Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

CVEs (1,467)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2010-4178 2Fedoraproject Oracle 2Fedora Mysql Gui Tools Nov 21, 2024 Nov 6, 2019 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 MySQL-GUI-tools (mysql-administrator) leaks passwords into process list after with launch of mysql text console
CVE-2016-4401 1Arubanetworks 1Clearpass Nov 21, 2024 Nov 6, 2019 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Aruba ClearPass Policy Manager before 6.5.7 and 6.6.x before 6.6.2 allows attackers to obtain database credentials.
CVE-2013-4423 1Redhat 1Cloudforms Nov 21, 2024 Nov 4, 2019 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 CloudForms stores user passwords in recoverable format
CVE-2019-10210 1Postgresql 1Postgresql Jun 17, 2026 Oct 29, 2019 N/A· v4 7.0 HIGH· v3 1.9 LOW· v2 Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via superuser writing password to unprotected temporary file.
CVE-2019-4307 1Ibm 1Security Guardium Big Data Intelligence Jun 17, 2026 Oct 29, 2019 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 IBM Security Guardium Big Data Intelligence (SonarG) 4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 160987.
CVE-2019-14929 2Inea Mitsubishielectric 2Me Rtu Firmware Smartrtu Firmware Jun 17, 2026 Oct 28, 2019 N/A· v4 9.8 CRITICAL· v3 5.0 MEDIUM· v2 An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Stored cleartext passwords could allow an unauthenticated attacker to obtain configured username...Show more An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Stored cleartext passwords could allow an unauthenticated attacker to obtain configured username and password combinations on the RTU due to the weak credentials management on the RTU. An unauthenticated user can obtain the exposed password credentials to gain access to the following services: DDNS service, Mobile Network Provider, and OpenVPN service.Show less
CVE-2019-10476 1Jenkins 1Zulip Jun 17, 2026 Oct 23, 2019 N/A· v4 7.8 HIGH· v3 2.1 LOW· v2 Jenkins Zulip Plugin 1.1.0 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
CVE-2019-10467 1Jenkins 1Sonar Gerrit Jun 17, 2026 Oct 23, 2019 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 Jenkins Sonar Gerrit Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
CVE-2019-10461 1Jenkins 1Dynatrace Application Monitoring Jun 17, 2026 Oct 23, 2019 N/A· v4 7.8 HIGH· v3 2.1 LOW· v2 Jenkins Dynatrace Application Monitoring Plugin 2.1.3 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file s...Show more Jenkins Dynatrace Application Monitoring Plugin 2.1.3 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.Show less
CVE-2019-10460 1Jenkins 1Bitbucket Oauth Jun 17, 2026 Oct 23, 2019 N/A· v4 7.8 HIGH· v3 2.1 LOW· v2 Jenkins Bitbucket OAuth Plugin 0.9 and earlier stored credentials unencrypted in the global config.xml configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
CVE-2019-10459 1Jenkins 1Mattermost Notification Jun 17, 2026 Oct 23, 2019 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 Jenkins Mattermost Notification Plugin 2.7.0 and earlier stored webhook URLs containing a secret token unencrypted in its global configuration file and job config.xml files on the Jenkins master where they could be viewe...Show more Jenkins Mattermost Notification Plugin 2.7.0 and earlier stored webhook URLs containing a secret token unencrypted in its global configuration file and job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.Show less
CVE-2019-17393 1Tomedo 1Server Jun 17, 2026 Oct 18, 2019 N/A· v4 9.8 CRITICAL· v3 5.0 MEDIUM· v2 The Customer's Tomedo Server in Version 1.7.3 communicates to the Vendor Tomedo Server via HTTP (in cleartext) that can be sniffed by unauthorized actors. Basic authentication is used for the authentication, making it po...Show more The Customer's Tomedo Server in Version 1.7.3 communicates to the Vendor Tomedo Server via HTTP (in cleartext) that can be sniffed by unauthorized actors. Basic authentication is used for the authentication, making it possible to base64 decode the sniffed credentials and discover the username and password.Show less
CVE-2019-11284 2Broadcom Pivotal 2Reactor Netty Reactor Netty Sep 4, 2026 Oct 17, 2019 N/A· v4 8.6 HIGH· v3 5.0 MEDIUM· v2 Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they hav...Show more Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.Show less
CVE-2019-17662 1Cybelsoft 1Thinvnc Jun 17, 2026 Oct 16, 2019 N/A· v4 9.8 CRITICAL· v3 5.0 MEDIUM· v2 ThinVNC 1.0b1 is vulnerable to arbitrary file read, which leads to a compromise of the VNC server. The vulnerability exists even when authentication is turned on during the deployment of the VNC server. The password for...Show more ThinVNC 1.0b1 is vulnerable to arbitrary file read, which leads to a compromise of the VNC server. The vulnerability exists even when authentication is turned on during the deployment of the VNC server. The password for authentication is stored in cleartext in a file that can be read via a ../../ThinVnc.ini directory traversal attack vector.Show less
CVE-2019-10448 1Jenkins 1Extensive Testing Jun 17, 2026 Oct 16, 2019 N/A· v4 8.8 HIGH· v3 4.0 MEDIUM· v2 Jenkins Extensive Testing Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
CVE-2019-17356 1Infinitestudio 1Infinite Design Jun 17, 2026 Oct 15, 2019 N/A· v4 6.5 MEDIUM· v3 3.3 LOW· v2 The Infinite Design application 3.4.12 for Android sends a username and password via TCP without any encryption during login, as demonstrated by sniffing of a public Wi-Fi network.
CVE-2019-17497 1Pdf Xchange 1Pdf Xchange Editor Jun 17, 2026 Oct 11, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Tracker PDF-XChange Editor before 8.0.330.0 has an NTLM SSO hash theft vulnerability using crafted FDF or XFDF files (a related issue to CVE-2018-4993). For example, an NTLM hash is sent for a link to \\192.168.0.2\C$\fi...Show more Tracker PDF-XChange Editor before 8.0.330.0 has an NTLM SSO hash theft vulnerability using crafted FDF or XFDF files (a related issue to CVE-2018-4993). For example, an NTLM hash is sent for a link to \\192.168.0.2\C$\file.pdf without user interaction.Show less
CVE-2019-9533 1Cobham 1Explorer 710 Firmware Jun 17, 2026 Oct 10, 2019 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 The root password of the Cobham EXPLORER 710 is the same for all versions of firmware up to and including v1.08. This could allow an attacker to reverse-engineer the password from available versions to gain authenticated...Show more The root password of the Cobham EXPLORER 710 is the same for all versions of firmware up to and including v1.08. This could allow an attacker to reverse-engineer the password from available versions to gain authenticated access to the device.Show less
CVE-2019-0072 1Juniper 1Sbr Carrier Jun 17, 2026 Oct 9, 2019 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 An Unprotected Storage of Credentials vulnerability in the identity and access management certificate generation procedure allows a local attacker to gain access to confidential information. This issue affects: Juniper N...Show more An Unprotected Storage of Credentials vulnerability in the identity and access management certificate generation procedure allows a local attacker to gain access to confidential information. This issue affects: Juniper Networks SBR Carrier: 8.4.1 versions prior to 8.4.1R13; 8.5.0 versions prior to 8.5.0R4.Show less
CVE-2019-10429 1Jenkins 1Gitlab Logo Jun 17, 2026 Sep 25, 2019 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 Jenkins GitLab Logo Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

Previous 1...565758...74 Next