less
CVE-2014-2581 2Fedoraproject Smb4k Project 2Fedora Smb4k Nov 21, 2024 Jan 28, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Smb4K before 1.1.1 allows remote attackers to obtain credentials via vectors related to the cuid option in the "Additional options" line edit.
CVE-2019-19539 1Hp 3Web Viewpoint T0320 Web Viewpoint T0952Web Viewpoint T0986 Jun 17, 2026 Jan 27, 2020 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 An issue was discovered in Idelji Web ViewPoint H01ABO-H01BY and L01ABP-L01ABZ, Web ViewPoint Plus H01AAG-H01AAQ and L01AAH-L01AAR, and Web ViewPoint Enterprise H01-H01AAE and L01-L01AAF. By reading ADB or AADB file cont...Show more An issue was discovered in Idelji Web ViewPoint H01ABO-H01BY and L01ABP-L01ABZ, Web ViewPoint Plus H01AAG-H01AAQ and L01AAH-L01AAR, and Web ViewPoint Enterprise H01-H01AAE and L01-L01AAF. By reading ADB or AADB file content within the Installation subvolume, a Guardian user can discover the password of the group.user or alias who acknowledges events from the WVP Events screen.Show less
CVE-2019-19823 11Ciktel CoshipFg Products+8 more 18A3002ru Firmware A702r FirmwareEmta Ap Firmwre+15 more Jun 17, 2026 Jan 27, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) stores cleartext administrative passwords in flash memory and in a file. This affects TOTOLINK A3002RU through 2.0.0, A702...Show more A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) stores cleartext administrative passwords in flash memory and in a file. This affects TOTOLINK A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0; Rutek RTK 11N AP through 2019-12-12; Sapido GR297n through 2019-12-12; CIK TELECOM MESH ROUTER through 2019-12-12; KCTVJEJU Wireless AP through 2019-12-12; Fibergate FGN-R2 through 2019-12-12; Hi-Wifi MAX-C300N through 2019-12-12; HCN MAX-C300N through 2019-12-12; T-broad GN-866ac through 2019-12-12; Coship EMTA AP through 2019-12-12; and IO-Data WN-AC1167R through 2019-12-12.Show less
CVE-2020-6961 1Gehealthcare 6Apexpro Telemetry Server Firmware Carescape Central Station Mai700 FirmwareCarescape Central Station Mas700 Firmware+3 more Jun 17, 2026 Jan 24, 2020 N/A· v4 10.0 CRITICAL· v3 7.5 HIGH· v2 In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Telemetry Server Version 4.3, CARESCAPE Central Station (CSC...Show more In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Telemetry Server Version 4.3, CARESCAPE Central Station (CSCS) Versions 1.X, a vulnerability exists in the affected products that could allow an attacker to obtain access to the SSH private key in configuration files.Show less
CVE-2012-6663 1Ge 2D200 Firmware D20me Firmware Nov 21, 2024 Jan 23, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 General Electric D20ME devices are not properly configured and reveal plaintext passwords.
CVE-2019-19898 1Ixpdata 1Easyinstall Jun 17, 2026 Jan 23, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In IXP EasyInstall 6.2.13723, there are cleartext credentials in network communication on TCP port 20050 when using the Administrator console remotely.
CVE-2019-19843 1Ruckuswireless 2Unleashed Zonedirector 1200 Firmware Jun 17, 2026 Jan 22, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote credential fetch via an unauthenticated HTTP request involving a symlink with /tmp and web/user/wps_tool_ca...Show more Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote credential fetch via an unauthenticated HTTP request involving a symlink with /tmp and web/user/wps_tool_cache.Show less

Previous 1...535455...74 Next