← Back
CWE-522

1,466 CVEs • Abstraction: Class

Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

JSON object

Loading...

CVEs (1,466)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2012-3025
1Tridium
1Niagara Ax
Apr 29, 2026
Aug 16, 2012
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The default configuration of Tridium Niagara AX Framework through 3.6 uses a cleartext base64 format for transmission of credentials in cookies, which allows remote attackers to obtain sensitive information by sniffing t...Show more
The default configuration of Tridium Niagara AX Framework through 3.6 uses a cleartext base64 format for transmission of credentials in cookies, which allows remote attackers to obtain sensitive information by sniffing the network.Show less
CVE-2012-4028
1Tridium
1Niagara Ax
Apr 29, 2026
Jul 16, 2012
N/A· v4
N/A· v3
7.8 HIGH· v2
Tridium Niagara AX Framework does not properly store credential data, which allows context-dependent attackers to bypass intended access restrictions by using the stored information for authentication.
CVE-2007-0681
1Extcalendar Project
1Extcalendar
Apr 23, 2026
Feb 3, 2007
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
profile.php in ExtCalendar 2 and earlier allows remote attackers to change the passwords of arbitrary users without providing the original password, and possibly perform other unauthorized actions, via modified values to...Show more
profile.php in ExtCalendar 2 and earlier allows remote attackers to change the passwords of arbitrary users without providing the original password, and possibly perform other unauthorized actions, via modified values to register.php.Show less
CVE-2005-3435
1Archilles
1Newsworld
Apr 16, 2026
Nov 2, 2005
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
admin_news.php in Archilles Newsworld up to 1.3.0 allows attackers to bypass authentication by obtaining the password hash for another user, for example through another Newsworld vulnerability, and specifying the hash in...Show more
admin_news.php in Archilles Newsworld up to 1.3.0 allows attackers to bypass authentication by obtaining the password hash for another user, for example through another Newsworld vulnerability, and specifying the hash in the pwd argument.Show less
CVE-2000-0944
1Cgi
1Script Center News Update
Apr 16, 2026
Dec 19, 2000
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
CGI Script Center News Update 1.1 does not properly validate the original news administration password during a password change operation, which allows remote attackers to modify the password without knowing the original...Show more
CGI Script Center News Update 1.1 does not properly validate the original news administration password during a password change operation, which allows remote attackers to modify the password without knowing the original password.Show less
CVE-1999-0013
1Ssh
1Ssh
Apr 16, 2026
Jan 22, 1998
N/A· v4
8.4 HIGH· v3
7.5 HIGH· v2
Stolen credentials from SSH clients via ssh-agent program, allowing other local users to access remote accounts belonging to the ssh-agent user.