CWE-522 Insufficiently Protected Credentials
classThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
untergeordnete Schwächen
Spezifischere Einträge unterhalb dieses.
03
Schwachstellen (1717)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-40655US | high7.5OT kritisch | KEV | ||
An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php… | ||||
| CVE-2021-30116US | critical9.8OT kritisch | KEV | ||
Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the insta… | ||||
| CVE-2021-22681US | critical9.8OT kritisch | KEV | ||
Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell… | ||||
| CVE-2020-29583US | critical9.8OT kritisch | KEV | ||
Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the fi… | ||||
| CVE-2017-9248US | critical9.8OT kritisch | KEV | ||
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionK… | ||||
| CVE-2014-1812US | high9.0OT kritisch | KEV | ||
The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does… | ||||
| CVE-2019-17662US | critical9.8 | Exploit | ||
ThinVNC 1.0b1 is vulnerable to arbitrary file read, which leads to a compromise of the VNC server. The vulnerability exists even when authentication is turned on during the deploym… | ||||
| CVE-2024-44000US | critical9.8 | Exploit | ||
Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Authentication Bypass.This issue affects LiteSpeed Cache: from n… | ||||
| CVE-2018-9160US | critical9.8 | Exploit | ||
SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses. | ||||
| CVE-2022-37109US | critical9.8 | Exploit | ||
patrickfuller camp up to and including commit bbd53a256ed70e79bd8758080936afbf6d738767 is vulnerable to Incorrect Access Control. Access to the password.txt file is not properly re… | ||||
| CVE-2022-35411US | critical9.8 | Exploit | ||
rpc.py through 0.6.0 allows Remote Code Execution because an unpickle occurs when the "serializer: pickle" HTTP header is sent. In other words, although JSON (not Pickle) is the de… | ||||
| CVE-2014-6039US | high7.5 | Exploit | ||
ManageEngine EventLog Analyzer version 7 through 9.9 build 9002 has a Credentials Disclosure Vulnerability. Fixed version 10 Build 10000. | ||||
| CVE-2017-8225US | critical9.8 | Exploit | ||
On Wireless IP Camera (P2P) WIFICAM devices, access to .ini files (containing credentials) is not correctly checked. An attacker can bypass authentication by providing an empty log… | ||||
| CVE-2013-7052US | critical9.8 | Exploit | ||
D-Link DIR-100 4.03B07: security bypass via an error in the cliget.cgi script | ||||
| CVE-2017-7925US | critical9.8 | — | ||
A Password in Configuration File issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-HFW1XXX, DH-IPC-HFW2X… | ||||
| CVE-2018-11742US | critical9.8 | Exploit | ||
NEC Univerge Sv9100 WebPro 6.00.00 devices have Cleartext Password Storage in the Web UI. | ||||
| CVE-2018-10824US | critical9.8 | Exploit | ||
An issue was discovered on D-Link DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 thro… | ||||
| CVE-2017-3192US | critical9.8 | — | ||
D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 do not sufficiently protect administrator credentials. The tools_admin.asp page discloses the administrator p… | ||||
| CVE-2000-0944US | critical9.8 | Exploit | ||
CGI Script Center News Update 1.1 does not properly validate the original news administration password during a password change operation, which allows remote attackers to modify t… | ||||
| CVE-2025-44823US | high8.8 | Exploit | ||
Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/get_users call. This is GL:… | ||||
04
Angriffsmuster (13)
CAPEC-Angriffsmuster, die dies ausnutzen.
05
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan