CWE-522
1,467 CVEs • Abstraction: Class
Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CVEs (1,467)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
Pass-Back vulnerability in versions prior to 2025.35.000 of Sage 200 Spain. This vulnerability allows an authenticated attacker with administrator privileges to discover stored SMTP credentials. |
Insufficiently Protected Credentials vulnerability in OpenText Identity Manager Advanced Edition on Windows, Linux, 64 bit allows Privilege Abuse. This vulnerability could allow an authenticated user to obtain higher pri...Show more |
1Printerlogic 2Vasion Print Virtual ApplianceJun 17, 2026 Mar 5, 2025 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Private Keys in Docker Overlay V-2023-013. |
1Printerlogic 2Vasion Print Virtual ApplianceJun 17, 2026 Mar 5, 2025 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.913 Application 20.0.2253 allows Cross Tenant Password Exposure V-2024-003. |
1Ibm 1Engineering Requirements Management Doors Next Jun 17, 2026 Mar 3, 2025 N/A· v4 7.5 HIGH· v3 N/A· v2 IBM Engineering Requirements Management DOORS Next 7.0.2, 7.0.3, and 7.1 could allow a remote attacker to download temporary files which could expose application logic or other sensitive information. |
1Ibm 1Engineering Requirements Management Doors Next Jun 17, 2026 Mar 3, 2025 N/A· v4 7.5 HIGH· v3 N/A· v2 IBM Engineering Requirements Management DOORS Next 7.0.2, 7.0.3, and 7.1 could allow a remote attacker to download temporary files which could expose application logic or other sensitive information. |
Cryptographic key extraction from internal flash in Minut M2 with firmware version #15142 allows physically proximate attackers to inject modified firmware into any other Minut M2 product via USB. |
Vue Vben Admin 2.10.1 allows unauthorized login to the backend due to an issue with hardcoded credentials. |
In XIQ-SE before 24.2.11, a low-privileged user may be able to access admin passwords, which could lead to privilege escalation. |
A Credential Disclosure vulnerability exists where an administrator could extract the stored SMTP account credentials due to lack of encryption. |
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. (CWE-522) Hitachi Vantara Pentaho Data Integration &...Show more |
The standard user uses the run as function to start the MEAC applications with administrative privileges. To ensure that the system can startup on its own, the credentials of the administrator were stored. Consequently,...Show more |
In JetBrains TeamCity before 2024.12.2 improper Kubernetes connection settings could expose sensitive resources |
An information disclosure vulnerability exists in the Vault API functionality of ClearML Enterprise Server 3.22.5-1533. A specially crafted HTTP request can lead to reading vaults that have been previously disabled, poss...Show more |
1Zyxel 14Sbg3300 N000 Firmware Sbg3300 Nb00 FirmwareSbg3500 N000 Firmware+11 moreJun 17, 2026 Feb 4, 2025 N/A· v4 9.8 CRITICAL· v3 N/A· v2 **UNSUPPORTED WHEN ASSIGNED** Insecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an attacker to log in to the management int...Show more |
With address book access, SMB/FTP settings could be modified, redirecting scans and possibly capturing credentials. This requires enabled scan functions and printer access. |
1Rockwellautomation 1Factorytalk Assetcentre Jun 17, 2026 Jan 30, 2025 7.0 HIGH· v4 9.8 CRITICAL· v3 N/A· v2 A data exposure vulnerability exists in all versions prior to V15.00.001 of Rockwell Automation FactoryTalk® AssetCentre. The vulnerability exists due to insecure storage of FactoryTalk® Security user tokens, which could...Show more |
1Rockwellautomation 1Factorytalk Assetcentre Jun 17, 2026 Jan 30, 2025 7.3 HIGH· v4 9.8 CRITICAL· v3 N/A· v2 A data exposure vulnerability exists in all versions prior to V15.00.001 of Rockwell Automation FactoryTalk® AssetCentre. The vulnerability exists due to storing credentials in the configuration file of EventLogAttachmen...Show more |
1Rockwellautomation 1Factorytalk Assetcentre Jun 17, 2026 Jan 30, 2025 9.3 CRITICAL· v4 9.8 CRITICAL· v3 N/A· v2 An encryption vulnerability exists in all versions prior to V15.00.001 of Rockwell Automation FactoryTalk® AssetCentre. The vulnerability exists due to a weak encryption methodology and could allow a threat actor to extr...Show more |
Password Vulnerability in Safety production process management system v1.0 allows a remote attacker to escalate privileges, execute arbitrary code and obtain sensitive information via the password and account number para...Show more |