CWE-522 Insufficiently Protected Credentials
classThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (1717)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-40655US | high7.5OT critical | KEV | ||
An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php… | ||||
| CVE-2021-30116US | critical9.8OT critical | KEV | ||
Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the insta… | ||||
| CVE-2021-22681US | critical9.8OT critical | KEV | ||
Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell… | ||||
| CVE-2020-29583US | critical9.8OT critical | KEV | ||
Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the fi… | ||||
| CVE-2017-9248US | critical9.8OT critical | KEV | ||
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionK… | ||||
| CVE-2014-1812US | high9.0OT critical | KEV | ||
The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does… | ||||
| CVE-2019-17662US | critical9.8 | Exploit | ||
ThinVNC 1.0b1 is vulnerable to arbitrary file read, which leads to a compromise of the VNC server. The vulnerability exists even when authentication is turned on during the deploym… | ||||
| CVE-2024-44000US | critical9.8 | Exploit | ||
Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Authentication Bypass.This issue affects LiteSpeed Cache: from n… | ||||
| CVE-2018-9160US | critical9.8 | Exploit | ||
SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses. | ||||
| CVE-2022-37109US | critical9.8 | Exploit | ||
patrickfuller camp up to and including commit bbd53a256ed70e79bd8758080936afbf6d738767 is vulnerable to Incorrect Access Control. Access to the password.txt file is not properly re… | ||||
| CVE-2022-35411US | critical9.8 | Exploit | ||
rpc.py through 0.6.0 allows Remote Code Execution because an unpickle occurs when the "serializer: pickle" HTTP header is sent. In other words, although JSON (not Pickle) is the de… | ||||
| CVE-2014-6039US | high7.5 | Exploit | ||
ManageEngine EventLog Analyzer version 7 through 9.9 build 9002 has a Credentials Disclosure Vulnerability. Fixed version 10 Build 10000. | ||||
| CVE-2017-8225US | critical9.8 | Exploit | ||
On Wireless IP Camera (P2P) WIFICAM devices, access to .ini files (containing credentials) is not correctly checked. An attacker can bypass authentication by providing an empty log… | ||||
| CVE-2013-7052US | critical9.8 | Exploit | ||
D-Link DIR-100 4.03B07: security bypass via an error in the cliget.cgi script | ||||
| CVE-2017-7925US | critical9.8 | — | ||
A Password in Configuration File issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-HFW1XXX, DH-IPC-HFW2X… | ||||
| CVE-2018-11742US | critical9.8 | Exploit | ||
NEC Univerge Sv9100 WebPro 6.00.00 devices have Cleartext Password Storage in the Web UI. | ||||
| CVE-2018-10824US | critical9.8 | Exploit | ||
An issue was discovered on D-Link DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 thro… | ||||
| CVE-2017-3192US | critical9.8 | — | ||
D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 do not sufficiently protect administrator credentials. The tools_admin.asp page discloses the administrator p… | ||||
| CVE-2000-0944US | critical9.8 | Exploit | ||
CGI Script Center News Update 1.1 does not properly validate the original news administration password during a password change operation, which allows remote attackers to modify t… | ||||
| CVE-2025-44823US | high8.8 | Exploit | ||
Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/get_users call. This is GL:… | ||||
04
attack patterns (13)
CAPEC attack patterns that exploit this.
05
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan