← Back
CWE-522

1,467 CVEs • Abstraction: Class

Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

JSON object

Loading...

CVEs (1,467)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
1Tianyisc
1Tewa 700g Firmware
Jun 17, 2026
Sep 14, 2023
N/A· v4
5.5 MEDIUM· v3
N/A· v2
Insecure Permissions vulnerability in Sichuan Tianyi Kanghe Communication Co., Ltd China Telecom Tianyi Home Gateway v.TEWA-700G allows a local attacker to obtain sensitive information via the default password parameter.
1Ibm
2Sterling External Authentication Server
Sterling Secure Proxy
Jun 17, 2026
Sep 5, 2023
N/A· v4
5.5 MEDIUM· v3
N/A· v2
IBM Sterling Secure Proxy and IBM Sterling External Authentication Server 6.0.3 and 6.1.0 stores user credentials in plain clear text which can be read by a local user with container access. IBM X-Force ID: 255585.
1Tenable
1Nessus
Jun 17, 2026
Aug 29, 2023
N/A· v4
4.9 MEDIUM· v3
N/A· v2
A pass-back vulnerability exists where an authenticated, remote attacker with administrator privileges could uncover stored SMTP credentials within the Nessus application.This issue affects Nessus: before 10.6.0....Show more
A pass-back vulnerability exists where an authenticated, remote attacker with administrator privileges could uncover stored SMTP credentials within the Nessus application.This issue affects Nessus: before 10.6.0. Show less
1Fresenius Kabi
1Pharmahelp Firmware
Jun 17, 2026
Aug 22, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
An issue was discovered in Fresenius Kabi PharmaHelp 5.1.759.0 allows attackers to gain escalated privileges via via capture of user login information.
1Fobybus
1Social Media Skeleton
Jun 17, 2026
Aug 18, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. Prior to version 1.0.5 Social media skeleton did not properly salt passwords leaving user password...Show more
Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. Prior to version 1.0.5 Social media skeleton did not properly salt passwords leaving user passwords susceptible to cracking should an attacker gain access to hashed passwords. This issue has been addressed in version 1.0.5 and users are advised to upgrade. There are no known workarounds for this issue.Show less
1Zohocorp
1Manageengine Admanager Plus
Jun 17, 2026
Aug 17, 2023
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Zoho ManageEngine ADManager Plus version 7182 and prior disclosed the default passwords for the account restoration of unauthorized domains to the authenticated users.
1Jenkins
1Maven Artifact Choicelistprovider (nexus)
Jun 17, 2026
Aug 16, 2023
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin 1.14 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials t...Show more
Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin 1.14 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to.Show less
1Jenkins
1Delphix
Jun 17, 2026
Aug 16, 2023
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Jenkins Delphix Plugin 3.0.2 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Overall/Read permission to access and capture credentials they are not entitled to.
1Broadcom
1Raid Controller Web Interface
Jun 17, 2026
Aug 15, 2023
N/A· v4
5.5 MEDIUM· v3
N/A· v2
Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any local user on Windows
1Broadcom
1Raid Controller Web Interface
Jun 17, 2026
Aug 15, 2023
N/A· v4
5.5 MEDIUM· v3
N/A· v2
Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any local user on Linux
1Google
1Android
Jun 17, 2026
Aug 14, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
In processMessageImpl of ClientModeImpl.java, there is a possible credential disclosure in the TOFU flow due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution pr...Show more
In processMessageImpl of ClientModeImpl.java, there is a possible credential disclosure in the TOFU flow due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Show less
1Gatesair
1Flexiva Fax 150w Firmware
Jul 9, 2026
Aug 3, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
An isssue in GatesAIr Flexiva FM Transmitter/Exiter Fax 150W allows a remote attacker to gain privileges via the LDAP and SMTP credentials.
2Fedoraproject
Google
2Chrome
Fedora
Jun 17, 2026
Jul 29, 2023
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Insufficient policy enforcement in Intents in Google Chrome on Android prior to 109.0.5414.119 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
1Infodrom
1E Invoice Approval System
Jun 17, 2026
Jul 25, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
Plaintext Storage of a Password vulnerability in Infodrom Software E-Invoice Approval System allows Read Sensitive Strings Within an Executable. This issue affects E-Invoice Approval System: before v.20230701.
1Weintek
1Weincloud
Jun 17, 2026
Jul 19, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Weintek Weincloud v0.13.6 could allow an attacker to abuse the registration functionality to login with testing credentials to the official website.
1Dericia
1Delicia
Jul 9, 2026
Jul 13, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
An issue found in DERICIA Co. Ltd, DELICIA v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp DELICIA function.
1Sonicwall
2Analytics
Global Management System
Jun 17, 2026
Jul 13, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Tomcat application credentials are hardcoded in SonicWall GMS and Analytics configuration file. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
1Jenkins
1Mabl
Jun 17, 2026
Jul 12, 2023
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Jenkins mabl Plugin 0.0.46 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to.
1Keepersecurity
2Keeper
Keeperfill
Jun 17, 2026
Jul 12, 2023
N/A· v4
5.5 MEDIUM· v3
N/A· v2
An issue was discovered in Keeper Password Manager for Desktop version 16.10.2 (fixed in 17.2), and the KeeperFill Browser Extensions version 16.5.4 (fixed in 17.2), allows local attackers to gain sensitive information v...Show more
An issue was discovered in Keeper Password Manager for Desktop version 16.10.2 (fixed in 17.2), and the KeeperFill Browser Extensions version 16.5.4 (fixed in 17.2), allows local attackers to gain sensitive information via plaintext password storage in memory after the user is already logged in, and may persist after logout. NOTE: the vendor disputes this for two reasons: the information is inherently available during a logged-in session when the attacker can read from arbitrary memory locations, and information only remains available after logout because of memory-management limitations of web browsers (not because the Keeper technology itself is retaining the information).Show less
1Microsoft
3Windows Server 2016
Windows Server 2019Windows Server 2022
Jun 17, 2026
Jul 11, 2023
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Active Directory Federation Service Security Feature Bypass Vulnerability