CWE-522
1,396 CVEs • Abstraction: Class
Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CVEs (1,396)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
typed-rest-client is a library for Node Rest and Http Clients with typings for use with TypeScript. Users of the typed-rest-client library version 1.7.3 or lower are vulnerable to leak authentication data to 3rd parties....Show more |
Sangoma FreePBX 1805 through 2302 (when obtained as a ,.ISO file) places AMPDBUSER, AMPDBPASS, AMPMGRUSER, and AMPMGRPASS in the list of global variables. This exposes cleartext authentication credentials for the Asteris...Show more |
2Hp Hpe2Oneview Oneview Global DashboardJun 17, 2026 Apr 25, 2023 N/A· v4 5.5 MEDIUM· v3 N/A· v2 HPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokens |
An HPE OneView appliance dump may expose SNMPv3 read credentials |
An HPE OneView appliance dump may expose FTP credentials for c7000 Interconnect Modules |
An HPE OneView appliance dump may expose SAN switch administrative credentials |
An HPE OneView appliance dump may expose OneView user accounts |
An HPE OneView appliance dump may expose proxy credential settings |
An authenticated user with specific data permissions could access database connections stored passwords by requesting a specific REST API. This issue affects Apache Superset version 1.3.0 up to 2.0.1. |
1Expo 1Expo Software Development Kit Jun 17, 2026 Apr 24, 2023 N/A· v4 9.6 CRITICAL· v3 N/A· v2 A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that configured the "Expo AuthSession Redirect Proxy" for social sign-in. This can be achi...Show more |
Ribose RNP before 0.15.1 does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than on the tin of the algorithm. |
Incorrect Access Control in Tripleplay Platform releases prior to Caveman 3.4.0 allows authenticated user to modify other users passwords via a crafted request payload |
Plaintext Storage of a Password vulnerability in Secomea GateManager (USB wizard) allows Authentication abuse on SiteManager, if the generated file is leaked. |
Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control. The device allows unauthenticated access to Telnet and SNMP credentials. |
Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control. Restricted users have read access to administrator credentials. |
Information disclosure in the user creation feature of a MSSQL data source in Devolutions Remote Desktop Manager 2023.1.9 and below on Windows allows an attacker with access to the user interface to obtain sensitive info...Show more |
In JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could leak through an API method used in the IntelliJ IDEA built-in web server. |
CP Plus KVMS Pro versions 2.01.0.T.190521 and prior are vulnerable to
sensitive credentials being leaked because they are insufficiently
protected.
|
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which a low-level user could extract files and plaintext credentials of administrator users, resulting in privilege escalation...Show more |
1Ibm 1Security Key Lifecycle Manager Jun 17, 2026 Mar 21, 2023 N/A· v4 5.5 MEDIUM· v3 N/A· v2 IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 247601. |